fix: make release PR creation robust against race conditions (#19)

Two fixes for intermittent release workflow failures:

- **Use `BASE_BRANCH` instead of `DEFAULT_BRANCH`** for the PR `base` field — `BASE_BRANCH` has a `:-main` fallback, preventing an empty base from causing a 404
- **Replace fixed `sleep 3` with proper polling and retry** — polls for branch readiness (up to 10 attempts) before creating the PR, then retries PR creation (up to 5 attempts) with backoff

Fixes the `Error creating PR (HTTP 404)` seen when Gitea hasn't fully indexed the `next-release` branch by the time the PR creation request fires.

🤖 Generated with [Claude Code](https://claude.ai/claude-code)

Reviewed-on: #19

.gitea/workflows/Release.yml

@@ -9,6 +9,10 @@ on:
         default: false
         type: boolean
 
+concurrency:
+  group: release-${{ github.repository }}
+  cancel-in-progress: false
+
 env:
   GITEA_URL: http://gitea-http.gitea.svc.cluster.local:3000
   RELEASE_TOKEN_FILE: /runner-secrets/release-token
@@ -94,39 +98,18 @@ jobs:
           PR_NOTE="**Note:** Please use **Squash Merge** when merging this PR."
           DESCRIPTION="${CHANGES_CONTENT}"$'\n\n---\n\n'"${PR_NOTE}"
 
-          echo "Checking for existing release PRs..."
+          # Delete existing next-release branch to start fresh (auto-closes any open PR)
-          PRS=$(curl -sf --retry 3 --retry-delay 2 --retry-connrefused \
-            -H "Authorization: token ${TOKEN}" \
-            "${API_URL}/pulls?state=open" | jq '[.[] | select(.head.ref == "next-release")]')
-          PR_INDEX=$(echo "${PRS}" | jq -r '.[0].number // empty')
-
-          # If PR exists, rebase the branch onto the latest base branch
-          if [ -n "${PR_INDEX}" ]; then
-            echo "Rebasing PR #${PR_INDEX} branch onto ${BASE_BRANCH}..."
-            REBASE_RESPONSE=$(curl -s --retry 3 --retry-delay 2 --retry-connrefused -w "\n%{http_code}" -X POST \
-              -H "Authorization: token ${TOKEN}" \
-              "${API_URL}/pulls/${PR_INDEX}/update?style=rebase")
-            REBASE_CODE=$(echo "${REBASE_RESPONSE}" | tail -1)
-            if [ "${REBASE_CODE}" = "200" ]; then
-              echo "Successfully rebased branch onto ${BASE_BRANCH}"
-            elif [ "${REBASE_CODE}" = "409" ]; then
-              echo "Branch already up to date or rebase conflict - continuing with update"
-            else
-              echo "Warning: Rebase returned ${REBASE_CODE}, continuing anyway"
-            fi
-          fi
-
           echo "Checking for existing next-release branch..."
           BRANCH_CHECK=$(curl -s --retry 3 --retry-delay 2 --retry-connrefused -w "%{http_code}" -o /dev/null \
             -H "Authorization: token ${TOKEN}" \
             "${API_URL}/branches/next-release")
-          echo "Branch check HTTP status: ${BRANCH_CHECK}"
           if [ "${BRANCH_CHECK}" = "200" ]; then
-            BRANCH_EXISTS="true"
+            echo "Deleting existing next-release branch..."
-          else
+            curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X DELETE \
-            BRANCH_EXISTS="false"
+              -H "Authorization: token ${TOKEN}" \
+              "${API_URL}/branches/next-release"
+            echo "Branch deleted"
           fi
-          echo "Branch exists: ${BRANCH_EXISTS}"
 
           # Prepare CHANGELOG.md content
           CHANGELOG_CONTENT=$(base64 -w0 < CHANGELOG.md)
@@ -135,67 +118,6 @@ jobs:
           VERSION_JSON=$(jq -n --arg v "${VERSION}" '{"version":$v}')
           VERSION_CONTENT=$(echo "${VERSION_JSON}" | base64 -w0)
 
