Answer architecture round 2: 1 🔴, 0 🟡; self-host signed apt, dnf and apk repositories on GitHub Pages in place of Cloudsmith, and keep an older tag's image while leaving latest alone

.github/workflows/packages.yml

@@ -11,7 +11,9 @@ on:
         required: true
       AUR_KEY:
         required: true
-      CLOUDSMITH_API_KEY:
+      PACKAGES_GPG_KEY:
+        required: true
+      PACKAGES_RSA_KEY:
         required: true
   workflow_dispatch:
     inputs:
@@ -34,6 +36,8 @@ jobs:
     permissions:
       contents: write
       packages: write
+    outputs:
+      latest: ${{ steps.latest.outputs.latest }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -54,8 +58,8 @@ jobs:
         with:
           go-version: ${{ steps.go.outputs.version }}
           cache: false
-      # The tap, the bucket, the AUR and the image's latest tag each hold one version, so
-      # only the latest release updates them.
+      # The tap, the bucket, the AUR, the image's latest tag and the Linux repositories each
+      # hold one version, so only the latest release updates them.
       - name: Channels holding one version
         id: latest
         env:
@@ -63,9 +67,10 @@ jobs:
           TAG: ${{ inputs.tag }}
         run: |
           if [ "$(gh release view --repo "$GITHUB_REPOSITORY" --json tagName --jq .tagName)" = "$TAG" ]; then
-            echo "skip=" >> "$GITHUB_OUTPUT"
+            echo "latest=true" >> "$GITHUB_OUTPUT"
           else
-            echo "skip=--skip=homebrew,scoop,aur,docker" >> "$GITHUB_OUTPUT"
+            echo "skip=--skip=homebrew,scoop,aur" >> "$GITHUB_OUTPUT"
+            echo "OLDER_TAG=1" >> "$GITHUB_ENV"
           fi
       - uses: docker/setup-buildx-action@v4
       - uses: docker/login-action@v4
@@ -82,20 +87,48 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
           AUR_KEY: ${{ secrets.AUR_KEY }}
-      - name: Upload to the Cloudsmith repositories
-        env:
-          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
-        run: |
-          pip install --quiet cloudsmith-cli==1.27.0
-          for f in dist/*.deb; do cloudsmith push deb --republish larvit/fejkdata/any-distro/any-version "$f"; done
-          for f in dist/*.rpm; do cloudsmith push rpm --republish larvit/fejkdata/any-distro/any-version "$f"; done
-          for f in dist/*.apk; do cloudsmith push alpine --republish larvit/fejkdata/alpine/any-version "$f"; done
       - name: The built binary and the published image print the tag
         env:
           TAG: ${{ inputs.tag }}
-          IMAGE: ${{ steps.latest.outputs.skip == '' }}
         run: |
           test "$(dist/fejkdata_linux_amd64_v1/fejkdata --version)" = "fejkdata $TAG"
-          if [ "$IMAGE" = true ]; then
-            test "$(docker run --rm "ghcr.io/larvit/fejkdata:${TAG#v}" --version)" = "fejkdata $TAG"
-          fi
+          test "$(docker run --rm "ghcr.io/larvit/fejkdata:${TAG#v}" --version)" = "fejkdata $TAG"
+
+  repos:
+    name: apt, dnf and apk repositories for ${{ inputs.tag }}
+    needs: packages
+    if: needs.packages.outputs.latest == 'true'
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: The release's Linux packages
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+        run: gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --dir packages --pattern '*.deb' --pattern '*.rpm' --pattern '*.apk'
+      - uses: docker/setup-buildx-action@v4
+      - name: Install fejkdata from each repository, then export them
+        env:
+          PACKAGES_GPG_KEY: ${{ secrets.PACKAGES_GPG_KEY }}
+          PACKAGES_RSA_KEY: ${{ secrets.PACKAGES_RSA_KEY }}
+        run: |
+          build() {
+            docker buildx build -f release-tooling/package-repos.Dockerfile \
+              --secret id=gpg,env=PACKAGES_GPG_KEY --secret id=rsa,env=PACKAGES_RSA_KEY "$@" packages
+          }
+          build --target checks --output type=local,dest=checks
+          build --target site --output type=local,dest=site
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: site
+      - id: deploy
+        uses: actions/deploy-pages@v5

.github/workflows/test.yml

@@ -78,10 +78,13 @@ jobs:
     permissions:
       contents: write
       packages: write
+      pages: write
+      id-token: write
     uses: ./.github/workflows/packages.yml
     with:
       tag: ${{ needs.release.outputs.tag }}
     secrets:
       TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
       AUR_KEY: ${{ secrets.AUR_KEY }}
-      CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
+      PACKAGES_GPG_KEY: ${{ secrets.PACKAGES_GPG_KEY }}
+      PACKAGES_RSA_KEY: ${{ secrets.PACKAGES_RSA_KEY }}