CI: refuse unsigned bakery index on stable tag releases

.forgejo/workflows/release.yml

@@ -22,7 +22,16 @@ jobs:
         # `backend` in config.toml. All three are ort load-dynamic (dlopen)
         # EPs, so this doesn't require the NPU/ROCm/CUDA toolkits to be
         # present on the build host — see breadmill/Cargo.toml.
-        run: cd src && bash ci/build.sh cargo build --release --locked --workspace --features full
+        run: |
+          set -euo pipefail
+          if [ ! -f src/ci/build.sh ]; then
+            echo "::error::ci/build.sh is missing — bakery release builds must go through the shared CI wrapper"
+            exit 1
+          fi
+          cd src && bash ci/build.sh cargo build --release --locked --workspace --features full || {
+            echo "::error::cargo build --release --locked failed. If Cargo.lock drifted, update and commit it; do not drop --locked."
+            exit 1
+          }
 
       - name: test
         run: cd src && bash ci/build.sh cargo test --release --locked --workspace --features full
@@ -45,8 +54,14 @@ jobs:
           ln -sfn "${VERSION}" "/srv/breadway-dl/breadsearch/latest"
 
       - name: regenerate index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
         run: |
           set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone)"
+            exit 1
+          fi
           rm -rf /tmp/bread-ecosystem-ci
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
           bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh