chore(deps): update actions/checkout action to v7 (#26)

This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) | action | major | `v6` → `v7` | `v7.0.0` |

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)

[Compare Source](https://github.com/actions/checkout/compare/v7.0.0...v7.0.0)

- Block checking out fork PR for pull\_request\_target and workflow\_run by [@&#8203;aiqiaoy](https://github.com/aiqiaoy) in [#&#8203;2454](https://github.com/actions/checkout/pull/2454)
- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2458](https://github.com/actions/checkout/pull/2458)
- Bump flatted from 3.3.1 to 3.4.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2460](https://github.com/actions/checkout/pull/2460)
- Bump js-yaml from 4.1.0 to 4.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2461](https://github.com/actions/checkout/pull/2461)
- Bump [@&#8203;actions/core](https://github.com/actions/core) and [@&#8203;actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2459](https://github.com/actions/checkout/pull/2459)
- upgrade module to esm and update dependencies by [@&#8203;aiqiaoy](https://github.com/aiqiaoy) in [#&#8203;2463](https://github.com/actions/checkout/pull/2463)
- Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2462](https://github.com/actions/checkout/pull/2462)

### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)

[Compare Source](https://github.com/actions/checkout/compare/v6.0.3...v7.0.0)

- Block checking out fork PR for pull\_request\_target and workflow\_run by [@&#8203;aiqiaoy](https://github.com/aiqiaoy) in [#&#8203;2454](https://github.com/actions/checkout/pull/2454)
- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2458](https://github.com/actions/checkout/pull/2458)
- Bump flatted from 3.3.1 to 3.4.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2460](https://github.com/actions/checkout/pull/2460)
- Bump js-yaml from 4.1.0 to 4.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2461](https://github.com/actions/checkout/pull/2461)
- Bump [@&#8203;actions/core](https://github.com/actions/core) and [@&#8203;actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2459](https://github.com/actions/checkout/pull/2459)
- upgrade module to esm and update dependencies by [@&#8203;aiqiaoy](https://github.com/aiqiaoy) in [#&#8203;2463](https://github.com/actions/checkout/pull/2463)
- Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2462](https://github.com/actions/checkout/pull/2462)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIyMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: #26
Co-authored-by: Renovate Bot <renovate@unbound.se>
Co-committed-by: Renovate Bot <renovate@unbound.se>

.claude/settings.local.json

@@ -2,7 +2,11 @@
   "permissions": {
     "allow": [
       "Bash(but --help:*)",
-      "Bash(but rub --help:*)"
+      "Bash(but rub --help:*)",
+      "WebSearch",
+      "WebFetch(domain:docs.gitea.com)",
+      "WebFetch(domain:gitea.com)",
+      "Bash(but status:*)"
     ]
   }
 }

.gitea/workflows/Release.yml

@@ -9,10 +9,14 @@ on:
         default: false
         type: boolean
 
+concurrency:
+  group: release-${{ github.repository }}
+  cancel-in-progress: false
+
 env:
   GITEA_URL: http://gitea-http.gitea.svc.cluster.local:3000
   RELEASE_TOKEN_FILE: /runner-secrets/release-token
-  GIT_CLIFF_VERSION: "2.10.1"
+  GIT_CLIFF_VERSION: "2.13.1"
 
 jobs:
   preconditions:
@@ -39,7 +43,7 @@ jobs:
     if: github.ref_type == 'branch' && github.ref_name == github.event.repository.default_branch
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -83,144 +87,184 @@ jobs:
           OWNER=$(echo "${REPOSITORY}" | cut -d'/' -f1)
           REPO=$(echo "${REPOSITORY}" | cut -d'/' -f2)
           API_URL="${GITEA_URL}/api/v1/repos/${OWNER}/${REPO}"
+          BASE_BRANCH="${DEFAULT_BRANCH:-main}"
+          echo "Using base branch: ${BASE_BRANCH}"
 
           TITLE="chore(release): prepare for ${VERSION}"
-          # Read CHANGES.md and escape for JSON
+          CHANGES_CONTENT=$(cat CHANGES.md)
-          DESCRIPTION=$(cat CHANGES.md | jq -Rs .)
+          PR_NOTE="**Note:** Please use **Squash Merge** when merging this PR."
-          DESCRIPTION="${DESCRIPTION:1:-1}"  # Remove surrounding quotes from jq
+          DESCRIPTION="${CHANGES_CONTENT}"$'\n\n---\n\n'"${PR_NOTE}"
-
-          # Add squash merge reminder
-          DESCRIPTION="${DESCRIPTION}
-
-          ---
-          **Note:** Please use **Squash Merge** when merging this PR."
-
-          echo "Checking for existing release PRs..."
-          PRS=$(curl -sf \
-            -H "Authorization: token ${TOKEN}" \
-            "${API_URL}/pulls?state=open" | jq '[.[] | select(.head.ref == "next-release")]')
-          PR_INDEX=$(echo "${PRS}" | jq -r '.[0].number // empty')
-
-          echo "Checking for existing next-release branch..."
-          BRANCH_EXISTS=$(curl -sf \
-            -H "Authorization: token ${TOKEN}" \
-            "${API_URL}/branches/next-release" 2>/dev/null && echo "true" || echo "false")
-
-          # Prepare CHANGELOG.md content
           CHANGELOG_CONTENT=$(base64 -w0 < CHANGELOG.md)
+          VERSION_CONTENT=$(jq -n --arg v "${VERSION}" '{"version":$v}' | base64 -w0)
 
