stoke/scripts/publish-deb.sh

#!/usr/bin/env bash
#
# Publish a .deb to the Forgejo Debian package registry.
#
# Usage: scripts/publish-deb.sh <path-to-deb> [owner] [distribution] [component]
#
#   owner         registry owner (user or org), default: heavy-duty
#   distribution  APT distribution, default: stable
#   component     APT component, default: main
#
# Authentication (first match wins):
#   1. STOKE_TOKEN environment variable (set from secrets.RELEASE_TOKEN in CI)
#   2. The token stored by `stoke auth login`
#
# The Forgejo URL defaults to the instance in the stoke config, falling back
# to https://forgejo.heavyduty.builders. Override with FORGE_URL.

set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

DEB="${1:?usage: publish-deb.sh <path-to-deb> [owner] [distribution] [component]}"
OWNER="${2:-heavy-duty}"
DISTRIBUTION="${3:-stable}"
COMPONENT="${4:-main}"

[ -f "$DEB" ] || { echo "error: no such file: $DEB" >&2; exit 1; }

CONFIG_JSON="$(node -e "const c = require('$ROOT/src/config').loadConfig(); if (c) process.stdout.write(JSON.stringify(c));" 2>/dev/null || true)"
TOKEN="${STOKE_TOKEN:-$(node -pe "(JSON.parse(process.argv[1] || '{}').token) || ''" "$CONFIG_JSON")}"
FORGE_URL="${FORGE_URL:-$(node -pe "(JSON.parse(process.argv[1] || '{}').url) || 'https://forgejo.heavyduty.builders'" "$CONFIG_JSON")}"

if [ -z "$TOKEN" ]; then
  cat >&2 <<'EOF'
error: no token.
  In CI, this step reads STOKE_TOKEN from secrets.RELEASE_TOKEN; an empty value
  means the secret is unset or unreadable by this workflow, not that the tool is missing.
  Locally: export STOKE_TOKEN, or run `stoke auth login`.
EOF
  exit 1
fi

if [ -n "${RUNNER_TEMP:-}" ]; then
  TMP="$(mktemp -d "$RUNNER_TEMP/stoke-publish.XXXXXX")"
else
  TMP="$(mktemp -d)"
fi
trap 'rm -rf "$TMP"' EXIT

HEADER_FILE="$TMP/authorization-header"
RESPONSE_FILE="$TMP/response"
umask 077
printf 'Authorization: token %s\n' "$TOKEN" >"$HEADER_FILE"
chmod 0600 "$HEADER_FILE"

URL="$FORGE_URL/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
echo "Uploading $(basename "$DEB") to $URL"

STATUS="$(curl -sS -o "$RESPONSE_FILE" -w '%{http_code}' \
  -X PUT -H @"$HEADER_FILE" \
  --upload-file "$DEB" "$URL")"

case "$STATUS" in
  201) echo "Published." ;;
  409) echo "Already published (409): this exact version already exists in the registry." ;;
  *)
    echo "error: upload failed with HTTP $STATUS" >&2
    cat "$RESPONSE_FILE" >&2 || true
    exit 1
    ;;
esac