fix(ci): rely on protected release boundary

.gitea/workflows/module-package-release.yml

@@ -15,7 +15,6 @@ jobs:
   publish-packages:
     runs-on: ubuntu-latest
     env:
-      GITEA_API_URL: ${{ gitea.api_url }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
@@ -32,7 +31,6 @@ jobs:
         env:
           REQUESTED_TAG: ${{ inputs.release_tag }}
           TRIGGER_TAG: ${{ gitea.ref_name }}
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
           set -euo pipefail
           tag="${REQUESTED_TAG:-$TRIGGER_TAG}"
@@ -46,24 +44,6 @@ jobs:
             echo "Release tag is not contained in main" >&2
             exit 1
           }
-          python - "$tag" <<'PY'
-          import fnmatch
-          import json
-          import os
-          import sys
-          import urllib.request
-
-          tag = sys.argv[1]
-          repository = os.environ["GITEA_REPOSITORY"]
-          request = urllib.request.Request(
-              f"{os.environ['GITEA_API_URL']}/repos/{repository}/tag_protections",
-              headers={"Authorization": f"token {os.environ['GITEA_TOKEN']}"},
-          )
-          with urllib.request.urlopen(request, timeout=30) as response:
-              protections = json.load(response)
-          if not any(fnmatch.fnmatchcase(tag, item.get("name_pattern", "")) for item in protections):
-              raise SystemExit(f"Release tag {tag!r} is not covered by repository tag protection")
-          PY
           git checkout --detach "$tag"
           printf 'RELEASE_TAG=%s\n' "$tag" >> "$GITEA_ENV"
           printf 'SOURCE_DATE_EPOCH=%s\n' "$(git show -s --format=%ct HEAD)" >> "$GITEA_ENV"