ci: Open bump PRs instead of pushing protected master

Nightly update.yml rewrote PKGBUILD then failed with pre-receive hook
declined on protected master and tags. Push chore/bump-$pkgver and open
(or reuse) a PR instead. After merge, tag-release.yml creates v$pkgver
so build.yml still attaches the package.

.gitea/workflows/tag-release.yml

@@ -0,0 +1,58 @@
+name: Tag release after merge
+on:
+  push:
+    branches: ['master']
+  workflow_dispatch:
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+      - name: Create v$pkgver tag if missing
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_REF:-}" != "refs/heads/master" ]]; then
+            echo "error: refusing to tag from ${GITHUB_REF:-unset}; only master" >&2
+            exit 1
+          fi
+          pkgver=$(sed -n 's/^pkgver=//p' PKGBUILD | head -1)
+          if [[ -z "$pkgver" ]]; then
+            echo "error: could not read pkgver from PKGBUILD" >&2
+            exit 1
+          fi
+          if [[ ! "$pkgver" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z]+)*$ ]]; then
+            echo "error: PKGBUILD pkgver looks wrong: $pkgver" >&2
+            exit 1
+          fi
+          if [[ -z "${GITHUB_SHA:-}" ]]; then
+            echo "error: GITHUB_SHA is empty; cannot tag v${pkgver}" >&2
+            exit 1
+          fi
+          tag="v${pkgver}"
+          existing=$(git ls-remote --tags origin "refs/tags/${tag}")
+          if [[ -n "$existing" ]]; then
+            echo "Tag ${tag} already exists; nothing to do"
+            exit 0
+          fi
+          if [[ -z "${GITEA_TOKEN:-}" ]]; then
+            echo "error: GITEA_TOKEN is empty; cannot push tag ${tag}" >&2
+            exit 1
+          fi
+          git tag "${tag}" "${GITHUB_SHA}"
+          if git push origin "refs/tags/${tag}"; then
+            echo "Pushed tag ${tag} -> ${GITHUB_SHA}"
+            exit 0
+          fi
+          existing=$(git ls-remote --tags origin "refs/tags/${tag}")
+          if [[ -n "$existing" ]]; then
+            echo "Tag ${tag} appeared concurrently; nothing to do"
+            exit 0
+          fi
+          echo "error: could not push tag ${tag} for ${GITHUB_SHA}." >&2
+          echo "error: Manual path: git tag ${tag} && git push origin ${tag} so build.yml can attach the release asset." >&2
+          exit 1

