fix flatpak key again.

fix(flatpak): regenerate summary in publish jobs, add flatpak tooling + gpg key

Author: Philipp Wagner <philipp@wagnersnetz.de>

.github/workflows/nightly-artifacts.yml

@@ -12,7 +12,7 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 permissions:
-  contents: read
+  contents: write
   packages: write
 
 jobs:
@@ -453,18 +453,103 @@ jobs:
                   path: flatpak-src/KST4Contest
           EOF
 
-      - name: Build Flatpak bundle
+      - name: Import Flatpak signing key
+        run: |
+          echo "${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}" | gpg --batch --import
+          FLATPAK_GPG_KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr/{print $10; exit}')
+          echo "FLATPAK_GPG_KEY_ID=$FLATPAK_GPG_KEY_ID" >> "$GITHUB_ENV"
+
+      - name: Build Flatpak repo (nightly)
         run: |
           flatpak-builder --force-clean target/flatpak-build target/de.x08.KST4Contest.yml
-          flatpak build-export target/flatpak-repo target/flatpak-build
+          flatpak build-export --gpg-sign="$FLATPAK_GPG_KEY_ID" target/flatpak-repo target/flatpak-build nightly
-          flatpak build-bundle target/flatpak-repo "dist/${ASSET_BASENAME}-linux-x86_64.flatpak" de.x08.KST4Contest
+          flatpak build-update-repo --gpg-sign="$FLATPAK_GPG_KEY_ID" target/flatpak-repo
 
-      - name: Upload Flatpak artifact
+      - name: Create flatpakref (nightly)
+        run: |
+          REPO_NAME="${GITHUB_REPOSITORY#*/}"
+          PAGES_URL="https://${GITHUB_REPOSITORY_OWNER}.github.io/${REPO_NAME}/"
+          GPG_KEY_B64=$(gpg --export "$FLATPAK_GPG_KEY_ID" | base64 -w 0)
+          cat > "dist/de.x08.KST4Contest.nightly.flatpakref" << EOF
+          [Flatpak Ref]
+          Name=de.x08.KST4Contest
+          Branch=nightly
+          Title=KST4Contest (Nightly) – ON4KST Chat Client
+          Url=${PAGES_URL}
+          RuntimeRepo=https://flathub.org/repo/flathub.flatpakrepo
+          GPGKey=${GPG_KEY_B64}
+          IsRuntime=false
+          EOF
+
+      - name: Upload flatpakref
         uses: actions/upload-artifact@v4.3.4
         with:
-          name: linux-flatpak
+          name: flatpakref
-          path: dist/KST4Contest-*-linux-x86_64.flatpak
+          path: dist/de.x08.KST4Contest.nightly.flatpakref
-          retention-days: 14
+
+      - name: Upload Flatpak OSTree repo
+        uses: actions/upload-artifact@v4.3.4
+        with:
+          name: flatpak-ostree-repo
+          path: target/flatpak-repo/
+
+  publish-flatpak-repo:
+    name: Publish Flatpak OSTree Repo (nightly)
+    runs-on: ubuntu-latest
+    needs: build-flatpak
+
+    steps:
+      - name: Install Flatpak tooling
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends flatpak
+
+      - name: Import Flatpak signing key
+        run: |
+          echo "${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}" | gpg --batch --import
+          echo "FLATPAK_GPG_KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr/{print $10; exit}')" >> "$GITHUB_ENV"
+
+      - name: Download OSTree repo artifact
+        uses: actions/download-artifact@v4.1.3
+        with:
+          name: flatpak-ostree-repo
+          path: flatpak-ostree-repo/
+
+      - name: Checkout existing flatpak-repo branch
+        uses: actions/checkout@v4.1.7
+        with:
+          ref: flatpak-repo
+          path: existing-flatpak-repo
+
+      - name: Merge nightly build into flatpak-repo
+        run: |
+          cd existing-flatpak-repo
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          # Copy the new OSTree build into the repo
+          rsync -a ../flatpak-ostree-repo/ ./
+          # Regenerate summary with all branches
+          flatpak build-update-repo --gpg-sign="$FLATPAK_GPG_KEY_ID" .
+          # Generate .flatpakrepo with embedded GPG key so users can do remote-add without errors
+          REPO_NAME="${GITHUB_REPOSITORY#*/}"
+          PAGES_URL="https://${GITHUB_REPOSITORY_OWNER}.github.io/${REPO_NAME}/"
+          GPG_KEY_B64=$(gpg --export "$FLATPAK_GPG_KEY_ID" | base64 -w 0)
+          cat > kst4contest.flatpakrepo << EOF
+          [Flatpak Repo]
+          Title=KST4Contest
+          Url=${PAGES_URL}
+          Homepage=https://github.com/${GITHUB_REPOSITORY}
+          Comment=KST4Contest – ON4KST Chat Client for VHF/UHF contests
+          GPGKey=${GPG_KEY_B64}
+          EOF
+          # Stage all changes (new/updated refs, summary, objects in OSTree)
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "Nightly flatpak: $(echo ${{ github.sha }} | cut -c1-7)"
+            git push https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git HEAD:flatpak-repo
+          fi
 
