Fix CI checkout: use token auth for git clone

Repo requires authentication; use gitea.token in clone URLs.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/release.yaml

@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: Checkout
         run: |
-          git clone --depth=1 https://git.produktor.io/${{ gitea.repository }}.git .
+          git clone --depth=1 https://${{ gitea.actor }}:${{ gitea.token }}@git.produktor.io/${{ gitea.repository }}.git .
           git checkout ${{ gitea.sha }}
 
       - name: Install Helm
@@ -48,10 +48,27 @@ jobs:
     steps:
       - name: Checkout (full history for tags)
         run: |
-          git clone https://git.produktor.io/${{ gitea.repository }}.git .
+          git clone https://${{ gitea.actor }}:${{ gitea.token }}@git.produktor.io/${{ gitea.repository }}.git .
           git fetch --tags
 
+      - name: Check if release-worthy changes
+        id: changes
+        run: |
+          CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || git diff --name-only HEAD)
+          echo "Changed files:"
+          echo "$CHANGED"
+          # Skip release if only docs, markdown, or non-chart files changed
+          RELEASE_FILES=$(echo "$CHANGED" | grep -vE '^(docs/|README\.md|STATUS\.md|AGENTS\.md|TASKS\.md|\.gitignore|djinni-)' || true)
+          if [ -z "$RELEASE_FILES" ]; then
+            echo "Only docs/meta files changed — skipping release."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Chart/workflow files changed — proceeding with release."
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Determine version bump
+        if: steps.changes.outputs.skip != 'true'
         id: version
         run: |
           LATEST_TAG=$(git tag -l 'v*' --sort=-v:refname | head -1)
@@ -99,16 +116,19 @@ jobs:
           echo "bump_type=${BUMP}" >> "$GITHUB_OUTPUT"
 
       - name: Install Helm
+        if: steps.changes.outputs.skip != 'true'
         run: |
           curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 
       - name: Update Chart.yaml version
+        if: steps.changes.outputs.skip != 'true'
         run: |
           sed -i "s/^version: .*/version: ${{ steps.version.outputs.new_version }}/" fleetdm-stack/Chart.yaml
           echo "Chart.yaml version set to ${{ steps.version.outputs.new_version }}"
           grep '^version:' fleetdm-stack/Chart.yaml
 
       - name: Package chart
+        if: steps.changes.outputs.skip != 'true'
         run: |
           helm dependency update fleetdm-stack/
           helm package fleetdm-stack/
@@ -117,6 +137,7 @@ jobs:
           ls -la .tmp/
 
       - name: Create tag
+        if: steps.changes.outputs.skip != 'true'
         run: |
           git config user.name "Gitea Actions"
           git config user.email "actions@git.produktor.io"
@@ -124,6 +145,7 @@ jobs:
           git push https://${{ gitea.actor }}:${{ gitea.token }}@git.produktor.io/${{ gitea.repository }}.git "${{ steps.version.outputs.new_tag }}"
 
       - name: Create Gitea Release
+        if: steps.changes.outputs.skip != 'true'
         run: |
           TAG="${{ steps.version.outputs.new_tag }}"
           BUMP="${{ steps.version.outputs.bump_type }}"

docs/architecture-design-company-inc.md

@@ -106,6 +106,7 @@ flowchart TD
 
 Zero-downtime releases without duplicating infrastructure. Both versions run inside the **same GKE cluster**; the load balancer switches traffic atomically.
 
+
 ```mermaid
 flowchart LR
     LB[Load Balancer]
@@ -113,7 +114,7 @@ flowchart LR
     LB -.->|0% traffic| Blue[Blue — v1.3.0<br/>new release]
     Blue -.->|smoke tests pass| LB
 ```
-
+---
 | Phase | Action |
 |-------|--------|
 | **Deploy** | New version deployed to the idle slot (blue) |
@@ -207,7 +208,7 @@ Not everything in a "best practices" architecture is worth implementing on day o
 ## 7. High-Level Architecture Diagram
 
 ```mermaid
-flowchart TB
+flowchart TD
     Users((Users))
 
     Users --> CDN[Cloud CDN<br/>Static Assets]
@@ -230,7 +231,7 @@ flowchart TB
 
     API --> Mongo
     API --> Secrets
-    GKE --> Registry
+    GKE ----> Registry
 ```
 
 ---

docs/architecture-hld.md

@@ -67,7 +67,7 @@ flowchart TB
 
     Git --> Actions
     Actions --> Registry
-    Argo --> GKE
+    Argo ----> GKE
 ```
 
 ## Blue-Green Deployment Flow
@@ -103,7 +103,7 @@ flowchart LR
 ## Network Security Layers
 
 ```mermaid
-flowchart TD
+flowchart LR
     Internet((Internet)) --> FW[VPC Firewall<br/>Default deny]
     FW --> LB[Load Balancer<br/>HTTPS only]
     LB --> NP[K8s Network Policies]