It said no organisation appears "in a path, URL or workflow reference",
while the usage examples immediately above necessarily contain
`https://git.chaosbit.de/weblib/fdroid-repo-ci@main` -- a consumer has to
type this repository's address, so it cannot not appear.
A rule a file visibly breaks is worse than no rule: the next person either
"fixes" the examples or stops trusting the section. So the claim now covers
what it should -- consumer-specific things, and any named consumer -- and
calls out this repo's own address as the one deliberate exception, which is
also a useful pointer to the exact lines to edit when the repo moves org.
Found in the cold re-read of #2.
Co-authored-by: bit <bit@das-labor.org>
Adds sign-apk.sh (align-check + apksigner), fdroid-update.sh (fdroid
update over a binary repo, signing the index with its own separate
key), publish.sh (S3-compatible upload) and the composite action
tying them together, matching weblib-ci's shape.
zipalign is not a standalone nixpkgs attribute; resolved by measurement
rather than assumption that Gradle/AGP already aligns its output (Android's
own docs, corroborated by fdroidserver never shelling out to zipalign) and
added check_zip_alignment.py as the safety net, since apksigner itself does
not check alignment at all. nixpkgs is pinned via a committed nixpkgs-pin
revision, since this repo has no flake.lock of its own for with-nixpkgs.sh
to read (fdroid-repo-ci#1, weblib-ci#9) -- a missing or malformed pin fails
loudly rather than degrading to an unpinned nix shell.
No consumer repo, bucket, hostname or channel name is hard-coded: which
repo holds the keys and runs the publish has already changed once during
this issue and may again, so every example uses a placeholder.
42 offline/local-only test assertions across five suites (run_tests.sh),
including fault injection on the alignment check, the password/argument
validation, and the with-nixpkgs.sh fail-loud paths.
Co-authored-by: bit <bit@das-labor.org>
claudeandbit