hanna/fabrica

feat(web): releases — list, detail, drafts, assets, source archives

16a2dd1 · hanna committed on 2026-07-26

Build the releases UI on the existing store foundation:

- A Releases repo tab (behind the per-repo releases_enabled toggle, added
  to repo settings alongside issues/PRs) and /-/releases list + detail,
  GitHub-style: title, Latest/pre-release/draft badges, author, date,
  markdown notes, assets, and source-code zip/tar.gz downloads.
- Draft/create a release from an existing tag or a new tag cut from a
  target branch (git::Repo::create_tag); edit and delete; publish vs save
  draft. Drafts are hidden from non-writers.
- Asset upload (multipart, streamed to disk under data_dir/releases),
  download (with a download counter), and delete.
- Source archives via `git archive` (git::pack::archive), streamed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +92 −0

crates/git/src/pack.rs +31 −0

crates/git/src/repo.rs +18 −0

crates/store/src/tests.rs +81 −0

crates/web/src/lib.rs +10 −0

crates/web/src/releases.rs +777 −0

crates/web/src/repo.rs +22 −1

data/fabrica/trash/01kydxcsngxmfpk2bzfdt0sfmx-1785056820303.git/HEAD +0 −0

No textual changes.

data/fabrica/trash/01kydxcsngxmfpk2bzfdt0sfmx-1785056820303.git/config +0 −0

No textual changes.

data/fabrica/trash/01kydxcsngxmfpk2bzfdt0sfmx-1785056820303.git/description +0 −0

No textual changes.

data/fabrica/trash/01kydxcsngxmfpk2bzfdt0sfmx-1785056820303.git/hooks/README.sample +0 −0

No textual changes.

data/fabrica/trash/01kydxcsngxmfpk2bzfdt0sfmx-1785056820303.git/hooks/post-receive +0 −0

No textual changes.

data/fabrica/trash/01kydxcsngxmfpk2bzfdt0sfmx-1785056820303.git/hooks/pre-receive +0 −0

No textual changes.

data/fabrica/trash/01kydxcsngxmfpk2bzfdt0sfmx-1785056820303.git/info/exclude +0 −0

No textual changes.

@@ @@ -2130,6 +2130,98 @@ pre.code { @@
   margin: 0.6rem 0 0;
   font-size: 0.9em;
+}
 /* Releases. */
 .releases-head {
   display: flex;
   align-items: center;
   justify-content: space-between;
   gap: 1rem;
   margin-bottom: 1rem;
+}
 .back-link {
   font-size: 0.9em;
+}
 .release {
   margin-bottom: 1.25rem;
+}
 .release-head {
   display: flex;
   align-items: flex-start;
   justify-content: space-between;
   gap: 1rem;
+}
 .release-title {
   margin: 0;
   font-size: 1.4rem;
+}
 .release-title a {
   color: var(--fb-fg);
+}
 .release-meta {
   display: flex;
   align-items: center;
   gap: 0.35rem;
   flex-wrap: wrap;
   margin-top: 0.35rem;
   font-size: 0.9em;
+}
 .release-actions {
   display: flex;
   gap: 0.5rem;
   flex: none;
+}
 .release-notes {
   margin: 1rem 0;
   padding-top: 1rem;
   border-top: 1px solid var(--fb-border);
+}
 .release-assets h3 {
   margin: 1rem 0 0.5rem;
+}
 .asset-list {
   list-style: none;
   margin: 0;
   padding: 0;
   border: 1px solid var(--fb-border);
   border-radius: var(--fb-radius);
+}
 .asset-row {
   display: flex;
   align-items: center;
   gap: 0.6rem;
   padding: 0.55rem 0.85rem;
   border-bottom: 1px solid var(--fb-border);
+}
 .asset-row:last-child {
   border-bottom: none;
+}
 .asset-name {
   flex: 1;
   min-width: 0;
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
   font-weight: 600;
+}
 .asset-row.source .asset-name {
   font-weight: 400;
+}
 .asset-size {
   flex: none;
   font-size: 0.85em;
+}
 .asset-upload {
   display: flex;
   align-items: center;
   gap: 0.6rem;
   margin-top: 0.75rem;
   flex-wrap: wrap;
+}
 .release-form-actions {
   display: flex;
   gap: 0.6rem;
   margin-top: 1rem;
+}
 /* Notifications inbox. */
 .notif-head {
   display: flex;