-          # Prepare .version content
+          # api_call METHOD PATH [JSON_BODY]
-          VERSION_JSON=$(jq -n --arg v "${VERSION}" '{"version":$v}')
+          # Stdout: first line "<http_code>|<curl_rc>", then response body.
-          VERSION_CONTENT=$(echo "${VERSION_JSON}" | base64 -w0)
+          # Never returns non-zero so callers must inspect http_code; this
-
+          # prevents curl exit codes (e.g. CURLE_WRITE_ERROR / 23) from
-          if [ "${BRANCH_EXISTS}" = "true" ]; then
+          # killing the script via `set -e` inside command substitutions.
-            echo "Updating existing next-release branch..."
+          api_call() {
-
+            local method="$1" path="$2" data="${3:-}"
-            # Get SHA of existing CHANGELOG.md
+            local body_file http_code rc=0
-            CHANGELOG_SHA=$(curl -sf \
+            body_file=$(mktemp)
-              -H "Authorization: token ${TOKEN}" \
+            local args=(-sS --retry 3 --retry-delay 2 --retry-all-errors
-              "${API_URL}/contents/CHANGELOG.md?ref=next-release" | jq -r '.sha // empty')
+                        -w '%{http_code}'
-
+                        -o "${body_file}"
-            # Update or create CHANGELOG.md
+                        -X "${method}"
-            if [ -n "${CHANGELOG_SHA}" ]; then
+                        -H "Authorization: token ${TOKEN}")
-              curl -sf -X PUT \
+            if [ -n "${data}" ]; then
-                -H "Authorization: token ${TOKEN}" \
+              args+=(-H "Content-Type: application/json" --data "${data}")
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${CHANGELOG_CONTENT}" \
-                  --arg sha "${CHANGELOG_SHA}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, sha: $sha, message: $message, branch: $branch}')" \
-                "${API_URL}/contents/CHANGELOG.md"
-            else
-              curl -sf -X POST \
-                -H "Authorization: token ${TOKEN}" \
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${CHANGELOG_CONTENT}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, message: $message, branch: $branch, new_branch: $branch}')" \
-                "${API_URL}/contents/CHANGELOG.md"
             fi
+            http_code=$(curl "${args[@]}" "${API_URL}${path}" 2>/dev/null) || rc=$?
+            printf '%s|%s\n' "${http_code:-000}" "${rc}"
+            cat "${body_file}"
+            rm -f "${body_file}"
+            return 0
+          }
 
-            # Get SHA of existing .version
+          # Extract first-line meta and remaining body from api_call output.
-            VERSION_SHA=$(curl -sf \
+          meta_line() { printf '%s\n' "$1" | head -n1; }
-              -H "Authorization: token ${TOKEN}" \
+          body_lines() { printf '%s\n' "$1" | tail -n +2; }
-              "${API_URL}/contents/.version?ref=next-release" | jq -r '.sha // empty')
+          http_of() { local m; m=$(meta_line "$1"); printf '%s' "${m%%|*}"; }
+          ok_code() { [ -n "$1" ] && [ "$1" -ge 200 ] 2>/dev/null && [ "$1" -lt 400 ]; }
 
