Merge pull request 'promote: uat → main (tarball grep fix for release workflow)' (#180) from uat into main

Merge PR #180: promote uat → main (tarball grep fix for release workflow)

.github/workflows/dual-approval.yaml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Install dependencies
-        run: apt-get update -qq && apt-get install -y --no-install-recommends curl jq
+        run: apt-get update -qq && apt-get install -y --no-install-recommends ca-certificates curl jq
 
       - name: Check promotion approval
         env:
@@ -28,6 +28,7 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
           BASE_REF: ${{ github.base_ref }}
+          HEAD_REF: ${{ github.head_ref }}
         run: |
           if [ -z "${PR_NUMBER}" ] || [ "${PR_NUMBER}" = "null" ]; then
             echo "::notice::No PR number in context. Skipping promotion gate."
@@ -59,10 +60,7 @@ jobs:
               GATE_NAME="QA"
               # For plugin repos (Pipeline A), UAT approval is needed for uat→main
               # Check if the source branch is uat
-              SOURCE_REF=$(curl -sf \
-                -H "Authorization: token ${GITEA_TOKEN}" \
-                -H "Accept: application/json" \
-                "https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}" | jq -r '.head.ref')
+              SOURCE_REF="${HEAD_REF}"
 
               if [ "${SOURCE_REF}" = "uat" ]; then
                 REQUIRED_REVIEWER="pe_patty"
@@ -113,4 +111,4 @@ jobs:
           else
             echo "Promotion gate failed: waiting for ${GATE_NAME} approval from ${REQUIRED_REVIEWER}."
             exit 1
-          fi
+          fi