@@ @@ -112,6 +112,37 @@ pub fn spawn( @@
     cmd.spawn()
+}
 /// Spawn `git archive` for a source download, streaming the archive on stdout.
 ///
 /// `format` is a git archive format (`zip` or `tar.gz`); `prefix` is the top-level
 /// directory inside the archive (e.g. `repo-v1.0`); `rev` is the tag/branch/commit.
 ///
 /// # Errors
 ///
 /// Returns the [`std::io::Error`] from spawning if the `git` binary cannot be run.
 pub fn archive(
     binary: &str,
     repo_path: &Path,
     format: &str,
     rev: &str,
     prefix: &str,
     home: &Path,
 ) -> std::io::Result<Child> {
     let mut cmd = Command::new(binary);
     cmd.arg("archive");
     cmd.arg(format!("--format={format}"));
     cmd.arg(format!("--prefix={prefix}/"));
     cmd.arg(rev);
     cmd.env("GIT_DIR", repo_path);
     cmd.env("GIT_TERMINAL_PROMPT", "0");
     cmd.env("GIT_CONFIG_NOSYSTEM", "1");
     cmd.env("HOME", home);
     cmd.stdout(Stdio::piped());
     cmd.stderr(Stdio::null());
     cmd.kill_on_drop(true);
     cmd.spawn()
+}
 /// Encode `payload` as a single git pkt-line (`{len:04x}{payload}`). Used to frame
 /// the smart-HTTP service advertisement.
 #[must_use]

@@ @@ -240,6 +240,24 @@ impl Repo { @@
         })
+    }
     /// Create a lightweight tag `name` pointing at `rev`, failing if it already
     /// exists (releases must not silently move a tag). For cutting a release from
     /// a branch/commit.
     ///
     /// # Errors
     ///
     /// Returns [`GitError::Libgit2`] if the tag exists or the ref cannot be written.
     pub fn create_tag(&self, name: &str, rev: &Resolved) -> Result<(), GitError> {
         let oid = git2::Oid::from_str(&rev.oid.to_string())?;
         self.inner.reference(
             &format!("refs/tags/{name}"),
             oid,
             false,
             "fabrica release tag",
         )?;
         Ok(())
+    }
     /// The local branches, each with its position (ahead/behind) relative to the
     /// default branch and its tip commit.
     ///

@@ @@ -857,6 +857,87 @@ async fn fork_parent_and_count_round_trip() { @@
+}
 #[tokio::test]
 async fn releases_and_assets_round_trip() {
     for fx in sqlite_fixtures().await {
         let owner = fx
             .store
             .create_user(sample_user("rel", "rel@example.com"))
             .await
             .unwrap();
         let repo = fx
             .store
             .create_repo(NewRepo {
                 owner_id: owner.id.clone(),
                 group_id: None,
                 name: "r".to_string(),
                 path: "r".to_string(),
                 description: None,
                 visibility: model::Visibility::Public,
                 default_branch: "main".to_string(),
             })
             .await
             .unwrap();
         let rel = fx
             .store
             .create_release(crate::NewRelease {
                 repo_id: repo.id.clone(),
                 tag: "v1.0".to_string(),
                 name: "First".to_string(),
                 body: Some("notes".to_string()),
                 is_prerelease: false,
                 is_draft: false,
                 author_id: owner.id.clone(),
             })
             .await
             .unwrap();
         // Duplicate tag conflicts.
         assert!(matches!(
             fx.store
                 .create_release(crate::NewRelease {
                     repo_id: repo.id.clone(),
                     tag: "v1.0".to_string(),
                     name: "dup".to_string(),
                     body: None,
                     is_prerelease: false,
                     is_draft: false,
                     author_id: owner.id.clone(),
                 })
                 .await,
             Err(StoreError::Conflict { .. })
         ));
         assert_eq!(fx.store.list_releases(&repo.id).await.unwrap().len(), 1);
         assert_eq!(
             fx.store
                 .release_by_tag(&repo.id, "v1.0")
                 .await
                 .unwrap()
                 .unwrap()
                 .id,
             rel.id
         );
         let asset = fx
             .store
             .add_release_asset(&rel.id, "bin.tar.gz", 4096, "application/gzip")
             .await
             .unwrap();
         assert_eq!(
             fx.store.list_release_assets(&rel.id).await.unwrap().len(),
         );
         // Deleting the release cascades to its assets.
         assert!(fx.store.delete_release(&rel.id).await.unwrap());
         assert!(
             fx.store
                 .release_asset_by_id(&asset.id)
                 .await
                 .unwrap()
                 .is_none()
         );
+    }
+}
 #[tokio::test]
 async fn mirrors_create_list_due_and_delete() {
     for fx in sqlite_fixtures().await {
         let owner = fx

@@ @@ -27,6 +27,7 @@ mod markdown; @@
 mod notifications;
 mod pages;
 mod pulls;
 mod releases;
 mod repo;
 mod search;
 #[path = "serve.rs"]
@@ @@ -339,6 +340,15 @@ pub fn build_router(state: AppState) -> Router { @@
         .route("/comment/{id}/edit", post(issues::comment_edit))
         .route("/pull-new/{repo_id}", post(pulls::create))
         .route("/pull/{id}/merge", post(pulls::merge))
         .route("/release-new/{repo_id}", post(releases::create))
         .route(
             "/release/{id}/edit",
             get(releases::edit_form).post(releases::edit),
+        )
         .route("/release/{id}/delete", post(releases::delete))
         .route("/release/{id}/asset", post(releases::asset_upload))
         .route("/release-asset/{id}", get(releases::asset_download))
         .route("/release-asset/{id}/delete", post(releases::asset_delete))
         .route("/healthz", get(serve_assets::healthz))
         .route("/version", get(serve_assets::version))
         .route("/theme.css", get(serve_assets::theme_default))

