ci: use workflow runs API to detect built version

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Author: sisyphus-dev-ai

.github/workflows/check-upstream-release.yml

@@ -17,7 +17,6 @@ jobs:
     permissions:
       contents: read
       actions: write
-      packages: read
     outputs:
       should_build: ${{ steps.check.outputs.should_build }}
       new_version: ${{ steps.check.outputs.new_version }}
@@ -42,16 +41,14 @@ jobs:
           # Fetch latest upstream version
           UPSTREAM_VERSION="${{ steps.upstream.outputs.version }}"
           
-          # Query GHCR for existing image tags - use repo-level packages API
-          TAGS_RESPONSE=$(curl -s -H "Accept: application/vnd.github+json" \
+          # Query workflow runs to find the last successful build with upstream version
+          RUNS_RESPONSE=$(curl -s -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            "https://api.github.com/repos/${{ github.repository }}/packages/container/opencode-server-docker/versions")
+            "https://api.github.com/repos/${{ github.repository }}/actions/runs?status=success&per_page=5")
           
-          echo "GHCR response: $TAGS_RESPONSE"
-          
-          # Find the latest upstream-* tag
-          CURRENT_VERSION=$(echo "$TAGS_RESPONSE" | jq -r '.[] | .metadata.container.tags[]' 2>/dev/null | grep '^upstream-' | head -1 | sed 's/upstream-//')
+          # Find the most recent run that was triggered by upstream-release and has upstream_version
+          CURRENT_VERSION=$(echo "$RUNS_RESPONSE" | jq -r '.workflow_runs[] | select(.display_title? | contains("upstream")) | .inputs.upstream_version // empty' 2>/dev/null | head -1)
           
           echo "Current built version: $CURRENT_VERSION"
           echo "Latest upstream version: $UPSTREAM_VERSION"

.sisyphus/boulder.json

@@ -0,0 +1 @@
+{"active_plan": ".sisyphus/plans/fix-upstream-checker.md", "started_at": "2026-02-19T21:04:00Z", "session_ids": ["ses_placeholder"], "plan_name": "fix-upstream-checker"}

.sisyphus/plans/fix-upstream-checker.md

@@ -0,0 +1,41 @@
+# Fix: Upstream Release Checker GHCR API Issue
+
+## Context
+The `check-upstream-release.yml` workflow fails to detect previously built versions because:
+1. GHCR packages are owned by users/orgs, not repos directly
+2. The API endpoint `repos/{owner}/{repo}/packages/container/...` returns 404
+3. Need to use a more reliable method to track built versions
+
+## Plan
+
+### Task 1: Fix version detection to use workflow runs API
+
+**What to do**:
+- Replace GHCR API call with GitHub Actions workflow runs API
+- Query last successful runs to find upstream version that was built
+- Update the check-release job logic
+
+**Files**:
+- `.github/workflows/check-upstream-release.yml`
+
+**QA Scenarios**:
+
+Scenario: Happy path - new version detected
+  Tool: Bash (simulation)
+  Preconditions: Last workflow run had upstream_version="v1.2.5", new release is "v1.2.6"
+  Steps:
+    1. Simulate API response with old run showing v1.2.5
+    2. New upstream shows v1.2.6
+    3. Verify should_build=true
+  Expected Result: should_build=true, new_version=v1.2.6, old_version=v1.2.5
+  Evidence: Console output showing version comparison
+
+Scenario: No change - same version
+  Tool: Bash (simulation)
+  Preconditions: Last workflow run had upstream_version="v1.2.6", new release is "v1.2.6"
+  Steps:
+    1. Simulate API response with run showing v1.2.6
+    2. New upstream shows v1.2.6
+    3. Verify should_build=false
+  Expected Result: should_build=false
+  Evidence: Console output "No new version. Already at: v1.2.6"