   build-macos-dmg:
     name: Build macOS DMG (${{ matrix.os }})

.github/workflows/tagged-release.yml

@@ -408,10 +408,18 @@ jobs:
           FLATPAK_GPG_KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr/{print $10; exit}')
           echo "FLATPAK_GPG_KEY_ID=$FLATPAK_GPG_KEY_ID" >> "$GITHUB_ENV"
 
+      - name: Determine OSTree branch
+        run: |
+          if [[ "${{ github.ref_name }}" == beta-* ]]; then
+            echo "OSTREE_BRANCH=beta" >> "$GITHUB_ENV"
+          else
+            echo "OSTREE_BRANCH=stable" >> "$GITHUB_ENV"
+          fi
+
       - name: Build Flatpak repo
         run: |
           flatpak-builder --force-clean target/flatpak-build target/de.x08.KST4Contest.yml
-          flatpak build-export --gpg-sign="$FLATPAK_GPG_KEY_ID" target/flatpak-repo target/flatpak-build stable
+          flatpak build-export --gpg-sign="$FLATPAK_GPG_KEY_ID" target/flatpak-repo target/flatpak-build "$OSTREE_BRANCH"
           flatpak build-update-repo --gpg-sign="$FLATPAK_GPG_KEY_ID" target/flatpak-repo
 
       - name: Create flatpakref
@@ -419,11 +427,11 @@ jobs:
           REPO_NAME="${GITHUB_REPOSITORY#*/}"
           PAGES_URL="https://${GITHUB_REPOSITORY_OWNER}.github.io/${REPO_NAME}/"
           GPG_KEY_B64=$(gpg --export "$FLATPAK_GPG_KEY_ID" | base64 -w 0)
-          cat > "dist/de.x08.KST4Contest.flatpakref" << EOF
+          cat > "dist/de.x08.KST4Contest.${OSTREE_BRANCH}.flatpakref" << EOF
           [Flatpak Ref]
           Name=de.x08.KST4Contest
-          Branch=stable
+          Branch=${OSTREE_BRANCH}
-          Title=KST4Contest – ON4KST Chat Client
+          Title=KST4Contest (${{ startsWith(github.ref_name, 'beta-') && 'Beta' || 'Release' }}) – ON4KST Chat Client
           Url=${PAGES_URL}
           RuntimeRepo=https://flathub.org/repo/flathub.flatpakrepo
           GPGKey=${GPG_KEY_B64}
@@ -434,7 +442,7 @@ jobs:
         uses: actions/upload-artifact@v4.3.4
         with:
           name: flatpakref
-          path: dist/de.x08.KST4Contest.flatpakref
+          path: dist/de.x08.KST4Contest.*.flatpakref
 