@@ @@ -0,0 +1,777 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Releases: tag-based release notes with uploaded assets and source archives.
 //!
 //! A release is cut from a git tag (existing, or newly created from a target
 //! branch), carries markdown notes and an optional pre-release / draft label,
 //! and any number of uploaded asset files (stored under `data_dir/releases`,
 //! keyed by asset id). The list and detail views mirror GitHub's releases page.
 use std::path::{Path as FsPath, PathBuf};
 use std::sync::atomic::{AtomicU64, Ordering};
 use axum::body::Body;
 use axum::extract::{Multipart, Path, State};
 use axum::http::{HeaderMap, StatusCode, Uri, header};
 use axum::response::{IntoResponse, Redirect, Response};
 use axum_extra::extract::cookie::CookieJar;
 use futures_util::TryStreamExt as _;
 use maud::{Markup, html};
 use model::User;
 use serde::Deserialize;
 use tokio::io::AsyncWriteExt as _;
 use tokio_util::io::ReaderStream;
 use crate::AppState;
 use crate::error::{AppError, AppResult};
 use crate::icons::{Icon, icon};
 use crate::layout::page;
 use crate::markdown;
 use crate::pages::build_chrome;
 use crate::repo::{
     Pagination, RepoCtx, Tab, branch_names, git_read, page_slice, pagination_nav, repo_header,
     require_readable_repo,
 };
 use crate::session::{MaybeUser, verify_csrf};
 /// The on-disk directory holding release asset files.
 fn assets_dir(state: &AppState) -> PathBuf {
     state.config.storage.data_dir.join("releases")
+}
 /// The release that should carry the "Latest" badge: the newest published,
 /// non-pre-release. `releases` is newest-first.
 fn latest_release_id(releases: &[store::Release]) -> Option<String> {
     releases
         .iter()
         .find(|r| !r.is_draft && !r.is_prerelease)
         .map(|r| r.id.clone())
+}
 /// `GET …/-/releases` — the release list.
 pub(crate) async fn list(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
 ) -> AppResult<Response> {
     if !ctx.repo.releases_enabled {
         return Err(AppError::NotFound);
+    }
     let can_write = viewer.is_some() && ctx.access >= auth::Access::Write;
     let mut releases = state.store.list_releases(&ctx.repo.id).await?;
     if !can_write {
         releases.retain(|r| !r.is_draft);
+    }
     let latest = latest_release_id(&releases);
     let paging = Pagination::from_query(uri.query());
     let (shown, has_next) = page_slice(&releases, paging);
     let base = format!("/{}/{}", ctx.owner.username, ctx.repo.path);
     let branches = branch_names(state, &ctx.repo.id).await;
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let mut cards = Vec::with_capacity(shown.len());
     for r in &shown {
         cards.push(
             release_card(
                 state,
                 &base,
                 r,
                 latest.as_deref() == Some(&r.id),
                 can_write,
                 &chrome.csrf,
+            )
             .await,
         );
+    }
     let body = html! {
         (repo_header(state, &ctx, Tab::Releases, &ctx.repo.default_branch, &branches))
         div class="releases-head" {
             h2 { "Releases" }
             @if can_write {
                 a class="btn btn-primary" href=(format!("{base}/-/releases/new")) {
                     (icon(Icon::Plus)) span { "Draft a new release" }
+                }
+            }
+        }
         @if cards.is_empty() {
             div class="card" { p class="muted" { "No releases yet." } }
         } @else {
             @for card in &cards { (card) }
             @if has_next || paging.page > 1 {
                 (pagination_nav(uri.path(), uri.query(), paging, has_next))
+            }
+        }
     };
     let title = format!("{}/{}: releases", ctx.owner.username, ctx.repo.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 /// `GET …/-/releases/{tag}` — a single release.
 pub(crate) async fn view(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
     tag: &str,
 ) -> AppResult<Response> {
     if !ctx.repo.releases_enabled {
         return Err(AppError::NotFound);
+    }
     let can_write = viewer.is_some() && ctx.access >= auth::Access::Write;
     let release = state
         .store
         .release_by_tag(&ctx.repo.id, tag)
         .await?
         .ok_or(AppError::NotFound)?;
     if release.is_draft && !can_write {
         return Err(AppError::NotFound);
+    }
     let all = state.store.list_releases(&ctx.repo.id).await?;
     let latest = latest_release_id(&all);
     let base = format!("/{}/{}", ctx.owner.username, ctx.repo.path);
     let branches = branch_names(state, &ctx.repo.id).await;
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let card = release_card(
         state,
         &base,
         &release,
         latest.as_deref() == Some(&release.id),
         can_write,
         &chrome.csrf,
+    )
     .await;
     let body = html! {
         (repo_header(state, &ctx, Tab::Releases, &ctx.repo.default_branch, &branches))
         p { a class="back-link" href=(format!("{base}/-/releases")) { "← Releases" } }
         (card)
     };
     let title = format!(
         "{} · {}/{}",
         release.name, ctx.owner.username, ctx.repo.path
     );
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 /// Render one release: header (title, badges, tag/date/author), notes, assets,
 /// and source archives.
 async fn release_card(
     state: &AppState,
     base: &str,
     r: &store::Release,
     is_latest: bool,
     can_write: bool,
     csrf: &str,
 ) -> Markup {
