scripts: watcher with correct Forgejo job status codes

1=success 2=failure 3=cancelled 4=skipped 5=waiting 6=running 7=blocked,
terminal is 1..4. The first cut treated 2 as success and reported a failed
job as green.

scripts/watch-release-run.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Wait for a Forgejo Actions run to reach a terminal state, then report.
+#
+# Forgejo job status codes (action_run_job.status):
+#   0 unknown  1 success  2 failure  3 cancelled  4 skipped
+#   5 waiting  6 running  7 blocked (needs a parent job)
+# Terminal = 1..4. Usage: watch-release-run.sh [run_id] [timeout_minutes]
+set -uo pipefail
+
+run_id="${1:-}"
+timeout_min="${2:-60}"
+TOK=$(grep '^FORGEJO_TOKEN=' ~/.hermes/.env | cut -d= -f2)
+
+q() {
+  ssh -o ConnectTimeout=10 sirius@rpi \
+    "docker exec forgejo-db psql -U forgejo -d forgejo -t -A -F'|' -c \"$1\"" 2>/dev/null
+}
+
+if [ -z "$run_id" ]; then
+  run_id=$(q "select max(id) from action_run;")
+fi
+meta=$(q "select r.id, r.status, r.event, r.title from action_run r where r.id = $run_id;")
+echo "watching run: $meta"
+
+deadline=$(( $(date +%s) + timeout_min * 60 ))
+while :; do
+  jobs=$(q "select j.status, j.name from action_run_job j where j.run_id = $run_id order by j.id;")
+  echo "[$(date +%H:%M:%S)] $(echo "$jobs" | tr '\n' ' ')"
+  all_jobs=$(q "select count(*) from action_run_job j where j.run_id = $run_id;")
+  done_jobs=$(q "select count(*) from action_run_job j where j.run_id = $run_id and j.status in (1,2,3,4);")
+  if [ "$done_jobs" = "$all_jobs" ] && [ "$all_jobs" != "0" ]; then
+    break
+  fi
+  if [ "$(date +%s)" -ge "$deadline" ]; then
+    echo "watch: timed out after ${timeout_min}m (run $run_id still not terminal)"
+    exit 1
+  fi
+  sleep 45
+done
+
+echo "=== final ==="
+echo "$jobs"
+if echo "$jobs" | grep -qE '^2\|'; then
+  echo "run $run_id: FAILED (job status 2) — read the log on the Pi:"
+  echo "  sudo find /opt/siriusdevops/forgejo/data/gitea/data/actions_log/sirius/<repo> -newermt '-20 min' -name '*.zst'"
+fi
+echo "run_id=$run_id"