fix: add -k to curl to bypass TLS verification in container

Also ensure RELEASER_TOKEN secret is set in Woodpecker.

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>

.woodpecker/release.yaml

@@ -21,16 +21,28 @@ steps:
         from_secret: RELEASER_TOKEN
     commands:
       - |
-        curl --output /usr/local/bin/tea https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/0.12.0/tea-0.12.0-linux-amd64 && chmod +x /usr/local/bin/tea
-        tea logins add --name gitea --url https://git.unkin.net --token "$${RELEASER_TOKEN}" --no-version-check
         PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
         if [ -n "$PREV_TAG" ]; then
           NOTES=$(git log "${PREV_TAG}..${CI_COMMIT_TAG}" --merges --pretty=format:"- %s")
         else
           NOTES=$(git log --merges --pretty=format:"- %s")
         fi
-        tea releases edit "${CI_COMMIT_TAG}" --note "${NOTES}" --login gitea --repo "${CI_REPO}"
-        tea releases assets create "${CI_COMMIT_TAG}" node-lookup --login gitea --repo "${CI_REPO}"
+        BODY=$(printf '%s' "$NOTES" | sed 's/"/\\"/g; s/$/\\n/' | tr -d '\n')
+        GET_RESPONSE=$(curl -sk "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/tags/${CI_COMMIT_TAG}")
+        echo "GET response: ${GET_RESPONSE}"
+        RELEASE_ID=$(printf '%s' "${GET_RESPONSE}" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+        if [ -z "$RELEASE_ID" ]; then
+          echo "ERROR: failed to find release for tag ${CI_COMMIT_TAG}" >&2
+          exit 1
+        fi
+        echo "Release ID: ${RELEASE_ID}"
+        curl -sk -X PATCH "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/${RELEASE_ID}" \
+          -H "Authorization: token ${RELEASER_TOKEN}" \
+          -H "Content-Type: application/json" \
+          -d "{\"body\":\"${BODY}\"}"
+        curl -sk -X POST "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/${RELEASE_ID}/assets" \
+          -H "Authorization: token ${RELEASER_TOKEN}" \
+          -F "attachment=@node-lookup"
     backend_options:
       kubernetes:
         serviceAccountName: default