feat(packaging): dual-series migration publishing & dms migrate dux

- Further banner notices will show once per/shell session in notifications, dms doctor and software updates
- Doc updates to follow

Port 2.0

(cherry picked from commit 095d1c6fd5)

.github/workflows/prune-r2.yml

@@ -3,6 +3,7 @@ name: Prune Void R2 archive
 # Keeps the danklinux-void bucket inside the Cloudflare R2 free tier by
 # deleting the oldest archive/<repo>/<timestamp>/ snapshots written by
 # publish-void-r2.sh. Live repositories (<repo>/current/) are never touched.
+# <repo> comes from the listing, so new and legacy prefixes need no list.
 
 on:
   schedule:

.github/workflows/run-copr.yml

@@ -18,185 +18,141 @@ on:
         description: 'Release number (e.g., 1, 2, 3 for hotfixes)'
         required: false
         default: '1'
+      owners:
+        description: 'Copr owners to publish to'
+        required: false
+        default: 'all'
+        type: choice
+        options:
+          - all
+          - duxlabs
+          - avengemedia
 
 jobs:
-  determine-packages:
+  plan:
     runs-on: ubuntu-latest
     outputs:
-      packages: ${{ steps.set-packages.outputs.packages }}
+      matrix: ${{ steps.plan.outputs.matrix }}
+      version: ${{ steps.plan.outputs.version }}
+      release: ${{ steps.plan.outputs.release }}
     steps:
-      - name: Set package list
-        id: set-packages
+      - name: Plan owners and version
+        id: plan
+        env:
+          OWNERS: ${{ inputs.owners || 'all' }}
+          PACKAGE: ${{ inputs.package || 'dms' }}
+          VERSION: ${{ inputs.version }}
+          RELEASE: ${{ inputs.release || '1' }}
         run: |
-          PACKAGE_INPUT="${{ github.event.inputs.package || 'dms' }}"
-          echo "packages=[\"$PACKAGE_INPUT\"]" >> $GITHUB_OUTPUT
+          MATRIX=$(jq -cn --arg owners "$OWNERS" --arg pkg "$PACKAGE" '
+            [{owner: "duxlabs", suffix: ""}, {owner: "avengemedia", suffix: "_LEGACY"}]
+            | map(select($owners == "all" or .owner == $owners) | .package = $pkg)
+            | {include: .}')
+
+          if [ -z "$VERSION" ]; then
+            VERSION=$(curl -sL "https://api.github.com/repos/${{ github.repository }}/releases/latest" | jq -r '.tag_name' | sed 's/^v//')
+          fi
+          if [ -z "$VERSION" ] || [ "$VERSION" = "null" ]; then
+            echo "::error::Could not determine the latest release of ${{ github.repository }}"
+            exit 1
+          fi
+
+          echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+          echo "Building $PACKAGE $VERSION-$RELEASE for: $(jq -r '[.include[].owner] | join(", ")' <<< "$MATRIX")"
 
   build-and-upload:
-    needs: determine-packages
+    name: ${{ matrix.package }} to ${{ matrix.owner }}
+    needs: plan
     runs-on: ubuntu-latest
     strategy:
-      matrix:
-        package: ${{ fromJSON(needs.determine-packages.outputs.packages) }}
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
+    env:
+      VERSION: ${{ needs.plan.outputs.version }}
+      RELEASE: ${{ needs.plan.outputs.release }}
+      PACKAGE: ${{ matrix.package }}
+      COPR_PROJECT: ${{ matrix.owner }}/dms
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      - name: Determine version
-        id: version
-        run: |
-          # Get version from manual input or latest release
-          if [ -n "${{ github.event.inputs.version }}" ]; then
-            VERSION="${{ github.event.inputs.version }}"
-            echo "Using manual version: $VERSION"
-          else
-            VERSION=$(curl -s https://api.github.com/repos/${{ github.repository }}/releases/latest | jq -r '.tag_name' | sed 's/^v//')
-            echo "Using latest release version: $VERSION"
-          fi
-
-          RELEASE="${{ github.event.inputs.release }}"
-          if [ -z "$RELEASE" ]; then
-            RELEASE="1"
-          fi
-
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "release=$RELEASE" >> $GITHUB_OUTPUT
-          echo "✅ Building ${{ matrix.package }} version: $VERSION-$RELEASE"
-
       - name: Setup build environment
         run: |
           sudo apt-get update
-          sudo apt-get install -y rpm wget curl jq gzip
+          sudo apt-get install -y rpm wget curl jq gzip python3-pip
           mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
-          echo "✅ RPM build environment ready"
 
