fix: Detect and recreate incorrectly ordered releases (#148)

[arunavo4]

This fix addresses the persistent release ordering issue by detecting when existing releases in Gitea are in the wrong chronological order and automatically deleting and recreating them in the correct order.

Root Cause:

• Gitea ALWAYS sorts releases by created_unix DESC, id DESC
• The Gitea API provides NO way to set created_unix when creating releases
• Previous fix (PR fix: Ensure proper release ordering in Gitea mirrors (#129) #146) only worked for NEW releases, not UPDATES
• When releases are UPDATED, their created_unix timestamp doesn't change
• So releases created in wrong order initially stayed wrong forever

Solution:
Before processing releases, the code now:

1. Fetches all existing releases from Gitea
2. Checks if they're in correct chronological order
3. If order is wrong: deletes all releases and recreates them in correct order
4. If order is correct: proceeds with normal update logic

How it works:

• Maps each release to its expected chronological index (0=oldest, n=newest)
• Checks if Gitea's releases (sorted by created_unix DESC) match expected order
• Detects mis-ordering by comparing adjacent releases
• Logs detailed information about ordering issues found
• Deletes and recreates only when necessary (optimized)

User Impact:

• Users who mirrored repos BEFORE PR fix: Ensure proper release ordering in Gitea mirrors (#129) #146: ordering will be fixed on next mirror
• First-time mirrors: work correctly (as before)
• Subsequent mirrors: verify order and fix if needed
• No manual intervention required

Fixes #148
Related: #129, PR #146

[cloudflare-workers-and-pages]

Deploying gitea-mirror-website with    Cloudflare Pages

Latest commit:	e951e97
Status:	✅  Deploy successful!
Preview URL:	https://95db9e2a.gitea-mirror-website.pages.dev
Branch Preview URL:	https://148-release-order-again.gitea-mirror-website.pages.dev

View logs

[github-actions]

🐳 Docker Image Built Successfully

Your PR image is available for testing:

Image Tag: pr-150
Full Image Path: ghcr.io/raylabshq/gitea-mirror:pr-150

Pull and Test

docker pull ghcr.io/raylabshq/gitea-mirror:pr-150
docker run -d   -p 4321:4321   -e BETTER_AUTH_SECRET=your-secret-here   -e BETTER_AUTH_URL=http://localhost:4321   --name gitea-mirror-test ghcr.io/raylabshq/gitea-mirror:pr-150

Docker Compose Testing

services:
  gitea-mirror:
    image: ghcr.io/raylabshq/gitea-mirror:pr-150
    ports:
      - "4321:4321"
    environment:
      - BETTER_AUTH_SECRET=your-secret-here
      - BETTER_AUTH_URL=http://localhost:4321
      - BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:4321

💡 Note: PR images are tagged as pr-<number> and built for both linux/amd64 and linux/arm64.
Production images (latest, version tags) use the same multi-platform set.

---

📦 View in GitHub Packages

[github-actions]

🔍 Vulnerabilities of gitea-mirror:scan

📦 Image Reference gitea-mirror:scan

digest	sha256:59c565290e58b2279439c808a88bdbd30778684cca591f33e1c2adeba250a8f8
vulnerabilities
platform	linux/amd64
size	304 MB
packages	894

📦 Base Image alpine:3.20

also known as	3.20.8 7723689796d2bbfe038446faac416211f2eb48871669de9e7d0196db78c44ce1
digest	sha256:008827ed2172a676b08121e21cf9db0ce08a90ee6c8a12fc374af8a56c0e496d
vulnerabilities

stdlib 1.23.12 (golang) pkg:golang/[email protected] Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.075% EPSS Percentile 23rd percentile Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.033% EPSS Percentile 9th percentile Description Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.017% EPSS Percentile 3rd percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

sqlite 3.45.3-r2 (apk) pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.20 Affected range <=3.45.3-r2 Fixed version Not Fixed EPSS Score 0.037% EPSS Percentile 11th percentile Description

[github-actions]

Recommended fixes for local gitea-mirror:scan

Base image is alpine:3.20

Name	3.20.8
Digest	sha256:008827ed2172a676b08121e21cf9db0ce08a90ee6c8a12fc374af8a56c0e496d
Vulnerabilities
Pushed	1 month ago
Size	3.6 MB
Packages	17
OS	3.20.8

The base image is also available under the supported tag(s): 3.20.8

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
3.21 Tag is preferred tag Also known as: 3.21.5	Benefits: Minor OS version update Tag is preferred tag Image has similar size Image has same number of vulnerabilities Image details: Size: 3.6 MB OS: 3.21.5	1 month ago
3.22 Tag is latest Also known as: 3.22.2 3 latest	Benefits: Minor OS version update Image has similar size Tag is latest Image has same number of vulnerabilities Image details: Size: 3.8 MB OS: 3.22.2	1 month ago

[github-actions]

Overview

Image reference	ghcr.io/raylabshq/gitea-mirror:latest	gitea-mirror:scan
- digest	ff33ec441f32	59c565290e58
- tag	latest	scan
- provenance	e951e97	oven-sh/bun@89fa0f3
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	262 MB	304 MB (+42 MB)
- packages	894	894
Base Image	alpine:3.20 also known as: • 3.20.8	alpine:3.20 also known as: • 3.20.8
- vulnerabilities

Labels (8 changes)

• ± 8 changed

-org.opencontainers.image.created=2025-11-08T03:30:50.796Z
+org.opencontainers.image.created=2025-10-22T07:56:38.047Z
-org.opencontainers.image.description=Gitea Mirror auto-syncs GitHub repos to your self-hosted Gitea/Forgejo, with a sleek Web UI and easy Docker deployment.
+org.opencontainers.image.description=Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one
-org.opencontainers.image.licenses=AGPL-3.0
+org.opencontainers.image.licenses=NOASSERTION
-org.opencontainers.image.revision=e951e97790efb8fcee4c1852479a11520dfa607b
+org.opencontainers.image.revision=89fa0f343945e61d5e4a0077cc7e93a802ed56e7
-org.opencontainers.image.source=https://github.com/RayLabsHQ/gitea-mirror
+org.opencontainers.image.source=https://github.com/oven-sh/bun
-org.opencontainers.image.title=gitea-mirror
+org.opencontainers.image.title=bun
-org.opencontainers.image.url=https://github.com/RayLabsHQ/gitea-mirror
+org.opencontainers.image.url=https://github.com/oven-sh/bun
-org.opencontainers.image.version=pr-150
+org.opencontainers.image.version=1.3.1-alpine