f54795f34f
The CI builds a non-reproducible tarball after the tag is created, then updates artifacthub-pkg.yml on main with the correct checksum. But Artifact Hub reads from the tag ref, not main, so it sees the stale checksum and Headlamp rejects the plugin with "Checksum mismatch". Changes: - Add guard step: if the GitHub release tarball checksum already matches the metadata in the current commit, skip the entire build (prevents infinite retrigger loop) - After updating metadata on main, force-move the tag to that commit so AH reads the correct checksum - Push main + tag directly to GitHub to avoid mirror sync delay - Replace akkuman/gitea-release-action with curl-based approach so all steps use the same shell guard pattern Release flow: tag push -> build -> publish releases -> update metadata on main -> force-move tag -> (retriggered run hits guard -> exits) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>