From 64aa3611b44ff85df1b4e1e2d08c2ee66e53d2fd Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sun, 16 Aug 2026 05:35:56 +0800
Subject: [PATCH] ci: do not fail signed-repo publish on chmod of gpg
 signatures

repo-add -s already wrote the signed db; chmod a+r on .sig files
returned EPERM and rolled back the stage dir.
---
 scripts/ci-publish-signed-repo.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/ci-publish-signed-repo.sh b/scripts/ci-publish-signed-repo.sh
index 08fbb53..65b235b 100755
--- a/scripts/ci-publish-signed-repo.sh
+++ b/scripts/ci-publish-signed-repo.sh
@@ -243,8 +243,10 @@ publish_tree() {
   parent="$(dirname "$DEST")"
   dest_name="$(basename "$DEST")"
   mkdir -p "$parent"
-  chmod a+rX "$STAGE"
-  find "$STAGE" -type f -exec chmod a+r {} +
+  chmod a+rX "$STAGE" || true
+  # gpg --detach-sign often writes 0600 files the runner cannot chmod;
+  # do not fail the publish after repo-add -s already succeeded.
+  find "$STAGE" -type f -exec chmod a+r {} + || true
   prev="$parent/${dest_name}.prev"
   rm -rf "$prev"
   if [[ -e "$DEST" ]]; then