Cargo.toml can drift stale relative to the actual last release (observed
on breadbox/breadpad/breadcrumbs/breadpaper), which made the auto-bumped
dev version sort as OLDER than what's already installed — bakery's semver
check correctly refused those "updates". Deriving the base version from
git ls-remote --tags instead is self-healing regardless of Cargo.toml
drift, with a Cargo.toml fallback only for a repo with no tags yet.
The fixed /tmp/bread-ecosystem-ci path races when multiple repos' dev/beta
workflows run close together on the same self-hosted runner — one job's
rm -rf/clone can stomp another's in-progress checkout, causing the
regenerate-index step to fail intermittently. Switch to mktemp -d.
The TRACK-aware gen-index.sh only exists on bread-ecosystem's dev branch
so far (not yet merged to main). Without --branch dev, the remote clone
defaulted to main and silently ran the old track-blind script, which is
why dl.breadway.dev/dev/index.json never actually picked up bread's dev
builds despite the workflow reporting success.
The remote gen-index.sh call never had MINISIGN_SEC_KEY wired through, so a
missing/misconfigured secret silently produced an unsigned index.json that
overwrote the previously-signed one instead of failing the job — this is
why bread's dev track never appeared in dl.breadway.dev/dev/index.json
after the first dev-release.yml run despite it reporting success.
Mirrors the new stable/beta/dev track feature landing in bread-ecosystem's
bakery. dev-release.yml publishes on every push to dev; beta-release.yml
publishes on a beta-v* tag. Both skip the GitHub Release upload step and
publish to dl.breadway.dev/{dev,beta}/bread/ via gen-index.sh's new TRACK
env var. See bread-ecosystem/docs/release-channels.md for the full policy.