-            # Update or create .version
+          # Delete existing next-release branch if it exists (auto-closes any open PR)
-            if [ -n "${VERSION_SHA}" ]; then
+          echo "Checking for existing next-release branch..."
-              curl -sf -X PUT \
+          OUT=$(api_call GET "/branches/next-release")
-                -H "Authorization: token ${TOKEN}" \
+          CODE=$(http_of "${OUT}")
-                -H "Content-Type: application/json" \
+          if [ "${CODE}" = "200" ]; then
-                --data "$(jq -n \
+            echo "Deleting existing next-release branch..."
-                  --arg content "${VERSION_CONTENT}" \
+            OUT=$(api_call DELETE "/branches/next-release")
-                  --arg sha "${VERSION_SHA}" \
+            echo "  delete result: $(meta_line "${OUT}")"
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, sha: $sha, message: $message, branch: $branch}')" \
-                "${API_URL}/contents/.version"
-            else
-              curl -sf -X POST \
-                -H "Authorization: token ${TOKEN}" \
-                -H "Content-Type: application/json" \
-                --data "$(jq -n \
-                  --arg content "${VERSION_CONTENT}" \
-                  --arg message "${TITLE}" \
-                  --arg branch "next-release" \
-                  '{content: $content, message: $message, branch: $branch}')" \
-                "${API_URL}/contents/.version"
-            fi
           else
-            echo "Creating new next-release branch with CHANGELOG.md..."
+            echo "  no existing branch (HTTP ${CODE})"
-            curl -sf -X POST \
+          fi
-              -H "Authorization: token ${TOKEN}" \
-              -H "Content-Type: application/json" \
-              --data "$(jq -n \
-                --arg content "${CHANGELOG_CONTENT}" \
-                --arg message "${TITLE}" \
-                --arg branch "${DEFAULT_BRANCH}" \
-                --arg new_branch "next-release" \
-                '{content: $content, message: $message, branch: $branch, new_branch: $new_branch}')" \
-              "${API_URL}/contents/CHANGELOG.md"
 
-            echo "Adding .version to next-release branch..."
+          # Explicitly create next-release branch from base
-            curl -sf -X POST \
+          echo "Creating next-release branch from ${BASE_BRANCH}..."
-              -H "Authorization: token ${TOKEN}" \
+          BRANCH_PAYLOAD=$(jq -n --arg new "next-release" --arg old "${BASE_BRANCH}" \
-              -H "Content-Type: application/json" \
+            '{new_branch_name: $new, old_branch_name: $old}')
-              --data "$(jq -n \
+          for i in $(seq 1 5); do
-                --arg content "${VERSION_CONTENT}" \
+            OUT=$(api_call POST "/branches" "${BRANCH_PAYLOAD}")
+            META=$(meta_line "${OUT}"); BODY=$(body_lines "${OUT}"); CODE="${META%%|*}"
+            if ok_code "${CODE}"; then
+              echo "Branch created (${META})"
+              break
+            fi
+            if [ "${i}" = "5" ]; then
+              echo "Branch create failed after 5 attempts (${META}): ${BODY}"
+              exit 1
+            fi
+            echo "  attempt ${i}/5 (${META}): ${BODY} — retrying..."
+            sleep 3
+          done
+
+          # Poll until branch is readable
+          echo "Waiting for branch readiness..."
+          for i in $(seq 1 10); do
+            OUT=$(api_call GET "/branches/next-release")
+            META=$(meta_line "${OUT}"); CODE="${META%%|*}"
+            if [ "${CODE}" = "200" ]; then
+              echo "Branch ready after ${i} attempt(s)"
+              break
+            fi
+            if [ "${i}" = "10" ]; then
+              echo "Branch not ready after 10 attempts (last: ${META})"
+              exit 1
+            fi
+            echo "  attempt ${i}/10 (${META}) — waiting..."
+            sleep 2
+          done
+
+          # Fetch file blob SHA from BASE_BRANCH. next-release was just forked
+          # from base so the blob SHA matches; querying base avoids racing
+          # Gitea's per-endpoint propagation for the new branch (the /contents
+          # endpoint can still 500/404 after /branches reports 200). Returns
+          # empty only when the file genuinely does not exist on base.
+          fetch_sha() {
+            local path="$1" out meta code body
+            for i in $(seq 1 5); do
+              out=$(api_call GET "/contents/${path}?ref=${BASE_BRANCH}")
+              meta=$(meta_line "${out}"); code="${meta%%|*}"; body=$(body_lines "${out}")
+              if [ "${code}" = "200" ]; then
+                printf '%s' "${body}" | jq -r '.sha // empty'
+                return 0
+              fi
+              if [ "${code}" = "404" ]; then
+                return 0
+              fi
+              if [ "${i}" = "5" ]; then
+                echo "fetch_sha ${path} failed after 5 attempts (${meta}): ${body}" >&2
+                return 0
+              fi
+              sleep 2
+            done
+          }
+          CHANGELOG_SHA=$(fetch_sha "CHANGELOG.md")
+          VERSION_SHA=$(fetch_sha ".version")
+
+          # Write file with retry. Args: PATH CONTENT_B64 [SHA]
+          write_file() {
+            local path="$1" content="$2" sha="${3:-}"
+            local method payload out meta body code
+            if [ -n "${sha}" ]; then
+              method=PUT
+              payload=$(jq -n \
+                --arg content "${content}" \
+                --arg sha "${sha}" \
                 --arg message "${TITLE}" \
                 --arg branch "next-release" \
-                '{content: $content, message: $message, branch: $branch}')" \
+                '{content: $content, sha: $sha, message: $message, branch: $branch}')
-              "${API_URL}/contents/.version"
+            else
-          fi
+              method=POST
+              payload=$(jq -n \
+                --arg content "${content}" \
+                --arg message "${TITLE}" \
+                --arg branch "next-release" \
+                '{content: $content, message: $message, branch: $branch}')
+            fi
+            for i in $(seq 1 5); do
+              out=$(api_call "${method}" "/contents/${path}" "${payload}")
+              meta=$(meta_line "${out}"); body=$(body_lines "${out}"); code="${meta%%|*}"
+              if ok_code "${code}"; then
+                echo "${path} write succeeded (${meta})"
+                return 0
+              fi
+              if [ "${i}" = "5" ]; then
+                echo "${path} write failed after 5 attempts (${meta}): ${body}"
+                return 1
+              fi
+              echo "  ${path} attempt ${i}/5 (${meta}): ${body} — retrying..."
+              sleep 3
+            done
+          }
 
