fix(ci): follow HTTP redirect and validate JSON in fetch-releases step

curl -sf without -L silently wrote '301 Moved Permanently' to releases.json
instead of following the http→https redirect. Added -L to follow redirects,
set -euo pipefail, and jq type validation so the step fails hard on bad JSON.

.gitea/workflows/release.yaml

@@ -190,6 +190,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Fetch releases from Gitea API
+        run: |
+          set -euo pipefail
+          RESPONSE=$(curl -sfL \
+            -H "Accept: application/json" \
+            "http://gitea.kalekber.cc/api/v1/repos/kamil/libnovel/releases?limit=50&page=1")
+          # Validate JSON before writing — fails hard if response is not a JSON array
+          COUNT=$(echo "$RESPONSE" | jq 'if type == "array" then length else error("expected array, got \(type)") end')
+          echo "$RESPONSE" > ui/static/releases.json
+          echo "Fetched $COUNT releases"
+
       - uses: docker/setup-buildx-action@v3
 
       - name: Log in to Docker Hub

ui/.gitignore

@@ -21,3 +21,6 @@ Thumbs.db
 # Vite
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
+
+# Generated by CI at build time — do not commit
+/static/releases.json

ui/src/routes/admin/changelog/+page.server.ts

@@ -1,3 +1,5 @@
+import { readFileSync } from 'fs';
+import { join } from 'path';
 import type { PageServerLoad } from './$types';
 
 export interface Release {
@@ -10,17 +12,14 @@ export interface Release {
 	draft: boolean;
 }
 
-export const load: PageServerLoad = async ({ fetch }) => {
+export const load: PageServerLoad = async () => {
 	try {
-		const res = await fetch(
-			'https://gitea.kalekber.cc/api/v1/repos/kamil/libnovel/releases?limit=50&page=1',
-			{ headers: { Accept: 'application/json' } }
-		);
-		if (!res.ok) throw new Error(`Gitea API returned ${res.status}`);
-		const releases: Release[] = await res.json();
-		return {
-			releases: releases.filter((r) => !r.draft)
-		};
+		// releases.json is baked into the image at build time by CI.
+		// SvelteKit Node adapter copies static/ → build/client/, so the file
+		// lives at <cwd>/build/client/releases.json in production.
+		const raw = readFileSync(join(process.cwd(), 'build', 'client', 'releases.json'), 'utf-8');
+		const releases: Release[] = JSON.parse(raw);
+		return { releases: releases.filter((r) => !r.draft) };
 	} catch (e) {
 		return { releases: [], error: String(e) };
 	}