fix(gatekeeper): enhance logging and stabilize upstream polling

packages/infra/scripts/wait-for-upstream.sh

@@ -28,20 +28,35 @@ echo "🔎 Searching for upstream release $TAG in $REPO..."
 # We look for runs on the specific ref (refs/tags/vX.Y.Z)
 RUN_QUERY=$(curl -s -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/actions/runs?ref=refs/tags/$TAG")
 
-# Gitea returns a list of runs. We take the latest one.
-RUN_ID=$(echo "$RUN_QUERY" | jq -r '.workflow_runs[0].id')
+# Gitea returns a list of runs. We take the latest one by creation date.
+RUN_ID=$(echo "$RUN_QUERY" | jq -r '.workflow_runs | sort_by(.created_at) | last | .id // empty')
 
-if [[ "$RUN_ID" == "null" ]]; then
-  echo "⚠️ Warning: No active run found for tag $TAG in $REPO yet. Upstream might be lagging."
-  echo "   If this is a new tag, it might take a few seconds to appear."
-  # Optional: Wait a bit and try once more before failing
-  sleep 10
-  RUN_QUERY=$(curl -s -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/actions/runs?ref=refs/tags/$TAG")
-  RUN_ID=$(echo "$RUN_QUERY" | jq -r '.workflow_runs[0].id')
+if [[ -z "$RUN_ID" || "$RUN_ID" == "null" ]]; then
+  echo "ℹ️ No recent action run found for tag $TAG in $REPO."
+  echo "🔎 Checking if tag $TAG exists in the repository..."
   
-  if [[ "$RUN_ID" == "null" ]]; then
-     echo "❌ Error: Could not find any action run for $TAG. Proceeding blindly or failing?"
-     # For safety, we fail if we explicitly requested a version that isn't building
+  TAG_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/tags/$TAG")
+  
+  if [[ "$TAG_EXISTS" == "200" ]]; then
+    echo "✅ Tag $TAG exists. Assuming it was released successfully in the past."
+    exit 0
+  fi
+
+  echo "⚠️ Warning: Tag $TAG not found either. Upstream might be lagging or the version is invalid."
+  echo "   Waiting 15s to see if it appears..."
+  sleep 15
+  
+  RUN_QUERY=$(curl -s -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/actions/runs?ref=refs/tags/$TAG")
+  RUN_ID=$(echo "$RUN_QUERY" | jq -r '.workflow_runs[0].id // empty')
+  
+  if [[ -z "$RUN_ID" || "$RUN_ID" == "null" ]]; then
+     # Final check for tag
+     TAG_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/tags/$TAG")
+     if [[ "$TAG_EXISTS" == "200" ]]; then
+       echo "✅ Tag $TAG finally detected. Proceeding."
+       exit 0
+     fi
+     echo "❌ Error: Could not find any action run OR tag for $TAG in $REPO."
      exit 1
   fi
 fi