feat(workflows): add manual package removal workflow by mairas · Pull Request #20 · hatlabs/apt.hatlabs.fi

mairas · 2025-11-15T21:44:13Z

Summary

Adds a manually-triggered workflow for removing packages from specific distributions in the APT repository.

Use Case

This workflow is needed to clean up packages that were:

Published to the wrong distribution (e.g., unstable instead of trixie-unstable)
Need to be yanked/removed from the repository
Published with errors and need to be removed before republishing

Features

Manual Trigger with Inputs:

package_name: Name of package to remove (e.g., cockpit-apt)
distribution: Target distribution (stable, unstable, trixie-unstable, etc.)
architecture: Package architecture (all, arm64, amd64)

Workflow Steps:

✅ Removes all matching .deb files from the distribution pool
✅ Rebuilds repository metadata (Packages, Packages.gz)
✅ Regenerates Release file with checksums
✅ Re-signs the repository with GPG
✅ Commits and pushes changes

Usage

1. Go to Actions → Remove Package from APT Repository
2. Click "Run workflow"
3. Fill in:
   - Package name: cockpit-apt
   - Distribution: unstable
   - Architecture: all
4. Click "Run workflow"

Example: Remove cockpit-apt from unstable

This will remove the cockpit-apt package that was incorrectly published to unstable/main (should have been trixie-unstable/main):

package_name: cockpit-apt
distribution: unstable
architecture: all

Safety

Only removes packages matching the exact name pattern
Rebuilds metadata to keep repository consistent
Creates a commit showing what was removed and by whom
Can be run multiple times safely (idempotent)

🤖 Generated with Claude Code

Adds a workflow_dispatch workflow for manually removing packages from specific distributions in the APT repository. Features: - Manual trigger with inputs for package name, distribution, and architecture - Removes .deb files from the specified distribution pool - Rebuilds repository metadata (Packages, Release files) - Re-signs the repository - Commits and pushes changes Usage: Go to Actions → Remove Package → Run workflow - Enter package name (e.g., cockpit-apt) - Select distribution (stable, unstable, trixie-unstable, etc.) - Select architecture (all, arm64, amd64) Use case: Remove packages that were published to wrong distributions or need to be yanked from the repository. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull Request Overview

This PR adds a manually-triggered GitHub Actions workflow for removing packages from the APT repository. The workflow allows operators to clean up incorrectly published packages or remove packages that need to be yanked from specific distributions.

Key Changes:

New workflow with manual trigger (workflow_dispatch) accepting package name, distribution, and architecture inputs
Implements package removal, metadata regeneration, and repository re-signing
Creates audit trail through Git commits showing who triggered the removal and what was removed

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-15T21:48:33Z

+
+        # Sign Release file
+        echo "Signing Release file..."
+        gpg --default-key "$GPG_KEY_ID" --armor --detach-sign --yes -o Release.gpg Release


The GPG signing command is missing the --batch flag that's used in the existing update-repo.yml workflow. This flag prevents GPG from prompting for user input, which is important for automation.

Add the --batch flag for consistency:

gpg --batch --yes --default-key "$GPG_KEY_ID" --armor --detach-sign -o Release.gpg Release

Suggested change

gpg --default-key "$GPG_KEY_ID" --armor --detach-sign --yes -o Release.gpg Release

gpg --batch --default-key "$GPG_KEY_ID" --armor --detach-sign --yes -o Release.gpg Release

Copilot · 2025-11-15T21:48:33Z

+        PACKAGE="${{ github.event.inputs.package_name }}"
+        DIST="${{ github.event.inputs.distribution }}"
+        ARCH="${{ github.event.inputs.architecture }}"
+


The package name input is not validated and is directly used in shell commands and file operations. A malicious actor could potentially inject shell commands or path traversal sequences (e.g., ../../../etc/passwd).

