fix: make release PR creation robust against race conditions (#19)

Two fixes for intermittent release workflow failures:

- **Use `BASE_BRANCH` instead of `DEFAULT_BRANCH`** for the PR `base` field — `BASE_BRANCH` has a `:-main` fallback, preventing an empty base from causing a 404
- **Replace fixed `sleep 3` with proper polling and retry** — polls for branch readiness (up to 10 attempts) before creating the PR, then retries PR creation (up to 5 attempts) with backoff

Fixes the `Error creating PR (HTTP 404)` seen when Gitea hasn't fully indexed the `next-release` branch by the time the PR creation request fires.

🤖 Generated with [Claude Code](https://claude.ai/claude-code)

Reviewed-on: #19

.claude/settings.local.json

@@ -0,0 +1,12 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(but --help:*)",
+      "Bash(but rub --help:*)",
+      "WebSearch",
+      "WebFetch(domain:docs.gitea.com)",
+      "WebFetch(domain:gitea.com)",
+      "Bash(but status:*)"
+    ]
+  }
+}

.gitea/workflows/Release.yml

@@ -9,16 +9,19 @@ on:
         default: false
         type: boolean
 
+concurrency:
+  group: release-${{ github.repository }}
+  cancel-in-progress: false
+
 env:
-  GITEA_URL: https://git.unbound.se
+  GITEA_URL: http://gitea-http.gitea.svc.cluster.local:3000
   RELEASE_TOKEN_FILE: /runner-secrets/release-token
+  GIT_CLIFF_VERSION: "2.12.0"
 
 jobs:
   preconditions:
     name: Check Preconditions
     runs-on: ubuntu-latest
-    container:
-      image: amd64/alpine:3.22.2@sha256:b687e78c6e2785808446f45b52f1540a1e58adc07bdcffea354933b18c613d90
     steps:
       - name: Validate token
         run: |
@@ -33,22 +36,23 @@ jobs:
           fi
           echo "Release token found"
 
-  changelog:
+  changelog-and-pr:
-    name: Generate Changelog
+    name: Generate Changelog and Handle PR
     runs-on: ubuntu-latest
     needs: preconditions
     if: github.ref_type == 'branch' && github.ref_name == github.event.repository.default_branch
-    container:
-      image: orhunp/git-cliff:2.10.1@sha256:6ba0d1fcb051bd7b154cfb19c4b2b3bfa2c22c475f5285fc30606777b6573119
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-      has_changes: ${{ steps.check.outputs.has_changes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
+      - name: Install git-cliff
+        run: |
+          curl -sSfL "https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz" | tar xz
+          sudo mv "git-cliff-${GIT_CLIFF_VERSION}/git-cliff" /usr/local/bin/
+          git-cliff --version
+
       - name: Generate changelog
         run: |
           git-cliff --bump --unreleased --strip header > CHANGES.md
@@ -72,32 +76,8 @@ jobs:
             echo "has_changes=true" >> $GITHUB_OUTPUT
           fi
 
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: changelog-artifacts
-          path: |
-            CHANGES.md
-            CHANGELOG.md
-            VERSION
-
-  handle-pr:
-    name: Handle Release PR
-    runs-on: ubuntu-latest
-    needs: changelog
-    if: needs.changelog.outputs.has_changes == 'true'
-    container:
-      image: amd64/alpine:3.22.2@sha256:b687e78c6e2785808446f45b52f1540a1e58adc07bdcffea354933b18c613d90
-    steps:
-      - name: Install dependencies
-        run: apk add --no-cache git jq curl
-
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: changelog-artifacts
-
       - name: Create or update release PR
+        if: steps.check.outputs.has_changes == 'true'
         env:
           REPOSITORY: ${{ github.repository }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
@@ -108,27 +88,28 @@ jobs:
           REPO=$(echo "${REPOSITORY}" | cut -d'/' -f2)
           API_URL="${GITEA_URL}/api/v1/repos/${OWNER}/${REPO}"
 
