[getappz]

Summary

This is why pushing the v1.3.0 tag didn't trigger a release build at all.

release.yml's trigger-ppa-publish job has if: secrets.PPA_GPG_KEY != '' -- GitHub Actions does not allow the secrets context directly in an if: conditional (job or step level). It produces Unrecognized named-value: 'secrets', and GitHub responds by treating the entire workflow file as unparseable:

• Falls back to the file path (.github/workflows/release.yml) as the run name instead of the declared name: release
• Creates an instant-failure stub run on every single push to any branch, regardless of the on: push: tags: ["v*"] filter
• For actual tag pushes specifically, produces no run at all (confirmed: pushing v1.3.0 produced zero workflow runs across the whole repo)

Confirmed via git diff v1.2.0 HEAD -- .github/workflows/release.yml: this if: condition is the only non-cosmetic change since the last tag (v1.2.0) that produced a correctly-named release run. It's been silently broken since whatever PR introduced it, landing on master, and nobody had tried cutting a tag-triggered release since -- until now, when I hit it directly.

Fix

Map the secret to a job-scoped env var first, then condition on that, per GitHub's documented workaround:

env:
  PPA_GPG_KEY: ${{ secrets.PPA_GPG_KEY }}
...
if: env.PPA_GPG_KEY != ''

Test plan

• CI status checks pass
• After merge: re-tag v1.3.0 (delete + re-push, since the original tag's commit predates this fix) and confirm release.yml actually runs and produces a real release

Summary by CodeRabbit

• Chores
  • Improved the release publishing workflow’s handling of the package signing key.
  • Ensured the publishing step runs correctly when the configured signing key is available.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1adabea7-6dd7-4da7-ae66-8a6b9d6881e4

📥 Commits

Reviewing files that changed from the base of the PR and between f5a4127 and 6efc4e4.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The release workflow’s PPA dispatch step now exposes the signing key through its environment and evaluates that environment variable before running, while retaining the GitHub token export.

Changes

Release workflow

Layer / File(s)	Summary
PPA dispatch environment condition .github/workflows/release.yml	The dispatch step maps secrets.PPA_GPG_KEY to env.PPA_GPG_KEY and checks env.PPA_GPG_KEY before execution, while retaining GH_TOKEN.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• getappz/agentflare#164: Adjusts the PPA_GPG_KEY secret check for the same PPA dispatch workflow step.

Suggested reviewers: dependabot[bot]

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch worktree-release-1.3.0

---

_{Comment @coderabbitai help to get the list of available commands.}