       - name: Download release assets
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
           cd ~/rpmbuild/SOURCES
-
-          echo "📦 Downloading DMS QML source for v${VERSION}..."
-
-          # Download DMS QML source
-          wget "https://github.com/duxlabs-dev/dux-shell/releases/download/v${VERSION}/dms-qml.tar.gz" || {
-            echo "❌ Failed to download dms-qml.tar.gz for v${VERSION}"
+          wget "https://github.com/${{ github.repository }}/releases/download/v${VERSION}/dms-qml.tar.gz" || {
+            echo "::error::Failed to download dms-qml.tar.gz for v${VERSION}"
             exit 1
           }
-
-          echo "✅ Source downloaded"
-          echo "Note: dms-cli binary will be downloaded during build based on target architecture"
           ls -lh
 
       - name: Generate stable spec file
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          RELEASE="${{ steps.version.outputs.release }}"
-          CHANGELOG_DATE="$(date '+%a %b %d %Y')"
-          PACKAGE="${{ matrix.package }}"
-
-          # Copy spec file from repository
-          cp distro/fedora/${PACKAGE}.spec ~/rpmbuild/SPECS/${PACKAGE}.spec
-
-          # Replace placeholders with actual values
-          sed -i "s/VERSION_PLACEHOLDER/${VERSION}/g" ~/rpmbuild/SPECS/${PACKAGE}.spec
-          sed -i "s/RELEASE_PLACEHOLDER/${RELEASE}/g" ~/rpmbuild/SPECS/${PACKAGE}.spec
-          sed -i "s/CHANGELOG_DATE_PLACEHOLDER/${CHANGELOG_DATE}/g" ~/rpmbuild/SPECS/${PACKAGE}.spec
-
-          echo "✅ Spec file generated for ${PACKAGE} v${VERSION}-${RELEASE}"
-          echo ""
-          echo "=== Spec file preview ==="
-          head -40 ~/rpmbuild/SPECS/${PACKAGE}.spec
+          SPEC=~/rpmbuild/SPECS/${PACKAGE}.spec
+          cp "distro/fedora/${PACKAGE}.spec" "$SPEC"
+          sed -i -e "s/VERSION_PLACEHOLDER/${VERSION}/g" \
+            -e "s/RELEASE_PLACEHOLDER/${RELEASE}/g" \
+            -e "s/CHANGELOG_DATE_PLACEHOLDER/$(date '+%a %b %d %Y')/g" "$SPEC"
+          head -40 "$SPEC"
 
       - name: Build SRPM
         id: build
         run: |
-          cd ~/rpmbuild/SPECS
-          PACKAGE="${{ matrix.package }}"
-
-          echo "🔨 Building SRPM for ${PACKAGE}..."
-          rpmbuild -bs ${PACKAGE}.spec
-
+          rpmbuild -bs ~/rpmbuild/SPECS/${PACKAGE}.spec
           SRPM=$(ls ~/rpmbuild/SRPMS/${PACKAGE}-*.src.rpm | tail -n 1)
-          SRPM_NAME=$(basename "$SRPM")
-
-          echo "srpm_path=$SRPM" >> $GITHUB_OUTPUT
-          echo "srpm_name=$SRPM_NAME" >> $GITHUB_OUTPUT
-
-          echo "✅ SRPM built: $SRPM_NAME"
-          echo ""
-          echo "=== SRPM Info ==="
+          echo "srpm_path=$SRPM" >> "$GITHUB_OUTPUT"
+          echo "srpm_name=$(basename "$SRPM")" >> "$GITHUB_OUTPUT"
           rpm -qpi "$SRPM"
 
+      # Per-owner name: two legs uploading the same artifact name get a 409.
       - name: Upload SRPM artifact
         uses: actions/upload-artifact@v5
         with:
-          name: ${{ matrix.package }}-stable-srpm-${{ steps.version.outputs.version }}
+          name: ${{ matrix.package }}-stable-srpm-${{ needs.plan.outputs.version }}-${{ matrix.owner }}
           path: ${{ steps.build.outputs.srpm_path }}
           retention-days: 90
 
       - name: Install Copr CLI
+        env:
+          COPR_LOGIN: ${{ secrets[format('COPR_LOGIN{0}', matrix.suffix)] }}
+          COPR_TOKEN: ${{ secrets[format('COPR_TOKEN{0}', matrix.suffix)] }}
         run: |
-          sudo apt-get install -y python3-pip
+          : "${COPR_LOGIN:?COPR_LOGIN${{ matrix.suffix }} is not set}" "${COPR_TOKEN:?COPR_TOKEN${{ matrix.suffix }} is not set}"
           pip3 install copr-cli
-
           mkdir -p ~/.config
-          cat > ~/.config/copr << EOF
-          [copr-cli]
-          login = ${{ secrets.COPR_LOGIN }}
-          username = avengemedia
-          token = ${{ secrets.COPR_TOKEN }}
-          copr_url = https://copr.fedorainfracloud.org
-          EOF
-          chmod 600 ~/.config/copr
-
-          echo "✅ Copr CLI configured"
-
-      - name: Determine Copr project
-        id: copr_project
-        run: |
-          PACKAGE="${{ matrix.package }}"
-          if [ "$PACKAGE" = "dms" ]; then
-            COPR_PROJECT="avengemedia/dms"
-          else
-            echo "❌ Unknown package: $PACKAGE"
-            exit 1
-          fi
-          echo "copr_project=$COPR_PROJECT" >> $GITHUB_OUTPUT
-          echo "✅ Copr project: $COPR_PROJECT"
+          umask 077
+          printf '[copr-cli]\nlogin = %s\nusername = %s\ntoken = %s\ncopr_url = https://copr.fedorainfracloud.org\n' \
+            "$COPR_LOGIN" "${{ matrix.owner }}" "$COPR_TOKEN" > ~/.config/copr
 
