ci: call the APT publish from release.yml instead of trusting on: release

[davidboulay]

Problem

apt-repo.yml was triggered by on: release: [published]. That never fired for a tagged release: release.yml publishes with ${{ github.token }}, and GitHub deliberately raises no workflow-triggering event for anything a GITHUB_TOKEN did (a recursion guard). So the index was only ever rebuilt when someone remembered to dispatch it manually.

It had run exactly once in its first month:

2026-07-01T07:55:09Z  event=workflow_dispatch  completed/success   ← the only run

Meanwhile 1.4.16, 1.4.17, 1.4.23 and 1.4.25 all shipped while the APT index sat unchanged — apt upgrade users were pinned to whatever was current on 1 July. Nothing failed loudly; the release workflow went green every time. The backlog only cleared because a later manual dispatch rebuilds from all release .debs.

Change

• apt-repo.yml also accepts workflow_call.
• release.yml invokes it as a job after the .dmg upload — transitively after deb (macos already needs it), so the release exists with its artifact attached before the index is collected.

  apt:
    needs: macos
    permissions:
      contents: write
    secrets: inherit          # apt-repo signs with APT_GPG_PRIVATE_KEY
    uses: ./.github/workflows/apt-repo.yml

Being called needs no event delivery, so it can't silently skip.

Why the other triggers stay

release: published still covers releases a human or PAT publishes through the UI — those do raise the event, and release.yml never sees them. workflow_dispatch stays for backfills. The repo is rebuilt from every release .deb on each run, so overlapping entry points are idempotent, and the existing concurrency: group: apt-repo serialises them.

Verification

YAML parses and the call job is structurally valid (no runs-on/steps, secrets: inherit present, needs resolves).

Only a real tag push exercises the new path — release.yml is tag-triggered, so there's no dry run short of cutting a release. If the wiring is wrong the release still succeeds and the index goes stale exactly as it does today, with gh workflow run apt-repo.yml as the fallback. Worth watching the Actions tab on the next tag for an apt job in the release run.