feat(ci): auto-update updates.xml on production deploy

After a successful production deployment, the deploy workflow now
automatically updates updates.xml on main with the new version,
release URL, and docker image tag for the stable channel.

Dev deployments skip this step — only production releases update
the stable channel.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.mokogitea/workflows/deploy-mokogitea.yml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version tag (e.g. v1.26.1-moko.04.00.00)'
+        description: 'Version tag (e.g. v1.26.1-moko.05.01.00)'
         required: true
         default: 'latest'
       environment:
@@ -30,6 +30,7 @@ env:
   DEPLOY_HOST: git.mokoconsulting.tech
   DEPLOY_PORT: 2918
   DEPLOY_USER: mokoconsulting
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
   deploy:
@@ -47,15 +48,30 @@ jobs:
             echo "source_dir=/opt/gitea/source" >> $GITHUB_OUTPUT
             echo "branch=main" >> $GITHUB_OUTPUT
             echo "tag=${VERSION}" >> $GITHUB_OUTPUT
+            echo "instance_url=https://git.mokoconsulting.tech" >> $GITHUB_OUTPUT
           else
             echo "compose_dir=/opt/gitea-dev" >> $GITHUB_OUTPUT
             echo "container=mokogitea-dev" >> $GITHUB_OUTPUT
             echo "source_dir=/opt/gitea-dev/source" >> $GITHUB_OUTPUT
             echo "branch=dev" >> $GITHUB_OUTPUT
             echo "tag=${VERSION}-dev" >> $GITHUB_OUTPUT
+            echo "instance_url=https://git.dev.mokoconsulting.tech" >> $GITHUB_OUTPUT
           fi
 
-      - name: Build, push, and deploy via SSH
+      - name: Enable maintenance mode
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          INSTANCE_URL: ${{ steps.config.outputs.instance_url }}
+        run: |
+          echo "Enabling maintenance mode on ${INSTANCE_URL}..."
+          curl -sf -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/x-www-form-urlencoded" \
+            "${INSTANCE_URL}/-/admin/config" \
+            -d 'key=instance.maintenance_mode&value={"AdminWebAccessOnly":true}' \
+            || echo "WARNING: Could not enable maintenance mode (instance may be down)"
+
+      - name: Build and deploy via SSH
         env:
           SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
           TAG: ${{ steps.config.outputs.tag }}
@@ -124,6 +140,92 @@ jobs:
             exit 1
           "
 
+      - name: Update updates.xml
+        if: success()
+        env:
+          GITEA_TOKEN: ${{ secrets.GA_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+          INSTANCE_URL: ${{ steps.config.outputs.instance_url }}
+          DEPLOY_ENV: ${{ github.event.inputs.environment }}
+        run: |
+          # Only update updates.xml for production stable releases
+          if [ "$DEPLOY_ENV" != "production" ]; then
+            echo "Skipping updates.xml — dev deployments don't update stable channel"
+            exit 0
+          fi
+
+          # Extract moko version from tag (e.g. v1.26.1-moko.05.01.01 -> 05.01.01)
+          MOKO_VER=$(echo "$TAG" | sed -n 's/.*-moko\.\(.*\)/\1/p')
+          if [ -z "$MOKO_VER" ]; then
+            echo "Could not extract moko version from tag: $TAG"
+            exit 0
+          fi
+
+          RELEASE_URL="https://${REGISTRY}/MokoConsulting/MokoGitea/releases/tag/${TAG}"
+          DOCKER_IMG="${REGISTRY}/${IMAGE}:${TAG}"
+
+          python3 << PYEOF
+          import json, os, re, base64, urllib.request
+
+          token = os.environ["GITEA_TOKEN"]
+          registry = os.environ["REGISTRY"]
+          tag = os.environ["TAG"]
+          moko_ver = os.environ["MOKO_VER"]
+          release_url = os.environ["RELEASE_URL"]
+          docker_img = os.environ["DOCKER_IMG"]
+          api = f"https://{registry}/api/v1/repos/MokoConsulting/MokoGitea"
+
+          # Fetch current updates.xml
+          req = urllib.request.Request(f"{api}/contents/updates.xml?ref=main",
+              headers={"Authorization": f"token {token}"})
+          with urllib.request.urlopen(req) as resp:
+              data = json.loads(resp.read())
+          sha = data["sha"]
+          content = base64.b64decode(data["content"]).decode("utf-8")
+
+          # Update stable channel version, infourl, and docker tag
+          content = re.sub(
+              r"(<tags><tag>stable</tag></tags>[\s\S]*?<version>)[^<]*(</version>)",
+              rf"\g<1>{moko_ver}\2", content)
+          content = re.sub(
+              r"(<tags><tag>stable</tag></tags>[\s\S]*?<infourl[^>]*>)[^<]*(</infourl>)",
+              rf"\g<1>{release_url}\2", content)
+          content = re.sub(
+              r"(<tags><tag>stable</tag></tags>[\s\S]*?<downloadurl[^>]*>)[^<]*(</downloadurl>)",
+              rf"\g<1>{docker_img}\2", content)
+
+          # Also update VERSION comment at top
+          content = re.sub(r"VERSION: [^\n]*", f"VERSION: {moko_ver}", content)
+
+          # Push updated file
+          encoded = base64.b64encode(content.encode()).decode()
+          payload = json.dumps({
+              "message": f"chore(ci): update updates.xml to {moko_ver}",
+              "content": encoded,
+              "sha": sha,
+              "branch": "main",
+          }).encode()
+          req = urllib.request.Request(f"{api}/contents/updates.xml",
+              data=payload, method="PUT",
+              headers={"Authorization": f"token {token}", "Content-Type": "application/json"})
+          with urllib.request.urlopen(req) as resp:
+              print(f"updates.xml updated to {moko_ver}")
+          PYEOF
+
+      - name: Disable maintenance mode
+        if: always()
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          INSTANCE_URL: ${{ steps.config.outputs.instance_url }}
+        run: |
+          echo "Disabling maintenance mode on ${INSTANCE_URL}..."
+          curl -sf -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/x-www-form-urlencoded" \
+            "${INSTANCE_URL}/-/admin/config" \
+            -d 'key=instance.maintenance_mode&value={"AdminWebAccessOnly":false}' \
+            || echo "WARNING: Could not disable maintenance mode"
+
       - name: Verify
         run: |
           sleep 5