       - name: Upload to Copr
         run: |
           SRPM="${{ steps.build.outputs.srpm_path }}"
-          VERSION="${{ steps.version.outputs.version }}"
-          COPR_PROJECT="${{ steps.copr_project.outputs.copr_project }}"
-          PACKAGE="${{ matrix.package }}"
-
-          echo "🚀 Uploading ${PACKAGE} SRPM to ${COPR_PROJECT}..."
-          echo "   SRPM: $(basename $SRPM)"
-          echo "   Version: $VERSION"
-
+          echo "Uploading $(basename "$SRPM") to ${COPR_PROJECT}"
           BUILD_OUTPUT=$(copr-cli build "$COPR_PROJECT" "$SRPM" --nowait 2>&1)
           echo "$BUILD_OUTPUT"
 
           BUILD_ID=$(echo "$BUILD_OUTPUT" | grep -oP 'Build was added to.*\K[0-9]+' || echo "unknown")
-
           if [ "$BUILD_ID" != "unknown" ]; then
-            echo "✅ Build submitted successfully!"
-            echo "🔗 https://copr.fedorainfracloud.org/coprs/${COPR_PROJECT}/build/$BUILD_ID/"
+            echo "https://copr.fedorainfracloud.org/coprs/${COPR_PROJECT}/build/$BUILD_ID/"
           else
-            echo "⚠️  Could not extract build ID, but upload may have succeeded"
+            echo "::warning::Could not extract build ID, but upload may have succeeded"
           fi
 
       - name: Build summary
         if: always()
         run: |
-          PACKAGE="${{ matrix.package }}"
-          COPR_PROJECT="${{ steps.copr_project.outputs.copr_project }}"
-          echo "### 🎉 ${PACKAGE} Stable Build Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- **Package:** ${PACKAGE}" >> $GITHUB_STEP_SUMMARY
-          echo "- **Version:** ${{ steps.version.outputs.version }}-${{ steps.version.outputs.release }}" >> $GITHUB_STEP_SUMMARY
-          echo "- **SRPM:** ${{ steps.build.outputs.srpm_name }}" >> $GITHUB_STEP_SUMMARY
-          echo "- **Project:** https://copr.fedorainfracloud.org/coprs/${COPR_PROJECT}/" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Stable release has been built and uploaded to Copr!" >> $GITHUB_STEP_SUMMARY
+          {
+            echo "### ${PACKAGE} stable to ${{ matrix.owner }}"
+            echo ""
+            echo "- **Version:** ${VERSION}-${RELEASE}"
+            echo "- **SRPM:** ${{ steps.build.outputs.srpm_name }}"
+            echo "- **Project:** https://copr.fedorainfracloud.org/coprs/${COPR_PROJECT}/"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/run-obs.yml

@@ -16,6 +16,15 @@ on:
         description: "Release number for rebuilds (e.g., 2, 3, 4 to increment spec Release)"
         required: false
         default: ""
+      owners:
+        description: "OBS owners to publish to"
+        required: false
+        default: "all"
+        type: choice
+        options:
+          - all
+          - duxlabs
+          - avengemedia
   schedule:
     - cron: "0 2,5,14,17,20,23 * * *" # 9am, 12pm, 3pm, 6pm, 9pm, 12am EST (UTC times shown)
 
@@ -27,7 +36,7 @@ jobs:
 
     outputs:
       has_updates: ${{ steps.check.outputs.has_updates }}
-      packages: ${{ steps.check.outputs.packages }}
+      matrix: ${{ steps.check.outputs.matrix }}
       version: ${{ steps.check.outputs.version }}
 
