From 00160e172d907fd0a45ddcb7bebe8bc7159a8b64 Mon Sep 17 00:00:00 2001
From: Joakim Olsson <joakim@unbound.se>
Date: Wed, 7 Oct 2026 16:13:23 +0200
Subject: [PATCH 1/2] fix: release to the Gitea API on its public URL

goreleaser's gitea_urls.api still pointed at the AWS in-cluster service (gitea-http.gitea.svc.cluster.local), which does not resolve from the Frostmoln runner. Use https://git.unbound.se/api/v1. Also drop RELEASE_TOKEN_FILE=/runner-secrets/release-token (the AWS runner mount); the Frostmoln runner exports RELEASE_TOKEN_FILE itself.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
---
 .gitea/workflows/goreleaser.yaml | 3 ---
 .goreleaser.yml                  | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/.gitea/workflows/goreleaser.yaml b/.gitea/workflows/goreleaser.yaml
index 3be99eb..c322b58 100644
--- a/.gitea/workflows/goreleaser.yaml
+++ b/.gitea/workflows/goreleaser.yaml
@@ -5,9 +5,6 @@ on:
     tags:
       - 'v*'
 
-env:
-  RELEASE_TOKEN_FILE: /runner-secrets/release-token
-
 jobs:
   release:
     runs-on: ubuntu-latest
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 4ea27a3..300ae0d 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -2,7 +2,7 @@ project_name: unbound-schemas
 version: 2
 
 gitea_urls:
-  api: http://gitea-http.gitea.svc.cluster.local:3000/api/v1
+  api: https://git.unbound.se/api/v1
   download: https://gitea.unbound.se
 
 env:
-- 
2.54.0


From 3921de91a6ff26715cdc276ebc0d5d1a0cf14b42 Mon Sep 17 00:00:00 2001
From: Joakim Olsson <joakim@unbound.se>
Date: Wed, 7 Oct 2026 16:57:18 +0200
Subject: [PATCH 2/2] ci: run goreleaser without the runner's GOCACHEPROG

goreleaser runs several go builds at once; each spawns its own gobuildcache,
and they time out on its per-entry file locks while one holds the lock
across a slow S3 call ('failed to acquire lock: context deadline exceeded',
check-release on #997). Use Go's local cache for goreleaser.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
---
 .gitea/workflows/ci.yaml         | 8 ++++++--
 .gitea/workflows/goreleaser.yaml | 3 ++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 1f78094..c6fea6b 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -61,11 +61,15 @@ jobs:
         with:
           version: '~> v2'
           args: check
-      - name: Test release build
+      - name: Install goreleaser
         uses: goreleaser/goreleaser-action@v7
         with:
           version: '~> v2'
-          args: release --snapshot --clean
+          install-only: true
+      # Without the runner's GOCACHEPROG (gobuildcache): goreleaser's parallel
+      # go builds contend for its per-entry locks and time out.
+      - name: Test release build
+        run: env -u GOCACHEPROG goreleaser release --snapshot --clean
 
   build:
     needs: [check, vulnerabilities, check-release]
diff --git a/.gitea/workflows/goreleaser.yaml b/.gitea/workflows/goreleaser.yaml
index c322b58..544b0a1 100644
--- a/.gitea/workflows/goreleaser.yaml
+++ b/.gitea/workflows/goreleaser.yaml
@@ -27,4 +27,5 @@ jobs:
         run: |
           GITEA_TOKEN=$(cat "${RELEASE_TOKEN_FILE}")
           export GITEA_TOKEN
-          goreleaser release --clean
+          # Without GOCACHEPROG: parallel builds contend for gobuildcache's locks.
+          env -u GOCACHEPROG goreleaser release --clean
-- 
2.54.0