fix(ci): properly update latest-main release on every push

Made-with: Cursor

.gitea/workflows/ci.yml

@@ -127,51 +127,89 @@ jobs:
           find releases/ -type f -exec ls -lh {} \; | awk '{print $5, $9}'
 
       - name: Publish rolling release
-        # Only publish on branch pushes, not PRs
         if: github.event_name == 'push'
         run: |
           SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-          BRANCH=$(echo "${{ github.ref_name }}" | sed 's|/|-|g')
-          TAG="latest-${BRANCH}"
-          TITLE="Latest build (${BRANCH} @ ${SHORT_SHA})"
+          TAG="latest-main"
+          TITLE="Latest build (main @ ${SHORT_SHA})"
+          BODY="Automated build from \`main\` branch.\n\n**Commit:** \`${{ github.sha }}\`\n**Message:** ${{ github.event.head_commit.message }}\n\nThis release is updated on every push to main and always contains the latest artifacts."
+          API="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+          AUTH="Authorization: token ${{ secrets.RELEASE_TOKEN }}"
 
-          # Delete existing rolling release/tag so we can recreate it
-          curl -s -X DELETE \
-            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/${TAG}" || true
+          # Force-move the git tag to the current commit
+          # Try to update existing ref first, create if it doesn't exist
+          UPDATE=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH \
+            -H "$AUTH" -H "Content-Type: application/json" \
+            "${API}/git/refs/tags/${TAG}" \
+            -d "{\"sha\": \"${{ github.sha }}\", \"force\": true}")
+          echo "Tag update HTTP: $UPDATE"
 
-          curl -s -X DELETE \
-            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/git/refs/tags/${TAG}" || true
+          if [ "$UPDATE" != "200" ]; then
+            echo "Tag doesn't exist yet, creating..."
+            curl -s -X POST \
+              -H "$AUTH" -H "Content-Type: application/json" \
+              "${API}/git/refs" \
+              -d "{\"ref\": \"refs/tags/${TAG}\", \"sha\": \"${{ github.sha }}\"}"
+          fi
 
-          sleep 2
+          # Get existing release by tag (if any)
+          EXISTING=$(curl -s -H "$AUTH" "${API}/releases/tags/${TAG}")
+          RELEASE_ID=$(echo "$EXISTING" | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{const r=JSON.parse(d);console.log(r.id||'')}catch{console.log('')}})")
+          echo "Existing release ID: $RELEASE_ID"
 
-          # Create new release
-          RELEASE_ID=$(curl -s -X POST \
-            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
-            -H "Content-Type: application/json" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases" \
-            -d "{
-              \"tag_name\": \"${TAG}\",
-              \"name\": \"${TITLE}\",
-              \"body\": \"Automated build from \`${BRANCH}\` branch, commit \`${SHORT_SHA}\`.\n\nThis release is updated on every push and always contains the latest build.\",
-              \"prerelease\": true,
-              \"target_commitish\": \"${{ github.sha }}\"
-            }" | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>console.log(JSON.parse(d).id))")
+          if [ -n "$RELEASE_ID" ] && [ "$RELEASE_ID" != "null" ] && [ "$RELEASE_ID" != "" ]; then
+            # Update the existing release title, body and target commit
+            curl -s -X PATCH \
+              -H "$AUTH" -H "Content-Type: application/json" \
+              "${API}/releases/${RELEASE_ID}" \
+              -d "{
+                \"name\": \"${TITLE}\",
+                \"body\": \"${BODY}\",
+                \"prerelease\": true,
+                \"target_commitish\": \"${{ github.sha }}\"
+              }"
+            echo "Updated release ${RELEASE_ID}"
 
-          echo "Release ID: $RELEASE_ID"
+            # Delete all existing assets so we can re-upload fresh ones
+            ASSETS=$(curl -s -H "$AUTH" "${API}/releases/${RELEASE_ID}/assets")
+            echo "$ASSETS" | node -e "
+              let d='';
+              process.stdin.on('data',c=>d+=c).on('end',()=>{
+                try {
+                  const assets = JSON.parse(d);
+                  if (Array.isArray(assets)) assets.forEach(a => console.log(a.id));
+                } catch(_) {}
+              })" | while read ASSET_ID; do
+              [ -z "$ASSET_ID" ] && continue
+              echo "Deleting asset $ASSET_ID..."
+              curl -s -X DELETE -H "$AUTH" "${API}/releases/${RELEASE_ID}/assets/${ASSET_ID}"
+            done
+          else
+            # Create a brand new release
+            RELEASE_ID=$(curl -s -X POST \
+              -H "$AUTH" -H "Content-Type: application/json" \
+              "${API}/releases" \
+              -d "{
+                \"tag_name\": \"${TAG}\",
+                \"name\": \"${TITLE}\",
+                \"body\": \"${BODY}\",
+                \"prerelease\": true,
+                \"target_commitish\": \"${{ github.sha }}\"
+              }" | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{console.log(JSON.parse(d).id)}catch{console.log('')}})")
+            echo "Created release ${RELEASE_ID}"
+          fi
 
-          # Upload all artifacts
+          # Upload all fresh artifacts
           for FILE in releases/*.zip releases/*.xpi releases/SHA256SUMS.txt; do
             [ -f "$FILE" ] || continue
             NAME=$(basename "$FILE")
             echo "Uploading $NAME..."
             curl -s -X POST \
-              -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
+              -H "$AUTH" \
               -H "Content-Type: application/octet-stream" \
-              "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets?name=${NAME}" \
+              "${API}/releases/${RELEASE_ID}/assets?name=${NAME}" \
               --data-binary "@${FILE}"
             echo ""
           done
 
-          echo "Release published: ${TAG}"
+          echo "Done — release ${TAG} updated to ${{ github.sha }}"