fix(ci): retention deletes the mirror's release (and its ISO) too, not only the GitHub release

.github/workflows/iso-1-github-tag.yml

@@ -118,13 +118,20 @@ jobs:
           echo "ISO_TAG=$tag" >> "$GITHUB_ENV"
           echo "STEAMIFY_REF=$sref" >> "$GITHUB_ENV"
 
-          # Retention (space): at most 10 dev and 10 real releases; the oldest go, release and tag. The mirror drops the
+          # Retention (space): at most 10 dev and 10 real releases; the oldest go: the mirror's release with its ISO, then the GitHub
-          # tag with its release and ISO at its next sync (the step below).
+          # release and tag (the mirror drops the tag at its next sync, the step below).
           keep=10
           for pre_flag in true false; do
             gh release list -L 200 --json tagName,isPrerelease,createdAt \
                 -q "[.[] | select(.isPrerelease == $pre_flag)] | sort_by(.createdAt) | reverse | .[$keep:][] | .tagName" |
-              while read -r old; do echo "Retention: removing $old"; gh release delete "$old" --cleanup-tag -y; done
+              while read -r old; do
+                echo "Retention: removing $old"
+                # The mirror keeps a release (and its 3 GB ISO) after its tag is gone, so it is deleted there first.
+                if [ -n "$GIT_UPRISER_TOKEN" ]; then
+                  curl -sS -X DELETE -H "Authorization: token $GIT_UPRISER_TOKEN" -o /dev/null -w "  mirror release $old: HTTP %{http_code}\n" "$GITEA_URL/api/v1/repos/$GITEA_REPO/releases/tags/$old" || true
+                fi
+                gh release delete "$old" --cleanup-tag -y
+              done
           done
 
       # The mirror takes the tag (sync), then the build on the mirror is started explicitly (its dispatch API): a tag that

AGENTS.md

@@ -119,7 +119,7 @@ Full write-up, with every trap: `steamify-iso-release` in steamify-cachyos-dev.
   date, no time): `vX.Y.Z-YYMMDD` (real) or `vX.Y.Z-dev-YYMMDD` (dev), file `steamify-cachyos-X.Y.Z-[dev-]YYMMDD-x86_64.iso`, an **annotated** tag and a
   release with notes and the direct download link. One ISO per day and kind: a second build the same day deletes
   the earlier release and tag (GitHub) and tags again; the mirror takes the new tag object, iso-2 replaces the old mirror release. Retention: at most 10 dev and 10 real
-  releases are kept (space); the oldest are deleted with `gh release delete --cleanup-tag`, and the mirror drops their tags, releases and ISOs at its next sync. The workflow always runs from `master`; its input `steamify_ref` (a Steamify branch or tag, empty = the newest published release) builds the ISO with that checkout and names it after that branch's `VERSION` (a release branch tests its own version before it is released); its input `kind` (`release`, `dev`, or `auto`: release on master, dev on other branches) decides: `release` is a real release, `dev` a `dev-` pre-release. steamify-cachyos' bundle.yml passes it: a version published from main -> `release`, a version on a release branch -> `dev`.
+  releases are kept (space); the oldest are deleted: first the mirror's release with its ISO (Gitea API, `GIT_UPRISER_TOKEN`), then the GitHub release and tag with `gh release delete --cleanup-tag`; the mirror drops the tag at its next sync. (A mirror release is NOT removed by a tag deletion alone: it stays, tagless, with its ISO.) The workflow always runs from `master`; its input `steamify_ref` (a Steamify branch or tag, empty = the newest published release) builds the ISO with that checkout and names it after that branch's `VERSION` (a release branch tests its own version before it is released); its input `kind` (`release`, `dev`, or `auto`: release on master, dev on other branches) decides: `release` is a real release, `dev` a `dev-` pre-release. steamify-cachyos' bundle.yml passes it: a version published from main -> `release`, a version on a release branch -> `dev`.
 - `.github/workflows/iso-2-gitea-build.yml` (Gitea, `workflow_dispatch` with the tag as the ref, started by iso-1's last step through the mirror's dispatch API after the mirror has the new tag object; a tag push starts nothing, because a replaced tag of the same name starts no run; skipped on GitHub) runs two jobs for that
   tag: build the ISO, then attach it to the mirror's release. It is not tested there (the runner is small): the VM tests
   run on GitHub, in steamify-cachyos `vmtest.yml`, on the newest ISO release of the mirror. The tag decides everything: Steamify version (`steamify-prepare.sh`