From 00ba49bfe9a13b7a780727d98defe1ecc71530e8 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 22 Jul 2026 09:44:44 +0800
Subject: [PATCH] ci: fail fast on missing signing key when regenerating
 index.json
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The remote gen-index.sh call never had MINISIGN_SEC_KEY wired through, so a
missing/misconfigured secret silently produced an unsigned index.json that
overwrote the previously-signed one instead of failing the job — this is
why bread's dev track never appeared in dl.breadway.dev/dev/index.json
after the first dev-release.yml run despite it reporting success.
---
 .forgejo/workflows/beta-release.yml | 6 ++++++
 .forgejo/workflows/dev-release.yml  | 6 ++++++
 .forgejo/workflows/release.yml      | 6 ++++++
 3 files changed, 18 insertions(+)

diff --git a/.forgejo/workflows/beta-release.yml b/.forgejo/workflows/beta-release.yml
index e452b2b..1894498 100644
--- a/.forgejo/workflows/beta-release.yml
+++ b/.forgejo/workflows/beta-release.yml
@@ -42,8 +42,14 @@ jobs:
       # No GitHub Release upload — beta, like dev, is only distributed via
       # dl.breadway.dev/beta/.
       - name: regenerate beta index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
         run: |
           set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
+            exit 1
+          fi
           rm -rf /tmp/bread-ecosystem-ci
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
           TRACK=beta bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh
diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml
index 9347e34..dc5c608 100644
--- a/.forgejo/workflows/dev-release.yml
+++ b/.forgejo/workflows/dev-release.yml
@@ -56,8 +56,14 @@ jobs:
       # spam a release per commit, so dl.breadway.dev/dev/ is the only
       # distribution point for this track.
       - name: regenerate dev index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
         run: |
           set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
+            exit 1
+          fi
           rm -rf /tmp/bread-ecosystem-ci
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
           TRACK=dev bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index fd4669c..4a7eff1 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -38,8 +38,14 @@ jobs:
           ln -sfn "${VERSION}" "/srv/breadway-dl/bread/latest"
 
       - name: regenerate index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
         run: |
           set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone)"
+            exit 1
+          fi
           rm -rf /tmp/bread-ecosystem-ci
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
           bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh