fix(release): seed the version floor on the parent, not on HEAD (#3)

The floor tag marks what has already been released, so tagging the
commit being pushed leaves nothing between the floor and HEAD --
semantic-release then correctly reports there is nothing to release.
That is what the first run did: it seeded v0.0.0 on the merge commit
itself and cut no release.

HEAD^ is the first parent, so on a merge commit it is main as it was
before the merge and everything the merge brought in is releasable.

The tag has been moved to 6fb7b5e by hand; this is so the next repo
never needs that.

.gitea/workflows/android-apk.yml

@@ -133,7 +133,7 @@ jobs:
           # see the bootstrap step in release.yml.  It is skipped cleanly
           # rather than failing the guard below, because a 45-minute red
           # run against a tag that was never meant to ship is noise, and
-          # this is the most expensive of the three workflows a tag fires.
+          # this is the most expensive of the four workflows a tag fires.
           if [ "$v" = "0.0.0" ]; then
             echo "v0.0.0 is the version floor, not a release; nothing to build"
             echo "skip=true" >> "$GITHUB_OUTPUT"

.gitea/workflows/arch-package.yml

@@ -56,7 +56,7 @@ jobs:
       # v0.0.0 is semantic-release's version floor, not a shipment — see
       # the bootstrap step in release.yml.  A clean skip rather than a
       # failure: a red run against a tag that was never meant to ship is
-      # noise, and this is one of the three workflows that would otherwise
+      # noise, and this is one of the four workflows that would otherwise
       # fire on it.
       - name: Resolve the version
         id: version

.gitea/workflows/ci.yml

@@ -1,6 +1,6 @@
 name: CI
 
-# The other three workflows package and publish; none of them test
+# The other five workflows package, publish or release; none of them test
 # anything, so a green tick on this repo used to mean "the Arch package
 # built", which is not the question anyone was asking.  This is the
 # workflow that gates.
@@ -92,7 +92,7 @@ jobs:
       # Cloned by hand rather than with actions/checkout: that is a JS
       # action and needs node inside the job container before any step
       # has had a chance to install it.  Same approach as the other
-      # three workflows in this directory.
+      # other workflows in this directory.
       - name: Clone repo at this commit
         run: |
           set -eu

.gitea/workflows/release.yml

@@ -128,12 +128,26 @@ jobs:
           token="${ACTIONS_TOKEN:-$PACKAGE_TOKEN}"
           [ -n "$ACTIONS_TOKEN" ] || echo "note: GITEA_TOKEN is unset; using the PAT"
 
+          # **On the parent, not on HEAD.**  The floor marks what has
+          # already been released, so tagging the commit being pushed
+          # leaves nothing between the floor and HEAD — semantic-release
+          # then correctly reports there is nothing to release, which is
+          # exactly what the first run of this workflow did.  HEAD^ is the
+          # first parent, so on the merge commit this fires for it is main
+          # as it was before the merge, and everything the merge brought
+          # in is releasable.
+          floor=$(git rev-parse "${{ github.sha }}^" 2>/dev/null || true)
+          if [ -z "$floor" ]; then
+            echo "HEAD has no parent, so no commit can precede the floor" >&2
+            exit 1
+          fi
+
           echo "no v* tag exists — seeding v0.0.0 so the first release is 0.0.1"
-          git tag v0.0.0 "${{ github.sha }}"
+          git tag v0.0.0 "$floor"
           git push --quiet \
             "https://x-access-token:${token}@${SERVER_URL#https://}/${REPO}.git" \
             refs/tags/v0.0.0
-          echo "seeded v0.0.0 at ${{ github.sha }}"
+          echo "seeded v0.0.0 at $floor (parent of ${{ github.sha }})"
 
       # Pinned rather than installed into the repo: this is a Go project
       # and a package.json at its root invites the npm plugin and every

backend/explore/cache_test.go

@@ -46,23 +46,42 @@ func TestCacheMiss(t *testing.T) {
 	}
 }
 
+// TestCacheTTLExpiry checks both halves of the TTL contract, and uses two
+// entries to do it.
+//
+// **No assertion here may depend on an upper bound of elapsed wall-clock
+// time**, which is what the single-entry version of this test did: it set
+// a 1s TTL and immediately asserted a *hit*, so on a loaded runner — one
+// goroutine descheduled for over a second while the rest of the suite
+// runs — the entry was correctly gone and the test failed with "expected
+// cache hit immediately after set".  It did exactly that in CI while
+// passing five times out of five locally.
+//
+// Sleeping *past* a TTL is always safe, so the expiry half keeps a short
+// one; the presence half gets a TTL nothing can outrun.
 func TestCacheTTLExpiry(t *testing.T) {
 	c := newTestCache(t)
 
 	data := []byte(`{"ephemeral":true}`)
-	c.Set("ttl-test-key", data, 1*time.Second, "", "")
+	c.Set("ttl-live-key", data, time.Hour, "", "")
+	c.Set("ttl-expiring-key", data, 1*time.Second, "", "")
 
-	// Verify it's there immediately.
-	if _, ok := c.Get("ttl-test-key"); !ok {
-		t.Fatal("expected cache hit immediately after set")
+	if _, ok := c.Get("ttl-live-key"); !ok {
+		t.Fatal("expected a cache hit on an entry with an hour to live")
 	}
 
-	// Wait for expiry.
+	// Wait for the short one to expire.
 	time.Sleep(2 * time.Second)
 
-	if _, ok := c.Get("ttl-test-key"); ok {
+	if _, ok := c.Get("ttl-expiring-key"); ok {
 		t.Error("expected cache miss after TTL expiry, got hit")
 	}
+
+	// And the long-lived entry is still there, which is what says the
+	// sweep above expired an entry rather than the cache.
+	if _, ok := c.Get("ttl-live-key"); !ok {
+		t.Error("the hour-long entry expired too")
+	}
 }
 
 func TestCacheMBID(t *testing.T) {