From 5a04dae4712f69e8a9d96b16edefae1d4ac55ea6 Mon Sep 17 00:00:00 2001 From: jasonwitty Date: Tue, 2 Jun 2026 12:55:43 -0700 Subject: [PATCH] ci(deb): restrict APT publish to v* release tags Previously the workflow built and published on every push to master and feature/debian-packaging in addition to v* tags. That meant the gh-pages APT repo got overwritten on every commit with same-version .debs, causing apt clients to see a phantom "update available" each time and burning ~5-10 min of cross-compile CI per merge. After this change: - PRs into master still cross-build .debs as a sanity check. - v* tags build, publish to gh-pages, and create a GitHub release. - workflow_dispatch remains as the manual escape hatch. - master pushes no longer trigger this workflow (ci.yml still runs). Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/build-deb.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml index c03fe91..032c499 100644 --- a/.github/workflows/build-deb.yml +++ b/.github/workflows/build-deb.yml @@ -1,10 +1,10 @@ name: Build Debian Packages on: + # APT publishing is release-driven: we build + publish only on `v*` tag + # pushes. PRs into master still build the .debs as a sanity check (no + # publish). Manual dispatch is kept as an escape hatch. push: - branches: - - master - - feature/debian-packaging tags: - "v*" pull_request: @@ -231,7 +231,9 @@ jobs: name: Publish to APT Repository needs: combine-artifacts runs-on: ubuntu-latest - if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v') + # Publish only on `v*` release tags — keep gh-pages stable between + # releases instead of overwriting same-version .debs on every commit. + if: startsWith(github.ref, 'refs/tags/v') permissions: contents: write steps: