feat(release): apt/dnf/pacman repos on gh-pages, Flathub + AUR packaging, zsync, draft-then-flip publish - #35
Merged
Conversation
…, atomic publish - release.yml: publish as draft then flip (atomic for latest.json and the zsync pattern), prerelease tag support (1.2.3-rc.1 skips the manifest and the repos), apt-publish + rpm-publish jobs regenerating GPG-signed package repos on gh-pages, harden replaced by the shared _release_harden.yml (cosign 2.6.5, SPDX+CycloneDX), checkout v7.0.0 / gh-release v3.0.2 pins, bare MAJOR.MINOR.PATCH tags (org convention; android requires bare) - packaging/repo/: apt/dnf repo build scripts, Pages landing page, key README (ported from satellite), committed public key - packaging/aur/: dish-bin PKGBUILD + .SRCINFO + install scriptlets (checksums filled at first publish; see its README) - packaging/flatpak/flathub/ + docs/FLATHUB.md: pinned-source manifest and submission runbook; metainfo gains a screenshots template - scripts/build-appimage.sh: embed gh-releases-zsync update metadata and ship the .zsync - UpdatePreferenceStore: update checks default off inside Flatpak (the store owns delivery); Settings toggle still overrides - docs/PACKAGING.md, README.md: distribution channels, aarch64 decision
AUR account registration is closed, so ship Arch the same way as Debian and Fedora: a new arch-publish release job builds dish-bin from the in-tree PKGBUILD against the published release assets, GPG-signs the package and repo database, and publishes arch/x86_64/ on gh-pages. pacman -Syu then owns updates — no AUR helper, no manual bumps. packaging/aur/ stays AUR-ready for if registration reopens; landing page and docs updated.
Screenshots for the AppStream listing land in docs/screenshots/ (captured from the app, dark theme, clean profile) and the metainfo references them pinned to the release tag. Comments and docs added on this branch are reworded to the house style: why over what, colon and semicolon over the em-dash. SECURITY.md drops the .invalid placeholder for the real address the sibling repos already use, and FUNDING.yml arrives so this repo shows the same Sponsor button they do.
emir-hasanbegovic
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds every Linux distribution channel this repo was missing and reshapes the release pipeline around them.
Pipeline
releases/latestbacks both the update manifest and the AppImage zsync pattern, so a half-uploaded release must never belatest.1.2.3-rc.1) mark the release as prerelease, skiplatest.json, and skip the package repos.apt-publish/rpm-publish/arch-publishregenerate GPG-signed APT, DNF and pacman trees ongh-pages(ported from satellite; the pacman repo stands in for an AUR listing because AUR registration is closed)._release_harden.yml, canonical copy in satellite, synced like_security.yml. cosign 2.6.5, SHA cross-checked against sigstore's checksums and the android pin.MAJOR.MINOR.PATCH(android's pipeline requires bare tags); every consumer still strips a legacyv. The first release must be tagged0.1.0.Packaging
packaging/repo/: repo build scripts, the Pages landing page, and the key README. Fingerprint96FF AACB 78FE 75D1 8CEE E332 C398 1795 12D6 BDF3; the private half lives in the repo secrets and the password manager.packaging/aur/:dish-binPKGBUILD and scriptlets.arch-publishbuilds it each release; checksums stay placeholders until 0.1.0 exists (updpkgsums).packaging/flatpak/flathub/anddocs/FLATHUB.md: pinned-source manifest and the submission procedure.scripts/build-appimage.shembeds gh-releases-zsync update information and ships the.zsync.docs/screenshots/and the metainfo: four screenshots, tag-pinned URLs.App
UpdatePreferenceStore: the update check defaults off inside a Flatpak (FLATPAK_ID//.flatpak-info); the store that installed Dish also updates it. The Settings toggle still overrides and persists.Also
security@tinkernorth.invalidfor the real address the sibling repos use.After merge: tag
0.1.0. Pages is already enabled and serving the landing page; the repos populate on the first tag. AUR (packaging/aur/README.md) and Flathub (docs/FLATHUB.md) follow when registration reopens and when the listing is submitted.