+          # Fallback to main if DEFAULT_BRANCH is empty
+          BASE_BRANCH="${DEFAULT_BRANCH:-main}"
+          echo "Using base branch: ${BASE_BRANCH}"
+
           TITLE="chore(release): prepare for ${VERSION}"
-          # Read CHANGES.md and escape for JSON
+          # Read CHANGES.md content and add note (jq --arg will handle JSON escaping)
-          DESCRIPTION=$(cat CHANGES.md | jq -Rs .)
+          CHANGES_CONTENT=$(cat CHANGES.md)
-          DESCRIPTION="${DESCRIPTION:1:-1}"  # Remove surrounding quotes from jq
+          PR_NOTE="**Note:** Please use **Squash Merge** when merging this PR."
-
+          DESCRIPTION="${CHANGES_CONTENT}"$'\n\n---\n\n'"${PR_NOTE}"
-          # Add squash merge reminder
-          DESCRIPTION="${DESCRIPTION}
-
-          ---
-          **Note:** Please use **Squash Merge** when merging this PR."
-
-          echo "Checking for existing release PRs..."
-          PRS=$(curl -sf \
-            -H "Authorization: token ${TOKEN}" \
-            "${API_URL}/pulls?state=open" | jq '[.[] | select(.head.ref == "next-release")]')
-          PR_INDEX=$(echo "${PRS}" | jq -r '.[0].number // empty')
 
+          # Delete existing next-release branch to start fresh (auto-closes any open PR)
           echo "Checking for existing next-release branch..."
-          BRANCH_EXISTS=$(curl -sf \
+          BRANCH_CHECK=$(curl -s --retry 3 --retry-delay 2 --retry-connrefused -w "%{http_code}" -o /dev/null \
             -H "Authorization: token ${TOKEN}" \
-            "${API_URL}/branches/next-release" 2>/dev/null && echo "true" || echo "false")
+            "${API_URL}/branches/next-release")
+          if [ "${BRANCH_CHECK}" = "200" ]; then
+            echo "Deleting existing next-release branch..."
+            curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X DELETE \
+              -H "Authorization: token ${TOKEN}" \
+              "${API_URL}/branches/next-release"
+            echo "Branch deleted"
+          fi
 
           # Prepare CHANGELOG.md content
           CHANGELOG_CONTENT=$(base64 -w0 < CHANGELOG.md)
@@ -137,81 +118,66 @@ jobs:
           VERSION_JSON=$(jq -n --arg v "${VERSION}" '{"version":$v}')
           VERSION_CONTENT=$(echo "${VERSION_JSON}" | base64 -w0)
 
-          if [ "${BRANCH_EXISTS}" = "true" ]; then
+          echo "Creating new next-release branch from ${BASE_BRANCH}..."
-            echo "Updating existing next-release branch..."
 
