From 6e6e49a2d409eca6d018561780dc646a999a7ebb Mon Sep 17 00:00:00 2001
From: Julian Lechner <fraujulian@lechner.top>
Date: Fri, 2 Oct 2026 11:51:38 +0200
Subject: [PATCH] ci: make production release manual

---
 ...{BuildLatest.yml => ReleaseProduction.yml} | 79 ++++++++-----------
 1 file changed, 35 insertions(+), 44 deletions(-)
 rename .gitea/workflows/{BuildLatest.yml => ReleaseProduction.yml} (68%)

diff --git a/.gitea/workflows/BuildLatest.yml b/.gitea/workflows/ReleaseProduction.yml
similarity index 68%
rename from .gitea/workflows/BuildLatest.yml
rename to .gitea/workflows/ReleaseProduction.yml
index 6e56ce3..874a498 100644
--- a/.gitea/workflows/BuildLatest.yml
+++ b/.gitea/workflows/ReleaseProduction.yml
@@ -1,44 +1,21 @@
-name: Build Docker Image - Latest
+name: Release Production
 
 on:
   workflow_dispatch:
-    inputs:
-      create_release:
-        description: Create or update the Gitea release for this version
-        required: true
-        default: true
-        type: boolean
+
+permissions:
+  contents: write
 
 env:
   REGISTRY: docker.lechner-systems.at
   IMAGE_NAME: lechnersystems/maintenance
 
 jobs:
-  docker:
+  image:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Read version
-        id: version
-        shell: bash
-        run: |
-          version="$(git rev-parse --short=12 HEAD)"
-
-          if [[ ! "$version" =~ ^[0-9a-f]{12}$ ]]; then
-            echo "Invalid git hash version: $version" >&2
-            exit 1
-          fi
-
-          echo "value=$version" >> "$GITEA_OUTPUT"
-          echo "docker_tag=$version" >> "$GITEA_OUTPUT"
-          echo "release_tag=v$version" >> "$GITEA_OUTPUT"
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -50,7 +27,7 @@ jobs:
           username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
           password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
 
-      - name: Build and push latest image
+      - name: Build and push production image
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -58,33 +35,47 @@ jobs:
           provenance: false
           build-args: |
             APP_VERSION=${{ gitea.sha }}
-            VCS_REF=${{ gitea.run_number }}
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+            VCS_REF=${{ gitea.sha }}
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
           labels: |
             org.opencontainers.image.version=${{ gitea.sha }}
-            org.opencontainers.image.revision=${{ gitea.run_number }}
+            org.opencontainers.image.revision=${{ gitea.sha }}
             org.opencontainers.image.source=${{ gitea.repositoryUrl }}
 
-      - name: Create Gitea release
-        if: ${{ inputs.create_release }}
+  release:
+    needs: image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create or update Gitea release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_API_URL: ${{ gitea.api_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_SHA: ${{ gitea.sha }}
-          RELEASE_TAG: ${{ steps.version.outputs.release_tag }}
         shell: bash
         run: |
+          version="$(git rev-parse --short=12 "$GITEA_SHA")"
+          if [[ ! "$version" =~ ^[0-9a-f]{12}$ ]]; then
+            echo "Invalid git hash version: $version" >&2
+            exit 1
+          fi
+
+          release_tag="v$version"
           releases_url="$GITEA_API_URL/repos/$GITEA_REPOSITORY/releases"
           auth_header="Authorization: token $GITEA_TOKEN"
-          previous_tag="$(curl --fail --silent --show-error --header "$auth_header" "$releases_url?limit=100" | jq -r --arg tag "$RELEASE_TAG" '[.[] | select(.draft == false and .prerelease == false and .tag_name != $tag)][0].tag_name // empty')"
+          previous_tag="$(curl --fail --silent --show-error --header "$auth_header" "$releases_url?limit=100" | jq -r --arg tag "$release_tag" '[.[] | select(.draft == false and .prerelease == false and .tag_name != $tag)][0].tag_name // empty')"
 
           if [ -n "$previous_tag" ]; then
             commit_messages="$(git log --reverse --format='- %s' "${previous_tag}..${GITEA_SHA}")"
-            full_changelog="${{ gitea.server_url }}/${GITEA_REPOSITORY}/compare/${previous_tag}...${RELEASE_TAG}"
+            full_changelog="$GITEA_SERVER_URL/$GITEA_REPOSITORY/compare/${previous_tag}...$release_tag"
           else
-            commit_messages="$(git log --reverse --format='- %s' "${GITEA_SHA}")"
+            commit_messages="$(git log --reverse --format='- %s' "$GITEA_SHA")"
             full_changelog=""
           fi
 
@@ -93,17 +84,17 @@ jobs:
           fi
 
           {
-            echo "## Changes"
+            echo '## Changes'
             echo
-            printf "%s\n" "$commit_messages"
+            printf '%s\n' "$commit_messages"
             echo
             if [ -n "$full_changelog" ]; then
-              echo "**Full Changelog**: ${full_changelog}"
+              echo "**Full Changelog**: $full_changelog"
             fi
           } > release-notes.md
 
-          payload="$(jq -Rs --arg tag "$RELEASE_TAG" --arg target "$GITEA_SHA" '{tag_name: $tag, target_commitish: $target, name: $tag, body: ., draft: false, prerelease: false}' release-notes.md)"
-          status="$(curl --silent --show-error --output release.json --write-out '%{http_code}' --header "$auth_header" "$releases_url/tags/$RELEASE_TAG")"
+          payload="$(jq -Rs --arg tag "$release_tag" --arg target "$GITEA_SHA" '{tag_name: $tag, target_commitish: $target, name: $tag, body: ., draft: false, prerelease: false}' release-notes.md)"
+          status="$(curl --silent --show-error --output release.json --write-out '%{http_code}' --header "$auth_header" "$releases_url/tags/$release_tag")"
 
           if [ "$status" = 200 ]; then
             release_id="$(jq -r '.id' release.json)"