release v1.1.2 [skip ci]

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.5.12` → `5.6.0`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.5.12/5.6.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.6.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.5.12/5.6.0?slim=true) |

---

### Release Notes

<details>
<summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary>

### [`v5.6.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.6.0): use @&#8203;nodable/entities to replace entities

[Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.12...v5.6.0)

- No API change
- No change in performance for basic usage
- No typing change
- No config change
- new dependency
- breaking: error messages for entities might have been changed.
-

**Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.12...v5.6.0>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEyMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: #28
Co-authored-by: Renovate Bot <renovate@keligrubb.com>
Co-committed-by: Renovate Bot <renovate@keligrubb.com>

.gitea/workflows/pr.yml

@@ -79,7 +79,14 @@ jobs:
 
       - name: Build (dry run)
         uses: https://git.keligrubb.com/actions/docker-build-push-action@v7
+        env:
+          # Keeps GITHUB_OUTPUT small; Gitea act-runner can choke on multiline
+          # outputs when PR webhook payloads (e.g. Renovate bodies) are huge.
+          DOCKER_BUILD_SUMMARY: "false"
+          DOCKER_BUILD_RECORD_UPLOAD: "false"
         with:
           context: .
           push: false
+          provenance: false
+          sbom: false
           tags: ${{ steps.image.outputs.tag }}

.gitea/workflows/push.yml

@@ -5,13 +5,25 @@ on:
     branches: [main]
 
 jobs:
-  release-docker-helm:
+  release:
     runs-on: ubuntu-latest
     steps:
       - uses: https://git.keligrubb.com/actions/checkout@v6
         with:
           token: ${{ secrets.KESTRELOS_REPO_TOKEN }}
 
+      - name: Get PR description for changelog
+        env:
+          GITEA_REPO_TOKEN: ${{ secrets.KESTRELOS_REPO_TOKEN }}
+        run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft*.list /etc/apt/sources.list.d/azure*.list 2>/dev/null || true
+          sudo apt-get update -qq && sudo apt-get install -y -qq jq
+          RESP=$(curl -sf -H "Authorization: token $GITEA_REPO_TOKEN" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/commits/${{ github.sha }}/pull") || true
+          if [ -n "$RESP" ]; then
+            echo "$RESP" | jq -r '.body // empty' > .ci_pr_body 2>/dev/null || true
+          fi
+
       - name: Release (bump, tag, push, create release)
         env:
           CI_REPO_OWNER: ${{ github.actor }}
@@ -20,9 +32,19 @@ jobs:
           CI_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
           GITEA_REPO_TOKEN: ${{ secrets.KESTRELOS_REPO_TOKEN }}
         run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft*.list /etc/apt/sources.list.d/azure*.list 2>/dev/null || true
           sudo apt-get update -qq && sudo apt-get install -y -qq git wget
           ./scripts/release.sh
 
+  publish:
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://git.keligrubb.com/actions/checkout@v6
+        with:
+          ref: main
+          token: ${{ secrets.KESTRELOS_REPO_TOKEN }}
+
       - name: Log in to container registry
         uses: https://git.keligrubb.com/actions/docker-login-action@v4
         with:
@@ -40,14 +62,19 @@ jobs:
           load: true
           tags: kestrelos:built
 
-      - name: Push Docker image (all tags from .tags)
+      - name: Push Docker image (version + latest)
         run: |
+          VERSION=$(awk '/"version"/ { match($0, /[0-9]+\.[0-9]+\.[0-9]+/); print substr($0, RSTART, RLENGTH); exit }' package.json)
+          case "$VERSION" in
+            [0-9]*.[0-9]*.[0-9]*) ;;
+            *) echo "error: package.json version must be x.y.z (got: $VERSION)"; exit 1 ;;
+          esac
           REGISTRY="git.keligrubb.com"
           IMAGE="$REGISTRY/${{ github.repository }}"
-          while read -r tag; do
+          for tag in "$VERSION" latest; do
             docker tag kestrelos:built "$IMAGE:$tag"
             docker push "$IMAGE:$tag"
-          done < .tags
+          done
 
       - name: Set up Helm
         uses: https://git.keligrubb.com/actions/setup-helm@v5

CHANGELOG.md

@@ -1,3 +1,72 @@
+## [1.1.2] - 2026-04-15
+### Changed
+- Update dependency fast-xml-parser to v5.6.0 (#28)
+
+This PR contains the following updates:
+
+| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
+|---|---|---|---|
+| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.5.12` → `5.6.0`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.5.12/5.6.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.6.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.5.12/5.6.0?slim=true) |
+
+---
+
+### Release Notes
+
+<details>
+<summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary>
+
+### [`v5.6.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.6.0): use @&#8203;nodable/entities to replace entities
+
+[Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.12...v5.6.0)
+
+- No API change
+- No change in performance for basic usage
+- No typing change
+- No config change
+- new dependency
+- breaking: error messages for entities might have been changed.
+-
+
+**Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.12...v5.6.0>
+
+</details>
+
+---
+
+### Configuration
+
+📅 **Schedule**: (UTC)
+
+- Branch creation
+  - At any time (no schedule defined)
+- Automerge
+  - At any time (no schedule defined)
+
+🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
+
+♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
+
+🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
+
+---
+
+ - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
+
+---
+
+This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
+<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEyMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
+
+## [1.1.1] - 2026-04-15
+### Changed
+- split push release/publish and harden workflows (#27)
+
+### Added
+* Separate release from Docker/Helm publish
+* enrich releases with PRbodies when available
+* tighten release.sh validation and idempotency
+* trim PR docker-build metadata for act-runner stability
+
 ## [1.1.0] - 2026-04-15
 ### Changed
 - Update all non-major dependencies (#25)

