From 86e712d726f0a54cfb180a4921d1843a5cefbd70 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 22 Jul 2026 09:50:54 +0800
Subject: [PATCH] ci: fail fast on missing signing key in dev/beta index
 regeneration

Matches the same guard just added to bread's dev/beta workflows: a missing
BAKERY_MINISIGN_SEC_KEY_PATH secret should fail the job loudly rather than
silently publish an unsigned index.
---
 .forgejo/workflows/beta-bakery.yml      | 8 +++++++-
 .forgejo/workflows/beta-bread-theme.yml | 8 +++++++-
 .forgejo/workflows/dev-bakery.yml       | 8 +++++++-
 .forgejo/workflows/dev-bread-theme.yml  | 8 +++++++-
 4 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/.forgejo/workflows/beta-bakery.yml b/.forgejo/workflows/beta-bakery.yml
index ca2f49c..05c1774 100644
--- a/.forgejo/workflows/beta-bakery.yml
+++ b/.forgejo/workflows/beta-bakery.yml
@@ -58,4 +58,10 @@ jobs:
         env:
           MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
           TRACK: beta
-        run: cd src && bash scripts/gen-index.sh
+        run: |
+          set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
+            exit 1
+          fi
+          cd src && bash scripts/gen-index.sh
diff --git a/.forgejo/workflows/beta-bread-theme.yml b/.forgejo/workflows/beta-bread-theme.yml
index 89e3386..24bde62 100644
--- a/.forgejo/workflows/beta-bread-theme.yml
+++ b/.forgejo/workflows/beta-bread-theme.yml
@@ -53,4 +53,10 @@ jobs:
         env:
           MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
           TRACK: beta
-        run: cd src && bash scripts/gen-index.sh
+        run: |
+          set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
+            exit 1
+          fi
+          cd src && bash scripts/gen-index.sh
diff --git a/.forgejo/workflows/dev-bakery.yml b/.forgejo/workflows/dev-bakery.yml
index 3801ad0..3501c48 100644
--- a/.forgejo/workflows/dev-bakery.yml
+++ b/.forgejo/workflows/dev-bakery.yml
@@ -77,4 +77,10 @@ jobs:
         env:
           MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
           TRACK: dev
-        run: cd src && bash scripts/gen-index.sh
+        run: |
+          set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
+            exit 1
+          fi
+          cd src && bash scripts/gen-index.sh
diff --git a/.forgejo/workflows/dev-bread-theme.yml b/.forgejo/workflows/dev-bread-theme.yml
index 36694fe..75ef96e 100644
--- a/.forgejo/workflows/dev-bread-theme.yml
+++ b/.forgejo/workflows/dev-bread-theme.yml
@@ -66,4 +66,10 @@ jobs:
         env:
           MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
           TRACK: dev
-        run: cd src && bash scripts/gen-index.sh
+        run: |
+          set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
+            exit 1
+          fi
+          cd src && bash scripts/gen-index.sh