runs-on: ubuntu-latest + actions/checkout@v4 (a node action) can't run on our
Forgejo runners — it has failed on every push since the crafting-table:local
image was retired. Secret-scanning coverage is unaffected: the strict
enforcement layer is the server-side pre-receive gitleaks hook on the bare repo
(this workflow was only the redundant per-PR status), which still rejects any
push introducing a secret.
The OSS public-scrub removed .forgejo/workflows/ wholesale — it only needed
to parameterize the two infra literals in the publish step. Restored both
workflows; the publish target (root@host) and its SSH host-key now come from
Forgejo repo secrets (STRAW_PUBLISH_TARGET / STRAW_LUCY_HOSTKEY) instead of
literals, so the public workflow carries zero infra topology. Everything else
was already clean: signing keystore + deploy key are secrets, the actual
publish is a forced-command on the host (not in this YAML), and the runner
label / build image / signer fingerprint are non-sensitive.
Restores push-triggered CI: build assembleDebug in the straw-build image,
verify signer bb9ca96b, publish to fdroid. This push also builds vc=91.
