Prepare release engine

bin/ship.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# One command for a release: build (tests, Divi check, ZIP), push main, publish, check from outside.
+#
+#   bin/ship.sh
+#
+# Run it when Plugin::VERSION is bumped and committed (release.sh refuses a dirty tree or an existing tag). The token
+# comes from $GITEA_TOKEN or a file (see bin/token.sh).
+#
+# Environment: LIT_MCP_GITEA (default https://git.loosen-it.de), only to try the script against another server.
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$root"
+
+gitea="${LIT_MCP_GITEA:-https://git.loosen-it.de}"
+repo="janniclas.loosen/WP-LIT-MCP"
+
+fail() { echo "ABBRUCH: $*" >&2; exit 1; }
+step() { echo "==> $*"; }
+
+source "$root/bin/token.sh"
+load_token
+export GITEA_TOKEN
+[[ "$(git rev-parse --abbrev-ref HEAD)" == "main" ]] || fail "Releases gehen nur von main aus"
+
+bash bin/release.sh
+
+# Push only if Gitea does not have HEAD yet. The token travels in a header of this one call, via the environment: not
+# in the URL, not in the git configuration, not in the process list.
+remote_head="$(curl -fsS "$gitea/api/v1/repos/$repo/branches/main" | jq -r .commit.id)"
+if [[ "$remote_head" != "$(git rev-parse HEAD)" ]]; then
+    step "main pushen"
+    basic="$(printf 'janniclas.loosen:%s' "$GITEA_TOKEN" | base64 -w0)"
+    GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: Basic $basic" \
+        git push "$gitea/$repo.git" HEAD:main || fail "Push fehlgeschlagen"
+fi
+
+bash bin/release-publish.sh