fix(ci): upgrade upstream verification logic to klz-2026 standard

.gitea/workflows/deploy.yml

@@ -105,17 +105,32 @@ jobs:
             if [[ "${{ github.ref_type }}" == "tag" ]]; then
               echo "🔎 Checking for @mintel dependencies in package.json..."
               # Extract any @mintel/ version (they should be synced in monorepo)
-              UPSTREAM_VERSION=$(grep -o '"@mintel/.*": "[^"]*"' package.json | head -1 | cut -d'"' -f4 | sed 's/\^//; s/\~//')
+              UPSTREAM_VERSION=$(grep -o '"@mintel/.*": "[^"]*"' package.json | grep -v "next-utils" | cut -d'"' -f4 | sed 's/\^//; s/\~//' | sort -V | tail -1)
               TAG_TO_WAIT="v$UPSTREAM_VERSION"
               
               if [[ -n "$UPSTREAM_VERSION" && "$UPSTREAM_VERSION" != "workspace:"* ]]; then
-                echo "⏳ This release depends on @mintel v$UPSTREAM_VERSION. Waiting for upstream build..."
-                # Fetch script from monorepo (main)
-                curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-                  "https://git.infra.mintel.me/mmintel/at-mintel/raw/branch/main/packages/infra/scripts/wait-for-upstream.sh" > wait-for-upstream.sh
-                chmod +x wait-for-upstream.sh
+                # 1. Discovery (Works without token for public repositories)
+                UPSTREAM_SHA=$(git ls-remote --tags https://git.infra.mintel.me/mmintel/at-mintel.git "$TAG_TO_WAIT" | grep "$TAG_TO_WAIT" | tail -n1 | awk '{print $1}')
                 
-                GITEA_TOKEN=${{ secrets.GITHUB_TOKEN }} ./wait-for-upstream.sh "mmintel/at-mintel" "$TAG_TO_WAIT"
+                if [[ -z "$UPSTREAM_SHA" ]]; then
+                  echo "❌ Error: Tag $TAG_TO_WAIT not found in mmintel/at-mintel."
+                  exit 1
+                fi
+                echo "✅ Tag verified: Found upstream SHA $UPSTREAM_SHA for $TAG_TO_WAIT"
+
+                # 2. Status Check (Requires PAT for cross-repo API access)
+                POLL_TOKEN="${{ secrets.GITEA_PAT || secrets.MINTEL_PRIVATE_TOKEN }}"
+                
+                if [[ -n "$POLL_TOKEN" ]]; then
+                  echo "⏳ POLL_TOKEN found. Checking upstream build status..."
+                  curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+                    "https://git.infra.mintel.me/mmintel/at-mintel/raw/branch/main/packages/infra/scripts/wait-for-upstream.sh" > wait-for-upstream.sh
+                  chmod +x wait-for-upstream.sh
+                  GITEA_TOKEN="$POLL_TOKEN" ./wait-for-upstream.sh "mmintel/at-mintel" "$TAG_TO_WAIT"
+                else
+                  echo "ℹ️ No PAT secret found. Skipping build status wait (Actions API is restricted)."
+                  echo "   If this build fails, ensure that mmintel/at-mintel $TAG_TO_WAIT has finished its Docker build."
+                fi
               fi
             fi
           else