name: Publish signed [breadway] repo

# Host job on hestia (no container:) so it can write /srv/breadway-dl, same
# as bakery releases. breadlock package.yml uses archlinux:latest and cannot
# see host /srv — do not add container: here.
#
# Collects breadlock + the ISO AUR republishes from the Forgejo Arch
# registry, detach-signs each .pkg.tar.zst, repo-add -s, publishes
# https://dl.breadway.dev/arch/x86_64/. Does not PUT to the registry
# (existing packaging workflows keep doing that). Does not flip ISO SigLevel.
#
# Required secret: GPG_PRIVATE_KEY (same BOS release key as release-iso.yml).

on:
  workflow_dispatch:
  repository_dispatch:
    types: [publish-signed-repo]
  workflow_run:
    workflows:
      - Build and publish calamares
      - Build and publish bibata-cursor-theme
      - Build and publish powerlevel10k
      - Build and publish yay-bin
    types: [completed]

concurrency:
  group: signed-repo
  cancel-in-progress: false

jobs:
  publish:
    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: [self-hosted, hestia]
    steps:
      - name: Clone repository
        run: |
          set -euo pipefail
          REF="${GITHUB_REF_NAME:-main}"
          rm -rf src
          git clone --depth 1 --branch "$REF" \
            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src

      - name: Sign packages and publish repo
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
            echo "GPG_PRIVATE_KEY secret is missing; refusing to publish an unsigned [breadway] repo." >&2
            exit 1
          fi
          bash src/scripts/ci-publish-signed-repo.sh