-            # Get SHA of existing CHANGELOG.md
+          # Check if CHANGELOG.md exists on base branch to determine create vs update
-            CHANGELOG_SHA=$(curl -sf \
+          CHANGELOG_SHA=$(curl -sf --retry 3 --retry-delay 2 --retry-connrefused \
+            -H "Authorization: token ${TOKEN}" \
+            "${API_URL}/contents/CHANGELOG.md?ref=${BASE_BRANCH}" | jq -r '.sha // empty')
+
+          if [ -n "${CHANGELOG_SHA}" ]; then
+            echo "Updating CHANGELOG.md (exists on ${BASE_BRANCH}) on new branch..."
+            RESPONSE=$(curl -s --retry 3 --retry-delay 2 --retry-connrefused -w "\n%{http_code}" -X PUT \
               -H "Authorization: token ${TOKEN}" \
-              "${API_URL}/contents/CHANGELOG.md?ref=next-release" | jq -r '.sha // empty')
+              -H "Content-Type: application/json" \
-
+              --data "$(jq -n \
-            # Update or create CHANGELOG.md
+                --arg content "${CHANGELOG_CONTENT}" \
-            if [ -n "${CHANGELOG_SHA}" ]; then
+                --arg sha "${CHANGELOG_SHA}" \
-              curl -sf -X PUT \
+                --arg message "${TITLE}" \
-                -H "Authorization: token ${TOKEN}" \
+                --arg branch "${BASE_BRANCH}" \
-                -H "Content-Type: application/json" \
+                --arg new_branch "next-release" \
-                --data "$(jq -n \
+                '{content: $content, sha: $sha, message: $message, branch: $branch, new_branch: $new_branch}')" \
-                  --arg content "${CHANGELOG_CONTENT}" \
+              "${API_URL}/contents/CHANGELOG.md")
-                  --arg sha "${CHANGELOG_SHA}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, sha: $sha, message: $message, branch: $branch}')" \
-                "${API_URL}/contents/CHANGELOG.md"
-            else
-              curl -sf -X POST \
-                -H "Authorization: token ${TOKEN}" \
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${CHANGELOG_CONTENT}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, message: $message, branch: $branch, new_branch: $branch}')" \
-                "${API_URL}/contents/CHANGELOG.md"
-            fi
-
-            # Get SHA of existing .version
-            VERSION_SHA=$(curl -sf \
-              -H "Authorization: token ${TOKEN}" \
-              "${API_URL}/contents/.version?ref=next-release" | jq -r '.sha // empty')
-
-            # Update or create .version
-            if [ -n "${VERSION_SHA}" ]; then
-              curl -sf -X PUT \
-                -H "Authorization: token ${TOKEN}" \
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${VERSION_CONTENT}" \
-                  --arg sha "${VERSION_SHA}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, sha: $sha, message: $message, branch: $branch}')" \
-                "${API_URL}/contents/.version"
-            else
-              curl -sf -X POST \
-                -H "Authorization: token ${TOKEN}" \
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${VERSION_CONTENT}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, message: $message, branch: $branch}')" \
-                "${API_URL}/contents/.version"
-            fi
           else
-            echo "Creating new next-release branch with CHANGELOG.md..."
+            echo "Creating CHANGELOG.md on new branch..."
-            curl -sf -X POST \
+            RESPONSE=$(curl -s --retry 3 --retry-delay 2 --retry-connrefused -w "\n%{http_code}" -X POST \
               -H "Authorization: token ${TOKEN}" \
               -H "Content-Type: application/json" \
               --data "$(jq -n \
                 --arg content "${CHANGELOG_CONTENT}" \
                 --arg message "${TITLE}" \
-                --arg branch "next-release" \
+                --arg branch "${BASE_BRANCH}" \
                 --arg new_branch "next-release" \
                 '{content: $content, message: $message, branch: $branch, new_branch: $new_branch}')" \
-              "${API_URL}/contents/CHANGELOG.md"
+              "${API_URL}/contents/CHANGELOG.md")
+          fi
+          HTTP_CODE=$(echo "${RESPONSE}" | tail -1)
+          BODY=$(echo "${RESPONSE}" | sed '$d')
+          if [ "${HTTP_CODE}" -ge 400 ]; then
+            echo "Error with CHANGELOG.md: ${BODY}"
+            exit 1
+          fi
 
-            echo "Adding .version to next-release branch..."
+          # Check if .version exists on base branch
-            curl -sf -X POST \
+          VERSION_SHA=$(curl -sf --retry 3 --retry-delay 2 --retry-connrefused \
+            -H "Authorization: token ${TOKEN}" \
+            "${API_URL}/contents/.version?ref=${BASE_BRANCH}" | jq -r '.sha // empty')
+
+          if [ -n "${VERSION_SHA}" ]; then
+            echo "Updating .version on next-release branch..."
+            curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              --data "$(jq -n \
+                --arg content "${VERSION_CONTENT}" \
+                --arg sha "${VERSION_SHA}" \
+                --arg message "${TITLE}" \
+                --arg branch "next-release" \
+                '{content: $content, sha: $sha, message: $message, branch: $branch}')" \
+              "${API_URL}/contents/.version"
+          else
+            echo "Creating .version on next-release branch..."
+            curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X POST \
               -H "Authorization: token ${TOKEN}" \
               -H "Content-Type: application/json" \
               --data "$(jq -n \
@@ -222,98 +188,87 @@ jobs:
               "${API_URL}/contents/.version"
           fi
 
