From 0d3d8ed2d2357499686d2885fae5acaf0fb0c6ac Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Mon, 2 Nov 2026 12:53:03 +0100
Subject: [PATCH] ci: the release carries the keyed flatpakref

The Bundle step copied the checkout's flatpakref into the release before
the publish step wrote the keyed one to the web root, so 1.0.0's asset
said GPGKey=GPG_KEY_BASE64_PLACEHOLDER and installing from it failed. A
step after publishing copies the web root's copy into the release files
and writes their checksums. Released as 1.0.1.
---
 .forgejo/workflows/ci.yaml                           | 12 +++++++++---
 .../flatpak/net.catcrafts.CrafterReview.metainfo.xml |  8 ++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
index 40ac771..211a1ce 100644
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@@ -259,9 +259,6 @@ jobs:
         run: |
           mkdir -p dist
           flatpak build-bundle repo "dist/crafter-review-${{ steps.meta.outputs.version }}.flatpak" "$APP_ID" stable
-          cp packaging/flatpak/net.catcrafts.CrafterReview.flatpakref dist/
-          (cd dist && sha256sum * > SHA256SUMS)
-          ls -la dist
 
       - name: Upload bundle
         uses: actions/upload-artifact@v3
@@ -296,6 +293,15 @@ jobs:
           sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/net.catcrafts.CrafterReview.flatpakref > "$WEB_DIR/net.catcrafts.CrafterReview.flatpakref"
           flock -u 9
 
+      - name: Release files
+        # The flatpakref as published, with the repo's key - the checkout's
+        # carries a placeholder - and the checksums of what the release carries.
+        run: |
+          set -eu
+          cp "$WEB_DIR/net.catcrafts.CrafterReview.flatpakref" dist/
+          (cd dist && sha256sum * > SHA256SUMS)
+          ls -la dist
+
       - name: Tag the release
         run: |
           # The release's tag at the pushed commit. Never forced: a tag that
diff --git a/packaging/flatpak/net.catcrafts.CrafterReview.metainfo.xml b/packaging/flatpak/net.catcrafts.CrafterReview.metainfo.xml
index 9013fdf..8e249d7 100644
--- a/packaging/flatpak/net.catcrafts.CrafterReview.metainfo.xml
+++ b/packaging/flatpak/net.catcrafts.CrafterReview.metainfo.xml
@@ -27,6 +27,14 @@
   </provides>
   <content_rating type="oars-1.1"/>
   <releases>
+    <release version="1.0.1" date="2026-11-02">
+      <description>
+        <p>Fixes</p>
+        <ul>
+          <li>The <code>.flatpakref</code> attached to a release carries the Catcrafts repository's key, so installing from that file works; 1.0.0's had a placeholder.</li>
+        </ul>
+      </description>
+    </release>
     <release version="1.0.0" date="2026-11-02">
       <description>
         <p>New</p>