From 71ca680c86c440acb97221da940a0c5baab3c9f5 Mon Sep 17 00:00:00 2001
From: autonomic-bot <64+autonomic-bot@noreply.git.autonomic.zone>
Date: Mon, 21 Sep 2026 16:49:30 +0000
Subject: [PATCH] =?UTF-8?q?chore:=20bump=20recipe-maintainer=20submodule?=
 =?UTF-8?q?=20to=206698723=20=E2=80=94=20recipe-upstream=20detects=20the?=
 =?UTF-8?q?=20upstream=20default=20branch=20(main=20vs=20master)=20instead?=
 =?UTF-8?q?=20of=20trusting=20the=20PR=20base?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .opencode/skills/cctest-recipe-upstream/SKILL.md | 11 +++++++----
 references/recipe-maintainer                     |  2 +-
 scripts/gen-cctest-skills.py                     | 11 +++++++----
 3 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/.opencode/skills/cctest-recipe-upstream/SKILL.md b/.opencode/skills/cctest-recipe-upstream/SKILL.md
index 2710596..e48a4c1 100644
--- a/.opencode/skills/cctest-recipe-upstream/SKILL.md
+++ b/.opencode/skills/cctest-recipe-upstream/SKILL.md
@@ -82,7 +82,10 @@ base produces the very messy 3-dot compare this guard exists to prevent (real ca
 first "rebase" landed on a stray `main` and had to be redone onto `master`).
 
 **Branch-name mismatch mirror vs upstream.** The mirror and upstream can use different base-branch
-names (gitea: mirror `main`, upstream `master`). When emitting step 3 (the post-merge release),
-NEVER hardcode `main` — derive the upstream default branch from the existing remotes (`git
-remote show origin` or `git ls-remote --symref origin HEAD`) and emit `git checkout <that>;
-git fetch origin; git merge --ff-only origin/<that>;` before `abra recipe release`.
+names, and a mirror can even carry a stray, divergent `main` alongside the real base (gitea: mirror
+PR against `main`, upstream `master`; keycloak PR #9: base `main`, both mirror and upstream on
+`master`). The canonical script now detects the upstream default branch by evidence (`git
+ls-remote --symref origin HEAD`, then the git.coopcloud.tech API, then the PR base with a warning)
+and uses it for the compare URL AND the post-merge release steps — never hardcode `main`, and when
+it prints the base-mismatch warning, confirm the upgrade branch actually sits on that line
+(`git merge-base` against both candidates) before emitting the push step.
diff --git a/references/recipe-maintainer b/references/recipe-maintainer
index ef3d703..6698723 160000
--- a/references/recipe-maintainer
+++ b/references/recipe-maintainer
@@ -1 +1 @@
-Subproject commit ef3d70384ca790c8fa2d3cdf1fef74e06dab5116
+Subproject commit 6698723a77a8d51301e947fa131b4f3931ce3883
diff --git a/scripts/gen-cctest-skills.py b/scripts/gen-cctest-skills.py
index bd74f60..4a94ffa 100644
--- a/scripts/gen-cctest-skills.py
+++ b/scripts/gen-cctest-skills.py
@@ -110,10 +110,13 @@ base produces the very messy 3-dot compare this guard exists to prevent (real ca
 first "rebase" landed on a stray `main` and had to be redone onto `master`).
 
 **Branch-name mismatch mirror vs upstream.** The mirror and upstream can use different base-branch
-names (gitea: mirror `main`, upstream `master`). When emitting step 3 (the post-merge release),
-NEVER hardcode `main` — derive the upstream default branch from the existing remotes (`git
-remote show origin` or `git ls-remote --symref origin HEAD`) and emit `git checkout <that>;
-git fetch origin; git merge --ff-only origin/<that>;` before `abra recipe release`.
+names, and a mirror can even carry a stray, divergent `main` alongside the real base (gitea: mirror
+PR against `main`, upstream `master`; keycloak PR #9: base `main`, both mirror and upstream on
+`master`). The canonical script now detects the upstream default branch by evidence (`git
+ls-remote --symref origin HEAD`, then the git.coopcloud.tech API, then the PR base with a warning)
+and uses it for the compare URL AND the post-merge release steps — never hardcode `main`, and when
+it prints the base-mismatch warning, confirm the upgrade branch actually sits on that line
+(`git merge-base` against both candidates) before emitting the push step.
 """,
 }
 
-- 
2.54.0