From 07154d9d7db0deca64ba235969fcb56d9b0f74d2 Mon Sep 17 00:00:00 2001
From: Forgejo Actions <actions@forgejo.local>
Date: Thu, 9 Jul 2026 20:31:50 +0200
Subject: fixed keys

---
 .forgejo/workflows/repoadd.yml | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

(limited to '.forgejo')

diff --git a/.forgejo/workflows/repoadd.yml b/.forgejo/workflows/repoadd.yml
index 2866720..77a3981 100644
--- a/.forgejo/workflows/repoadd.yml
+++ b/.forgejo/workflows/repoadd.yml
@@ -21,9 +21,21 @@ jobs:
           set -euo pipefail
           sudo pacman -S --needed --noconfirm pacman-contrib
 
+      - name: Import GPG signing key
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          rm -rf "$GNUPGHOME"
+          mkdir -m 700 "$GNUPGHOME"
+          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import
+          echo "gpg-agent-cache-prime" | gpg --batch --yes --pinentry-mode loopback \
+              --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
+              -u 25C7668F1235F5664F037671BDB2A9CE6EBFF113 --detach-sign --output /dev/null
+
       - name: Rebuild repo DB files
         run: |
           set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
 
           REPO_NAME="raveos-core-repo"
 
@@ -39,12 +51,18 @@ jobs:
                 "${REPO_NAME}.db.tar.xz" \
                 "${REPO_NAME}.files.tar.xz" \
                 "${REPO_NAME}.db.tar.xz.old" \
-                "${REPO_NAME}.files.tar.xz.old" || true
+                "${REPO_NAME}.files.tar.xz.old" \
+                "${REPO_NAME}.db.sig" \
+                "${REPO_NAME}.files.sig" \
+                "${REPO_NAME}.db.tar.xz.sig" \
+                "${REPO_NAME}.files.tar.xz.sig" || true
 
-          repo-add "${REPO_NAME}.db.tar.xz" ./*.pkg.tar.zst
+          repo-add -s -k 25C7668F1235F5664F037671BDB2A9CE6EBFF113 "${REPO_NAME}.db.tar.xz" ./*.pkg.tar.zst
 
           ln -sf "${REPO_NAME}.db.tar.xz" "${REPO_NAME}.db"
           ln -sf "${REPO_NAME}.files.tar.xz" "${REPO_NAME}.files"
+          ln -sf "${REPO_NAME}.db.tar.xz.sig" "${REPO_NAME}.db.sig"
+          ln -sf "${REPO_NAME}.files.tar.xz.sig" "${REPO_NAME}.files.sig"
 
           echo "=== DB files created ==="
           ls -la | grep -E "${REPO_NAME}\.(db|files)"
@@ -87,5 +105,8 @@ jobs:
       - name: Cleanup
         if: always()
         run: |
+          export GNUPGHOME=/tmp/raveos-gnupg
+          gpgconf --kill gpg-agent 2>/dev/null || true
+          rm -rf /tmp/raveos-gnupg
           sudo rm -rf /var/cache/pacman/pkg/* || true
           df -h
-- 
cgit v1.3