     let author = match &r.author_id {
         Some(id) => crate::issues::username(state, id).await,
         None => "unknown".to_string(),
     };
     let assets = state
         .store
         .list_release_assets(&r.id)
         .await
         .unwrap_or_default();
     html! {
         section class="release card" {
             div class="release-head" {
                 div {
                     h2 class="release-title" {
                         a href=(format!("{base}/-/releases/{}", r.tag)) { (r.name) }
                         @if is_latest { " " span class="badge badge-verified" { "Latest" } }
                         @if r.is_prerelease { " " span class="badge badge-archived" { "pre-release" } }
                         @if r.is_draft { " " span class="badge badge-private" { "draft" } }
+                    }
                     div class="release-meta muted" {
                         (icon(Icon::Box)) " " (r.tag)
                         " · " (author) " · " (crate::repo::fmt_date(r.created_at))
+                    }
+                }
                 @if can_write {
                     div class="release-actions" {
                         a class="btn" href=(format!("/release/{}/edit", r.id)) { "Edit" }
                         form method="post" action=(format!("/release/{}/delete", r.id)) class="inline-form" {
                             input type="hidden" name="_csrf" value=(csrf);
                             button class="btn btn-danger" type="submit" { "Delete" }
+                        }
+                    }
+                }
+            }
             @if let Some(body) = &r.body {
                 @if !body.trim().is_empty() {
                     div class="release-notes markdown" { (markdown::render_with_refs(body, base)) }
+                }
+            }
             div class="release-assets" {
                 h3 { "Assets" }
                 ul class="asset-list" {
                     @for a in &assets {
                         li class="asset-row" {
                             (icon(Icon::File))
                             a class="asset-name" href=(format!("/release-asset/{}", a.id)) { (a.name) }
                             span class="asset-size muted" { (fmt_bytes(a.size)) }
                             @if can_write {
                                 form method="post" action=(format!("/release-asset/{}/delete", a.id)) class="inline-form" {
                                     input type="hidden" name="_csrf" value=(csrf);
                                     button class="icon-btn" type="submit" aria-label="Delete asset" title="Delete asset" { (icon(Icon::X)) }
+                                }
+                            }
+                        }
+                    }
                     li class="asset-row source" {
                         (icon(Icon::Download))
                         a class="asset-name" href=(format!("{base}/-/archive/{}.zip", r.tag)) { "Source code (zip)" }
+                    }
                     li class="asset-row source" {
                         (icon(Icon::Download))
                         a class="asset-name" href=(format!("{base}/-/archive/{}.tar.gz", r.tag)) { "Source code (tar.gz)" }
+                    }
+                }
                 @if can_write {
                     form method="post" action=(format!("/release/{}/asset", r.id)) enctype="multipart/form-data" class="asset-upload" {
                         input type="hidden" name="_csrf" value=(csrf);
                         input type="file" name="asset" required;
                         button class="btn inline-btn" type="submit" { "Upload asset" }
+                    }
+                }
+            }
+        }
+    }
+}
 // ---- Draft / create / edit ----
 /// `GET …/-/releases/new` — the draft form.
 pub(crate) async fn new_form(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
 ) -> AppResult<Response> {
     if !ctx.repo.releases_enabled || viewer.is_none() || ctx.access < auth::Access::Write {
         return Err(AppError::NotFound);
+    }
     let branches = branch_names(state, &ctx.repo.id).await;
     let tags: Vec<String> = git_read(state, &ctx.repo.id, git::Repo::tags)
         .await
         .unwrap_or_default()
         .into_iter()
         .map(|t| t.name)
         .collect();
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let body = html! {
         (repo_header(state, &ctx, Tab::Releases, &ctx.repo.default_branch, &branches))
         (release_form(
             &format!("/release-new/{}", ctx.repo.id),
             &chrome.csrf,
             None,
             &branches,
             &tags,
         ))
     };
     Ok((jar, page(&chrome, "New release", body)).into_response())
+}
 /// `GET /release/{id}/edit` — edit an existing release (a focused form page).
 pub async fn edit_form(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     uri: Uri,
     Path(id): Path<String>,
 ) -> AppResult<Response> {
     let (release, repo, user) = writer_release(&state, viewer.as_ref(), &id).await?;
     let owner = state
         .store
         .user_by_id(&repo.owner_id)
         .await?
         .map_or(repo.owner_id.clone(), |u| u.username);
     let back = format!("/{owner}/{}/-/releases/{}", repo.path, release.tag);
     let (jar, chrome) = build_chrome(&state, jar, Some(user), uri.path().to_string());
     let body = html! {
         p { a class="back-link" href=(back) { "← Back to release" } }
