From deecb18f5d75f8bd54f85a0f0a8337b211fd1b52 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Sat, 10 Oct 2026 12:11:51 -0400
Subject: [PATCH] Review fix-up: skip pre-releases, prune the Pages repo,
 read-only pages in build

- Skip the build when the published release is a pre-release, and refuse a
  manual tag with a pre-release suffix or a release GitHub marks as one, so
  rc builds never reach the stable branch.
- flatpak build-update-repo --prune --prune-depth=3 so the re-mirrored
  Pages repository does not grow without bound.
- The build job only needs pages: read for configure-pages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/flatpak-pages.yml | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/flatpak-pages.yml b/.github/workflows/flatpak-pages.yml
index 44f97cc..cd8f12a 100644
--- a/.github/workflows/flatpak-pages.yml
+++ b/.github/workflows/flatpak-pages.yml
@@ -20,10 +20,14 @@ concurrency:
 jobs:
   build:
     name: Build Flatpak repository
+    # Pre-releases (rc builds) never reach the stable branch: a published pre-release is skipped
+    # here, and the validation step below refuses a manual tag with a pre-release suffix.
+    if: github.event_name != 'release' || !github.event.release.prerelease
     runs-on: ubuntu-24.04
     permissions:
       contents: read
-      pages: write
+      # configure-pages only reads the Pages configuration (base_url); deploy needs write.
+      pages: read
     env:
       GH_TOKEN: ${{ github.token }}
       RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }}
@@ -47,10 +51,17 @@ jobs:
             echo "::error::Release tag '$tag' is not strict SemVer prefixed with v"
             exit 1
           fi
+          # A pre-release has a "-" before any "+build" metadata (v1.2.3-rc.1).
+          case "${tag%%+*}" in
+            *-*)
+              echo "::error::$tag is a pre-release; only stable releases are published to the Flatpak repository"
+              exit 1
+              ;;
+          esac
           published_tag="$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$tag" --jq \
-            'select(.draft == false and .published_at != null) | .tag_name')"
+            'select(.draft == false and .prerelease == false and .published_at != null) | .tag_name')"
           if [[ "$published_tag" != "$tag" ]]; then
-            echo "::error::$tag is not a published release in $GITHUB_REPOSITORY"
+            echo "::error::$tag is not a published stable (non-pre-release) release in $GITHUB_REPOSITORY"
             exit 1
           fi
 
@@ -108,7 +119,10 @@ jobs:
             flatpak build-import-bundle "$repo_dir" \
               "bundles/gridcraft-$version-linux-$arch.flatpak"
           done
+          # Prune unreachable objects and keep at most 3 commits per ref, so the Pages repository
+          # (re-mirrored and re-deployed on every release) does not grow without bound.
           flatpak build-update-repo \
+            --prune --prune-depth=3 \
             --title="GridCraft" \
             --comment='Official GridCraft releases' \
             --description='Official Flatpak repository for GridCraft' \