       - name: Upload Flatpak OSTree repo
         uses: actions/upload-artifact@v4.3.4
@@ -576,32 +584,60 @@ jobs:
           path: dist/KST4Contest-${{ github.ref_name }}-manual-*.pdf
 
   publish-flatpak-repo:
-    name: Publish Flatpak OSTree Repo to GitHub Pages
+    name: Publish Flatpak OSTree Repo (${{ github.ref_name }})
     runs-on: ubuntu-latest
     needs: build-flatpak
 
     steps:
+      - name: Install Flatpak tooling
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends flatpak
+
+      - name: Import Flatpak signing key
+        run: |
+          echo "${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}" | gpg --batch --import
+          echo "FLATPAK_GPG_KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr/{print $10; exit}')" >> "$GITHUB_ENV"
+
       - name: Download OSTree repo artifact
         uses: actions/download-artifact@v4.1.3
         with:
           name: flatpak-ostree-repo
           path: flatpak-ostree-repo/
 
-      - name: Download flatpakref
+      - name: Checkout existing flatpak-repo branch
-        uses: actions/download-artifact@v4.1.3
+        uses: actions/checkout@v4.1.7
         with:
-          name: flatpakref
+          ref: flatpak-repo
-          path: flatpak-ostree-repo/
+          path: existing-flatpak-repo
 
-      - name: Push to flatpak-repo branch
+      - name: Merge build into flatpak-repo
         run: |
-          cd flatpak-ostree-repo
+          cd existing-flatpak-repo
-          git init
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config user.name "github-actions[bot]"
+          rsync -a ../flatpak-ostree-repo/ ./
+          # Regenerate summary with all branches (not just the one just built)
+          flatpak build-update-repo --gpg-sign="$FLATPAK_GPG_KEY_ID" .
+          # Generate .flatpakrepo with embedded GPG key so users can do remote-add without errors
+          REPO_NAME="${GITHUB_REPOSITORY#*/}"
+          PAGES_URL="https://${GITHUB_REPOSITORY_OWNER}.github.io/${REPO_NAME}/"
+          GPG_KEY_B64=$(gpg --export "$FLATPAK_GPG_KEY_ID" | base64 -w 0)
+          cat > kst4contest.flatpakrepo << EOF
+          [Flatpak Repo]
+          Title=KST4Contest
+          Url=${PAGES_URL}
+          Homepage=https://github.com/${GITHUB_REPOSITORY}
+          Comment=KST4Contest – ON4KST Chat Client for VHF/UHF contests
+          GPGKey=${GPG_KEY_B64}
+          EOF
           git add -A
-          git commit -m "Flatpak repo: ${{ github.ref_name }}"
+          if git diff --cached --quiet; then
-          git push --force https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git HEAD:flatpak-repo
+            echo "No changes to commit"
+          else
+            git commit -m "Flatpak repo: ${{ github.ref_name }}"
+            git push https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git HEAD:flatpak-repo
+          fi
 