Add input validation before using the package name:

PACKAGE="${{ github.event.inputs.package_name }}" # Validate package name (only allow alphanumeric, dash, underscore, dot) if ! [[ "$PACKAGE" =~ ^[a-zA-Z0-9._+-]+$ ]]; then echo "❌ Invalid package name. Only alphanumeric characters, dots, dashes, underscores, and plus signs are allowed." exit 1 fi

Suggested change

# Validate package name (only allow alphanumeric, dot, dash, underscore, plus)

if ! [[ "$PACKAGE" =~ ^[a-zA-Z0-9._+-]+$ ]]; then

echo "❌ Invalid package name. Only alphanumeric characters, dots, dashes, underscores, and plus signs are allowed."

exit 1

fi

Copilot · 2025-11-15T21:48:33Z

+          ARCH_DIR="dists/$DIST/main/binary-$arch"
+          if [ -d "$ARCH_DIR" ]; then
+            echo "Generating Packages file for $arch..."
+            dpkg-scanpackages --arch $arch "pool/$DIST/main" /dev/null > "$ARCH_DIR/Packages"


The dpkg-scanpackages command uses a different path pattern than the existing update-repo.yml workflow. The existing workflow uses dpkg-scanpackages -a $arch "pool/$dist/" /dev/null, scanning the entire pool directory for the distribution.

For consistency with the existing workflow (update-repo.yml line 275), consider using:

dpkg-scanpackages -a $arch "pool/$DIST/" /dev/null > "$ARCH_DIR/Packages" 2>/dev/null || touch "$ARCH_DIR/Packages"

Also add the || touch fallback to handle cases where no packages exist, preventing the Packages file from being empty/nonexistent.

Suggested change

dpkg-scanpackages --arch $arch "pool/$DIST/main" /dev/null > "$ARCH_DIR/Packages"

dpkg-scanpackages --arch $arch "pool/$DIST/" /dev/null > "$ARCH_DIR/Packages" 2>/dev/null || touch "$ARCH_DIR/Packages"

Copilot · 2025-11-15T21:48:34Z

+          if [ -d "$ARCH_DIR" ]; then
+            echo "Generating Packages file for $arch..."
+            dpkg-scanpackages --arch $arch "pool/$DIST/main" /dev/null > "$ARCH_DIR/Packages"
+            gzip -9c "$ARCH_DIR/Packages" > "$ARCH_DIR/Packages.gz"


The gzip command uses different flags than the existing update-repo.yml workflow. The existing workflow uses gzip -kf which keeps the original file and forces overwrite, while this uses -9c with output redirection.

For consistency with the existing workflow (update-repo.yml line 276), use:

gzip -kf "$ARCH_DIR/Packages"

This is simpler and consistent with the rest of the codebase.

Suggested change

gzip -9c "$ARCH_DIR/Packages" > "$ARCH_DIR/Packages.gz"

gzip -kf "$ARCH_DIR/Packages"

Copilot · 2025-11-15T21:48:34Z

+        options:
+          - all
+          - arm64
+          - amd64


The amd64 architecture is listed as an option, but the existing update-repo.yml workflow only creates and manages arm64 and all architectures. This means if a user tries to remove an amd64 package, the workflow will fail because the binary-amd64 directory doesn't exist in the repository structure.

Either remove amd64 from the options if it's not supported, or ensure the workflow can handle it properly:

options: - all - arm64

Suggested change

- amd64

Copilot · 2025-11-15T21:48:34Z

+          find "$POOL_DIR" -name "${PACKAGE}_*_${ARCH}.deb" -type f | while read -r debfile; do
+            echo "  Removing: $debfile"
+            rm -f "$debfile"
+            REMOVED_COUNT=$((REMOVED_COUNT + 1))
+          done


The REMOVED_COUNT variable is being incremented inside a subshell created by the while read loop in a pipe. This means the counter will not persist outside the loop, and line 73 will always evaluate to 0.

