fix(ci): pass Go image tag from build to gitops via artifact

github.event.workflow_run.head_branch is not populated for tag pushes
in Gitea Actions, causing the image tag to resolve to empty (-go suffix
with no version). Fix: build-go uploads the full image reference as a
one-line artifact; gitops-update downloads it via download-artifact@v4
with run-id from the workflow_run event.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -63,3 +63,11 @@ jobs:
             --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
             -t $IMAGE go/
           docker push $IMAGE
+          echo "$IMAGE" > /tmp/go-image-tag.txt
+
+      - name: Upload Go image tag for gitops workflow
+        uses: actions/upload-artifact@v4
+        with:
+          name: go-image-tag
+          path: /tmp/go-image-tag.txt
+          retention-days: 1

.gitea/workflows/gitops-update.yaml

@@ -58,23 +58,34 @@ jobs:
             -o /usr/local/bin/uh-cli
           chmod +x /usr/local/bin/uh-cli
 
+      - name: Download image tag artifact (workflow_run trigger)
+        if: github.event_name == 'workflow_run'
+        uses: actions/download-artifact@v4
+        with:
+          name: go-image-tag
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Resolve image tag
         id: resolve
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            GIT_TAG="${{ inputs.tag }}"
+            IMAGE="gitea.home.hrajfrisbee.cz/${{ github.repository }}:${{ inputs.tag }}-go"
           else
-            # workflow_run: use the ref name of the triggering workflow (the pushed git tag).
-            GIT_TAG="${{ github.event.workflow_run.head_branch }}"
+            IMAGE="$(cat go-image-tag.txt)"
           fi
-          IMAGE="gitea.home.hrajfrisbee.cz/${{ github.repository }}:${GIT_TAG}-go"
           echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
           echo "Resolved image: ${IMAGE}"
 
-      - name: Configure git identity
+      - name: Configure git identity and credentials
         run: |
           git config --global user.name  "uh-cli bot"
           git config --global user.email "bot@hrajfrisbee.cz"
+          # Store credentials separately so the --git-repo URL stays clean.
+          # Tea matches the login URL against the remote URL; embedded credentials
+          # break that matching and cause "path segment [0] is empty" on pr create.
+          git config --global credential.helper store
+          echo "https://kacerr:${GITEA_TOKEN}@gitea.home.hrajfrisbee.cz" >> ~/.git-credentials
 
       - name: Authenticate tea
         run: |
@@ -85,10 +96,11 @@ jobs:
 
       - name: Open image-update PR (or dry run)
         run: |
+          set -x
           uh-cli -v gitops deployment update \
             --deployment-name fuj-management \
             --deployment-namespace fuj \
             --set-image "${{ steps.resolve.outputs.image }}" \
-            --git-repo "https://kacerr:${GITEA_TOKEN}@gitea.home.hrajfrisbee.cz/kacerr/home-kubernetes" \
+            --git-repo "https://gitea.home.hrajfrisbee.cz/kacerr/home-kubernetes" \
             --git-path gitops/home-kubernetes \
             ${{ (github.event_name == 'workflow_dispatch' && inputs.dry_run == 'true') && '--dry-run' || '' }}

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026-06-12 19:32 CEST — feat(ci): gitops image-update PR workflow
+
+- Added `.gitea/workflows/gitops-update.yaml`: after each successful Go image build, `uh-cli gitops deployment update` opens a PR in `kacerr/home-kubernetes` bumping the `fuj-management` Deployment (namespace `fuj`) to the new image tag.
+- Supports `workflow_run` auto-trigger and `workflow_dispatch` with `dry_run` / `uh_cli_version` inputs.
+- Requires `GITOPS_TOKEN` repo secret (Gitea PAT with write+PR access to `home-kubernetes`).
+
 ## 2026-05-24 21:58 CEST — feat(fees): update adult monthly rates for 2026-05 through 2026-08
 
 - 2026-05: 700 → 450 CZK; 2026-06/07/08: 600 CZK (new months added).