From 2ebc8200b2ddd167f361fef29d1e58f6b9b18d7f Mon Sep 17 00:00:00 2001
From: manifest-updater pipeline seed <ci@gitea.mulligan.casa>
Date: Tue, 23 Jun 2026 18:23:51 +0000
Subject: [PATCH] Seed/update .ci pipeline from manifest-updater v1.1.0

---
 .ci/release.sh | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/.ci/release.sh b/.ci/release.sh
index d2873dc..227a937 100644
--- a/.ci/release.sh
+++ b/.ci/release.sh
@@ -39,6 +39,15 @@ if os.path.isfile("mu-release.yaml"):
 print("true" if val is True else "false" if val is False else val)
 PY
 }
+
+# Builder/config deps up front: cfg() parses YAML and build-manifest needs
+# markdown + pyyaml. Installing here (not mid-pipeline) so CHANNEL/APP_BUILD and
+# every later YAML read resolve correctly.
+command -v python3 >/dev/null 2>&1 || { sudo apt-get update -qq && sudo apt-get install -y -qq python3; }
+python3 -m pip --version >/dev/null 2>&1 || { sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip; }
+python3 -m pip install --quiet markdown pyyaml 2>/dev/null \
+  || python3 -m pip install --quiet --break-system-packages markdown pyyaml
+
 CHANNEL="$(cfg channel 'ee-extensions/foh-updates')"
 APP_BUILD="$(cfg app_build 'false')"
 
@@ -103,12 +112,12 @@ API="${HOST}/api/v1/repos/${GITHUB_REPOSITORY}"
 AUTH="Authorization: token ${GITHUB_TOKEN}"
 # Idempotent: reuse the release if this tag was already released (re-run/re-tag).
 REL="$(curl -fsS -H "${AUTH}" "${API}/releases/tags/${GITHUB_REF_NAME}" 2>/dev/null || true)"
-REL_ID="$(printf '%s' "${REL}" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')"
+REL_ID="$(printf '%s' "${REL}" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*' || true)"
 if [ -z "${REL_ID}" ]; then
   BODY="$(python3 -c 'import json,sys; print(json.dumps({"tag_name":sys.argv[1],"name":sys.argv[2],"body":sys.argv[3]}))' \
           "${GITHUB_REF_NAME}" "${SLUG} ${VER}" "Automated build of ${GITHUB_REF_NAME}.")"
   REL="$(curl -fsS -X POST "${API}/releases" -H "${AUTH}" -H "Content-Type: application/json" --data-raw "${BODY}")"
-  REL_ID="$(printf '%s' "${REL}" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')"
+  REL_ID="$(printf '%s' "${REL}" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*' || true)"
 fi
 [ -n "${REL_ID}" ] || { echo "::error::could not create/get the release"; echo "${REL}"; exit 1; }
 # Replace a same-named asset on a re-run rather than 409-ing.
@@ -156,11 +165,6 @@ d["icons"] = json.loads(sys.argv[10])
 json.dump(d, sys.stdout)
 PY
 
-# ensure python3 + pip + the builder's deps (markdown, pyyaml) are present.
-command -v python3 >/dev/null 2>&1 || { sudo apt-get update -qq && sudo apt-get install -y -qq python3; }
-python3 -m pip --version >/dev/null 2>&1 || { sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip; }
-python3 -m pip install --quiet markdown pyyaml 2>/dev/null \
-  || python3 -m pip install --quiet --break-system-packages markdown pyyaml
 # Prefer the tag-locked local builder (MU ships .ci/); consumer plugins fall back
 # to the channel copy seeded by MU's release. (Keep FOH_UPDATES_DEPLOY_KEY tightly held.)
 BUILDER="_upd/.ci/build-manifest.py"