Add allow-published (default false) to draft-release. When true, draft-release
permits uploading assets to an existing published release without failing or
attempting to convert it to a draft with --draft.
A new optional LINUX_SIGNING_KEY secret (an unprotected OpenPGP signing subkey, from the
release environment) signs each Linux format the way its tools check it:
- rpm: embedded signature (rpmsign), for `rpm -K` and dnf/zypper gpgcheck
- deb: embedded _gpgorigin member (debsigs) and a detached .asc
- Arch: <file>.sig, which pacman looks for
- AppImage, tar.gz, zsync: detached .asc
- Flatpak bundle: signed commit and embedded public key (flatpak-bundle.sh, via the
scaffold's new step 4), so `flatpak install` verifies it, plus a detached .asc
- Flatpak OCI image: a containers/image signature for ghcr.io/<repo>@<digest>, which Flatpak
checks from its signature lookaside; the flatpak job records the pushed manifest for it
- SHA256SUMS.txt.asc over every release asset, and release-signing-key.asc
The draft-release action signs before computing checksums (embedded signatures change the rpm
and deb files) and verifies every signature against the exported public key. The new
import-signing-key action is shared by the flatpak and release jobs and refuses a key that
needs a passphrase. Without the secret, releases are published unsigned with a warning.
draft-release and resolve-version interpolated caller-provided metadata directly
into Bash source (CWE-78):
- draft-release embedded app-title into the `title=` assignment in the step that
has GH_TOKEN available.
- resolve-version embedded input-version into a `v=` assignment before it was
validated, and app-title into the job-summary `echo`.
Both inputs now travel through the step `env:` and are read with quoted variable
expansions; the version is validated before it is used to produce outputs, and
the summary is written with a fixed `printf` format. No change to outputs or
release behavior.
Dylan M. Taylor