         (release_form(&format!("/release/{}/edit", release.id), &chrome.csrf, Some(&release), &[], &[]))
     };
     Ok((jar, page(&chrome, "Edit release", body)).into_response())
+}
 /// The create/edit form.
 fn release_form(
     action: &str,
     csrf: &str,
     existing: Option<&store::Release>,
     branches: &[String],
     tags: &[String],
 ) -> Markup {
     html! {
         h2 { @if existing.is_some() { "Edit release" } @else { "New release" } }
         div class="card" {
             form method="post" action=(action) {
                 input type="hidden" name="_csrf" value=(csrf);
                 @if let Some(r) = existing {
                     label { "Tag" }
                     p class="muted" { (r.tag) }
                 } @else {
                     label for="rl-tag" { "Tag" }
                     input type="text" id="rl-tag" name="tag" list="rl-tags"
                           placeholder="v1.0.0" required autocomplete="off";
                     datalist id="rl-tags" { @for t in tags { option value=(t) {} } }
                     label for="rl-target" { "Target (for a new tag)" }
                     select id="rl-target" name="target" {
                         @for b in branches { option value=(b) { (b) } }
+                    }
                     p class="muted field-hint" { "An existing tag is used as-is; a new tag is created from the target branch." }
+                }
                 label for="rl-title" { "Release title" }
                 input type="text" id="rl-title" name="name" value=(existing.map_or("", |r| r.name.as_str()));
                 label for="rl-body" { "Release notes" }
                 textarea id="rl-body" name="body" rows="10" placeholder="Describe this release (markdown supported)" {
                     (existing.and_then(|r| r.body.as_deref()).unwrap_or(""))
+                }
                 label class="checkbox" {
                     input type="checkbox" name="prerelease" value="1"
                           checked[existing.is_some_and(|r| r.is_prerelease)];
                     " This is a pre-release"
+                }
                 div class="release-form-actions" {
                     button class="btn btn-primary inline-btn" type="submit" name="action" value="publish" {
                         @if existing.is_some() { "Update release" } @else { "Publish release" }
+                    }
                     @if existing.is_none_or(|r| r.is_draft) {
                         button class="btn inline-btn" type="submit" name="action" value="draft" { "Save draft" }
+                    }
+                }
+            }
+        }
+    }
+}
 /// Create/edit form body.
 #[derive(Debug, Deserialize)]
 pub struct ReleaseForm {
     #[serde(default)]
     tag: String,
     #[serde(default)]
     target: String,
     #[serde(default)]
     name: String,
     #[serde(default)]
     body: String,
     #[serde(default)]
     prerelease: Option<String>,
     #[serde(default)]
     action: String,
     #[serde(rename = "_csrf")]
     csrf: String,
+}
 /// `POST /release-new/{repo_id}` — create a release (and its tag if new).
 pub async fn create(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(repo_id): Path<String>,
     axum::Form(form): axum::Form<ReleaseForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let (repo, user) = writer_repo(&state, viewer.as_ref(), &repo_id).await?;
         if !repo.releases_enabled {
             return Err(AppError::NotFound);
+        }
         let tag = form.tag.trim();
         if tag.is_empty() {
             return Err(AppError::BadRequest("A tag is required.".to_string()));
+        }
         // Use the tag if it exists; otherwise create it from the target branch.
         let exists = git_read(&state, &repo.id, {
             let tag = tag.to_string();
             move |g| Ok(g.resolve_ref(&tag).is_ok())
         })
         .await
         .unwrap_or(false);
         if !exists {
             let target = if form.target.trim().is_empty() {
                 repo.default_branch.clone()
             } else {
                 form.target.trim().to_string()
             };
             let tag_owned = tag.to_string();
             git_read(&state, &repo.id, move |g| {
                 let rev = g.resolve_ref(&target)?;
                 g.create_tag(&tag_owned, &rev)
             })
             .await
             .map_err(|_| {
                 AppError::BadRequest("Could not create the tag from that target.".to_string())
             })?;
+        }
         let name = if form.name.trim().is_empty() {
             tag.to_string()
         } else {
             form.name.trim().to_string()
         };
         let body = form.body.trim();
         state
             .store
             .create_release(store::NewRelease {
                 repo_id: repo.id.clone(),
                 tag: tag.to_string(),
                 name,
                 body: (!body.is_empty()).then(|| body.to_string()),
                 is_prerelease: form.prerelease.is_some(),
                 is_draft: form.action == "draft",
                 author_id: user.id.clone(),
             })
             .await
             .map_err(|e| match e {
                 store::StoreError::Conflict { .. } => {
                     AppError::BadRequest("A release already exists for that tag.".to_string())
+                }
                 other => AppError::from(other),
             })?;
         Ok::<String, AppError>(format!("/{}/{}/-/releases/{tag}", user.username, repo.path))