-          if [ -n "${PR_INDEX}" ]; then
+          echo "Creating new PR..."
-            echo "Updating existing PR #${PR_INDEX}..."
+          echo "Waiting for next-release branch to be ready..."
-            curl -sf -X PATCH \
+          for i in $(seq 1 10); do
+            BRANCH_STATUS=$(curl -s --retry 3 --retry-delay 2 --retry-connrefused \
+              -w "%{http_code}" -o /dev/null \
               -H "Authorization: token ${TOKEN}" \
-              -H "Content-Type: application/json" \
+              "${API_URL}/branches/next-release")
-              --data "$(jq -n \
+            if [ "${BRANCH_STATUS}" = "200" ]; then
-                --arg title "${TITLE}" \
+              echo "Branch ready after ${i} attempt(s)"
-                --arg body "${DESCRIPTION}" \
+              break
-                '{title: $title, body: $body}')" \
+            fi
-              "${API_URL}/pulls/${PR_INDEX}"
+            if [ "${i}" = "10" ]; then
-          else
+              echo "Branch next-release not found after 10 attempts, giving up"
-            echo "Creating new PR..."
+              exit 1
-            curl -sf -X POST \
+            fi
-              -H "Authorization: token ${TOKEN}" \
+            echo "Branch not ready yet (attempt ${i}/10), waiting..."
-              -H "Content-Type: application/json" \
+            sleep 3
-              --data "$(jq -n \
+          done
-                --arg title "${TITLE}" \
-                --arg body "${DESCRIPTION}" \
-                --arg head "next-release" \
-                --arg base "${DEFAULT_BRANCH}" \
-                '{title: $title, body: $body, head: $head, base: $base}')" \
-              "${API_URL}/pulls"
-          fi
 
-  prepare-release:
+          PR_DATA=$(jq -n \
-    name: Prepare Release
+            --arg title "${TITLE}" \
+            --arg body "${DESCRIPTION}" \
+            --arg head "next-release" \
+            --arg base "${BASE_BRANCH}" \
+            '{title: $title, body: $body, head: $head, base: $base}')
+
+          for i in $(seq 1 5); do
+            RESPONSE=$(curl -s --retry 3 --retry-delay 2 --retry-connrefused \
+              -w "\n%{http_code}" -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              --data "${PR_DATA}" \
+              "${API_URL}/pulls")
+            HTTP_CODE=$(echo "${RESPONSE}" | tail -1)
+            BODY=$(echo "${RESPONSE}" | sed '$d')
+            if [ "${HTTP_CODE}" -lt 400 ]; then
+              echo "PR created successfully"
+              break
+            fi
+            if [ "${i}" = "5" ]; then
+              echo "Error creating PR after 5 attempts (HTTP ${HTTP_CODE}): ${BODY}"
+              exit 1
+            fi
+            echo "PR creation attempt ${i}/5 failed (HTTP ${HTTP_CODE}), retrying..."
+            sleep 3
+          done
+
+  create-release:
+    name: Create Release
     runs-on: ubuntu-latest
     needs: preconditions
     if: |
-      (github.ref_type == 'branch' && github.ref_name == github.event.repository.default_branch) ||
+      github.ref_type == 'branch' &&
-      github.ref_type == 'tag'
+      github.ref_name == github.event.repository.default_branch &&
-    container:
+      inputs.tag_only != true
-      image: orhunp/git-cliff:2.10.1@sha256:6ba0d1fcb051bd7b154cfb19c4b2b3bfa2c22c475f5285fc30606777b6573119
-    outputs:
-      version: ${{ steps.version.outputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
-      - name: Generate changelog
+      - name: Install git-cliff
         run: |
-          if [ "${{ github.ref_type }}" = "tag" ]; then
+          curl -sSfL "https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz" | tar xz
-            git-cliff --bump --latest --strip header > CHANGES.md
+          sudo mv "git-cliff-${GIT_CLIFF_VERSION}/git-cliff" /usr/local/bin/
-          else
+          git-cliff --version
-            git-cliff --bump --unreleased --strip header > CHANGES.md
+
-          fi
+      - name: Generate changelog
+        run: git-cliff --bump --unreleased --strip header > CHANGES.md
 
