donutbrowser/.github/workflows/publish-repos.yml

name: Publish Linux Repos

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v0.18.1). Leave empty for latest."
        required: false
        type: string
  workflow_run:
    workflows: ["Release"]
    types:
      - completed

permissions:
  contents: read

jobs:
  publish-repos:
    if: >
      github.repository == 'zhom/donutbrowser' &&
      (github.event_name == 'workflow_dispatch' ||
       github.event.workflow_run.conclusion == 'success')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Determine release tag
        id: tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          if [[ -n "${INPUT_TAG:-}" ]]; then
            echo "tag=${INPUT_TAG}" >> "$GITHUB_OUTPUT"
          elif [[ "${{ github.event_name }}" == "workflow_run" ]]; then
            # The Release workflow is triggered by a tag push (v*),
            # so head_branch is the tag name
            echo "tag=${{ github.event.workflow_run.head_branch }}" >> "$GITHUB_OUTPUT"
          else
            TAG=$(gh release view --repo "${{ github.repository }}" --json tagName -q .tagName)
            echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          fi

      - name: Install tools
        run: |
          # Mirror the local/Docker setup from CLAUDE.md exactly: the same apt
          # packages and the same pip-installed awscli the working local run uses.
          sudo apt-get update
          sudo apt-get install -y dpkg-dev createrepo-c python3-pip
          pip3 install --break-system-packages awscli
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Publish DEB & RPM repositories to R2
        env:
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_ENDPOINT_URL: ${{ secrets.R2_ENDPOINT_URL }}
          R2_BUCKET_NAME: ${{ secrets.R2_BUCKET_NAME }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bash scripts/publish-repo.sh "${{ steps.tag.outputs.tag }}"