ci(srtla): dispatch-only publish + standardize apt-reindex payload

.github/workflows/publish-release.yml

@@ -137,8 +137,8 @@ jobs:
             dist/*.tar.gz
             dist/*.sha256
 
-  sign-and-publish:
-    name: Sign and Publish to R2
+  publish:
+    name: Publish receiver .deb
     needs: [calculate-version, build-deb]
     runs-on: ubuntu-latest
     permissions:
@@ -159,66 +159,20 @@ jobs:
           cp artifacts/srtla-arm64/*.sha256 dist/release/
           cp artifacts/srtla-amd64/*.sha256 dist/release/
 
-      - name: Import GPG key
-        run: |
-          echo "${{ secrets.DEB_SIGNING_KEY_B64 }}" | base64 -d | gpg --batch --import
-
-      - name: Install apt-utils
-        run: sudo apt-get update && sudo apt-get install -y apt-utils
-
-      - name: Generate and sign repo metadata (arm64)
-        run: |
-          cd dist/arm64
-          dpkg-scanpackages . > Packages
-          gzip -k Packages
-          apt-ftparchive release . > Release
-          gpg --batch --yes -abs -o Release.gpg Release
-          gpg --batch --yes --clearsign -o InRelease Release
+      # No per-repo APT metadata here: index ownership is centralized in
+      # CERALIVE/apt-worker. This job attaches the receiver .deb to the GitHub
+      # release, then fires an `apt-reindex` repository_dispatch (below) so the
+      # worker regenerates and signs Packages/Release once per channel — no
+      # per-repo reindex race. R2 upload is handled by apt-worker.
 
-      - name: Generate and sign repo metadata (amd64)
-        run: |
-          cd dist/amd64
-          dpkg-scanpackages . > Packages
-          gzip -k Packages
-          apt-ftparchive release . > Release
-          gpg --batch --yes -abs -o Release.gpg Release
-          gpg --batch --yes --clearsign -o InRelease Release
-
-      - name: Ensure AWS CLI
-        run: |
-          # ubuntu-latest ships AWS CLI v2 preinstalled; `aws/install` without
-          # --update aborts on a preexisting install. Only fetch when absent.
-          if ! command -v aws >/dev/null; then
-            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-            unzip -q awscliv2.zip
-            sudo ./aws/install
-          fi
-          aws --version
-
-      - name: Upload to R2
-        env:
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          CHANNEL: ${{ needs.calculate-version.outputs.channel }}
-          # aws-cli >= 2.23 sends CRC32/CRC64NVME integrity checksums on every
-          # request by default; Cloudflare R2 does not implement them and rejects
-          # the call. Restore the pre-2.23 behavior so the cp uploads succeed.
-          AWS_REQUEST_CHECKSUM_CALCULATION: when_required
-          AWS_RESPONSE_CHECKSUM_VALIDATION: when_required
-        run: |
-          aws configure set aws_access_key_id "$R2_ACCESS_KEY_ID"
-          aws configure set aws_secret_access_key "$R2_SECRET_ACCESS_KEY"
-
-          # R2 returns NoSuchKey from ListObjectsV2 for a not-yet-existing
-          # prefix, which breaks `aws s3 sync` on the first upload to a channel.
-          # `cp --recursive` uploads without diffing the destination: it
-          # overwrites the apt metadata and accumulates per-version .debs.
-          aws s3 cp dist/arm64/ "s3://$R2_BUCKET/dists/$CHANNEL/binary-arm64/" \
-            --recursive --endpoint-url "$R2_ENDPOINT"
-          aws s3 cp dist/amd64/ "s3://$R2_BUCKET/dists/$CHANNEL/binary-amd64/" \
-            --recursive --endpoint-url "$R2_ENDPOINT"
+      - name: Trigger centralized APT reindex
+        uses: peter-evans/repository-dispatch@v3
+        with:
+          token: ${{ secrets.CERALIVE_DISPATCH_TOKEN }}
+          repository: CERALIVE/apt-worker
+          event-type: apt-reindex
+          client-payload: >-
+            {"component":"srtla","repo":"srtla","channel":"${{ needs.calculate-version.outputs.channel }}","tag":"v${{ needs.calculate-version.outputs.version }}","version":"${{ needs.calculate-version.outputs.version }}"}
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2