       - name: Get version
         id: version
         run: |
           VERSION=$(git-cliff --bumped-version 2>/dev/null || echo "")
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          echo "${VERSION}" > VERSION
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: release-artifacts
-          path: |
-            CHANGES.md
-            VERSION
-
-  create-release:
-    name: Create Release
-    runs-on: ubuntu-latest
-    needs: prepare-release
-    if: |
-      github.ref_type == 'branch' &&
-      github.ref_name == github.event.repository.default_branch &&
-      inputs.tag_only != true
-    container:
-      image: amd64/alpine:3.22.2@sha256:b687e78c6e2785808446f45b52f1540a1e58adc07bdcffea354933b18c613d90
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install dependencies
-        run: apk add --no-cache git jq curl
-
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: release-artifacts
 
       - name: Create release
         env:
           REPOSITORY: ${{ github.repository }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
           TOKEN=$(cat "${RELEASE_TOKEN_FILE}")
           if [ ! -r .version ]; then
@@ -321,11 +276,11 @@ jobs:
             exit 0
           fi
 
-          VERSION=$(cat .version 2>/dev/null | jq -r '.version')
+          CURRENT_VERSION=$(cat .version 2>/dev/null | jq -r '.version')
           LATEST=$(git describe --abbrev=0 --tags 2>/dev/null || echo '')
 
-          if [ -n "${LATEST}" ] && [ "${VERSION}" = "${LATEST}" ]; then
+          if [ -n "${LATEST}" ] && [ "${CURRENT_VERSION}" = "${LATEST}" ]; then
-            echo "Version ${VERSION} already exists"
+            echo "Version ${CURRENT_VERSION} already exists"
             exit 0
           fi
 
@@ -333,17 +288,15 @@ jobs:
           REPO=$(echo "${REPOSITORY}" | cut -d'/' -f2)
           API_URL="${GITEA_URL}/api/v1/repos/${OWNER}/${REPO}"
 
-          NAME=$(cat VERSION)
+          MESSAGE=$(cat CHANGES.md)
-          MESSAGE=$(cat CHANGES.md | jq -Rs .)
-          MESSAGE="${MESSAGE:1:-1}"  # Remove surrounding quotes
 
-          echo "Creating release ${NAME}..."
+          echo "Creating release ${VERSION}..."
-          curl -sf -X POST \
+          curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X POST \
             -H "Authorization: token ${TOKEN}" \
             -H "Content-Type: application/json" \
             --data "$(jq -n \
-              --arg tag_name "${NAME}" \
+              --arg tag_name "${VERSION}" \
-              --arg name "${NAME}" \
+              --arg name "${VERSION}" \
               --arg body "${MESSAGE}" \
               --arg target "${DEFAULT_BRANCH}" \
               '{tag_name: $tag_name, name: $name, body: $body, target_commitish: $target}')" \
@@ -352,31 +305,34 @@ jobs:
   create-tag:
     name: Create Tag
     runs-on: ubuntu-latest
-    needs: prepare-release
+    needs: preconditions
     if: |
       github.ref_type == 'branch' &&
       github.ref_name == github.event.repository.default_branch &&
       inputs.tag_only == true
-    container:
-      image: amd64/alpine:3.22.2@sha256:b687e78c6e2785808446f45b52f1540a1e58adc07bdcffea354933b18c613d90
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
-      - name: Install dependencies
+      - name: Install git-cliff
-        run: apk add --no-cache git jq curl
+        run: |
+          curl -sSfL "https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz" | tar xz
+          sudo mv "git-cliff-${GIT_CLIFF_VERSION}/git-cliff" /usr/local/bin/
+          git-cliff --version
 
