ci: publish signed [breadway] repo to dl.breadway.dev/arch

Host job on hestia (no container) collects breadlock plus the ISO AUR
republishes from the Forgejo registry, detach-signs them, repo-add -s,
and writes /srv/breadway-dl/arch/x86_64/. ISO SigLevel stays Never.

.forgejo/workflows/release-iso.yml

@@ -12,8 +12,8 @@ name: Build and release ISO
 #   MIRROR_TOKEN     — GitHub personal access token with repo scope
 #   GPG_PRIVATE_KEY  — armoured secret key for the dedicated "BOS Release Signing"
 #                      identity (releases@breadway.dev); public half is committed
-#                      at KEYS.asc for verifying ISO SHA256SUMS only. That key
-#                      does not sign the [breadway] pacman repo. No passphrase
+#                      at KEYS.asc. Signs ISO SHA256SUMS here; the same secret
+#                      signs the [breadway] repo in signed-repo.yml. No passphrase
 #                      (CI-only key, access controlled via the Forgejo secret
 #                      store).
 

.forgejo/workflows/signed-repo.yml

@@ -0,0 +1,52 @@
+name: Publish signed [breadway] repo
+
+# Host job on hestia (no container:) so it can write /srv/breadway-dl, same
+# as bakery releases. breadlock package.yml uses archlinux:latest and cannot
+# see host /srv — do not add container: here.
+#
+# Collects breadlock + the ISO AUR republishes from the Forgejo Arch
+# registry, detach-signs each .pkg.tar.zst, repo-add -s, publishes
+# https://dl.breadway.dev/arch/x86_64/. Does not PUT to the registry
+# (existing packaging workflows keep doing that). Does not flip ISO SigLevel.
+#
+# Required secret: GPG_PRIVATE_KEY (same BOS release key as release-iso.yml).
+
+on:
+  workflow_dispatch:
+  repository_dispatch:
+    types: [publish-signed-repo]
+  workflow_run:
+    workflows:
+      - Build and publish calamares
+      - Build and publish bibata-cursor-theme
+      - Build and publish powerlevel10k
+      - Build and publish yay-bin
+    types: [completed]
+
+concurrency:
+  group: signed-repo
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: Clone repository
+        run: |
+          set -euo pipefail
+          REF="${GITHUB_REF_NAME:-main}"
+          rm -rf src
+          git clone --depth 1 --branch "$REF" \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
+
+      - name: Sign packages and publish repo
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
+            echo "GPG_PRIVATE_KEY secret is missing; refusing to publish an unsigned [breadway] repo." >&2
+            exit 1
+          fi
+          bash src/scripts/ci-publish-signed-repo.sh