Skip to content

ci: publish to the APT repo through the gh-action-debian-repo engine #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andresbott merged 1 commit into from
Sep 30, 2026
Merged

ci: publish to the APT repo through the gh-action-debian-repo engine #21

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 27 additions & 11 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,15 +37,31 @@ jobs:
# cross-repo PAT so goreleaser can push the cask to candy-tools/homebrew-tap
HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}

- name: Register the .deb with the Debian repo
# after goreleaser writes the .deb into dist/, hand it to
# candy-tools/debian-repo: the action writes packages/todo.json there
# and pushes it, which triggers a publish. needs a cross-repo PAT with
# contents:read+write on candy-tools/debian-repo (DEBIAN_REPO_TOKEN);
# the default GITHUB_TOKEN is scoped to this repo only, same reason as
# HOMEBREW_TAP_GITHUB_TOKEN above.
uses: candy-tools/debian-repo/.github/actions/register@main
- name: Upload the .debs for the Debian repo
# after goreleaser writes the .deb into dist/, hand it to the apt job
# below. only the .debs: dist/ also holds the binaries and archives,
# and a flat artifact means "every release" of the Debian repo.
uses: actions/upload-artifact@v4
with:
name: todo # must match the .deb's Package field (nfpms package_name)
dist-dir: dist # where goreleaser wrote the .deb files
token: ${{ secrets.DEBIAN_REPO_TOKEN }}
name: debs
path: dist/*.deb
if-no-files-found: error

# register the .deb with candy-tools/debian-repo through the
# gh-action-debian-repo engine: it writes packages/todo.json there and pushes
# it, which triggers a publish. the default GITHUB_TOKEN is scoped to this repo
# only, so it authenticates as the candy-tools GitHub App (org variable
# APT_APP_ID + secret APT_APP_PRIVATE_KEY), which mints a short-lived token
# scoped to debian-repo.
apt:
needs: release
permissions:
contents: read
uses: andresbott/gh-action-debian-repo/.github/workflows/publish.yml@v1.0.0-rc.2
with:
name: todo # must match the .deb's Package field (nfpms package_name)
artifact: debs
collection: candy-tools/debian-repo
app-id: ${{ vars.APT_APP_ID }}
secrets:
app-private-key: ${{ secrets.APT_APP_PRIVATE_KEY }}
Loading