+    }
     .await;
     crate::issues::respond_redirect(result)
+}
 /// `POST /release/{id}/edit` — update a release's editable fields.
 pub async fn edit(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(id): Path<String>,
     axum::Form(form): axum::Form<ReleaseForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let (release, repo, user) = writer_release(&state, viewer.as_ref(), &id).await?;
         let name = if form.name.trim().is_empty() {
             release.tag.clone()
         } else {
             form.name.trim().to_string()
         };
         let body = form.body.trim();
         state
             .store
             .update_release(
                 &release.id,
                 &name,
                 (!body.is_empty()).then_some(body),
                 form.prerelease.is_some(),
                 release.is_draft && form.action == "draft",
+            )
             .await?;
         Ok::<String, AppError>(format!(
             "/{}/{}/-/releases/{}",
             user.username, repo.path, release.tag
         ))
+    }
     .await;
     crate::issues::respond_redirect(result)
+}
 /// The CSRF-only form for asset/release deletion.
 #[derive(Debug, Deserialize)]
 pub struct BareForm {
     #[serde(rename = "_csrf")]
     csrf: String,
+}
 /// `POST /release/{id}/delete` — delete a release and its asset files.
 pub async fn delete(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(id): Path<String>,
     axum::Form(form): axum::Form<BareForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let (release, repo, user) = writer_release(&state, viewer.as_ref(), &id).await?;
         for a in state.store.list_release_assets(&release.id).await? {
             let _ = tokio::fs::remove_file(assets_dir(&state).join(&a.id)).await;
+        }
         state.store.delete_release(&release.id).await?;
         Ok::<String, AppError>(format!("/{}/{}/-/releases", user.username, repo.path))
+    }
     .await;
     crate::issues::respond_redirect(result)
+}
 // ---- Assets ----
 /// Per-process counter for unique upload temp-file names.
 static TMP_SEQ: AtomicU64 = AtomicU64::new(0);
 /// `POST /release/{id}/asset` — upload one asset (streamed to disk).
 pub async fn asset_upload(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     Path(id): Path<String>,
     mut multipart: Multipart,
 ) -> Response {
     let mut csrf: Option<String> = None;
     let mut saved: Option<(String, String, i64, String)> = None; // (tmp_name, name, size, ctype)
     while let Ok(Some(mut field)) = multipart.next_field().await {
         match field.name() {
             Some("_csrf") => csrf = field.text().await.ok(),
             Some("asset") => {
                 let name = field
                     .file_name()
                     .map(str::to_string)
                     .filter(|n| !n.is_empty());
                 let ctype = field
                     .content_type()
                     .map_or_else(|| "application/octet-stream".to_string(), str::to_string);
                 if let Some(name) = name {
                     let tmp_name = format!(
                         "tmp-{}-{}",
                         std::process::id(),
                         TMP_SEQ.fetch_add(1, Ordering::Relaxed)
                     );
                     let tmp_dir = assets_dir(&state).join("tmp");
                     if tokio::fs::create_dir_all(&tmp_dir).await.is_err() {
                         return AppError::internal("storage error").into_response();
+                    }
                     let tmp_path = tmp_dir.join(&tmp_name);
                     let Ok(size) = stream_field(&mut field, &tmp_path).await else {
                         let _ = tokio::fs::remove_file(&tmp_path).await;
                         return AppError::internal("upload failed").into_response();
                     };
                     saved = Some((tmp_name, name, size, ctype));
+                }
+            }
             _ => {}
+        }
+    }
     if crate::session::verify_csrf(&jar, &HeaderMap::new(), csrf.as_deref()).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let (release, repo, user) = writer_release(&state, viewer.as_ref(), &id).await?;
         if let Some((tmp_name, name, size, ctype)) = saved {
             let asset = state
                 .store
                 .add_release_asset(&release.id, &name, size, &ctype)
                 .await?;
             let dest = assets_dir(&state).join(&asset.id);
             let tmp = assets_dir(&state).join("tmp").join(&tmp_name);
             if tokio::fs::rename(&tmp, &dest).await.is_err() {
                 let _ = tokio::fs::remove_file(&tmp).await;
                 let _ = state.store.delete_release_asset(&asset.id).await;
                 return Err(AppError::internal("storage error"));
+            }
+        }
         Ok::<String, AppError>(format!(
             "/{}/{}/-/releases/{}",
             user.username, repo.path, release.tag
         ))
+    }
     .await;
     match result {
         Ok(dest) => Redirect::to(&dest).into_response(),
         Err(e) => e.into_response(),
+    }
+}
 /// `GET /release-asset/{id}` — download an asset.
 pub async fn asset_download(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     Path(id): Path<String>,
 ) -> AppResult<Response> {
     let asset = state
         .store
         .release_asset_by_id(&id)
         .await?
         .ok_or(AppError::NotFound)?;
     let release = state
         .store
         .release_by_id(&asset.release_id)
