fix(ci): match upstream ci by release sha

.gitea/workflows/deploy-prod.yml

@@ -137,29 +137,24 @@ jobs:
           with urllib.request.urlopen(req, timeout=30) as resp:
               payload = json.load(resp)
 
-          latest_ci = None
+          matched_ci = None
           for run in payload.get("workflow_runs", []):
               path = str(run.get("path") or "")
               if "ci.yml@" not in path:
                   continue
               if run.get("status") != "completed" or run.get("conclusion") != "success":
                   continue
-              latest_ci = run
+              actual_sha = str(run.get("head_sha") or "")
+              if actual_sha != expected_sha:
+                  continue
+              matched_ci = run
               break
 
-          if not latest_ci:
-              print("ERROR: No successful ci.yml run found in recent history")
+          if not matched_ci:
+              print("ERROR: No successful ci.yml run found for the release SHA")
               sys.exit(1)
 
-          actual_sha = str(latest_ci.get("head_sha") or "")
-          if actual_sha != expected_sha:
-              print("ERROR: Latest successful ci.yml SHA does not match upstream release SHA")
-              print(f"Expected: {expected_sha}")
-              print(f"Actual:   {actual_sha}")
-              print(f"Run ID:   {latest_ci.get('id')}")
-              sys.exit(1)
-
-          print(f"✓ Upstream CI verified: {actual_sha} (run {latest_ci.get('id')})")
+          print(f"✓ Upstream CI verified: {expected_sha} (run {matched_ci.get('id')})")
           PY
 
       - name: Download Release Artifact