makiolaj/calendula
1
0
Fork 1
Code Issues Pull Requests 5 Actions Releases 24 Activity

ci(release): use CODEBERG_RELEASE_TOKEN secret name
All checks were successful
Translations / check (pull_request) Successful in 6s
Details
CI / ci (pull_request) Successful in 4m29s
Details

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jean-Luc Makiola
2026-07-19 11:23:49 +02:00
parent 6a49539ae5
commit f459f7d39c
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.gitea/workflows/release.yaml
View File

@@ -360,18 +360,18 @@ jobs:
# a SHA-256 checksum. The APK is identical to the F-Droid one (same app # a SHA-256 checksum. The APK is identical to the F-Droid one (same app
# key), so this adds no trust surface. Best-effort: a Codeberg outage # key), so this adds no trust surface. Best-effort: a Codeberg outage
# (it 504s under load) must never fail an already-published F-Droid # (it 504s under load) must never fail an already-published F-Droid
# release. Needs the CODEBERG_TOKEN secret; skips cleanly if unset. # release. Needs the CODEBERG_RELEASE_TOKEN secret; skips cleanly if unset.
- name: Publish release to Codeberg - name: Publish release to Codeberg
if: env.IS_RELEASE == 'true' if: env.IS_RELEASE == 'true'
continue-on-error: true continue-on-error: true
env: env:
TOKEN: ${{ secrets.CODEBERG_TOKEN }} TOKEN: ${{ secrets.CODEBERG_RELEASE_TOKEN }}
API: https://codeberg.org/api/v1/repos/jlmakiola/calendula API: https://codeberg.org/api/v1/repos/jlmakiola/calendula
SHA: ${{ github.sha }} SHA: ${{ github.sha }}
run: | run: |
set -e set -e
if [ -z "${TOKEN:-}" ]; then if [ -z "${TOKEN:-}" ]; then
echo "CODEBERG_TOKEN not set — skipping Codeberg publish." echo "CODEBERG_RELEASE_TOKEN not set — skipping Codeberg publish."
exit 0 exit 0
fi fi
TAG="v$VERSION" TAG="v$VERSION"

6
docs/RELEASING.md
View File

@@ -96,9 +96,9 @@ aren't git objects and don't sync, so the pipeline creates the release over the
Codeberg API and attaches `calendula_v<version>.apk` + its `.sha256`. It's the Codeberg API and attaches `calendula_v<version>.apk` + its `.sha256`. It's the
same APK the F-Droid repo serves (same **app key**), so it adds no trust same APK the F-Droid repo serves (same **app key**), so it adds no trust
surface. The step is best-effort: a Codeberg outage never fails an surface. The step is best-effort: a Codeberg outage never fails an
already-published F-Droid release, and it skips cleanly if `CODEBERG_TOKEN` is already-published F-Droid release, and it skips cleanly if `CODEBERG_RELEASE_TOKEN` is
unset. One-time setup: the repo's **Releases** unit must be enabled and a unset. One-time setup: the repo's **Releases** unit must be enabled and a
`CODEBERG_TOKEN` secret (Codeberg access token, `write:repository` scope) added `CODEBERG_RELEASE_TOKEN` secret (Codeberg access token, `write:repository` scope) added
to Gitea Actions. to Gitea Actions.
### Manual re-sign / recovery ### Manual re-sign / recovery
@@ -118,7 +118,7 @@ for key rotation or repo recovery without publishing a new app version.
| `FDROID_CONFIG_BASE64` | F-Droid `config.yml` (base64) — repo metadata + keystore passwords. | | `FDROID_CONFIG_BASE64` | F-Droid `config.yml` (base64) — repo metadata + keystore passwords. |
| `HETZNER_HOST`, `HETZNER_USER`, `HETZNER_PASS` | Upload target for the F-Droid repo. | | `HETZNER_HOST`, `HETZNER_USER`, `HETZNER_PASS` | Upload target for the F-Droid repo. |
| `GITHUB_TOKEN` | Provided by Gitea Actions; used to create the release + attach assets. | | `GITHUB_TOKEN` | Provided by Gitea Actions; used to create the release + attach assets. |
| `CODEBERG_TOKEN` | Codeberg access token (`write:repository` scope) — creates the mirrored Codeberg release + uploads the APK/checksum. Best-effort; if unset the Codeberg step skips. | | `CODEBERG_RELEASE_TOKEN` | Codeberg access token (`write:repository` scope) — creates the mirrored Codeberg release + uploads the APK/checksum. Best-effort; if unset the Codeberg step skips. |
The two keys are independent: the **app key** signs APKs; the **repo key** The two keys are independent: the **app key** signs APKs; the **repo key**
signs the index (its fingerprint is what users pin). Neither key nor the signs the index (its fingerprint is what users pin). Neither key nor the