     steps:
@@ -40,13 +49,13 @@ jobs:
       - name: Check for updates
         id: check
         env:
-          OBS_USERNAME: ${{ secrets.OBS_USERNAME }}
-          OBS_PASSWORD: ${{ secrets.OBS_PASSWORD }}
+          # duxlabs is dispatch-only until its OBS account exists; drop this gate then
+          OWNERS: ${{ github.event_name == 'workflow_dispatch' && inputs.owners || 'avengemedia' }}
         run: |
-          # Helper function to check dms-git commit
+          # The public source API needs no credentials, so one job checks every owner
           check_dms_git() {
             local CURRENT_COMMIT=$(git rev-parse --short=8 HEAD)
-            local OBS_SPEC=$(curl -s -u "$OBS_USERNAME:$OBS_PASSWORD" "https://api.opensuse.org/source/home:AvengeMedia:dms-git/dms-git/dms-git.spec" 2>/dev/null || echo "")
+            local OBS_SPEC=$(curl -s "https://api.opensuse.org/public/source/$1:dms-git/dms-git/dms-git.spec" 2>/dev/null || echo "")
             local OBS_COMMIT=$(echo "$OBS_SPEC" | grep "^Version:" | grep -oP '\.[a-f0-9]{8}' | tr -d '.' || echo "")
 
             if [[ -n "$OBS_COMMIT" && "$CURRENT_COMMIT" == "$OBS_COMMIT" ]]; then
@@ -58,14 +67,13 @@ jobs:
             fi
           }
 
-          # Helper function to check dms stable tag
           # Sets LATEST_TAG variable in parent scope if update needed
           check_dms_stable() {
-            LATEST_TAG=$(curl -s https://api.github.com/repos/duxlabs-dev/dux-shell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
-            local OBS_SPEC=$(curl -s -u "$OBS_USERNAME:$OBS_PASSWORD" "https://api.opensuse.org/source/home:AvengeMedia:dms/dms/dms.spec" 2>/dev/null || echo "")
+            LATEST_TAG=$(curl -sL https://api.github.com/repos/duxlabs-dev/dux-shell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
+            local OBS_SPEC=$(curl -s "https://api.opensuse.org/public/source/$1:dms/dms/dms.spec" 2>/dev/null || echo "")
             local OBS_VERSION=$(echo "$OBS_SPEC" | grep "^Version:" | awk '{print $2}' | xargs || echo "")
 
-            if [[ -n "$LATEST_TAG" && "$LATEST_TAG" == "$OBS_VERSION" ]]; then
+            if [[ -n "$LATEST_TAG" && "${LATEST_TAG#v}" == "$OBS_VERSION" ]]; then
               echo "📋 dms: Tag $LATEST_TAG already exists, skipping"
               return 1  # No update needed
             else
@@ -74,94 +82,85 @@ jobs:
             fi
           }
 
-          # Main logic
           REBUILD="${{ github.event.inputs.rebuild_release }}"
+          PKG="${{ github.event.inputs.package }}"
+          VERSION=""
 
-          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]] && [[ -z "${{ github.event.inputs.package }}" ]]; then
-            # Run from tag with no package specified - update stable package
-            echo "packages=dms" >> $GITHUB_OUTPUT
-            VERSION="${GITHUB_REF#refs/tags/}"
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-            echo "Triggered by tag: $VERSION (always update)"
+          # Returns via OWNER_PACKAGES, and VERSION when a stable tag is due
+          plan_owner() {
+            OWNER_PACKAGES=""
+            if [[ "${{ github.ref }}" =~ ^refs/tags/ ]] && [[ -z "$PKG" ]]; then
+              OWNER_PACKAGES="dms"
+              VERSION="${GITHUB_REF#refs/tags/}"
+              echo "Triggered by tag: $VERSION (always update)"
 
-          elif [[ "${{ github.event_name }}" == "schedule" ]]; then
-            # Scheduled run - check dms-git only
-            echo "packages=dms-git" >> $GITHUB_OUTPUT
-            if check_dms_git; then
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-            else
-              echo "has_updates=false" >> $GITHUB_OUTPUT
-            fi
+            elif [[ "${{ github.event_name }}" == "schedule" ]]; then
+              if check_dms_git "$1"; then
+                OWNER_PACKAGES="dms-git"
+              fi
 
-          elif [[ -n "${{ github.event.inputs.package }}" ]]; then
-            # Manual workflow trigger
-            PKG="${{ github.event.inputs.package }}"
+            elif [[ -n "$PKG" ]]; then
+              if [[ -n "$REBUILD" ]]; then
+                OWNER_PACKAGES="$PKG"
+                echo "🔄 Manual rebuild requested: $PKG (db$REBUILD)"
 
-            if [[ -n "$REBUILD" ]]; then
-              # Rebuild requested - always proceed
-              echo "packages=$PKG" >> $GITHUB_OUTPUT
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "🔄 Manual rebuild requested: $PKG (db$REBUILD)"
-
-            elif [[ "$PKG" == "all" ]]; then
-              # Check the stable package and build list of those needing updates
-              PACKAGES_TO_UPDATE=()
-              if check_dms_stable; then
-                PACKAGES_TO_UPDATE+=("dms")
-                if [[ -n "$LATEST_TAG" ]]; then
-                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+              elif [[ "$PKG" == "all" || "$PKG" == "dms" ]]; then
+                # "all" only checks the stable package
+                if check_dms_stable "$1"; then
+                  OWNER_PACKAGES="dms"
+                  if [[ -n "$LATEST_TAG" ]]; then
+                    VERSION="$LATEST_TAG"
+                  fi
                 fi
-              fi
 
