fix(release): drop jq dependency, use python3 for JSON assembly

The 26.2-alpha release workflow hung for 15+ minutes on
"apt-get install -y jq" — the runner's apt mirror was unreachable
(or very slow), and the whole publish stalled.

jq was only used for two tiny things: building the release-create
POST body and reading the release id from the response. Both are
one-liners in Python, which is guaranteed-present on the Forgejo
Actions ubuntu-latest runner image. Replaced both uses; removed
the apt-get step from release.yml entirely. Slow mirrors no
longer block tagged releases.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.forgejo/workflows/release.yml

@@ -19,11 +19,6 @@ jobs:
         with:
           fetch-depth: 0  # changelog section extraction needs history
 
-      - name: Install jq
-        run: |
-          apt-get update -qq
-          apt-get install -y jq
-
       - name: Build release tarball
         run: ./scripts/build-release-tarball.sh "${GITHUB_REF_NAME}"
 

CHANGELOG.md

@@ -7,6 +7,12 @@ This project uses calendar versioning: `YY.N-stage` (e.g. `26.0-alpha` = 2026, r
 
 ## [Unreleased]
 
+## [26.3-alpha] - 2026-04-16
+
+### Fixed
+
+- **Release workflow no longer depends on `jq`.** The previous `apt-get install -y jq` step hung on a slow mirror for 15+ minutes and stalled the 26.2-alpha publish. `publish-release.sh` now assembles the release-create payload via a tiny `python3 -c` block — Python is always available on the Forgejo Actions runner. `apt-get` path removed entirely.
+
 ## [26.2-alpha] - 2026-04-16
 
 ### Fixed
@@ -65,7 +71,8 @@ First tagged snapshot. Pre-alpha — the installer does not yet boot, but the de
 - **Containers:** Docker + Compose
 - **License:** AGPL-3.0
 
-[Unreleased]: https://forgejo.sourcegate.online/daniel/furtka/compare/26.2-alpha...HEAD
+[Unreleased]: https://forgejo.sourcegate.online/daniel/furtka/compare/26.3-alpha...HEAD
+[26.3-alpha]: https://forgejo.sourcegate.online/daniel/furtka/releases/tag/26.3-alpha
 [26.2-alpha]: https://forgejo.sourcegate.online/daniel/furtka/releases/tag/26.2-alpha
 [26.1-alpha]: https://forgejo.sourcegate.online/daniel/furtka/releases/tag/26.1-alpha
 [26.0-alpha]: https://forgejo.sourcegate.online/daniel/furtka/releases/tag/26.0-alpha

scripts/publish-release.sh

@@ -57,20 +57,27 @@ api() {
 
 base="https://$HOST/api/v1/repos/$REPO"
 
-# 1. Create the release.
-release_body_json="$(jq -n \
-  --arg tag "$VERSION" \
-  --arg name "$VERSION" \
-  --arg body "$BODY" \
-  --argjson pre "$PRERELEASE" \
-  '{tag_name: $tag, name: $name, body: $body, prerelease: $pre}')"
+# 1. Create the release. Python for JSON assembly so we don't depend on jq
+# on the runner — the previous `apt-get install -y jq` step in release.yml
+# hung for 15+ minutes on a slow mirror and stalled the whole publish.
+release_body_json="$(
+  VERSION="$VERSION" BODY="$BODY" PRE="$PRERELEASE" python3 -c '
+import json, os
+print(json.dumps({
+    "tag_name": os.environ["VERSION"],
+    "name": os.environ["VERSION"],
+    "body": os.environ["BODY"],
+    "prerelease": os.environ["PRE"] == "true",
+}))
+'
+)"
 
 echo "==> Creating release $VERSION"
 release_response="$(api --request POST "$base/releases" \
   --header "Content-Type: application/json" \
   --data "$release_body_json")"
 
-release_id="$(echo "$release_response" | jq -r '.id')"
+release_id="$(echo "$release_response" | python3 -c 'import json, sys; print(json.load(sys.stdin).get("id", ""))')"
 if [ -z "$release_id" ] || [ "$release_id" = "null" ]; then
   echo "error: couldn't parse release id from response:"
   echo "$release_response"