dependabot[bot] chore(actions): bump actions/checkout from 4 to 7 (#36) · 7/8/2026
2f4f7d5
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
name: Deploy APT Repository
on:
release:
types: [published]
workflow_dispatch:
permissions:
contents: read
pages: write
id-token: write
concurrency:
group: "pages"
cancel-in-progress: false
jobs:
build-and-deploy:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Fetch repository debs
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
mkdir -p public/apt/pool/main
# Ensure gh cli operates non-interactively
gh release list --limit 10 | awk '{print $1}' > releases.txt
while read -r tag; do
echo "Fetching deb packages for release $tag"
gh release download "$tag" --pattern "*.deb" --dir public/apt/pool/main/ --clobber || echo "No deb found for $tag"
done < releases.txt
if [ ! "$(ls -A public/apt/pool/main/*.deb 2>/dev/null)" ]; then
echo "No .deb files found to publish!"
exit 1
fi
- name: Setup APT Metadata
run: |
sudo apt-get update
sudo apt-get install -y dpkg-dev apt-utils
cd public/apt
# Generate Packages and Archives metadata
dpkg-scanpackages --arch amd64 pool/ > Packages
cat Packages | gzip -9c > Packages.gz
# Generate base Release file
cat <<EOF > Release
Architectures: amd64
Codename: stable
Components: main
Date: $(date -Ru)
Description: Linuxy Official APT Repository
Label: Linuxy
Origin: swadhinbiswas
Suite: stable
EOF
# Append Checksums to Release
echo "MD5Sum:" >> Release
for f in Packages Packages.gz; do
echo " $(md5sum $f | cut -d' ' -f1) $(stat -c %s $f) $f" >> Release
done
echo "SHA1:" >> Release
for f in Packages Packages.gz; do
echo " $(sha1sum $f | cut -d' ' -f1) $(stat -c %s $f) $f" >> Release
done
echo "SHA256:" >> Release
for f in Packages Packages.gz; do
echo " $(sha256sum $f | cut -d' ' -f1) $(stat -c %s $f) $f" >> Release
done
- name: Sign Repository (Optional if Keys Present)
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
run: |
if [ -z "$GPG_PRIVATE_KEY" ]; then
echo "Warning: GPG_PRIVATE_KEY secret is not set. The repository will be unsigned."
exit 0
fi
echo "$GPG_PRIVATE_KEY" > private.key
gpg --batch --import private.key
rm private.key
KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/ { print $5 }' | head -n 1)
echo "Found key: $KEY_ID"
cd public/apt
if [ -n "$GPG_PASSPHRASE" ]; then
echo "$GPG_PASSPHRASE" | gpg --default-key "$KEY_ID" --batch --yes --pinentry-mode loopback --passphrase-fd 0 -abs -o Release.gpg Release
echo "$GPG_PASSPHRASE" | gpg --default-key "$KEY_ID" --batch --yes --pinentry-mode loopback --passphrase-fd 0 --clearsign -o InRelease Release
else
gpg --default-key "$KEY_ID" --batch --yes -abs -o Release.gpg Release
gpg --default-key "$KEY_ID" --batch --yes --clearsign -o InRelease Release
fi
# Export public key so users can download it
gpg --armor --export "$KEY_ID" > linuxy.gpg.key
- name: Deploy to gh-pages branch
uses: peaceiris/actions-gh-pages@v3
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
publish_dir: ./public
keep_files: true