helm/kestrelos/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: kestrelos
 description: KestrelOS TOC for OSINT feeds - map, camera feeds, offline tiles
 type: application
-version: 1.1.0
+version: 1.1.2
-appVersion: "1.1.0"
+appVersion: "1.1.2"

helm/kestrelos/values.yaml

@@ -2,7 +2,7 @@ replicaCount: 1
 
 image:
   repository: git.keligrubb.com/keligrubb/kestrelos
-  tag: 1.1.0
+  tag: 1.1.2
   pullPolicy: IfNotPresent
 
 service:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "kestrelos",
-  "version": "1.0.9",
+  "version": "1.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "kestrelos",
-      "version": "1.0.9",
+      "version": "1.1.1",
       "hasInstallScript": true,
       "dependencies": {
         "@nuxt/icon": "^2.2.1",
@@ -1560,6 +1560,18 @@
         "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
+    "node_modules/@nodable/entities": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-1.1.0.tgz",
+      "integrity": "sha512-bidpxmTBP0pOsxULw6XlxzQpTgrAGLDHGBK/JuWhPDL6ZV0GZ/PmN9CA9do6e+A9lYI6qx6ikJUtJYRxup141g==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodable"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -8532,9 +8544,9 @@
       }
     },
     "node_modules/fast-xml-parser": {
-      "version": "5.5.12",
+      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.12.tgz",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.6.0.tgz",
-      "integrity": "sha512-nUR0q8PPfoA/svPM43Gup7vLOZWppaNrYgGmrVqrAVJa7cOH4hMG6FX9M4mQ8dZA1/ObGZHzES7Ed88hxEBSJg==",
+      "integrity": "sha512-5G+uaEBbOm9M4dgMOV3K/rBzfUNGqGqoUTaYJM3hBwM8t71w07gxLQZoTsjkY8FtfjabqgQHEkeIySBDYeBmJw==",
       "funding": [
         {
           "type": "github",
@@ -8543,6 +8555,7 @@
       ],
       "license": "MIT",
       "dependencies": {
+        "@nodable/entities": "^1.1.0",
         "fast-xml-builder": "^1.1.4",
         "path-expression-matcher": "^1.5.0",
         "strnum": "^2.2.3"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "kestrelos",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "private": true,
   "type": "module",
   "scripts": {

scripts/release.sh

@@ -20,10 +20,18 @@ echo "$msg" | grep -Eqi '(^|[[:space:]])[a-zA-Z]+(\([^)]*\))?!:' && bump=major
 echo "$msg" | grep -qi minor: && [ "$bump" != "major" ] && bump=minor
 echo "$msg" | grep -qi major: && bump=major
 cur=$(awk '/"version"/ { match($0, /[0-9]+\.[0-9]+\.[0-9]+/); print substr($0, RSTART, RLENGTH); exit }' package.json)
+case "$cur" in
+  [0-9]*.[0-9]*.[0-9]*) ;;
+  *) echo "error: package.json version must be x.y.z (got: $cur)"; exit 1 ;;
+esac
 major=$(echo "$cur" | cut -d. -f1); minor=$(echo "$cur" | cut -d. -f2); patch=$(echo "$cur" | cut -d. -f3)
 case "$bump" in major) major=$((major+1)); minor=0; patch=0 ;; minor) minor=$((minor+1)); patch=0 ;; patch) patch=$((patch+1)) ;; esac
 newVersion="$major.$minor.$patch"
-[ -z "$cur" ] && { echo "error: could not read version from package.json"; exit 1; }
+
+url="https://${CI_REPO_OWNER}:${GITEA_REPO_TOKEN}@${CI_FORGE_URL#https://}/${CI_REPO_OWNER}/${CI_REPO_NAME}.git"
+if [ -n "$(git ls-remote "$url" "refs/tags/v$newVersion" 2>/dev/null)" ]; then
+  exit 0
+fi
 
 # changelog entry (strip explicit bump prefixes & any conventional-commit type(scope):); optional PR description enriches it
 changelogEntry=$(
@@ -59,7 +67,6 @@ $changelogFull
 git config user.email "ci@kestrelos" && git config user.name "CI"
 git add package.json helm/kestrelos/Chart.yaml helm/kestrelos/values.yaml CHANGELOG.md
 git commit -m "release v$newVersion [skip ci]"
-url="https://${CI_REPO_OWNER}:${GITEA_REPO_TOKEN}@${CI_FORGE_URL#https://}/${CI_REPO_OWNER}/${CI_REPO_NAME}.git"
 git tag "v$newVersion"
 # artifact for docker (tag list)
 printf '%s\n%s\n' "$newVersion" "latest" > .tags