ci(deb): restrict APT publish to v* release tags

Previously the workflow built and published on every push to master
and feature/debian-packaging in addition to v* tags. That meant the
gh-pages APT repo got overwritten on every commit with same-version
.debs, causing apt clients to see a phantom "update available" each
time and burning ~5-10 min of cross-compile CI per merge.

After this change:
  - PRs into master still cross-build .debs as a sanity check.
  - v* tags build, publish to gh-pages, and create a GitHub release.
  - workflow_dispatch remains as the manual escape hatch.
  - master pushes no longer trigger this workflow (ci.yml still runs).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/build-deb.yml

@@ -1,10 +1,10 @@
 name: Build Debian Packages
 
 on:
+  # APT publishing is release-driven: we build + publish only on `v*` tag
+  # pushes. PRs into master still build the .debs as a sanity check (no
+  # publish). Manual dispatch is kept as an escape hatch.
   push:
-    branches:
-      - master
-      - feature/debian-packaging
     tags:
       - "v*"
   pull_request:
@@ -231,7 +231,9 @@ jobs:
     name: Publish to APT Repository
     needs: combine-artifacts
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')
+    # Publish only on `v*` release tags — keep gh-pages stable between
+    # releases instead of overwriting same-version .debs on every commit.
+    if: startsWith(github.ref, 'refs/tags/v')
     permissions:
       contents: write
     steps:
@@ -314,8 +316,19 @@ jobs:
             done
           done
 
+      - name: Set GPG available flag
+        id: check_gpg
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+        run: |
+          if [ -n "$GPG_PRIVATE_KEY" ]; then
+            echo "available=true" >> $GITHUB_OUTPUT
+          else
+            echo "available=false" >> $GITHUB_OUTPUT
+          fi
+
       - name: Import GPG key
-        if: secrets.GPG_PRIVATE_KEY != ''
+        if: steps.check_gpg.outputs.available == 'true'
         env:
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
         run: |
@@ -323,29 +336,31 @@ jobs:
           gpg --list-secret-keys
 
       - name: Sign repository
-        if: secrets.GPG_PRIVATE_KEY != ''
+        if: steps.check_gpg.outputs.available == 'true'
         env:
           GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
         run: |
           if [ -n "$GPG_PASSPHRASE" ]; then
-            echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 \
+            echo "$GPG_PASSPHRASE" | gpg --batch --yes --no-tty --pinentry-mode loopback --passphrase-fd 0 \
               --default-key "$GPG_KEY_ID" \
               -abs -o dists/stable/Release.gpg dists/stable/Release
-            echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 \
+            echo "$GPG_PASSPHRASE" | gpg --batch --yes --no-tty --pinentry-mode loopback --passphrase-fd 0 \
               --default-key "$GPG_KEY_ID" \
               --clearsign -o dists/stable/InRelease dists/stable/Release
           else
-            gpg --batch --yes --default-key "$GPG_KEY_ID" \
+            gpg --batch --yes --no-tty --pinentry-mode loopback \
+              --default-key "$GPG_KEY_ID" \
               -abs -o dists/stable/Release.gpg dists/stable/Release
-            gpg --batch --yes --default-key "$GPG_KEY_ID" \
+            gpg --batch --yes --no-tty --pinentry-mode loopback \
+              --default-key "$GPG_KEY_ID" \
               --clearsign -o dists/stable/InRelease dists/stable/Release
           fi
           gpg --armor --export "$GPG_KEY_ID" > KEY.gpg
           echo "✓ Repository signed"
 
       - name: Create unsigned repository notice
-        if: secrets.GPG_PRIVATE_KEY == ''
+        if: steps.check_gpg.outputs.available == 'false'
         run: |
           echo "⚠️  Warning: GPG_PRIVATE_KEY not set. Repository will be UNSIGNED."
           echo "⚠️  Add GPG secrets to sign the repository automatically."

socktop_agent/debian/postinst

@@ -29,27 +29,27 @@ cat <<EOF
 ┌─────────────────────────────────────────────────────────────────────┐
 │ socktop-agent has been installed successfully!                      │
 ├─────────────────────────────────────────────────────────────────────┤
-│                                                                     │
-│ The systemd service has been installed but is NOT enabled by       │
-│ default. To enable and start the service:                          │
-│                                                                     │
-│   sudo systemctl enable --now socktop-agent                        │
-│                                                                     │
-│ To start without enabling on boot:                                 │
-│                                                                     │
-│   sudo systemctl start socktop-agent                               │
-│                                                                     │
-│ To check service status:                                           │
-│                                                                     │
-│   sudo systemctl status socktop-agent                              │
-│                                                                     │
-│ Default settings:                                                  │
-│   - Port: 3000 (use -p or --port to change)                       │
-│   - SSL/TLS: disabled (use --enableSSL to enable)                 │
-│                                                                     │
-│ For more information, see:                                         │
-│   /usr/share/doc/socktop_agent/README.md                           │
-│                                                                     │
+│                                                                      │
+│ The systemd service has been installed but is NOT enabled by        │
+│ default. To enable and start the service:                           │
+│                                                                      │
+│   sudo systemctl enable --now socktop-agent                         │
+│                                                                      │
+│ To start without enabling on boot:                                  │
+│                                                                      │
+│   sudo systemctl start socktop-agent                                │
+│                                                                      │
+│ To check service status:                                            │
+│                                                                      │
+│   sudo systemctl status socktop-agent                               │
+│                                                                      │
+│ Default settings:                                                   │
+│   - Port: 3000 (use -p or --port to change)                        │
+│   - SSL/TLS: disabled (use --enableSSL to enable)                  │
+│                                                                      │
+│ For more information, see:                                          │
+│   /usr/share/doc/socktop_agent/README.md                            │
+│                                                                      │
 └─────────────────────────────────────────────────────────────────────┘
 
 EOF