9fe02eeea6
Some checks failed
Build and release ISO / release-iso (push) Failing after 46s
Host job on hestia (no container) collects breadlock plus the ISO AUR republishes from the Forgejo registry, detach-signs them, repo-add -s, and writes /srv/breadway-dl/arch/x86_64/. ISO SigLevel stays Never.
52 lines
1.7 KiB
YAML
52 lines
1.7 KiB
YAML
name: Publish signed [breadway] repo
|
|
|
|
# Host job on hestia (no container:) so it can write /srv/breadway-dl, same
|
|
# as bakery releases. breadlock package.yml uses archlinux:latest and cannot
|
|
# see host /srv — do not add container: here.
|
|
#
|
|
# Collects breadlock + the ISO AUR republishes from the Forgejo Arch
|
|
# registry, detach-signs each .pkg.tar.zst, repo-add -s, publishes
|
|
# https://dl.breadway.dev/arch/x86_64/. Does not PUT to the registry
|
|
# (existing packaging workflows keep doing that). Does not flip ISO SigLevel.
|
|
#
|
|
# Required secret: GPG_PRIVATE_KEY (same BOS release key as release-iso.yml).
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
repository_dispatch:
|
|
types: [publish-signed-repo]
|
|
workflow_run:
|
|
workflows:
|
|
- Build and publish calamares
|
|
- Build and publish bibata-cursor-theme
|
|
- Build and publish powerlevel10k
|
|
- Build and publish yay-bin
|
|
types: [completed]
|
|
|
|
concurrency:
|
|
group: signed-repo
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
|
|
runs-on: [self-hosted, hestia]
|
|
steps:
|
|
- name: Clone repository
|
|
run: |
|
|
set -euo pipefail
|
|
REF="${GITHUB_REF_NAME:-main}"
|
|
rm -rf src
|
|
git clone --depth 1 --branch "$REF" \
|
|
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
|
|
|
|
- name: Sign packages and publish repo
|
|
env:
|
|
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
|
|
echo "GPG_PRIVATE_KEY secret is missing; refusing to publish an unsigned [breadway] repo." >&2
|
|
exit 1
|
|
fi
|
|
bash src/scripts/ci-publish-signed-repo.sh
|