fix(workflows): prefer caller tag in do-release resolution

Handle Teacup workflow_call input forwarding gaps by using needs.prepare.outputs.tag as a fallback and normalizing %touch docker-compose.yml(string=...) wrappers before selecting the release tag.

.gitea/workflows/do-release.yml

@@ -59,16 +59,40 @@ jobs:
         id: resolve-version
         env:
           INPUT_TAG: ${{ inputs.tag }}
+          CALLER_TAG: ${{ needs.prepare.outputs.tag }}
           DETECTED_TAG: ${{ steps.detect-tag.outputs.detected_tag }}
         run: |
           set -euo pipefail
 
-          # Try to use explicit input first
-          requested_tag="$(printf '%s' "${INPUT_TAG}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
+          normalize_candidate() {
+            local raw="$1"
+
+            raw="$(printf '%s' "$raw" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
+
+            # Teacup can surface expression strings as %!t(string=value); unwrap it.
+            if [[ "$raw" =~ ^%\!t\(string=(.*)\)$ ]]; then
+              raw="${BASH_REMATCH[1]}"
+            fi
+
+            raw="$(printf '%s' "$raw" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
+            printf '%s' "$raw"
+          }
+
+          input_tag="$(normalize_candidate "${INPUT_TAG}")"
+          caller_tag="$(normalize_candidate "${CALLER_TAG}")"
+          detected_tag="$(normalize_candidate "${DETECTED_TAG}")"
+
+          # Try explicit input first.
+          requested_tag="$input_tag"
+
+          # Fall back to caller workflow output when workflow_call input forwarding is unreliable.
+          if [[ -z "$requested_tag" && -n "$caller_tag" ]]; then
+            requested_tag="$caller_tag"
+          fi
           
-          # Fall back to detected tag if input is empty
-          if [[ -z "$requested_tag" && -n "${DETECTED_TAG}" ]]; then
-            requested_tag="$DETECTED_TAG"
+          # Fall back to detected tag if neither input nor caller tag is available.
+          if [[ -z "$requested_tag" && -n "$detected_tag" ]]; then
+            requested_tag="$detected_tag"
           fi
           
           # Try GITHUB_REF if still empty
@@ -82,8 +106,9 @@ jobs:
             tag="v${normalized}"
           else
             echo "Error: Could not resolve release version" >&2
-            echo "  - inputs.tag: '$INPUT_TAG'" >&2
-            echo "  - detected_tag: '${DETECTED_TAG}'" >&2
+            echo "  - inputs.tag(raw): '$INPUT_TAG'" >&2
+            echo "  - needs.prepare.outputs.tag(raw): '$CALLER_TAG'" >&2
+            echo "  - detected_tag(raw): '${DETECTED_TAG}'" >&2
             echo "  - GITHUB_REF: '$GITHUB_REF'" >&2
             exit 1
           fi

CHANGELOG.md

@@ -38,6 +38,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 - Made `do-release` version resolution resilient to `workflow_call` input passing issues by adding a separate tag detection step that fetches and discovers the latest tag from origin as a fallback when `inputs.tag` is empty, enabling proper operation even when Gitea's workflow_call doesn't pass inputs through correctly.
 - Fixed version resolution in `do-release` workflow by moving version calculation before checkout, resolving from inputs/git tags, and always passing explicit version to `publish` action.
 - Fixed tag detection in `do-release` to prioritize the tag at current HEAD (created by `prepare-release`) over the globally latest tag, ensuring correct version is detected when called from `prepare-release` workflow.
+- Fixed `do-release` workflow_call resolution on Teacup runners by explicitly falling back to `needs.prepare.outputs.tag` and normalizing `%!t(string=...)` wrapped values before choosing a release tag.
 - Made `publish` action version resolution more robust with clearer error messages when version input is missing and workflow is not running from a tag push.
 - Fixed `do-release` workflow to always checkout the resolved release tag, eliminating conditional checkout logic that could skip the checkout when called from `prepare-release` workflow.
 - Pinned `securego/gosec` and `golang/govulncheck-action` to concrete version tags (`v2.22.4` and `v1.0.4`) so self-hosted Gitea runners can resolve them via direct git clone without relying on the GitHub Actions floating-tag API.