-              if [[ ${#PACKAGES_TO_UPDATE[@]} -gt 0 ]]; then
-                echo "packages=${PACKAGES_TO_UPDATE[*]}" >> $GITHUB_OUTPUT
-                echo "has_updates=true" >> $GITHUB_OUTPUT
-                echo "✓ Packages to update: ${PACKAGES_TO_UPDATE[*]}"
-              else
-                echo "packages=" >> $GITHUB_OUTPUT
-                echo "has_updates=false" >> $GITHUB_OUTPUT
-                echo "✓ All packages up to date"
-              fi
-
-            elif [[ "$PKG" == "dms-git" ]]; then
-              if check_dms_git; then
-                echo "packages=$PKG" >> $GITHUB_OUTPUT
-                echo "has_updates=true" >> $GITHUB_OUTPUT
-              else
-                echo "packages=" >> $GITHUB_OUTPUT
-                echo "has_updates=false" >> $GITHUB_OUTPUT
-              fi
-
-            elif [[ "$PKG" == "dms" ]]; then
-              if check_dms_stable; then
-                echo "packages=$PKG" >> $GITHUB_OUTPUT
-                echo "has_updates=true" >> $GITHUB_OUTPUT
-                if [[ -n "$LATEST_TAG" ]]; then
-                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+              elif [[ "$PKG" == "dms-git" ]]; then
+                if check_dms_git "$1"; then
+                  OWNER_PACKAGES="$PKG"
                 fi
-              else
-                echo "packages=" >> $GITHUB_OUTPUT
-                echo "has_updates=false" >> $GITHUB_OUTPUT
-              fi
 
+              else
+                OWNER_PACKAGES="$PKG"
+                echo "Manual trigger: $PKG"
+              fi
             else
-              # Unknown package - proceed anyway
-              echo "packages=$PKG" >> $GITHUB_OUTPUT
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "Manual trigger: $PKG"
+              OWNER_PACKAGES="all"
             fi
+          }
+
+          # Planned per owner: the new projects may lag the legacy ones
+          INCLUDE='[]'
+          for T in duxlabs,,home:duxlabs avengemedia,_LEGACY,home:AvengeMedia; do
+            IFS=, read -r OWNER SUFFIX PROJECT <<< "$T"
+            [[ "$OWNERS" == all || "$OWNERS" == "$OWNER" ]] || continue
+            echo "==> $OWNER ($PROJECT)"
+            plan_owner "$PROJECT"
+            if [[ -z "$OWNER_PACKAGES" ]]; then
+              echo "✓ $OWNER: all packages up to date"
+              continue
+            fi
+            echo "✓ $OWNER: packages to update: $OWNER_PACKAGES"
+            INCLUDE=$(jq -c --arg o "$OWNER" --arg s "$SUFFIX" --arg p "$PROJECT" --arg k "$OWNER_PACKAGES" \
+              '. + [{owner: $o, suffix: $s, project: $p, packages: $k}]' <<< "$INCLUDE")
+          done
+
+          echo "matrix=$(jq -c '{include: .}' <<< "$INCLUDE")" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          if [[ "$INCLUDE" != "[]" ]]; then
+            echo "has_updates=true" >> "$GITHUB_OUTPUT"
           else
-            # Fallback - proceed
-            echo "packages=all" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
+            echo "has_updates=false" >> "$GITHUB_OUTPUT"
           fi
 
   update-obs:
-    name: Upload to OBS
+    name: Upload to OBS (${{ matrix.owner }})
     needs: check-updates
     runs-on: ubuntu-latest
     if: needs.check-updates.outputs.has_updates == 'true'
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.check-updates.outputs.matrix) }}
+    env:
+      OBS_BASE_PROJECT: ${{ matrix.project }}
 
     steps:
       - name: Checkout
@@ -179,12 +178,12 @@ jobs:
           # Use check-updates outputs when available
           if [[ -n "${{ needs.check-updates.outputs.version }}" ]]; then
             # Use version from check-updates job
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
+            echo "packages=${{ matrix.packages }}" >> $GITHUB_OUTPUT
             echo "version=${{ needs.check-updates.outputs.version }}" >> $GITHUB_OUTPUT
             echo "Using version from check-updates: ${{ needs.check-updates.outputs.version }}"
           elif [[ "${{ github.event_name }}" == "schedule" ]]; then
             # Scheduled run - dms-git only
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
+            echo "packages=${{ matrix.packages }}" >> $GITHUB_OUTPUT
             echo "Triggered by schedule: updating git package"
           elif [[ -n "${{ github.event.inputs.package }}" ]]; then
             # Manual workflow dispatch
@@ -192,7 +191,7 @@ jobs:
             # Determine version for dms stable using the API
             # GITHUB_REF is unreliable when "Use workflow from" a tag; API works from any ref
             if [[ "${{ github.event.inputs.package }}" == "dms" ]] || [[ "${{ github.event.inputs.package }}" == "all" ]]; then
-              LATEST_TAG=$(curl -s https://api.github.com/repos/duxlabs-dev/dux-shell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
+              LATEST_TAG=$(curl -sL https://api.github.com/repos/duxlabs-dev/dux-shell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
               if [[ -n "$LATEST_TAG" ]]; then
                 echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
                 echo "Using latest release from API: $LATEST_TAG"
@@ -204,14 +203,14 @@ jobs:
 