-          if [ -n "${PR_INDEX}" ]; then
+          echo "Writing CHANGELOG.md to next-release..."
-            echo "Updating existing PR #${PR_INDEX}..."
+          write_file "CHANGELOG.md" "${CHANGELOG_CONTENT}" "${CHANGELOG_SHA}"
-            curl -sf -X PATCH \
+          echo "Writing .version to next-release..."
-              -H "Authorization: token ${TOKEN}" \
+          write_file ".version" "${VERSION_CONTENT}" "${VERSION_SHA}"
-              -H "Content-Type: application/json" \
+
-              --data "$(jq -n \
+          # Create PR
-                --arg title "${TITLE}" \
+          echo "Creating PR..."
-                --arg body "${DESCRIPTION}" \
+          PR_DATA=$(jq -n \
-                '{title: $title, body: $body}')" \
+            --arg title "${TITLE}" \
-              "${API_URL}/pulls/${PR_INDEX}"
+            --arg body "${DESCRIPTION}" \
-          else
+            --arg head "next-release" \
-            echo "Creating new PR..."
+            --arg base "${BASE_BRANCH}" \
-            curl -sf -X POST \
+            '{title: $title, body: $body, head: $head, base: $base}')
-              -H "Authorization: token ${TOKEN}" \
+          for i in $(seq 1 5); do
-              -H "Content-Type: application/json" \
+            OUT=$(api_call POST "/pulls" "${PR_DATA}")
-              --data "$(jq -n \
+            META=$(meta_line "${OUT}"); BODY=$(body_lines "${OUT}"); CODE="${META%%|*}"
-                --arg title "${TITLE}" \
+            if ok_code "${CODE}"; then
-                --arg body "${DESCRIPTION}" \
+              echo "PR created (${META})"
-                --arg head "next-release" \
+              break
-                --arg base "${DEFAULT_BRANCH}" \
+            fi
-                '{title: $title, body: $body, head: $head, base: $base}')" \
+            if [ "${i}" = "5" ]; then
-              "${API_URL}/pulls"
+              echo "PR creation failed after 5 attempts (${META}): ${BODY}"
-          fi
+              exit 1
+            fi
+            echo "  PR attempt ${i}/5 (${META}): ${BODY} — retrying..."
+            sleep 3
+          done
 
   create-release:
     name: Create Release
@@ -232,7 +276,7 @@ jobs:
       inputs.tag_only != true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -275,11 +319,10 @@ jobs:
           REPO=$(echo "${REPOSITORY}" | cut -d'/' -f2)
           API_URL="${GITEA_URL}/api/v1/repos/${OWNER}/${REPO}"
 
-          MESSAGE=$(cat CHANGES.md | jq -Rs .)
+          MESSAGE=$(cat CHANGES.md)
-          MESSAGE="${MESSAGE:1:-1}"  # Remove surrounding quotes
 
           echo "Creating release ${VERSION}..."
-          curl -sf -X POST \
+          curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X POST \
             -H "Authorization: token ${TOKEN}" \
             -H "Content-Type: application/json" \
             --data "$(jq -n \
@@ -300,7 +343,7 @@ jobs:
       inputs.tag_only == true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -341,7 +384,7 @@ jobs:
           API_URL="${GITEA_URL}/api/v1/repos/${OWNER}/${REPO}"
 
           echo "Creating tag ${VERSION}..."
-          curl -sf -X POST \
+          curl -sf --retry 3 --retry-delay 2 --retry-connrefused -X POST \
             -H "Authorization: token ${TOKEN}" \
             -H "Content-Type: application/json" \
             --data "$(jq -n \

renovate.json

@@ -6,7 +6,9 @@
   "customManagers": [
     {
       "customType": "regex",
-      "fileMatch": ["^\\.gitea/workflows/.*\\.ya?ml$"],
+      "managerFilePatterns": [
+        "/^\\.gitea/workflows/.*\\.ya?ml$/"
+      ],
       "matchStrings": [
         "GIT_CLIFF_VERSION:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
       ],