To fix this, use process substitution instead:

while read -r debfile; do echo " Removing: $debfile" rm -f "$debfile" REMOVED_COUNT=$((REMOVED_COUNT + 1)) done < <(find "$POOL_DIR" -name "${PACKAGE}_*_${ARCH}.deb" -type f)

Suggested change

find "$POOL_DIR" -name "${PACKAGE}_*_${ARCH}.deb" -type f | while read -r debfile; do

echo " Removing: $debfile"

rm -f "$debfile"

REMOVED_COUNT=$((REMOVED_COUNT + 1))

done

while read -r debfile; do

echo " Removing: $debfile"

rm -f "$debfile"

REMOVED_COUNT=$((REMOVED_COUNT + 1))

done < <(find "$POOL_DIR" -name "${PACKAGE}_*_${ARCH}.deb" -type f)

Copilot · 2025-11-15T21:48:34Z

+        echo "MD5Sum:" >> Release
+        find main -type f | while read file; do
+          md5sum "$file" | awk '{print " " $1 " " size " " file}' size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file") file="$file" >> Release
+        done
+
+        echo "SHA256:" >> Release
+        find main -type f | while read file; do
+          sha256sum "$file" | awk '{print " " $1 " " size " " file}' size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file") file="$file" >> Release
+        done
+


The manual checksum generation using find, awk, and stat is complex and error-prone. The existing update-repo.yml workflow uses apt-ftparchive release . which automatically generates all checksums (MD5Sum, SHA256, SHA512) in the correct format.

Replace lines 116-125 with:

# Add checksums apt-ftparchive release . >> Release

This is simpler, more reliable, and consistent with the existing workflow.

Suggested change

echo "MD5Sum:" >> Release

find main -type f | while read file; do

md5sum "$file" | awk '{print " " $1 " " size " " file}' size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file") file="$file" >> Release

done

echo "SHA256:" >> Release

find main -type f | while read file; do

sha256sum "$file" | awk '{print " " $1 " " size " " file}' size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file") file="$file" >> Release

done

apt-ftparchive release . >> Release

Copilot · 2025-11-15T21:48:35Z

+        # Sign Release file
+        echo "Signing Release file..."
+        gpg --default-key "$GPG_KEY_ID" --armor --detach-sign --yes -o Release.gpg Release
+        gpg --default-key "$GPG_KEY_ID" --armor --detach-sign --yes --clearsign -o InRelease Release


The GPG command incorrectly combines --detach-sign with --clearsign. The --clearsign option creates an inline signature, not a detached signature, so these options are mutually exclusive.

The correct command based on the existing update-repo.yml workflow should be:

gpg --default-key "$GPG_KEY_ID" --batch --yes --clear-sign -o InRelease Release

Note: Also removed --armor since --clear-sign already produces ASCII-armored output.

Suggested change

gpg --default-key "$GPG_KEY_ID" --armor --detach-sign --yes --clearsign -o InRelease Release

gpg --default-key "$GPG_KEY_ID" --batch --yes --clear-sign -o InRelease Release

Fixes all 8 issues identified by Copilot code review: Security: - Add input validation for package name (prevents injection attacks) Only allows alphanumeric, dots, dashes, underscores, plus signs Bug Fixes: - Fix REMOVED_COUNT subshell issue using process substitution - Remove unsupported amd64 architecture from options - Fix GPG InRelease command (remove --detach-sign, use --clear-sign) Consistency: - Add --batch flag to GPG signing commands - Use dpkg-scanpackages with "pool/$DIST/" path pattern - Use gzip -kf instead of -9c for consistency - Use apt-ftparchive for checksums instead of manual generation All changes align with existing update-repo.yml workflow patterns for consistency across the codebase. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-15T22:01:28Z

+            DESCRIPTION="Hat Labs Stable APT Repository"
+            ;;
+          unstable)
+            SUITE="unstable"
+            CODENAME="unstable"
+            DESCRIPTION="Hat Labs Unstable APT Repository"
+            ;;
+          bookworm-stable)
+            SUITE="stable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Stable APT Repository"
+            ;;
+          bookworm-unstable)
+            SUITE="unstable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"
+            ;;
+          trixie-stable)
+            SUITE="stable"
+            CODENAME="trixie"
+            DESCRIPTION="Hat Labs Trixie Stable APT Repository"
+            ;;
+          trixie-unstable)
+            SUITE="unstable"
+            CODENAME="trixie"
+            DESCRIPTION="Hat Labs Trixie Unstable APT Repository"
+            ;;
+          *)
+            SUITE="$DIST"
+            CODENAME="$DIST"
+            DESCRIPTION="Hat Labs APT Repository"


The Description field is inconsistent with the existing update-repo.yml workflow. In update-repo.yml (lines 290-310), the descriptions use "Hat Labs product packages (stable)" and "Halos packages for Debian" for versioned distributions. This inconsistency could confuse users. Consider aligning with the existing format used in update-repo.yml.