.gitea/workflows/update.yml

@@ -10,6 +10,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Bump PKGBUILD if a new version is out
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
           set -euo pipefail
           sudo apt-get update -qq
@@ -17,9 +19,9 @@ jobs:
           for cmd in jq curl python3; do
             command -v "$cmd" >/dev/null || { echo "error: missing $cmd" >&2; exit 1; }
           done
-          before=$(sed -n 's/^pkgver=//p' PKGBUILD)
+          before=$(sed -n 's/^pkgver=//p' PKGBUILD | head -1)
           ./scripts/update.sh
-          after=$(sed -n 's/^pkgver=//p' PKGBUILD)
+          after=$(sed -n 's/^pkgver=//p' PKGBUILD | head -1)
           if [[ -z "$after" ]]; then
             echo "error: could not read pkgver after update.sh" >&2
             exit 1
@@ -28,15 +30,95 @@ jobs:
             echo "No bump (still $after)"
             exit 0
           fi
+          if [[ -z "${GITEA_TOKEN:-}" ]]; then
+            echo "error: GITEA_TOKEN is empty; cannot open or reuse bump PR" >&2
+            exit 1
+          fi
+          if [[ -z "${GITHUB_REPOSITORY:-}" ]]; then
+            echo "error: GITHUB_REPOSITORY is empty; cannot open or reuse bump PR" >&2
+            exit 1
+          fi
           git config user.name 'eva'
           git config user.email 's1d3sw1ped+eva@gmail.com'
           git add PKGBUILD .SRCINFO
           git commit -m "pkgbuild: Bump grok-bot-bin to ${after}"
-          git tag "v${after}"
-          # Proven on this forge: run 1190 pushed master + tag v0.35.0.
-          # Still fail the job if push is denied rather than reporting a landed bump.
-          if ! git push origin "HEAD:${GITHUB_REF_NAME}" "v${after}"; then
-            echo "error: could not push commit/tag to ${GITHUB_REF_NAME} (v${after})." >&2
-            echo "error: Manual path: ./scripts/update.sh, commit, PR/merge, then tag v${after} and push the tag so build.yml can attach the release asset." >&2
+          # Do not tag here and do not push protected master. Open a bump PR;
+          # tag-release.yml creates v$pkgver after merge so build.yml can run.
+          branch="chore/bump-${after}"
+          git fetch origin "refs/heads/${branch}:refs/remotes/origin/${branch}" || \
+            echo "note: ${branch} not on origin yet (creating)"
+          if ! git push --force-with-lease origin "HEAD:refs/heads/${branch}"; then
+            echo "error: could not push ${branch} (pkgver ${after})." >&2
+            echo "error: Manual path: commit PKGBUILD+.SRCINFO, open a PR to master, merge, then let tag-release.yml create v${after} (or push that tag yourself)." >&2
             exit 1
           fi
+          api="${GITHUB_API_URL:-https://git.s1d3sw1ped.com/api/v1}"
+          repo="${GITHUB_REPOSITORY}"
+          title="pkgbuild: Bump grok-bot-bin to ${after}"
+          body=$(printf '%s\n' \
+            "Automated PKGBUILD bump from Cursor's linux-x64 feed (${before} → ${after})." \
+            "" \
+            "This job does not create a git tag. After this PR merges to master, tag-release.yml should create \`v${after}\` so build.yml can attach the \`.pkg.tar.zst\`.")
+          find_pr() {
+            local prs
+            if ! prs=$(curl -fsS -H "Authorization: token ${GITEA_TOKEN}" \
+              "${api}/repos/${repo}/pulls?state=open&limit=50"); then
+              echo "error: could not list open pull requests for ${repo}" >&2
+              return 1
+            fi
+            if ! jq -e 'type == "array"' >/dev/null <<<"$prs"; then
+              echo "error: unexpected pulls list response for ${repo}" >&2
+              printf '%s\n' "$prs" >&2
+              return 1
+            fi
+            jq -r --arg h "$branch" \
+              '[.[] | select(.base.ref == "master" and (.head.ref == $h or ((.head.label // "") | endswith(":" + $h)))) | (.html_url // .url)] | .[0] // empty' \
+              <<<"$prs"
+          }
+          existing=$(find_pr) || {
+            echo "error: could not look up existing PR for ${branch} → master" >&2
+            exit 1
+          }
+          if [[ -n "$existing" ]]; then
+            echo "Reusing existing PR: ${existing}"
+            exit 0
+          fi
+          payload=$(jq -n \
+            --arg title "$title" \
+            --arg body "$body" \
+            --arg head "$branch" \
+            --arg base "master" \
+            '{title:$title, body:$body, head:$head, base:$base}')
+          tmp=$(mktemp)
+          trap 'rm -f "$tmp"' EXIT
+          set +e
+          code=$(curl -sS -o "$tmp" -w '%{http_code}' -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$payload" \
+            "${api}/repos/${repo}/pulls")
+          curl_ec=$?
+          set -e
+          if [[ $curl_ec -ne 0 ]]; then
+            echo "error: curl failed creating PR ${branch} → master (exit ${curl_ec})" >&2
+            exit 1
+          fi
+          if [[ "$code" == "201" ]]; then
+            pr_url=$(jq -r '.html_url // .url // empty' "$tmp")
+            echo "Opened PR: ${pr_url:-created (${branch} → master)}"
+            exit 0
+          fi
+          if [[ "$code" == "409" || "$code" == "422" ]]; then
+            existing=$(find_pr) || {
+              echo "error: PR create returned HTTP ${code} but looking up existing PR failed" >&2
+              cat "$tmp" >&2 || true
+              exit 1
+            }
+            if [[ -n "$existing" ]]; then
+              echo "Reusing existing PR: ${existing}"
+              exit 0
+            fi
+          fi
+          echo "error: could not open or reuse PR ${branch} → master (HTTP ${code})" >&2
+          cat "$tmp" >&2 || true
+          exit 1