Show a mirror failure, and link the release's own range

.github/workflows/release.yml

@@ -100,18 +100,54 @@ jobs:
 
       # The mirror's registry, from the image just built: no second build,
       # and Cloudflare rate limiting git.tben.me (429/1015 on blob uploads)
-      # can never fail a release the installer depends on.
+      # can never fail a release the installer depends on. It must still be
+      # loud: `continue-on-error` alone leaves the check green when the
+      # mirror does nothing at all, which is how the 413 below went unseen
+      # for four releases.
       - name: Mirror to Gitea
+        id: mirror
         continue-on-error: true
         env:
           GITEA_TAGS: ${{ steps.tags.outputs.gitea }}
           GHCR_IMAGES: ${{ steps.tags.outputs.ghcr }}
         run: |
-          set -euo pipefail
+          set -uo pipefail
           first_ghcr="$(printf '%s\n' "$GHCR_IMAGES" | head -n1)"
           args=()
           while IFS= read -r tag; do
             [ -n "$tag" ] || continue
             args+=(--tag "${tag}")
           done <<< "$GITEA_TAGS"
-          docker buildx imagetools create "${args[@]}" "${first_ghcr}"
+
+          output="$(mktemp)"
+          status=0
+          docker buildx imagetools create "${args[@]}" "${first_ghcr}" 2>&1 | tee "$output" || status=$?
+
+          if [ "$status" -eq 0 ]; then
+            {
+              echo "### Gitea mirror"
+              echo
+              echo "Mirrored \`${first_ghcr}\` to:"
+              echo
+              printf -- '- \`%s\`\n' $GITEA_TAGS
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          # The usual cause: git.tben.me sits behind Cloudflare, whose
+          # request-body cap is 100 MB, and this image has a 243 MiB
+          # `bun install` layer that no route through it can carry.
+          reason="$(grep -oE '[0-9]{3} [A-Za-z ]{0,40}' "$output" | tail -n1)"
+          {
+            echo "### Gitea mirror failed"
+            echo
+            echo "\`${first_ghcr}\` did **not** reach the Gitea registry. The release itself is fine: the installer defaults to GHCR."
+            echo
+            echo '```'
+            tail -n 12 "$output"
+            echo '```'
+            echo
+            echo "See the [registry push limits](https://developers.cloudflare.com/workers/platform/limits/): git.tben.me is behind Cloudflare, which refuses any request body over 100 MB, and this image's \`bun install\` layer alone is about 243 MiB."
+          } >> "$GITHUB_STEP_SUMMARY"
+          echo "::warning title=Gitea mirror failed::${reason:-docker buildx imagetools create failed}; the image did not reach git.tben.me. See the job summary."
+          exit "$status"