Suggested change

DESCRIPTION="Hat Labs Stable APT Repository"

;;

unstable)

SUITE="unstable"

CODENAME="unstable"

DESCRIPTION="Hat Labs Unstable APT Repository"

;;

bookworm-stable)

SUITE="stable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Stable APT Repository"

;;

bookworm-unstable)

SUITE="unstable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"

;;

trixie-stable)

SUITE="stable"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Stable APT Repository"

;;

trixie-unstable)

SUITE="unstable"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Unstable APT Repository"

;;

*)

SUITE="$DIST"

CODENAME="$DIST"

DESCRIPTION="Hat Labs APT Repository"

DESCRIPTION="Hat Labs product packages (stable)"

;;

unstable)

SUITE="unstable"

CODENAME="unstable"

DESCRIPTION="Hat Labs product packages (unstable)"

;;

bookworm-stable)

SUITE="stable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs product packages (bookworm-stable)"

;;

bookworm-unstable)

SUITE="unstable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs product packages (bookworm-unstable)"

;;

trixie-stable)

SUITE="stable"

CODENAME="trixie"

DESCRIPTION="Hat Labs product packages (trixie-stable)"

;;

trixie-unstable)

SUITE="unstable"

CODENAME="trixie"

DESCRIPTION="Hat Labs product packages (trixie-unstable)"

;;

*)

SUITE="$DIST"

CODENAME="$DIST"

DESCRIPTION="Hat Labs product packages ($DIST)"

Copilot · 2025-11-15T22:01:28Z

+            SUITE="stable"
+            CODENAME="stable"
+            DESCRIPTION="Hat Labs Stable APT Repository"
+            ;;
+          unstable)
+            SUITE="unstable"
+            CODENAME="unstable"
+            DESCRIPTION="Hat Labs Unstable APT Repository"
+            ;;
+          bookworm-stable)
+            SUITE="stable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Stable APT Repository"
+            ;;
+          bookworm-unstable)
+            SUITE="unstable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"
+            ;;
+          trixie-stable)
+            SUITE="stable"
+            CODENAME="trixie"
+            DESCRIPTION="Hat Labs Trixie Stable APT Repository"
+            ;;
+          trixie-unstable)
+            SUITE="unstable"


The Suite value is inconsistent with update-repo.yml. For bookworm-stable, this sets Suite="stable", but update-repo.yml (line 299) sets Suite="bookworm-stable" (using the full distribution name). This inconsistency could break APT repository functionality. The Suite should be set to "$DIST" instead of "stable" to match the existing workflow.

Suggested change

SUITE="stable"

CODENAME="stable"

DESCRIPTION="Hat Labs Stable APT Repository"

;;

unstable)

SUITE="unstable"

CODENAME="unstable"

DESCRIPTION="Hat Labs Unstable APT Repository"

;;

bookworm-stable)

SUITE="stable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Stable APT Repository"

;;

bookworm-unstable)

SUITE="unstable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"

;;

trixie-stable)

SUITE="stable"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Stable APT Repository"

;;

trixie-unstable)

SUITE="unstable"

SUITE="$DIST"

CODENAME="stable"

DESCRIPTION="Hat Labs Stable APT Repository"

;;

unstable)

SUITE="$DIST"

CODENAME="unstable"

DESCRIPTION="Hat Labs Unstable APT Repository"

;;

bookworm-stable)

SUITE="$DIST"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Stable APT Repository"

;;

bookworm-unstable)

SUITE="$DIST"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"

;;

trixie-stable)

SUITE="$DIST"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Stable APT Repository"

;;

trixie-unstable)

SUITE="$DIST"

Copilot · 2025-11-15T22:01:28Z

+            SUITE="stable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Stable APT Repository"
+            ;;
+          bookworm-unstable)
+            SUITE="unstable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"
+            ;;
+          trixie-stable)
+            SUITE="stable"
+            CODENAME="trixie"
+            DESCRIPTION="Hat Labs Trixie Stable APT Repository"
+            ;;
+          trixie-unstable)
+            SUITE="unstable"


The Suite value is inconsistent with update-repo.yml. For bookworm-unstable, this sets Suite="unstable", but update-repo.yml (line 299) sets Suite="bookworm-unstable" (using the full distribution name). This inconsistency could break APT repository functionality. The Suite should be set to "$DIST" instead of "unstable" to match the existing workflow.

