diff --git a/action.yml b/action.yml
new file mode 100644
index 0000000..28e9108
--- /dev/null
+++ b/action.yml
@@ -0,0 +1,230 @@
+name: 'publish-release'
+description: 'Publish a Gitea release with assets via API. Composite (bash + curl), zero node runtime.'
+author: 'fristy'
+
+inputs:
+  token:
+    description: 'Gitea API token with release write access'
+    required: true
+    default: ${{ github.token }}
+  server_url:
+    description: 'Gitea base URL'
+    required: false
+    default: ${{ github.server_url }}
+  repository:
+    description: 'Target repository in owner/repo format'
+    required: false
+    default: ${{ github.repository }}
+  tag_name:
+    description: 'Tag for the release'
+    required: false
+    default: ${{ github.ref_name }}
+  name:
+    description: 'Release title (defaults to tag name)'
+    required: false
+    default: ''
+  body:
+    description: 'Release notes (ignored when body_path is set)'
+    required: false
+    default: ''
+  body_path:
+    description: 'Path to a file with release notes'
+    required: false
+    default: ''
+  draft:
+    description: "'true' to create a draft release"
+    required: false
+    default: 'false'
+  prerelease:
+    description: "'true' to mark as pre-release"
+    required: false
+    default: 'false'
+  target_commitish:
+    description: 'Branch or SHA the tag is created from (defaults to default branch)'
+    required: false
+    default: ''
+  files:
+    description: 'Newline-delimited glob patterns of assets to upload'
+    required: false
+    default: ''
+  sha256sum:
+    description: "'true' to also upload a sha256sums.txt for the assets"
+    required: false
+    default: 'false'
+  overwrite:
+    description: "'true' to delete and recreate an existing release for the tag"
+    required: false
+    default: 'false'
+
+outputs:
+  release_id:
+    description: 'Numeric ID of the created release'
+    value: ${{ steps.publish.outputs.release_id }}
+  release_url:
+    description: 'HTML URL of the release page'
+    value: ${{ steps.publish.outputs.release_url }}
+
+runs:
+  using: 'composite'
+  steps:
+    - id: publish
+      shell: bash
+      env:
+        INPUT_TOKEN: ${{ inputs.token }}
+        INPUT_SERVER_URL: ${{ inputs.server_url }}
+        INPUT_REPOSITORY: ${{ inputs.repository }}
+        INPUT_TAG_NAME: ${{ inputs.tag_name }}
+        INPUT_NAME: ${{ inputs.name }}
+        INPUT_BODY: ${{ inputs.body }}
+        INPUT_BODY_PATH: ${{ inputs.body_path }}
+        INPUT_DRAFT: ${{ inputs.draft }}
+        INPUT_PRERELEASE: ${{ inputs.prerelease }}
+        INPUT_TARGET_COMMITISH: ${{ inputs.target_commitish }}
+        INPUT_FILES: ${{ inputs.files }}
+        INPUT_SHA256SUM: ${{ inputs.sha256sum }}
+        INPUT_OVERWRITE: ${{ inputs.overwrite }}
+      run: |
+        set -euo pipefail
+
+        SERVER="${INPUT_SERVER_URL%/}"
+        REPO="${INPUT_REPOSITORY}"
+        TAG="${INPUT_TAG_NAME}"
+        AUTH_HEADER="Authorization: token ${INPUT_TOKEN}"
+        API="${SERVER}/api/v1"
+
+        for flag in INPUT_DRAFT INPUT_PRERELEASE INPUT_OVERWRITE INPUT_SHA256SUM; do
+          val="${!flag}"
+          if [ "$val" != "true" ] && [ "$val" != "false" ]; then
+            echo "::error::${flag#INPUT_} must be 'true' or 'false' (got '$val')" >&2
+            exit 1
+          fi
+        done
+
+        if command -v jq >/dev/null 2>&1; then
+          JSON=json_jq
+        elif command -v python3 >/dev/null 2>&1; then
+          JSON=json_py
+        else
+          echo "::error::publish-release requires 'jq' or 'python3' on the runner" >&2
+          exit 1
+        fi
+
+        json_get() { # file key
+          if [ "$JSON" = "json_jq" ]; then
+            jq -r --arg k "$2" '.[$k] // ""' "$1"
+          else
+            python3 - "$1" "$2" <<'PYEOF'
+        import json, sys
+        print(json.load(open(sys.argv[1])).get(sys.argv[2], ""))
+        PYEOF
+          fi
+        }
+
+        urlenc() { # string
+          if [ "$JSON" = "json_jq" ]; then
+            jq -nr --arg v "$1" '$v | @uri'
+          else
+            python3 - "$1" <<'PYEOF'
+        import sys, urllib.parse
+        print(urllib.parse.quote(sys.argv[1], safe=""))
+        PYEOF
+          fi
+        }
+
+        REL_NAME="$INPUT_NAME"
+        [ -z "$REL_NAME" ] && REL_NAME="$TAG"
+        REL_BODY="$INPUT_BODY"
+        if [ -n "$INPUT_BODY_PATH" ]; then
+          [ -f "$INPUT_BODY_PATH" ] || { echo "::error::body_path not found: $INPUT_BODY_PATH" >&2; exit 1; }
+          REL_BODY="$(cat "$INPUT_BODY_PATH")"
+        fi
+
+        # Minimal tag encoding for the lookup path (covers owner/name style tags).
+        TAG_ENC="${TAG//\//%2F}"
+
+        echo "Checking for existing release '$TAG' in $REPO ..."
