ci: query GHCR for existing image tags to detect version

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Author: sisyphus-dev-ai

.github/workflows/check-upstream-release.yml

@@ -17,6 +17,7 @@ jobs:
     permissions:
       contents: read
       actions: write
+      packages: read
     outputs:
       should_build: ${{ steps.check.outputs.should_build }}
       new_version: ${{ steps.check.outputs.new_version }}
@@ -38,43 +39,40 @@ jobs:
       - name: Check if we need to build
         id: check
         run: |
-          CURRENT_VERSION=""
+          # Fetch latest upstream version
+          UPSTREAM_VERSION="${{ steps.upstream.outputs.version }}"
           
-          # Try to get the last built version from git tags
-          if git rev-parse last-built-version >/dev/null 2>&1; then
-            CURRENT_VERSION=$(git rev-parse last-built-version)
-          fi
+          # Query GHCR for existing image tags
+          # Need package:read permission for this
+          TAGS_RESPONSE=$(curl -s -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/orgs/${{ github.repository_owner }}/packages/container/${{ github.repository }}/versions")
           
-          # Also check if there's a recent Docker image tag
-          if [ -z "$CURRENT_VERSION" ]; then
-            # Try GitHub API to get existing image tags
-            TAGS_JSON=$(curl -s -H "Accept: application/vnd.github+json" \
-              -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              https://api.github.com/repos/${{ github.repository }}/git/refs/tags)
-            
-            # Get the most recent tag that matches anomalyco version pattern
-            CURRENT_VERSION=$(echo "$TAGS_JSON" | jq -r '.[] | select(.ref | startswith("refs/tags/anomalyco-")) | .ref' 2>/dev/null | head -1 | sed 's/refs\/tags\/anomalyco-//')
-          fi
+          # Find the latest upstream-* tag
+          CURRENT_VERSION=$(echo "$TAGS_RESPONSE" | jq -r '.[] | select(.metadata.container.tags[]? | startswith("upstream-")) | .metadata.container.tags[]' 2>/dev/null | head -1 | sed 's/upstream-//')
+          
+          echo "Current built version: $CURRENT_VERSION"
+          echo "Latest upstream version: $UPSTREAM_VERSION"
           
           # For manual dispatch or if no previous version, always build
           if [ "${{ github.event.inputs.force_build }}" == "true" ] || [ -z "$CURRENT_VERSION" ]; then
             echo "should_build=true" >> $GITHUB_OUTPUT
-            echo "new_version=${{ steps.upstream.outputs.version }}" >> $GITHUB_OUTPUT
+            echo "new_version=$UPSTREAM_VERSION" >> $GITHUB_OUTPUT
             echo "old_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
             echo "No previous version found or force build enabled. Will build."
             exit 0
           fi
           
           # Compare versions
-          if [ "$CURRENT_VERSION" != "${{ steps.upstream.outputs.version }}" ]; then
+          if [ "$CURRENT_VERSION" != "$UPSTREAM_VERSION" ]; then
             echo "should_build=true" >> $GITHUB_OUTPUT
-            echo "new_version=${{ steps.upstream.outputs.version }}" >> $GITHUB_OUTPUT
+            echo "new_version=$UPSTREAM_VERSION" >> $GITHUB_OUTPUT
             echo "old_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-            echo "New version detected: ${{ steps.upstream.outputs.version }} (was: $CURRENT_VERSION)"
+            echo "New version detected: $UPSTREAM_VERSION (was: $CURRENT_VERSION)"
           else
             echo "should_build=false" >> $GITHUB_OUTPUT
-            echo "new_version=${{ steps.upstream.outputs.version }}" >> $GITHUB_OUTPUT
+            echo "new_version=$UPSTREAM_VERSION" >> $GITHUB_OUTPUT
             echo "old_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
             echo "No new version. Already at: $CURRENT_VERSION"
           fi