Suggested change

SUITE="stable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Stable APT Repository"

;;

bookworm-unstable)

SUITE="unstable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"

;;

trixie-stable)

SUITE="stable"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Stable APT Repository"

;;

trixie-unstable)

SUITE="unstable"

SUITE="$DIST"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Stable APT Repository"

;;

bookworm-unstable)

SUITE="$DIST"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"

;;

trixie-stable)

SUITE="$DIST"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Stable APT Repository"

;;

trixie-unstable)

SUITE="$DIST"

Copilot · 2025-11-15T22:01:29Z

+            SUITE="stable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Stable APT Repository"
+            ;;
+          bookworm-unstable)
+            SUITE="unstable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"
+            ;;
+          trixie-stable)
+            SUITE="stable"
+            CODENAME="trixie"
+            DESCRIPTION="Hat Labs Trixie Stable APT Repository"
+            ;;
+          trixie-unstable)
+            SUITE="unstable"


The Suite value is inconsistent with update-repo.yml. For trixie-stable, this sets Suite="stable", but update-repo.yml (line 299) sets Suite="trixie-stable" (using the full distribution name). This inconsistency could break APT repository functionality. The Suite should be set to "$DIST" instead of "stable" to match the existing workflow.

Suggested change

SUITE="stable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Stable APT Repository"

;;

bookworm-unstable)

SUITE="unstable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"

;;

trixie-stable)

SUITE="stable"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Stable APT Repository"

;;

trixie-unstable)

SUITE="unstable"

SUITE="$DIST"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Stable APT Repository"

;;

bookworm-unstable)

SUITE="$DIST"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"

;;

trixie-stable)

SUITE="$DIST"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Stable APT Repository"

;;

trixie-unstable)

SUITE="$DIST"

Copilot · 2025-11-15T22:01:29Z

+            DESCRIPTION="Hat Labs Trixie Stable APT Repository"
+            ;;
+          trixie-unstable)
+            SUITE="unstable"


The Suite value is inconsistent with update-repo.yml. For trixie-unstable, this sets Suite="unstable", but update-repo.yml (line 299) sets Suite="trixie-unstable" (using the full distribution name). This inconsistency could break APT repository functionality. The Suite should be set to "$DIST" instead of "unstable" to match the existing workflow.

Suggested change

SUITE="unstable"

SUITE="$DIST"

Copilot · 2025-11-15T22:01:29Z

+            DESCRIPTION="Hat Labs Stable APT Repository"
+            ;;
+          unstable)
+            SUITE="unstable"
+            CODENAME="unstable"
+            DESCRIPTION="Hat Labs Unstable APT Repository"
+            ;;
+          bookworm-stable)
+            SUITE="stable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Stable APT Repository"
+            ;;
+          bookworm-unstable)
+            SUITE="unstable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"
+            ;;
+          trixie-stable)
+            SUITE="stable"
+            CODENAME="trixie"
+            DESCRIPTION="Hat Labs Trixie Stable APT Repository"
+            ;;
+          trixie-unstable)
+            SUITE="unstable"
+            CODENAME="trixie"
+            DESCRIPTION="Hat Labs Trixie Unstable APT Repository"
+            ;;
+          *)
+            SUITE="$DIST"
+            CODENAME="$DIST"
+            DESCRIPTION="Hat Labs APT Repository"


The Description field is inconsistent with the existing update-repo.yml workflow. In update-repo.yml (lines 290-310), the descriptions use "Halos packages for Debian Bookworm (stable)" format. This inconsistency could confuse users. Consider aligning with the existing format used in update-repo.yml.