             # Use filtered packages from check-updates when package="all" and no rebuild/tag specified
             if [[ "${{ github.event.inputs.package }}" == "all" ]] && [[ -z "${{ github.event.inputs.rebuild_release }}" ]] && [[ ! "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-              echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
-              echo "Manual trigger: all (filtered to: ${{ needs.check-updates.outputs.packages }})"
+              echo "packages=${{ matrix.packages }}" >> $GITHUB_OUTPUT
+              echo "Manual trigger: all (filtered to: ${{ matrix.packages }})"
             else
               echo "packages=${{ github.event.inputs.package }}" >> $GITHUB_OUTPUT
               echo "Manual trigger: ${{ github.event.inputs.package }}"
             fi
           else
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
+            echo "packages=${{ matrix.packages }}" >> $GITHUB_OUTPUT
             if [[ -n "${{ needs.check-updates.outputs.version }}" ]]; then
               echo "version=${{ needs.check-updates.outputs.version }}" >> $GITHUB_OUTPUT
             fi
@@ -311,20 +310,18 @@ jobs:
           cache-dependency-path: core/go.sum
 
       - name: Install OSC
+        env:
+          OBS_USERNAME: ${{ secrets[format('OBS_USERNAME{0}', matrix.suffix)] }}
+          OBS_PASSWORD: ${{ secrets[format('OBS_PASSWORD{0}', matrix.suffix)] }}
         run: |
+          : "${OBS_USERNAME:?OBS_USERNAME${{ matrix.suffix }} is not set}" "${OBS_PASSWORD:?OBS_PASSWORD${{ matrix.suffix }} is not set}"
           sudo apt-get update
           sudo apt-get install -y osc
 
           mkdir -p ~/.config/osc
-          cat > ~/.config/osc/oscrc << EOF
-          [general]
-          apiurl = https://api.opensuse.org
-
-          [https://api.opensuse.org]
-          user = ${{ secrets.OBS_USERNAME }}
-          pass = ${{ secrets.OBS_PASSWORD }}
-          EOF
-          chmod 600 ~/.config/osc/oscrc
+          umask 077
+          printf '[general]\napiurl = https://api.opensuse.org\n\n[https://api.opensuse.org]\nuser = %s\npass = %s\n' \
+            "$OBS_USERNAME" "$OBS_PASSWORD" > ~/.config/osc/oscrc
 
       # Cache OBS bundled Go toolchains
       - name: Cache OBS bundled Go toolchains (dms-git)
@@ -405,7 +402,7 @@ jobs:
       - name: Summary
         if: always()
         run: |
-          echo "### OBS Package Upload Summary" >> $GITHUB_STEP_SUMMARY
+          echo "### OBS Package Upload Summary (${{ matrix.owner }})" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
           PACKAGES="${{ steps.packages.outputs.packages }}"
@@ -458,10 +455,10 @@ jobs:
 
               case "$PKG" in
                 dms)
-                  echo "- $STATUS_ICON **dms** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms/dms)" >> $GITHUB_STEP_SUMMARY
+                  echo "- $STATUS_ICON **dms** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/${OBS_BASE_PROJECT}:dms/dms)" >> $GITHUB_STEP_SUMMARY
                   ;;
                 dms-git)
-                  echo "- $STATUS_ICON **dms-git** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms-git/dms-git)" >> $GITHUB_STEP_SUMMARY
+                  echo "- $STATUS_ICON **dms-git** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/${OBS_BASE_PROJECT}:dms-git/dms-git)" >> $GITHUB_STEP_SUMMARY
                   ;;
               esac
             done
@@ -477,5 +474,5 @@ jobs:
               echo "" >> $GITHUB_STEP_SUMMARY
             fi
 
-            echo "Monitor build progress on [OBS project page](https://build.opensuse.org/project/show/home:AvengeMedia)." >> $GITHUB_STEP_SUMMARY
+            echo "Monitor build progress on [OBS project page](https://build.opensuse.org/project/show/${OBS_BASE_PROJECT})." >> $GITHUB_STEP_SUMMARY
           fi

