From 16d6569acd7ed1f4241d41ca352b269e7e206ff3 Mon Sep 17 00:00:00 2001
From: copilotcoder <copilotcoder@darkhelm.org>
Date: Fri, 17 Jul 2026 15:18:27 -0400
Subject: [PATCH] ci: auto-tag main promotions from v0.0.0 baseline

---
 .gitea/workflows/cicd.yaml | 54 ++++++++++++++++++++++++++------------
 1 file changed, 37 insertions(+), 17 deletions(-)

diff --git a/.gitea/workflows/cicd.yaml b/.gitea/workflows/cicd.yaml
index 61518bb..935febd 100644
--- a/.gitea/workflows/cicd.yaml
+++ b/.gitea/workflows/cicd.yaml
@@ -2491,6 +2491,7 @@ jobs:
   promote-release-images:
     name: Promote Staging Images To Release
     runs-on: ubuntu-act
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     timeout-minutes: 15
     needs: [build_cicd, build-release-images, integration-tests, e2e-tests]
     outputs:
@@ -2616,18 +2617,30 @@ jobs:
             | tail -n 1)"
 
           if [ -z "${HEAD_SEMVER_TAG}" ]; then
-            echo "No semver tag found on HEAD (${HEAD_SHA}); skipping release promotion and release notes generation."
-            echo "release_version=" >> "$GITHUB_OUTPUT"
-            echo "release_short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
-            echo "release_tagged_version=" >> "$GITHUB_OUTPUT"
-            echo "previous_release_version=" >> "$GITHUB_OUTPUT"
-            echo "backend_release_version_ref=" >> "$GITHUB_OUTPUT"
-            echo "backend_release_tagged_ref=" >> "$GITHUB_OUTPUT"
-            echo "backend_release_build_ref=" >> "$GITHUB_OUTPUT"
-            echo "frontend_release_version_ref=" >> "$GITHUB_OUTPUT"
-            echo "frontend_release_tagged_ref=" >> "$GITHUB_OUTPUT"
-            echo "frontend_release_build_ref=" >> "$GITHUB_OUTPUT"
-            exit 0
+            ALL_SEMVER_TAGS="$({ GIT_SSH_COMMAND="${GIT_SSH_COMMAND}" git ls-remote --tags --refs "${GITEA_REPO_SSH_URL}" 2>/dev/null || true; } \
+              | awk '{sub("refs/tags/", "", $2); print $2}' \
+              | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
+              | sort -V)"
+
+            LAST_SEMVER_TAG="$(printf '%s\n' "${ALL_SEMVER_TAGS}" | tail -n 1)"
+            if [ -z "${LAST_SEMVER_TAG}" ]; then
+              LAST_SEMVER_TAG="v0.0.0"
+            fi
+
+            TAG_MAJOR="$(printf '%s' "${LAST_SEMVER_TAG}" | sed -E 's/^v([0-9]+)\.([0-9]+)\.([0-9]+)$/\1/')"
+            TAG_MINOR="$(printf '%s' "${LAST_SEMVER_TAG}" | sed -E 's/^v([0-9]+)\.([0-9]+)\.([0-9]+)$/\2/')"
+            TAG_PATCH="$(printf '%s' "${LAST_SEMVER_TAG}" | sed -E 's/^v([0-9]+)\.([0-9]+)\.([0-9]+)$/\3/')"
+            NEXT_PATCH="$((TAG_PATCH + 1))"
+            HEAD_SEMVER_TAG="v${TAG_MAJOR}.${TAG_MINOR}.${NEXT_PATCH}"
+
+            retry_cmd 5 2 git -C "${TMP_REPO_DIR}" init -q
+            retry_cmd 5 3 env GIT_SSH_COMMAND="${GIT_SSH_COMMAND}" git -C "${TMP_REPO_DIR}" remote add origin "${GITEA_REPO_SSH_URL}"
+            retry_cmd 5 3 env GIT_SSH_COMMAND="${GIT_SSH_COMMAND}" git -C "${TMP_REPO_DIR}" fetch --no-tags --depth 200 origin "${HEAD_SHA}"
+            git -C "${TMP_REPO_DIR}" config user.name "gitea-actions"
+            git -C "${TMP_REPO_DIR}" config user.email "gitea-actions@darkhelm.local"
+            git -C "${TMP_REPO_DIR}" tag "${HEAD_SEMVER_TAG}" "${HEAD_SHA}"
+            retry_cmd 5 3 env GIT_SSH_COMMAND="${GIT_SSH_COMMAND}" git -C "${TMP_REPO_DIR}" push origin "refs/tags/${HEAD_SEMVER_TAG}"
+            echo "Created patch release tag ${HEAD_SEMVER_TAG} for ${HEAD_SHA}"
           fi
 
           TAG_MAJOR="$(printf '%s' "${HEAD_SEMVER_TAG}" | sed -E 's/^v([0-9]+)\.([0-9]+)\.([0-9]+)$/\1/')"
@@ -2655,18 +2668,25 @@ jobs:
           FRONTEND_RELEASE_BUILD_REF="${RELEASE_FRONTEND_REPO}:${RELEASE_BUILD_TAG}"
           FRONTEND_RELEASE_LATEST_REF="${RELEASE_FRONTEND_REPO}:latest"
 
-          retry_cmd 5 2 git -C "${TMP_REPO_DIR}" init -q
-          retry_cmd 5 3 env GIT_SSH_COMMAND="${GIT_SSH_COMMAND}" git -C "${TMP_REPO_DIR}" remote add origin "${GITEA_REPO_SSH_URL}"
-          retry_cmd 5 3 env GIT_SSH_COMMAND="${GIT_SSH_COMMAND}" git -C "${TMP_REPO_DIR}" fetch --no-tags --depth 200 origin "${HEAD_SHA}"
+          if [ ! -d "${TMP_REPO_DIR}/.git" ]; then
+            retry_cmd 5 2 git -C "${TMP_REPO_DIR}" init -q
+            retry_cmd 5 3 env GIT_SSH_COMMAND="${GIT_SSH_COMMAND}" git -C "${TMP_REPO_DIR}" remote add origin "${GITEA_REPO_SSH_URL}"
+            retry_cmd 5 3 env GIT_SSH_COMMAND="${GIT_SSH_COMMAND}" git -C "${TMP_REPO_DIR}" fetch --no-tags --depth 200 origin "${HEAD_SHA}"
+          fi
           retry_cmd 5 3 env GIT_SSH_COMMAND="${GIT_SSH_COMMAND}" git -C "${TMP_REPO_DIR}" fetch --tags --force origin
 
           RELEASE_NOTES_FILE="$(mktemp)"
-          if [ -n "${PREVIOUS_RELEASE_VERSION}" ]; then
+          PREVIOUS_RELEASE_GIT_REF="${PREVIOUS_RELEASE_VERSION}"
+          if [ -z "${PREVIOUS_RELEASE_GIT_REF}" ]; then
+            PREVIOUS_RELEASE_VERSION="v0.0.0"
+          fi
+
+          if [ -n "${PREVIOUS_RELEASE_GIT_REF}" ]; then
             LOG_RANGE="${PREVIOUS_RELEASE_VERSION}..${HEAD_SHA}"
             CHANGES_HEADER="Changes since previous release ${PREVIOUS_RELEASE_VERSION}:"
           else
             LOG_RANGE="${HEAD_SHA}"
-            CHANGES_HEADER="Changes included in this initial tracked release:"
+            CHANGES_HEADER="Changes since baseline ${PREVIOUS_RELEASE_VERSION}:"
           fi
 
           {