ci: build snap nightlies every 12 hours instead of on every push (#40150)

The snap nightly ran on every push to `main`, about 58 runs and 520 job
minutes a week on GitHub-hosted runners, which share the concurrent job
limit with PR CI.

It now runs as a job in `release-nightly.yml`, reusing its 12-hourly
check for new commits on `main`, like
https://github.com/go-gitea/gitea/pull/40138 did for the other
nightlies. A new release tag is still published by the first build after
`main` changes.

.github/workflows/release-nightly-snapcraft.yml

@@ -1,55 +0,0 @@
-name: release-nightly-snapcraft
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  build-and-publish:
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-24.04, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.runner }}
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - name: Build snap
-        id: build
-        env:
-          SNAPCRAFT_IMAGE_INFO: '{"build_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}'
-        run: |
-          # snapcraft installs build-snaps and apt packages system-wide, which needs root
-          sudo snap install --classic snapcraft
-          sudo SNAPCRAFT_BUILD_INFO=1 SNAPCRAFT_IMAGE_INFO="$SNAPCRAFT_IMAGE_INFO" snapcraft pack --destructive-mode
-          echo "snap=$(ls ./*.snap)" >> "$GITHUB_OUTPUT"
-      # retry snapcraft uploads which can be flaky
-      - name: Publish snap
-        run: |
-          # part-gitea-pull.sh decides what is built, see the comments there:
-          # * grade devel (main or a prerelease tag) goes to latest/edge
-          # * grade stable (a new release tag) goes to latest/stable, and to latest/candidate which marks it as released
-          channel=latest/edge
-          if unsquashfs -cat "$SNAP" meta/snap.yaml | grep -qx 'grade: stable'; then
-            channel=latest/stable,latest/candidate
-          fi
-          for attempt in 1 2 3 4 5; do
-            snapcraft upload "$SNAP" --release "$channel" && exit 0
-            echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
-            sleep 15
-          done
-          exit 1
-        env:
-          SNAP: ${{ steps.build.outputs.snap }}
-          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}

.github/workflows/release-nightly.yml

@@ -183,3 +183,47 @@ jobs:
           annotations: ${{ steps.meta_rootless.outputs.annotations }}
           cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless
           cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless,mode=max
+
+  nightly-snap:
+    needs: branches
+    if: contains(fromJSON(needs.branches.outputs.branches), 'main')
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: main
+          fetch-depth: 0
+      - name: Build snap
+        id: build
+        env:
+          SNAPCRAFT_IMAGE_INFO: '{"build_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}'
+        run: |
+          # snapcraft installs build-snaps and apt packages system-wide, which needs root
+          sudo snap install --classic snapcraft
+          sudo SNAPCRAFT_BUILD_INFO=1 SNAPCRAFT_IMAGE_INFO="$SNAPCRAFT_IMAGE_INFO" snapcraft pack --destructive-mode
+          echo "snap=$(ls ./*.snap)" >> "$GITHUB_OUTPUT"
+      # retry snapcraft uploads which can be flaky
+      - name: Publish snap
+        run: |
+          # part-gitea-pull.sh decides what is built, see the comments there:
+          # * grade devel (main or a prerelease tag) goes to latest/edge
+          # * grade stable (a new release tag) goes to latest/stable, and to latest/candidate which marks it as released
+          channel=latest/edge
+          if unsquashfs -cat "$SNAP" meta/snap.yaml | grep -qx 'grade: stable'; then
+            channel=latest/stable,latest/candidate
+          fi
+          for attempt in 1 2 3 4 5; do
+            snapcraft upload "$SNAP" --release "$channel" && exit 0
+            echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
+            sleep 15
+          done
+          exit 1
+        env:
+          SNAP: ${{ steps.build.outputs.snap }}
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}

snap/part-gitea-pull.sh

@@ -16,14 +16,14 @@ else
 fi
 
 # How it works:
-# * release-nightly-snapcraft.yml builds the snap on every push to the default branch (e.g.: main during 1.27 dev period)
+# * the nightly-snap job in release-nightly.yml builds the snap when the default branch (e.g.: main during 1.27 dev period) has new commits
 # * "override-pull" step gets the latest tag by date (e.g.: v1.26.1)
 # * use "snap info gitea" to get the latest released tag, which is the version in the "latest/candidate" channel
 #   * if the latest tag is not released yet, checkout that tag and build it with grade "stable",
 #     the workflow publishes it to "latest/stable" and "latest/candidate"
 #   * otherwise, build the main branch with grade "devel", the workflow publishes it to "latest/edge"
 # * "override-build" step uses build script from the checked out commit to build
-# This approach highly depends on the "main" branch's push: a new tag is only published by the next push after it.
+# This approach highly depends on new commits to the "main" branch: a new tag is only published by the next build after it.
 
 # To debug the logic:
 # * last_committed_tag=v1.26.1 last_released_tag=v1.26.0 ./snap/part-gitea-pull.sh