Found via SSH log analysis (actions_log/.../2332.log, Run #2002):
1. This Gitea Actions instance's runner explicitly rejects the
actions/upload-artifact@v4 / download-artifact@v4 protocol:
"GHESNotSupportedError: @actions/artifact v2.0.0+,
upload-artifact@v4+ and download-artifact@v4+ are not
currently supported on GHES."
The old 3-job split (fetch-release -> pre-deploy-check -> deploy)
relied on upload-artifact/download-artifact to hand the .tar.gz
from the fetch job to the deploy job, so it could never succeed
on this server regardless of any other fix.
2. Independently, the guessed download URL pattern
/releases/download/{tag}/{filename} doesn't exist on this Gitea
instance -- it silently downloaded a 19-byte "404 page not found"
body as if it were the artifact (curl exited 0, file "existed").
Fixes:
- Merge fetch-release + pre-deploy-check + deploy into a single
`deploy` job so the downloaded artifact never needs to cross a
job boundary -- it's downloaded and scp'd from the same runner
filesystem in one shot.
- Fetch the real `browser_download_url` from the release JSON
instead of constructing the URL by convention.
- Add a `file "$ARTIFACT" | grep -q "gzip compressed"` guard right
after download so a wrong-URL / error-page download fails loudly
instead of silently proceeding with garbage bytes.
- Update post-deploy-check / post-deploy-report to read from
`needs.deploy.outputs.*` now that fetch-release no longer exists
as a separate job.
kjh2064
cc94d5aeae