.github/workflows/run-ppa.yml

@@ -16,6 +16,15 @@ on:
         description: "Release number for rebuilds (e.g., 2, 3, 4 for ppa2, ppa3, ppa4)"
         required: false
         default: ""
+      owners:
+        description: "PPA owners to publish to"
+        required: false
+        default: "all"
+        type: choice
+        options:
+          - all
+          - duxlabs
+          - avengemedia
   schedule:
     - cron: "0 2,5,14,17,20,23 * * *" # 9am, 12pm, 3pm, 6pm, 9pm, 12am EST (UTC times shown)
 
@@ -44,6 +53,8 @@ jobs:
 
       - name: Check for updates
         id: check
+        env:
+          OWNERS: ${{ inputs.owners || 'all' }}
         run: |
           chmod +x distro/scripts/ppa-sync-plan.sh
 
@@ -59,10 +70,20 @@ jobs:
             ARGS+=(--rebuild "$REBUILD_RELEASE")
           fi
 
-          TARGETS_JSON=$(distro/scripts/ppa-sync-plan.sh "${ARGS[@]}" 2> ppa-audit.log)
+          # Planned per owner: an empty new PPA needs everything, the old one may need nothing.
+          TARGETS_JSON='[]'
+          : > ppa-audit.log
+          for T in duxlabs: avengemedia:_LEGACY; do
+            OWNER="${T%%:*}" SUFFIX="${T#*:}"
+            [[ "$OWNERS" == all || "$OWNERS" == "$OWNER" ]] || continue
+            echo "~${OWNER}:" >> ppa-audit.log
+            PLAN=$(PPA_OWNER="$OWNER" distro/scripts/ppa-sync-plan.sh "${ARGS[@]}" 2>> ppa-audit.log)
+            TARGETS_JSON=$(jq -c --arg o "$OWNER" --arg s "$SUFFIX" --argjson p "$PLAN" \
+              '. + [$p[] | {owner: $o, suffix: $s, target: .}]' <<< "$TARGETS_JSON")
+          done
           cat ppa-audit.log
 
-          TARGETS=$(echo "$TARGETS_JSON" | jq -r 'join(" ")')
+          TARGETS=$(jq -r 'map(.owner + ":" + .target) | join(" ")' <<< "$TARGETS_JSON")
           if [[ "$TARGETS_JSON" != "[]" ]]; then
             echo "has_updates=true" >> "$GITHUB_OUTPUT"
             echo "targets=$TARGETS" >> "$GITHUB_OUTPUT"
@@ -76,7 +97,7 @@ jobs:
           fi
 
   upload-ppa:
-    name: Upload ${{ matrix.target }}
+    name: Upload ${{ matrix.owner }} ${{ matrix.target }}
     needs: check-updates
     runs-on: ubuntu-latest
     if: needs.check-updates.outputs.has_updates == 'true'
@@ -84,9 +105,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJson(needs.check-updates.outputs.targets_json) }}
+        include: ${{ fromJson(needs.check-updates.outputs.targets_json) }}
     concurrency:
-      group: ppa-dms-${{ matrix.target }}
+      group: ppa-dms-${{ matrix.owner }}-${{ matrix.target }}
       cancel-in-progress: false
 
     steps:
@@ -118,8 +139,9 @@ jobs:
 
       - name: Configure GPG
         env:
-          GPG_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_KEY: ${{ secrets[format('GPG_PRIVATE_KEY{0}', matrix.suffix)] }}
         run: |
+          : "${GPG_KEY:?GPG_PRIVATE_KEY${{ matrix.suffix }} is not set}"
           echo "$GPG_KEY" | gpg --import
           GPG_KEY_ID=$(gpg --list-secret-keys --keyid-format LONG | grep sec | awk '{print $2}' | cut -d'/' -f2)
           echo "DEBSIGN_KEYID=$GPG_KEY_ID" >> "$GITHUB_ENV"
@@ -127,9 +149,11 @@ jobs:
       - name: Upload target
         env:
           TARGET: ${{ matrix.target }}
-          LAUNCHPAD_SSH_PRIVATE_KEY: ${{ secrets.LAUNCHPAD_SSH_PRIVATE_KEY }}
-          LAUNCHPAD_SSH_LOGIN: ${{ secrets.LAUNCHPAD_SSH_LOGIN }}
+          PPA_OWNER: ${{ matrix.owner }}
+          LAUNCHPAD_SSH_PRIVATE_KEY: ${{ secrets[format('LAUNCHPAD_SSH_PRIVATE_KEY{0}', matrix.suffix)] }}
+          LAUNCHPAD_SSH_LOGIN: ${{ secrets[format('LAUNCHPAD_SSH_LOGIN{0}', matrix.suffix)] }}
         run: |
+          : "${LAUNCHPAD_SSH_PRIVATE_KEY:?LAUNCHPAD_SSH_PRIVATE_KEY${{ matrix.suffix }} is not set}" "${LAUNCHPAD_SSH_LOGIN:?LAUNCHPAD_SSH_LOGIN${{ matrix.suffix }} is not set}"
           IFS=':' read -r PACKAGE UBUNTU_SERIES PPA_NUM <<< "$TARGET"
 
           case "$PACKAGE" in
@@ -138,7 +162,7 @@ jobs:
             *) echo "::error::Unknown package $PACKAGE"; exit 1 ;;
           esac
 