-      - name: Download artifacts
+      - name: Get version
-        uses: actions/download-artifact@v4
+        id: version
-        with:
+        run: |
-          name: release-artifacts
+          VERSION=$(git-cliff --bumped-version 2>/dev/null || echo "")
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
       - name: Create tag
         env:
           REPOSITORY: ${{ github.repository }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
           TOKEN=$(cat "${RELEASE_TOKEN_FILE}")
           if [ ! -r .version ]; then
@@ -384,11 +340,11 @@ jobs:
             exit 0
           fi
 
-          VERSION=$(cat .version 2>/dev/null | jq -r '.version')
+          CURRENT_VERSION=$(cat .version 2>/dev/null | jq -r '.version')
           LATEST=$(git describe --abbrev=0 --tags 2>/dev/null || echo '')
 
-          if [ -n "${LATEST}" ] && [ "${VERSION}" = "${LATEST}" ]; then
+          if [ -n "${LATEST}" ] && [ "${CURRENT_VERSION}" = "${LATEST}" ]; then
-            echo "Version ${VERSION} already exists"
+            echo "Version ${CURRENT_VERSION} already exists"
             exit 0
           fi
 
@@ -396,15 +352,13 @@ jobs:
           REPO=$(echo "${REPOSITORY}" | cut -d'/' -f2)
           API_URL="${GITEA_URL}/api/v1/repos/${OWNER}/${REPO}"
 
-          NAME=$(cat VERSION)
+          echo "Creating tag ${VERSION}..."
-
+          curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X POST \
-          echo "Creating tag ${NAME}..."
-          curl -sf -X POST \
             -H "Authorization: token ${TOKEN}" \
             -H "Content-Type: application/json" \
             --data "$(jq -n \
-              --arg tag_name "${NAME}" \
+              --arg tag_name "${VERSION}" \
               --arg target "${DEFAULT_BRANCH}" \
-              --arg message "${NAME}" \
+              --arg message "${VERSION}" \
               '{tag_name: $tag_name, target: $target, message: $message}')" \
             "${API_URL}/tags"

CLAUDE.md

@@ -10,7 +10,8 @@ This repository contains reusable Gitea Actions workflows for Unbound Software r
 
 - **Location**: Workflows are stored in `.gitea/workflows/` (not `.github/workflows/`)
 - **Platform**: Gitea Actions (compatible with GitHub Actions syntax but runs on Gitea)
-- **Base images**: Uses pinned Alpine and git-cliff images with SHA256 digests for reproducibility
+- **Runner**: Uses `ubuntu-latest` runner directly (no containers)
+- **git-cliff**: Downloaded as binary from GitHub releases, version controlled via `GIT_CLIFF_VERSION` env var
 
 ### Release.yml Workflow
 
@@ -29,4 +30,3 @@ Version tracking uses a `.version` JSON file containing `{"version":"vX.Y.Z"}`.
 - No build/test commands exist - this is a workflow-only repository
 - Workflows use Gitea API directly via curl (not gh CLI)
 - Authentication reads from file-based token at `/runner-secrets/release-token`
-- Container images should include SHA256 digests for security

renovate.json

@@ -2,5 +2,16 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.*\\.ya?ml$"],
+      "matchStrings": [
+        "GIT_CLIFF_VERSION:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
+      ],
+      "depNameTemplate": "orhun/git-cliff",
+      "datasourceTemplate": "github-releases"
+    }
   ]
 }