         .await?
         .ok_or(AppError::NotFound)?;
     // The viewer must be able to read the repo the release belongs to.
     let _ = require_readable_repo(&state, viewer.as_ref(), &release.repo_id).await?;
     let path = assets_dir(&state).join(&asset.id);
     let Ok(file) = tokio::fs::File::open(&path).await else {
         return Err(AppError::NotFound);
     };
     let _ = state.store.bump_asset_download(&asset.id).await;
     let disposition = format!("attachment; filename=\"{}\"", asset.name.replace('"', ""));
     Ok((
+        [
             (header::CONTENT_TYPE, asset.content_type.clone()),
             (header::CONTENT_DISPOSITION, disposition),
         ],
         Body::from_stream(ReaderStream::new(file)),
+    )
         .into_response())
+}
 /// `POST /release-asset/{id}/delete` — delete one asset.
 pub async fn asset_delete(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(id): Path<String>,
     axum::Form(form): axum::Form<BareForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let asset = state
             .store
             .release_asset_by_id(&id)
             .await?
             .ok_or(AppError::NotFound)?;
         let (release, repo, user) =
             writer_release(&state, viewer.as_ref(), &asset.release_id).await?;
         let _ = tokio::fs::remove_file(assets_dir(&state).join(&asset.id)).await;
         state.store.delete_release_asset(&asset.id).await?;
         Ok::<String, AppError>(format!(
             "/{}/{}/-/releases/{}",
             user.username, repo.path, release.tag
         ))
+    }
     .await;
     crate::issues::respond_redirect(result)
+}
 // ---- Source archives ----
 /// `GET …/-/archive/{filename}` — stream a source archive (`{rev}.zip` /
 /// `{rev}.tar.gz`).
 pub(crate) async fn archive(state: &AppState, ctx: RepoCtx, filename: &str) -> Response {
     let (rev, format) = if let Some(rev) = filename.strip_suffix(".tar.gz") {
         (rev, "tar.gz")
     } else if let Some(rev) = filename.strip_suffix(".zip") {
         (rev, "zip")
     } else {
         return StatusCode::NOT_FOUND.into_response();
     };
     let rev_owned = rev.to_string();
     if git_read(state, &ctx.repo.id, move |g| g.resolve_ref(&rev_owned))
         .await
         .is_err()
+    {
         return StatusCode::NOT_FOUND.into_response();
+    }
     let Ok(repo_dir) = git::repo_path(&state.config.storage.repo_dir, &ctx.repo.id) else {
         return StatusCode::INTERNAL_SERVER_ERROR.into_response();
     };
     let home = state.config.storage.data_dir.join("tmp");
     let leaf = ctx.repo.path.rsplit('/').next().unwrap_or(&ctx.repo.path);
     let prefix = format!("{leaf}-{rev}");
     let Ok(mut child) = git::pack::archive(
         &state.config.git.binary,
         &repo_dir,
         format,
         rev,
         &prefix,
         &home,
     ) else {
         return StatusCode::INTERNAL_SERVER_ERROR.into_response();
     };
     let Some(stdout) = child.stdout.take() else {
         return StatusCode::INTERNAL_SERVER_ERROR.into_response();
     };
     tokio::spawn(async move {
         let _ = child.wait().await;
     });
     let ctype = if format == "zip" {
         "application/zip"
     } else {
         "application/gzip"
     };
     let disposition = format!("attachment; filename=\"{prefix}.{format}\"");
+    (
+        [
             (header::CONTENT_TYPE, ctype.to_string()),
             (header::CONTENT_DISPOSITION, disposition),
         ],
         Body::from_stream(ReaderStream::new(stdout)),
+    )
         .into_response()
+}
 // ---- Helpers ----
 /// Stream a multipart field to `path`, returning the byte count.
 async fn stream_field(
     field: &mut axum::extract::multipart::Field<'_>,
     path: &FsPath,
 ) -> std::io::Result<i64> {
     let mut file = tokio::fs::File::create(path).await?;
     let mut size: i64 = 0;
     while let Some(chunk) = field.try_next().await.map_err(std::io::Error::other)? {
         file.write_all(&chunk).await?;
         size += i64::try_from(chunk.len()).unwrap_or(0);
+    }
     file.flush().await?;
     Ok(size)
+}
 /// Resolve a repo by id and require the viewer to have write access.
 async fn writer_repo(
     state: &AppState,
     viewer: Option<&User>,
     repo_id: &str,
 ) -> Result<(model::Repo, User), AppError> {
     let user = viewer.cloned().ok_or(AppError::Forbidden)?;
     let repo = require_readable_repo(state, Some(&user), repo_id).await?;
     if crate::issues::access_for(state, Some(&user), &repo).await? < auth::Access::Write {
         return Err(AppError::NotFound);
+    }
     Ok((repo, user))
+}
 /// Load a release by id and require write access on its repo.
 async fn writer_release(
     state: &AppState,
     viewer: Option<&User>,
     release_id: &str,
 ) -> Result<(store::Release, model::Repo, User), AppError> {
     let release = state
         .store
         .release_by_id(release_id)
         .await?
         .ok_or(AppError::NotFound)?;
     let (repo, user) = writer_repo(state, viewer, &release.repo_id).await?;
     Ok((release, repo, user))
+}
 /// Human-readable byte size.
 fn fmt_bytes(bytes: i64) -> String {
     const UNITS: [&str; 5] = ["B", "KB", "MB", "GB", "TB"];
     #[allow(clippy::cast_precision_loss)]
     let mut v = bytes.max(0) as f64;
     let mut u = 0;
     while v >= 1024.0 && u < UNITS.len() - 1 {
         v /= 1024.0;
         u += 1;
+    }
     if u == 0 {
         format!("{bytes} B")
     } else {
         format!("{v:.1} {}", UNITS[u])
+    }
+}