+        HTTP_CODE=$(curl -sS -o /tmp/pr_existing.json -w '%{http_code}' -H "$AUTH_HEADER" "$API/repos/$REPO/releases/tags/$TAG_ENC")
+        if [ "$HTTP_CODE" = "200" ]; then
+          REL_ID="$(json_get /tmp/pr_existing.json id)"
+          if [ "$INPUT_OVERWRITE" = "true" ]; then
+            echo "Release exists (id=$REL_ID), deleting (overwrite=true) ..."
+            DEL_CODE=$(curl -sS -o /dev/null -w '%{http_code}' -X DELETE -H "$AUTH_HEADER" "$API/repos/$REPO/releases/$REL_ID")
+            [ "$DEL_CODE" = "204" ] || { echo "::error::failed to delete existing release (HTTP $DEL_CODE)" >&2; exit 1; }
+            REL_ID=""
+          else
+            echo "::error::release '$TAG' already exists (id=$REL_ID). Set overwrite: 'true' to replace." >&2
+            exit 1
+          fi
+        elif [ "$HTTP_CODE" != "404" ]; then
+          echo "::error::release lookup failed (HTTP $HTTP_CODE):" >&2
+          cat /tmp/pr_existing.json >&2
+          exit 1
+        fi
+
+        if [ -z "${REL_ID:-}" ]; then
+          echo "Creating release '$TAG' ..."
+          if [ "$JSON" = "json_jq" ]; then
+            PAYLOAD="$(jq -n --arg tag "$TAG" --arg name "$REL_NAME" --arg body "$REL_BODY" \
+              --argjson draft "$INPUT_DRAFT" --argjson pre "$INPUT_PRERELEASE" --arg target "$INPUT_TARGET_COMMITISH" \
+              '{tag_name:$tag,name:$name,body:$body,draft:$draft,prerelease:$pre} + (if $target == "" then {} else {target_commitish:$target} end)')"
+          else
+            PAYLOAD="$(TAG="$TAG" REL_NAME="$REL_NAME" REL_BODY="$REL_BODY" INPUT_DRAFT="$INPUT_DRAFT" INPUT_PRERELEASE="$INPUT_PRERELEASE" INPUT_TARGET_COMMITISH="$INPUT_TARGET_COMMITISH" python3 <<'PYEOF'
+        import json, os
+        p = {"tag_name": os.environ["TAG"], "name": os.environ["REL_NAME"], "body": os.environ["REL_BODY"],
+             "draft": os.environ["INPUT_DRAFT"] == "true", "prerelease": os.environ["INPUT_PRERELEASE"] == "true"}
+        if os.environ["INPUT_TARGET_COMMITISH"]:
+            p["target_commitish"] = os.environ["INPUT_TARGET_COMMITISH"]
+        print(json.dumps(p))
+        PYEOF
+            )"
+          fi
+          HTTP_CODE=$(curl -sS -o /tmp/pr_created.json -w '%{http_code}' -X POST -H "$AUTH_HEADER" -H 'Content-Type: application/json' -d "$PAYLOAD" "$API/repos/$REPO/releases")
+          if [ "$HTTP_CODE" != "201" ]; then
+            echo "::error::release creation failed (HTTP $HTTP_CODE):" >&2
+            cat /tmp/pr_created.json >&2
+            exit 1
+          fi
+          REL_ID="$(json_get /tmp/pr_created.json id)"
+          echo "Release created (id=$REL_ID)."
+        fi
+
+        ASSETS=()
+        while IFS= read -r pattern || [ -n "$pattern" ]; do
+          pattern="$(printf '%s' "$pattern" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+          [ -z "$pattern" ] && continue
+          # shellcheck disable=SC2206
+          expanded=( $pattern )
+          if [ "${#expanded[@]}" -eq 0 ]; then
+            echo "::warning::pattern matched nothing: $pattern"
+            continue
+          fi
+          for f in "${expanded[@]}"; do
+            if [ -f "$f" ]; then ASSETS+=("$f"); else echo "::warning::not a file: $f"; fi
+          done
+        done <<< "$INPUT_FILES"
+
+        if [ "$INPUT_SHA256SUM" = "true" ] && [ "${#ASSETS[@]}" -gt 0 ]; then
+          WORKDIR="${GITHUB_WORKSPACE:-$PWD}"
+          ( cd "$WORKDIR" && sha256sum "${ASSETS[@]}" > sha256sums.txt )
+          ASSETS+=("$WORKDIR/sha256sums.txt")
+          echo "sha256sums.txt generated."
+        fi
+
+        for f in ${ASSETS[@]+"${ASSETS[@]}"}; do
+          fname="$(basename "$f")"
+          ename="$(urlenc "$fname")"
+          echo "Uploading $f ..."
+          HTTP_CODE=$(curl -sS -o /tmp/pr_asset.json -w '%{http_code}' -X POST -H "$AUTH_HEADER" -H 'Content-Type: application/octet-stream' --data-binary "@$f" "$API/repos/$REPO/releases/$REL_ID/assets?name=$ename")
+          if [ "$HTTP_CODE" != "201" ]; then
+            echo "::error::asset upload failed for $f (HTTP $HTTP_CODE):" >&2
+            cat /tmp/pr_asset.json >&2
+            exit 1
+          fi
+        done
+
+        REL_URL="$(json_get /tmp/pr_created.json html_url)"
+        {
+          echo "release_id=$REL_ID"
+          echo "release_url=$REL_URL"
+        } >> "${GITHUB_OUTPUT:-/dev/null}"
+        echo "Done. release_id=$REL_ID url=$REL_URL"