   release-tag:
     name: Publish Tagged Release

github_docs/de-Installation.md

@@ -116,12 +116,47 @@ Die Datei `de.x08.KST4Contest.flatpakref` aus dem [aktuellen Release](https://gi
 flatpak install de.x08.KST4Contest.flatpakref
 ```
 
-Oder den Remote manuell hinzufügen:
+Oder den Remote manuell hinzufügen (empfohlen für Nightly/Beta-Zugriff):
 ```bash
-flatpak remote-add kst4contest https://praktimarc.github.io/kst4contest/
+flatpak remote-add --if-not-exists kst4contest https://praktimarc.github.io/kst4contest/kst4contest.flatpakrepo
 flatpak install kst4contest de.x08.KST4Contest
 ```
 
+#### Flatpak-Kanäle (nightly / beta / stable)
+
+Das Flatpak-Repository enthält drei Kanäle, die alle im selben Remote liegen:
+
+| Kanal | Inhalt | Wird gebaut bei |
+|---|---|---|
+| `stable` | Aktuelle stabile Version | Jedem normalen Release-Tag |
+| `beta` | Vorab-Version | Tags mit `beta-` Präfix |
+| `nightly` | Entwicklungsstand (main-Branch) | Täglich / jedem Push auf main |
+
+Remote einmalig hinzufügen, dann den gewünschten Kanal installieren:
+
+```bash
+flatpak remote-add --if-not-exists kst4contest https://praktimarc.github.io/kst4contest/kst4contest.flatpakrepo
+
+# Stable (Standard)
+flatpak install kst4contest de.x08.KST4Contest
+
+# Beta
+flatpak install kst4contest de.x08.KST4Contest//beta
+
+# Nightly
+flatpak install kst4contest de.x08.KST4Contest//nightly
+```
+
+> **Hinweis:** Flatpak erlaubt nur eine installierte Version pro App-ID gleichzeitig. Um den Kanal zu wechseln, zuerst die aktuelle Version deinstallieren:
+> ```bash
+> flatpak uninstall de.x08.KST4Contest
+> flatpak install kst4contest de.x08.KST4Contest//nightly
+> ```
+
+Updates erfolgen wie gewohnt mit `flatpak update`.
+
+Die `flatpakref`-Dateien für Beta und Stable liegen jeweils im entsprechenden [GitHub-Release](https://github.com/praktimarc/kst4contest/releases). Das Nightly-`flatpakref` (`de.x08.KST4Contest.nightly.flatpakref`) ist als Artifact im [GitHub Actions](https://github.com/praktimarc/kst4contest/actions)-Tab verfügbar (wird 14 Tage aufbewahrt) – der Remote-Weg oben ist für Nightly daher meist einfacher.
+
 ### macOS
 1. DMG-Datei für die eigene Architektur herunterladen (Apple Silicon oder Intel).
 2. DMG-Datei öffnen.

github_docs/en-Installation.md

@@ -116,12 +116,47 @@ Download `de.x08.KST4Contest.flatpakref` from the [latest release](https://githu
 flatpak install de.x08.KST4Contest.flatpakref
 ```
 
-Or add the remote manually:
+Or add the remote manually (recommended for nightly/beta access):
 ```bash
-flatpak remote-add kst4contest https://praktimarc.github.io/kst4contest/
+flatpak remote-add --if-not-exists kst4contest https://praktimarc.github.io/kst4contest/kst4contest.flatpakrepo
 flatpak install kst4contest de.x08.KST4Contest
 ```
 
+#### Flatpak Channels (nightly / beta / stable)
+
+The Flatpak repository provides three channels, all served from the same remote:
+
+| Channel | Content | Built on |
+|---|---|---|
+| `stable` | Current stable version | Every normal release tag |
+| `beta` | Pre-release version | Tags prefixed with `beta-` |
+| `nightly` | Development build (main branch) | Every push to main / daily |
+
+Add the remote once, then install the channel you want:
+
+```bash
+flatpak remote-add --if-not-exists kst4contest https://praktimarc.github.io/kst4contest/kst4contest.flatpakrepo
+
+# Stable (default)
+flatpak install kst4contest de.x08.KST4Contest
+
+# Beta
+flatpak install kst4contest de.x08.KST4Contest//beta
+
+# Nightly
+flatpak install kst4contest de.x08.KST4Contest//nightly
+```
+
+> **Note:** Flatpak only allows one installed version per App-ID at a time. To switch channels, uninstall the current version first:
+> ```bash
+> flatpak uninstall de.x08.KST4Contest
+> flatpak install kst4contest de.x08.KST4Contest//nightly
+> ```
+
+Updates work as usual with `flatpak update`.
+
+The `flatpakref` files for beta and stable are attached to their respective [GitHub Releases](https://github.com/praktimarc/kst4contest/releases). The nightly `flatpakref` (`de.x08.KST4Contest.nightly.flatpakref`) is available as an artifact on the [GitHub Actions](https://github.com/praktimarc/kst4contest/actions) tab (kept for 14 days) — for nightly builds, the manual remote approach above is usually more convenient.
+
 ### macOS
 1. Download the DMG file for your architecture (Apple Silicon or Intel).
 2. Open the DMG file.