@@ @@ -65,6 +65,7 @@ pub(crate) enum Tab { @@
     Commits,
     Branches,
     Tags,
     Releases,
     Search,
     Settings,
+}
@@ @@ -710,6 +711,12 @@ async fn dispatch_view( @@
                 },
+            }
+        }
         "releases" => match rest {
             "" => crate::releases::list(state, viewer, jar, uri, ctx).await,
             "new" => crate::releases::new_form(state, viewer, jar, uri, ctx).await,
             tag => crate::releases::view(state, viewer, jar, uri, ctx, tag).await,
         },
         "archive" => Ok(crate::releases::archive(state, ctx, rest).await),
         "settings" => repo_settings_view(state, viewer, jar, uri, ctx).await,
         // Reserved `runs` slot returns 404 until built.
         _ => Err(AppError::NotFound),
@@ @@ -1324,6 +1331,10 @@ async fn repo_settings_view( @@
                         input type="checkbox" name="pulls_enabled" value="1"
                               checked[ctx.repo.pulls_enabled]; " Pull requests"
+                    }
                     label class="checkbox" {
                         input type="checkbox" name="releases_enabled" value="1"
                               checked[ctx.repo.releases_enabled]; " Releases"
+                    }
+                }
                 div class="settings-actions" {
                     button class="btn btn-primary" type="submit" form="repo-general" { "Save changes" }
@@ @@ -1824,7 +1835,7 @@ pub async fn settings_mirror_sync( @@
+}
 /// Load a repo by id and require the viewer to be able to read it, else `404`.
 async fn require_readable_repo(
 pub(crate) async fn require_readable_repo(
     state: &AppState,
     viewer: Option<&User>,
     repo_id: &str,
@@ @@ -2100,6 +2111,9 @@ pub struct RepoGeneralForm { @@
     /// Enable pull requests.
     #[serde(default)]
     pulls_enabled: Option<String>,
     /// Enable releases.
     #[serde(default)]
     releases_enabled: Option<String>,
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
@@ @@ -2148,6 +2162,10 @@ pub async fn settings_general( @@
             .store
             .set_feature_enabled(&repo.id, "pulls", form.pulls_enabled.is_some())
             .await?;
         state
             .store
             .set_feature_enabled(&repo.id, "releases", form.releases_enabled.is_some())
             .await?;
         let owner = state
             .store
             .user_by_id(&repo.owner_id)
@@ @@ -3160,6 +3178,9 @@ pub(crate) fn repo_header( @@
                     (tab(Tab::Commits, "Commits", Icon::History, format!("{base}/-/commits/{rev}")))
                     (tab(Tab::Branches, "Branches", Icon::GitBranch, format!("{base}/-/branches")))
                     (tab(Tab::Tags, "Tags", Icon::Box, format!("{base}/-/tags")))
                     @if ctx.repo.releases_enabled {
                         (tab(Tab::Releases, "Releases", Icon::Download, format!("{base}/-/releases")))
+                    }
                     @if ctx.access == auth::Access::Admin {
                         (tab(Tab::Settings, "Settings", Icon::Settings, format!("{base}/-/settings")))
+                    }