diff --git a/cli/release_publish.php b/cli/release_publish.php
index 73d5b0a..3656ee9 100644
--- a/cli/release_publish.php
+++ b/cli/release_publish.php
@@ -45,6 +45,7 @@ $giteaUrl  = getenv('GITEA_URL') ?: 'https://git.mokoconsulting.tech';
 $org       = getenv('GITEA_ORG') ?: '';
 $repo      = getenv('GITEA_REPO') ?: '';
 $dryRun    = false;
+$repoUrl   = '';
 
 foreach ($argv as $i => $arg) {
     if ($arg === '--path'      && isset($argv[$i + 1])) $path      = $argv[$i + 1];
@@ -55,6 +56,7 @@ foreach ($argv as $i => $arg) {
     if ($arg === '--gitea-url' && isset($argv[$i + 1])) $giteaUrl  = $argv[$i + 1];
     if ($arg === '--org'       && isset($argv[$i + 1])) $org       = $argv[$i + 1];
     if ($arg === '--repo'      && isset($argv[$i + 1])) $repo      = $argv[$i + 1];
+    if ($arg === '--repo-url'  && isset($argv[$i + 1])) $repoUrl   = $argv[$i + 1];
     if ($arg === '--dry-run') $dryRun = true;
 }
 
@@ -76,6 +78,12 @@ if (empty($org) || empty($repo)) {
     }
 }
 
+// Auto-construct repo URL for git auth if not provided
+if (empty($repoUrl) && !empty($token) && !empty($org) && !empty($repo)) {
+    $host = preg_replace('#^https?://#', '', $giteaUrl);
+    $repoUrl = "https://x-access-token:{$token}@{$host}/{$org}/{$repo}.git";
+}
+
 // Auto-detect branch
 if (empty($branch)) {
     $branch = getenv('GITHUB_REF_NAME') ?: trim((string) @shell_exec("cd " . escapeshellarg($path) . " && git rev-parse --abbrev-ref HEAD 2>/dev/null"));
@@ -144,6 +152,35 @@ if (!$dryRun) {
 $releaseVersion = $baseVersion . $suffixMap[$stability];
 echo "Release version: {$releaseVersion}\n";
 
+// -- Step 2b: Update badges and changelog --
+if (!$dryRun) {
+    passthru("{$php} {$cli}/badge_update.php --path " . escapeshellarg($path) . " --version " . escapeshellarg($baseVersion) . " 2>/dev/null");
+
+    $changelogFile = realpath($path) . '/CHANGELOG.md';
+    if (file_exists($changelogFile)) {
+        passthru("{$php} {$cli}/changelog_promote.php --path " . escapeshellarg($path) . " --version " . escapeshellarg($baseVersion) . " 2>/dev/null");
+        passthru("{$php} {$cli}/changelog_prune.php --path " . escapeshellarg($path) . " --keep 5 2>/dev/null");
+    }
+}
+
+// -- Step 2c: Commit version changes before building --
+$root = realpath($path) ?: $path;
+if (!$dryRun) {
+    $diffCheck = trim((string) @shell_exec("cd " . escapeshellarg($root) . " && git diff --quiet && git diff --cached --quiet 2>&1 && echo clean || echo dirty"));
+    if ($diffCheck === 'dirty') {
+        @shell_exec("cd " . escapeshellarg($root) . " && git config --local user.email \"gitea-actions[bot]@mokoconsulting.tech\"");
+        @shell_exec("cd " . escapeshellarg($root) . " && git config --local user.name \"gitea-actions[bot]\"");
+        if (!empty($repoUrl)) {
+            @shell_exec("cd " . escapeshellarg($root) . " && git remote set-url origin " . escapeshellarg($repoUrl));
+        }
+        @shell_exec("cd " . escapeshellarg($root) . " && git add -A");
+        @shell_exec("cd " . escapeshellarg($root) . " && git commit -m " . escapeshellarg("chore(release): build {$releaseVersion} [skip ci]")
+            . " --author=\"gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>\"");
+        @shell_exec("cd " . escapeshellarg($root) . " && git push origin HEAD:refs/heads/" . escapeshellarg($branch) . " 2>&1");
+        echo "  Committed release changes\n";
+    }
+}
+
 // -- Step 3: Build release package --
 echo "\n--- Step 3: Build and upload release ---\n";
 $releaseTag = $releaseTagMap[$stability];