-          echo "Uploading $PACKAGE to $PPA_NAME/$UBUNTU_SERIES with ppa$PPA_NUM"
+          echo "Uploading $PACKAGE to ~$PPA_OWNER/$PPA_NAME/$UBUNTU_SERIES with ppa$PPA_NUM"
           bash distro/scripts/ppa-upload.sh "$PACKAGE" "$PPA_NAME" "$UBUNTU_SERIES" "$PPA_NUM"
 
       - name: Summary
@@ -146,6 +170,7 @@ jobs:
         run: |
           echo "### PPA Package Upload" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **Owner:** ${{ matrix.owner }}" >> "$GITHUB_STEP_SUMMARY"
           echo "- **Target:** ${{ matrix.target }}" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **DMS PPA:** https://launchpad.net/~avengemedia/+archive/ubuntu/dms/+packages" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **DMS-Git PPA:** https://launchpad.net/~avengemedia/+archive/ubuntu/dms-git/+packages" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **DMS PPA:** https://launchpad.net/~${{ matrix.owner }}/+archive/ubuntu/dms/+packages" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **DMS-Git PPA:** https://launchpad.net/~${{ matrix.owner }}/+archive/ubuntu/dms-git/+packages" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/run-xbps.yml

@@ -43,11 +43,11 @@ jobs:
       - name: Check published commit
         id: check
         env:
-          MANIFEST_URL: https://void.danklinux.com/dms/current/manifest.json
+          MANIFEST_URL: https://void.duxlabs.dev/dms/current/manifest.json
         run: |
           SHOULD_BUILD=true
           if [ "${{ github.event_name }}" = "schedule" ]; then
-            # dms/current is shared with dux-repo; read this repo's own entry
+            # dux-repo's legacy greeter mirror also writes dms/current; read this repo's own entry
             PUBLISHED_COMMIT="$(curl -fsSL --retry 3 "$MANIFEST_URL" \
               | jq -r --arg repo "${{ github.repository }}" '.sources[$repo] // .source_commit // empty' 2>/dev/null || true)"
             if [ "$PUBLISHED_COMMIT" = "${{ github.sha }}" ]; then
@@ -159,8 +159,8 @@ jobs:
       - name: Configure repositories
         run: |
           # Append the repository to repos-remote templates so xbps-src translates it automatically
-          echo "repository=https://void.danklinux.com/danklinux/current" >> void-packages/etc/xbps.d/repos-remote.conf
-          echo "repository=https://void.danklinux.com/danklinux/current" >> void-packages/etc/xbps.d/repos-remote-x86_64-multilib.conf
+          echo "repository=https://void.duxlabs.dev/dux-repo/current" >> void-packages/etc/xbps.d/repos-remote.conf
+          echo "repository=https://void.duxlabs.dev/dux-repo/current" >> void-packages/etc/xbps.d/repos-remote-x86_64-multilib.conf
 
           # Add any existing compiled packages to the build cache directory to avoid rebuilds
           if [ -d "r2-repo/current" ]; then
@@ -278,36 +278,9 @@ jobs:
           fi
 
       - name: Index and sign repository
-        run: |
-          cd r2-repo/current
-
-          rm -f *.sig
-
-          # Guard: nothing to index if no .xbps files exist
-          if ! ls *.xbps 1>/dev/null 2>&1; then
-            echo "⚠️ No .xbps files found to index, skipping."
-            exit 0
-          fi
-
-          # Regenerate repo index
-          xbps-rindex -a $(pwd)/*.xbps
-          xbps-rindex --remove-obsoletes $(pwd)
-
-          # Remove signatures left behind by obsolete packages. Signatures for
-          # unchanged immutable packages are retained byte-for-byte.
-          for sig in *.sig2; do
-            [ -e "$sig" ] || break
-            [ -f "${sig%.sig2}" ] || rm -f "$sig"
-          done
-
-          # Sign repository
-          echo "${{ secrets.XBPS_PRIVATE_KEY }}" > /tmp/xbps_privkey.pem
-          chmod 600 /tmp/xbps_privkey.pem
-
-          xbps-rindex --sign --signedby "AvengeMedia <[email protected]>" --privkey /tmp/xbps_privkey.pem $(pwd)
-          xbps-rindex --sign-pkg --privkey /tmp/xbps_privkey.pem $(pwd)/*.xbps
-
-          rm -f /tmp/xbps_privkey.pem
+        env:
+          XBPS_PRIVATE_KEY: ${{ secrets.XBPS_PRIVATE_KEY }}
+        run: bash .github/scripts/publish-void-r2.sh index
 
       - name: Publish repository to R2
         run: bash .github/scripts/publish-void-r2.sh publish