chore(release): require green CI on Gitea instead of re-running the checks

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/ship/SKILL.md

@@ -24,7 +24,8 @@ Repo rules: `CONTRIBUTING.md`. Gitea: https://git.mariuszpacek.pl/mariusz.pacek/
    then `git push origin master` and delete the branch locally and on origin. Confirm CI is
    green on master. Gitea does not close an AGit PR merged by hand: ask the user to close it.
 6. Release and update only with the user's explicit approval for this one:
-   `scripts/release.sh vMAJOR.MINOR.PATCH` (patch for fixes, minor for features) tags master;
+   `scripts/release.sh vMAJOR.MINOR.PATCH` (patch for fixes, minor for features) waits for green
+   CI on master's head (no local check run), then tags master;
    wait until the Release run under `…/actions` is green (it publishes the images). Then on the
    Pi (`ssh <host>`, an alias while D7 is open): `cd /home/pi/home-pump && ./update.sh <version>`,
    watch `journalctl -t home-pump-gateway -f` and Grafana for one polling cycle (300 s) and

scripts/release.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Releases master: scripts/release.sh vMAJOR.MINOR.PATCH
-# Runs the gate, tags master and pushes the tag; .gitea/workflows/release.yml then publishes the
+# Needs a green CI status for master's head on Gitea, tags master and pushes the tag; .gitea/workflows/release.yml then publishes the
 # gateway, backend and frontend images under that name. Then, on the Pi: ./update.sh <version>.
 set -euo pipefail
 cd "$(dirname "$0")/.."
@@ -10,6 +10,22 @@ die() {
     exit 1
 }
 
+# The combined state of all CI jobs for HEAD; polls while pending, up to 15 minutes.
+wait_for_green_ci() {
+    local url state attempt
+    url=https://git.mariuszpacek.pl/api/v1/repos/mariusz.pacek/home-pump/commits/$(git rev-parse HEAD)/status
+    for attempt in $(seq 30); do
+        state=$(curl -fsS "$url" | sed -n 's/^{"state":"\([a-z]*\)".*/\1/p')
+        case $state in
+            success) return ;;
+            failure | error) die "CI is $state for $(git rev-parse --short HEAD)" ;;
+        esac
+        echo "release: CI is ${state:-unknown}, waiting ($attempt/30)"
+        sleep 30
+    done
+    die "CI did not finish in time"
+}
+
 version=${1:-}
 [[ $version =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || die "usage: $0 vMAJOR.MINOR.PATCH"
 [[ $(git branch --show-current) == master ]] || die "release only from master"
@@ -18,7 +34,7 @@ git fetch -q origin master --tags
 [[ $(git rev-parse HEAD) == $(git rev-parse origin/master) ]] || die "master differs from origin/master"
 ! git rev-parse -q --verify "refs/tags/$version" > /dev/null || die "tag $version exists"
 
-scripts/check.sh
+wait_for_green_ci
 git tag -a "$version" -m "Release $version"
 git push -q origin "$version"
 echo "release: $version tagged. When the Release run in Gitea is green: ssh to the Pi, then"