Add hosted Gitea release delivery

scripts/test-release.py

@@ -216,6 +216,10 @@ def prepare_repository(repository, remote, environment, module_bytes, version):
 
 
 def verify_publication(repository, remote, temporary_root, environment, module_bytes, selected_go):
+    profile = json.loads((repository / "releasekit.json").read_text(encoding="utf-8"))
+    token_path = repository / profile["delivery"]["token_file"]
+    if token_path.exists() or environment.get("RELEASEKIT_GITEA_TOKEN"):
+        raise RuntimeError("publication fixture must not have delivery credentials")
     selected_releasekit = run(
         ["go", "list", "-mod=readonly", "-m", "-f", "{{.Version}}", RELEASEKIT_MODULE],
         cwd=repository,
@@ -387,6 +391,31 @@ def verify_validation_failure(
         raise RuntimeError(f"failure fixture checkout is not clean:\n{status}")
 
 
+def verify_forbidden_token(repository, environment):
+    profile = json.loads((repository / "releasekit.json").read_text(encoding="utf-8"))
+    token_path = profile["delivery"]["token_file"]
+    write_file(repository / token_path, "disposable fixture placeholder\n")
+    note_path = f"docs/releases/{FAILED_RELEASE_VERSION}.md"
+    write_file(repository / note_path, f"# Promptkit {FAILED_RELEASE_VERSION}\n\nFixture.\n")
+    repo_git(repository, environment, "add", "--", note_path)
+    repo_git(repository, environment, "add", "-f", "--", token_path)
+    repo_git(repository, environment, "commit", "-m", "Add forbidden-path fixture")
+
+    result = execute(
+        [str(repository / ".releasekit/bin/releasekit"), "check", FAILED_RELEASE_VERSION],
+        cwd=repository,
+        environment=environment,
+    )
+    if (
+        result.returncode != 1
+        or "forbidden-files" not in result.stderr
+        or token_path not in result.stderr
+    ):
+        raise RuntimeError(
+            f"committed delivery token path was not rejected:\n{result.stdout}\n{result.stderr}"
+        )
+
+
 def verify_usage_classification(binary, temporary_root, environment):
     result = execute(
         [str(binary), "unknown"], cwd=temporary_root, environment=environment
@@ -404,6 +433,7 @@ def verify_usage_classification(binary, temporary_root, environment):
 
 def main():
     environment = os.environ.copy()
+    environment.pop("RELEASEKIT_GITEA_TOKEN", None)
     environment.update(
         {
             "GOTOOLCHAIN": "local",
@@ -464,11 +494,12 @@ def main():
                 module_bytes,
                 selected_go,
             )
+            verify_forbidden_token(repository, environment)
         except (RuntimeError, OSError, json.JSONDecodeError) as error:
             print(error, file=sys.stderr)
             return 1
 
-    print("ReleaseKit publication success and failure fixtures passed")
+    print("ReleaseKit publication and committed-token-path fixtures passed")
     return 0