From c51df9977b4c6bb18d3d5f07f846a5d224ff560f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?=
 <zhangyanghaha0407@outlook.com>
Date: Thu, 27 Aug 2026 18:20:51 -0400
Subject: [PATCH] Publish cn-built packages to the omarchycn registry before
 each release

packages/publish-cn-packages.sh uploads the omarchy-dev and
omarchy-settings-dev builds (token via curl config on stdin), and the
release checklist runs it as step 8 ahead of the public Release so the
one-click convert never installs stale packages.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019hLK3wsDuKVAC37GgDqg6H
---
 docs/release-checklist.md       |  8 +++++---
 packages/publish-cn-packages.sh | 26 ++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 3 deletions(-)
 create mode 100644 packages/publish-cn-packages.sh

diff --git a/docs/release-checklist.md b/docs/release-checklist.md
index 6b65b28b..f3c9c315 100644
--- a/docs/release-checklist.md
+++ b/docs/release-checklist.md
@@ -9,9 +9,11 @@
 5. `sha256sum` → `SHA256SUMS.txt`；签名 SUMS 与 ISO（发布子钥）
 6. SBOM 两份：syft（live airootfs）+ 离线仓库 .PKGINFO 采集
 7. `release.json`（版本、双向提交、包版本表、迁移列表、min_compatible、产物清单）→ 签名 release.json
-8. 建 tag 与 Release，上传全部产物，Release Notes 写明上游基线与已知问题
-9. 匿名回读已发布 ISO 并 sha256 复核 == 本地构建值
-10. `cn/release` 数字 +1，提交
+8. 把本次构建的 `omarchy-dev` / `omarchy-settings-dev` 发布到 [omarchycn] registry
+    （`packages/publish-cn-packages.sh`；先于公开 Release，一键转换才不会装到旧包）
+9. 建 tag 与 Release，上传全部产物，Release Notes 写明上游基线与已知问题
+10. 匿名回读已发布 ISO 并 sha256 复核 == 本地构建值
+11. `cn/release` 数字 +1，提交
 
 ## 版本规则
 
diff --git a/packages/publish-cn-packages.sh b/packages/publish-cn-packages.sh
new file mode 100644
index 00000000..71fa8c69
--- /dev/null
+++ b/packages/publish-cn-packages.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+# Publishes cn-built packages into the Gitea [omarchycn] Arch registry.
+# usage: publish-cn-packages.sh <pkg.tar.zst>... (maintainer/release step)
+
+set -euo pipefail
+
+GITEA=${GITEA:-https://git.zacharyzhang.com}
+OWNER=${OWNER:-ZacharyZhang-NY}
+: "${PKG_SYNC_TOKEN:?PKG_SYNC_TOKEN (Gitea package-write token) is required}"
+(($# > 0)) || { echo "usage: publish-cn-packages.sh <pkg.tar.zst>..." >&2; exit 1; }
+
+for pkg in "$@"; do
+  [[ -f $pkg ]] || { echo "no such file: $pkg" >&2; exit 1; }
+  # Token travels via curl config on stdin, never in the process argument list
+  code=$(curl -sS --retry 2 -o /tmp/publish.out -w '%{http_code}' -X PUT -K - \
+    --upload-file "$pkg" "$GITEA/api/packages/$OWNER/arch/omarchycn" \
+    <<< "header = \"Authorization: token $PKG_SYNC_TOKEN\"")
+  case "$code" in
+  201) echo "published: ${pkg##*/}" ;;
+  409) echo "already present: ${pkg##*/}" ;;
+  *)
+    echo "upload of ${pkg##*/} failed (HTTP $code): $(head -c 300 /tmp/publish.out)" >&2
+    exit 1
+    ;;
+  esac
+done