upstream(immich): 2026-08-07 — upstream main at v3.1.0; runner clone-token stale

cc-ci-plan/upstream/immich.md

@@ -34,12 +34,29 @@
   `valkey:9@sha256:8e8d64b405ce18f41b8e5ee20aa4687a8ed0022d1298f2ce31cdcf3a76e09411`
   (a NEWER valkey build than v3.0.3's `4963247afc4cd…` — this `8e8d64b4…` is the same digest the live `9`
   tag had already moved to at the 2026-07-17 run; immich v3.1.0 now officially ships it, so it IS the
-  immich-tested combo → re-pin the recipe's `redis` service to `8e8d64b4…` for the v3.1.0 upgrade) and
+  immich-tested   combo → re-pin the recipe's `redis` service to `8e8d64b4…` for the v3.1.0 upgrade) and
   `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191…` (SAME combo as v3.0.3 — immich did NOT
   bump vectorchord/pgvectors, so the recipe STAYS AHEAD on `pgvectors0.3.0@sha256:87c050465…`; do NOT
   downgrade). Only **breaking change in v3.1.0** is `chore(mobile): drop support for iOS 14` (mobile
   client, NOT server-side — no server migration, no DB migration, no operator action for the recipe).
   Done in the 2026-07-31 upgrade (v3.0.1→v3.1.0, extending PR #4 again).
+- **2026-08-07: upstream main MOVED to v3.1.0 (published `1.10.0+v3.1.0`, commit `794560f`).** The
+  coopcloud maintainer published v3.1.0 independently of PR #4 (PR #4 tip `77d7937` is NOT in upstream
+  main, so the reconcile leaves it open — functionally superseded on the version bump). Upstream main
+  pins: `immich-server/ML v3.1.0`, `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf633…` (immich's
+  OFFICIAL v3.1.0 combo — a DOWNGRADE from the recipe's prior `pgvectors0.3.0@87c0…`), and
+  `valkey:9@sha256:3acc0687f2a2e1091fae6450d7842dd658c941338cf0a873ddd9e14b9e4ea4dd` (DIVERGES from
+  immich v3.1.0's official valkey pin `8e8d64b4…` — upstream pin hygiene discrepancy, not an upgrade).
+  Immich is now **up-to-date** (v3.1.0 is latest stable per GitHub releases; no v3.1.x patch / v3.2.x).
+  PR #4 now diverges from upstream main only on `database` (pgvectors0.3.0 vs 0.2.0) + `redis`
+  (valkey:9@8e8d64b4 vs @3acc0687) pins — operator decides merge-vs-close.
+- **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build
+  #1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for
+  'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified
+  HTTP 401 on the gitea API + git endpoint; `.testenv` basic creds work). PR #4's tree `77d79379` was
+  GREEN on #1145 (2026-07-31) & #1180 (2026-08-04) — the RED is infra, not the recipe. Fix: rotate the
+  runner's gitea clone-token (swarm secret), then re-`!testme`. (The 2026-08-04 Drone-direct
+  `GITEA_TOKEN`-as-build-param workaround is disallowed for normal runs.)
 - **Historical (v2.7.5, 2026-04-13):** immich-server v2.7.5 pinned
   `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191…`. PR #2 bumped the recipe to
   `pgvectors0.3.0@sha256:87c050465…` (same PG14 + VectorChord 0.4.3, newer pgvectors 0.2.0→0.3.0).