-          if [ "${BRANCH_EXISTS}" = "true" ]; then
-            echo "Updating existing next-release branch..."
-
-            # Get SHA of existing CHANGELOG.md
-            CHANGELOG_SHA=$(curl -sf --retry 3 --retry-delay 2 --retry-connrefused \
-              -H "Authorization: token ${TOKEN}" \
-              "${API_URL}/contents/CHANGELOG.md?ref=next-release" | jq -r '.sha // empty')
-
-            # Update or create CHANGELOG.md
-            if [ -n "${CHANGELOG_SHA}" ]; then
-              curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X PUT \
-                -H "Authorization: token ${TOKEN}" \
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${CHANGELOG_CONTENT}" \
-                  --arg sha "${CHANGELOG_SHA}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, sha: $sha, message: $message, branch: $branch}')" \
-                "${API_URL}/contents/CHANGELOG.md"
-            else
-              curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X POST \
-                -H "Authorization: token ${TOKEN}" \
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${CHANGELOG_CONTENT}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, message: $message, branch: $branch, new_branch: $branch}')" \
-                "${API_URL}/contents/CHANGELOG.md"
-            fi
-
-            # Get SHA of existing .version
-            VERSION_SHA=$(curl -sf --retry 3 --retry-delay 2 --retry-connrefused \
-              -H "Authorization: token ${TOKEN}" \
-              "${API_URL}/contents/.version?ref=next-release" | jq -r '.sha // empty')
-
-            # Update or create .version
-            if [ -n "${VERSION_SHA}" ]; then
-              curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X PUT \
-                -H "Authorization: token ${TOKEN}" \
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${VERSION_CONTENT}" \
-                  --arg sha "${VERSION_SHA}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, sha: $sha, message: $message, branch: $branch}')" \
-                "${API_URL}/contents/.version"
-            else
-              curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X POST \
-                -H "Authorization: token ${TOKEN}" \
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${VERSION_CONTENT}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, message: $message, branch: $branch}')" \
-                "${API_URL}/contents/.version"
-            fi
-          else
           echo "Creating new next-release branch from ${BASE_BRANCH}..."
 
           # Check if CHANGELOG.md exists on base branch to determine create vs update
@@ -265,31 +187,53 @@ jobs:
                 '{content: $content, message: $message, branch: $branch}')" \
               "${API_URL}/contents/.version"
           fi
-          fi
 
-          if [ -n "${PR_INDEX}" ]; then
-            echo "Updating existing PR #${PR_INDEX}..."
-            curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X PATCH \
-              -H "Authorization: token ${TOKEN}" \
-              -H "Content-Type: application/json" \
-              --data "$(jq -n \
-                --arg title "${TITLE}" \
-                --arg body "${DESCRIPTION}" \
-                '{title: $title, body: $body}')" \
-              "${API_URL}/pulls/${PR_INDEX}"
-          else
           echo "Creating new PR..."
-            curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X POST \
+          echo "Waiting for next-release branch to be ready..."
+          for i in $(seq 1 10); do
+            BRANCH_STATUS=$(curl -s --retry 3 --retry-delay 2 --retry-connrefused \
+              -w "%{http_code}" -o /dev/null \
               -H "Authorization: token ${TOKEN}" \
-              -H "Content-Type: application/json" \
+              "${API_URL}/branches/next-release")
-              --data "$(jq -n \
+            if [ "${BRANCH_STATUS}" = "200" ]; then
+              echo "Branch ready after ${i} attempt(s)"
+              break
+            fi
+            if [ "${i}" = "10" ]; then
+              echo "Branch next-release not found after 10 attempts, giving up"
+              exit 1
+            fi
+            echo "Branch not ready yet (attempt ${i}/10), waiting..."
+            sleep 3
+          done
+
+          PR_DATA=$(jq -n \
             --arg title "${TITLE}" \
             --arg body "${DESCRIPTION}" \
             --arg head "next-release" \
-                --arg base "${DEFAULT_BRANCH}" \
+            --arg base "${BASE_BRANCH}" \
-                '{title: $title, body: $body, head: $head, base: $base}')" \
+            '{title: $title, body: $body, head: $head, base: $base}')
-              "${API_URL}/pulls"
+
+          for i in $(seq 1 5); do
+            RESPONSE=$(curl -s --retry 3 --retry-delay 2 --retry-connrefused \
+              -w "\n%{http_code}" -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              --data "${PR_DATA}" \
+              "${API_URL}/pulls")
+            HTTP_CODE=$(echo "${RESPONSE}" | tail -1)
+            BODY=$(echo "${RESPONSE}" | sed '$d')
+            if [ "${HTTP_CODE}" -lt 400 ]; then
+              echo "PR created successfully"
+              break
             fi
+            if [ "${i}" = "5" ]; then
+              echo "Error creating PR after 5 attempts (HTTP ${HTTP_CODE}): ${BODY}"
+              exit 1
+            fi
+            echo "PR creation attempt ${i}/5 failed (HTTP ${HTTP_CODE}), retrying..."
+            sleep 3
+          done
 
   create-release:
     name: Create Release