ci(release): stamp the version in-pipeline from a dispatch input

Releasing no longer means hand-editing the version across four files. The
Release workflow is now workflow_dispatch with a `version` input:

  Actions → Run workflow → version: 0.4.0

A new `prepare` job validates the semver, runs scripts/set-version.sh to
stamp it into the workspace Cargo.toml, the two internal path-dep pins,
g:nuwiki_version, and the Cargo.lock entries for our crates; gates on
`cargo test --workspace`; then commits "chore(release): X.Y.Z" and pushes
the vX.Y.Z tag. The build matrix and release job run off that freshly
pushed tag (checkout ref = the new tag), so the tagged commit carries the
real version.

scripts/set-version.sh is the single source of truth for where the version
lives — run it locally with the same arg to bump by hand. It patches
Cargo.lock via awk so it needs no cargo/toolchain.

The push:tags trigger is removed (the pipeline now creates the tag itself,
so a tag-push trigger would double-fire).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -1,9 +1,17 @@
 name: Release
 
+# Releases are cut from the Actions UI: "Run workflow" → enter the version
+# (e.g. 0.4.0). The `prepare` job stamps that version into every hardcoded
+# spot (scripts/set-version.sh), commits "chore(release): X.Y.Z", and pushes
+# the vX.Y.Z tag. The build matrix + release job then run off that tag. No
+# more hand-editing versions across Cargo.toml/plugin/nuwiki.vim.
 on:
-  push:
-    tags:
-      - 'v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version, no leading v (e.g. 0.4.0)'
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -14,8 +22,77 @@ env:
   RUSTFLAGS: -D warnings
 
 jobs:
+  prepare:
+    name: bump + tag
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.stamp.outputs.version }}
+      tag: ${{ steps.stamp.outputs.tag }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          # Push the release commit + tag back with a write-capable token.
+          token: ${{ secrets.RELEASE_TOKEN }}
+
+      - uses: dtolnay/rust-toolchain@1.83
+
+      - name: Cache cargo state
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-prepare-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-prepare-
+
+      - name: Validate version + stamp
+        id: stamp
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          ver="${VERSION#v}" # tolerate a leading v
+          if ! printf '%s' "$ver" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$'; then
+            echo "::error::'$ver' is not a semver version (expected e.g. 0.4.0)"
+            exit 1
+          fi
+          tag="v$ver"
+          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null \
+            || git ls-remote --exit-code --tags origin "$tag" >/dev/null 2>&1; then
+            echo "::error::tag $tag already exists"
+            exit 1
+          fi
+          bash scripts/set-version.sh "$ver"
+          echo "version=$ver" >> "$GITHUB_OUTPUT"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
+      # Gate: never tag code that doesn't build/test. If this fails nothing
+      # is committed or pushed, so the release simply doesn't happen.
+      - name: Test
+        run: cargo test --workspace
+
+      - name: Commit, tag, push
+        env:
+          VER: ${{ steps.stamp.outputs.version }}
+          TAG: ${{ steps.stamp.outputs.tag }}
+        run: |
+          set -euo pipefail
+          git config user.name  "gitea-actions"
+          git config user.email "gitea-actions@users.noreply.code.gfran.co"
+          git add Cargo.toml Cargo.lock \
+            crates/nuwiki-lsp/Cargo.toml crates/nuwiki-ls/Cargo.toml \
+            plugin/nuwiki.vim
+          git commit -m "chore(release): $VER"
+          git tag -a "$TAG" -m "nuwiki $VER"
+          git push origin "HEAD:${GITHUB_REF_NAME}"
+          git push origin "$TAG"
+
   build:
     name: build ${{ matrix.target }}
+    needs: prepare
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -38,6 +115,9 @@ jobs:
             rustflags: "-D warnings -C linker=rust-lld -C link-self-contained=yes"
     steps:
       - uses: actions/checkout@v4
+        with:
+          # Build the just-tagged commit, not the branch tip.
+          ref: ${{ needs.prepare.outputs.tag }}
 
       - uses: dtolnay/rust-toolchain@1.83
         with:
@@ -72,10 +152,11 @@ jobs:
 
       - name: Package archive
         id: package
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
         run: |
           set -euo pipefail
-          version="${GITHUB_REF_NAME#v}"
-          archive="nuwiki-ls-${version}-${{ matrix.target }}.tar.gz"
+          archive="nuwiki-ls-${VERSION}-${{ matrix.target }}.tar.gz"
           tar -czf "$archive" -C "target/${{ matrix.target }}/release" nuwiki-ls
           # Use a stable name without version so /releases/latest/download/nuwiki-ls-{target}.tar.gz always resolves.
           stable="nuwiki-ls-${{ matrix.target }}.tar.gz"
@@ -91,11 +172,12 @@ jobs:
 
   release:
     name: gitea release
-    needs: build
+    needs: [prepare, build]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: ${{ needs.prepare.outputs.tag }}
           fetch-depth: 0
 
       - name: Download all build artifacts
@@ -116,18 +198,20 @@ jobs:
 
       - name: Generate release notes
         id: notes
+        env:
+          TAG: ${{ needs.prepare.outputs.tag }}
         run: |
           set -euo pipefail
-          # Get commits since the previous tag (or the first commit if this is the first release).
-          prev_tag=$(git tag --sort=-version:refname | awk "NR==2" || echo "")
+          git fetch --tags --force origin >/dev/null 2>&1 || true
+          # Previous tag = newest tag that isn't the one we just cut.
+          prev_tag=$(git tag --sort=-version:refname | grep -vxF "$TAG" | head -n1 || echo "")
           if [ -n "$prev_tag" ]; then
-            log=$(git log --oneline "$prev_tag"..HEAD)
+            log=$(git log --oneline "$prev_tag..$TAG")
           else
-            log=$(git log --oneline --max-parents=0..HEAD)
+            log=$(git log --oneline "$TAG")
           fi
-          # Write notes to a file for later use.
           cat > release-notes.txt <<EOF
-          **Full Changelog**: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/compare/${prev_tag:-$(git rev-list --max-parents=0 HEAD)}...${GITHUB_REF_NAME}
+          **Full Changelog**: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/compare/${prev_tag:-$(git rev-list --max-parents=0 HEAD)}...${TAG}
 
           **Changes**:
           $log
@@ -139,7 +223,7 @@ jobs:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           GITEA_SERVER: ${{ github.server_url }}
           REPO: ${{ github.repository }}
-          TAG: ${{ github.ref_name }}
+          TAG: ${{ needs.prepare.outputs.tag }}
         run: |
           set -euo pipefail
           if [ -z "${RELEASE_TOKEN:-}" ]; then