Beta is now a real stabilization branch: publishes on every push to
`beta` (mirroring dev's model, auto-versioned X.Y.Z-beta.<ts>+<sha>,
base version from the latest published tag) instead of a manual
beta-v* tag. Fixes made during the freeze land via fix/<issue> branches
merged into `beta` directly. The gen-index.sh clone for beta pulls
bread-ecosystem's default branch (main) rather than pinning to dev,
since beta is the more stable track and main now carries the
TRACK-aware script.
The fixed /tmp/bread-ecosystem-ci path races when multiple repos' dev/beta
workflows run close together on the same self-hosted runner — one job's
rm -rf/clone can stomp another's in-progress checkout, causing the
regenerate-index step to fail intermittently. Switch to mktemp -d.
The TRACK-aware gen-index.sh only exists on bread-ecosystem's dev branch
so far (not yet merged to main). Without --branch dev, the remote clone
defaulted to main and silently ran the old track-blind script, which is
why dl.breadway.dev/dev/index.json never actually picked up bread's dev
builds despite the workflow reporting success.
The remote gen-index.sh call never had MINISIGN_SEC_KEY wired through, so a
missing/misconfigured secret silently produced an unsigned index.json that
overwrote the previously-signed one instead of failing the job — this is
why bread's dev track never appeared in dl.breadway.dev/dev/index.json
after the first dev-release.yml run despite it reporting success.
Mirrors the new stable/beta/dev track feature landing in bread-ecosystem's
bakery. dev-release.yml publishes on every push to dev; beta-release.yml
publishes on a beta-v* tag. Both skip the GitHub Release upload step and
publish to dl.breadway.dev/{dev,beta}/bread/ via gen-index.sh's new TRACK
env var. See bread-ecosystem/docs/release-channels.md for the full policy.