Suggested change

DESCRIPTION="Hat Labs Stable APT Repository"

;;

unstable)

SUITE="unstable"

CODENAME="unstable"

DESCRIPTION="Hat Labs Unstable APT Repository"

;;

bookworm-stable)

SUITE="stable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Stable APT Repository"

;;

bookworm-unstable)

SUITE="unstable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"

;;

trixie-stable)

SUITE="stable"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Stable APT Repository"

;;

trixie-unstable)

SUITE="unstable"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Unstable APT Repository"

;;

*)

SUITE="$DIST"

CODENAME="$DIST"

DESCRIPTION="Hat Labs APT Repository"

DESCRIPTION="Halos packages for Debian Stable (stable)"

;;

unstable)

SUITE="unstable"

CODENAME="unstable"

DESCRIPTION="Halos packages for Debian Unstable (unstable)"

;;

bookworm-stable)

SUITE="stable"

CODENAME="bookworm"

DESCRIPTION="Halos packages for Debian Bookworm (stable)"

;;

bookworm-unstable)

SUITE="unstable"

CODENAME="bookworm"

DESCRIPTION="Halos packages for Debian Bookworm (unstable)"

;;

trixie-stable)

SUITE="stable"

CODENAME="trixie"

DESCRIPTION="Halos packages for Debian Trixie (stable)"

;;

trixie-unstable)

SUITE="unstable"

CODENAME="trixie"

DESCRIPTION="Halos packages for Debian Trixie (unstable)"

;;

*)

SUITE="$DIST"

CODENAME="$DIST"

DESCRIPTION="Halos packages for Debian $DIST"

Copilot · 2025-11-15T22:01:29Z

+            DESCRIPTION="Hat Labs Stable APT Repository"
+            ;;
+          unstable)
+            SUITE="unstable"
+            CODENAME="unstable"
+            DESCRIPTION="Hat Labs Unstable APT Repository"
+            ;;
+          bookworm-stable)
+            SUITE="stable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Stable APT Repository"
+            ;;
+          bookworm-unstable)
+            SUITE="unstable"
+            CODENAME="bookworm"
+            DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"
+            ;;
+          trixie-stable)
+            SUITE="stable"
+            CODENAME="trixie"
+            DESCRIPTION="Hat Labs Trixie Stable APT Repository"
+            ;;
+          trixie-unstable)
+            SUITE="unstable"
+            CODENAME="trixie"
+            DESCRIPTION="Hat Labs Trixie Unstable APT Repository"
+            ;;
+          *)
+            SUITE="$DIST"
+            CODENAME="$DIST"
+            DESCRIPTION="Hat Labs APT Repository"


The Description field is inconsistent with the existing update-repo.yml workflow. In update-repo.yml (lines 290-310), the descriptions use "Halos packages for Debian Trixie (stable)" format. This inconsistency could confuse users. Consider aligning with the existing format used in update-repo.yml.

Suggested change

DESCRIPTION="Hat Labs Stable APT Repository"

;;

unstable)

SUITE="unstable"

CODENAME="unstable"

DESCRIPTION="Hat Labs Unstable APT Repository"

;;

bookworm-stable)

SUITE="stable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Stable APT Repository"

;;

bookworm-unstable)

SUITE="unstable"

CODENAME="bookworm"

DESCRIPTION="Hat Labs Bookworm Unstable APT Repository"

;;

trixie-stable)

SUITE="stable"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Stable APT Repository"

;;

trixie-unstable)

SUITE="unstable"

CODENAME="trixie"

DESCRIPTION="Hat Labs Trixie Unstable APT Repository"

;;

*)

SUITE="$DIST"

CODENAME="$DIST"

DESCRIPTION="Hat Labs APT Repository"

DESCRIPTION="Halos packages for Debian Stable (stable)"

;;

unstable)

SUITE="unstable"

CODENAME="unstable"

DESCRIPTION="Halos packages for Debian Unstable (unstable)"

;;

bookworm-stable)

SUITE="stable"

CODENAME="bookworm"

DESCRIPTION="Halos packages for Debian Bookworm (stable)"

;;

bookworm-unstable)

SUITE="unstable"

CODENAME="bookworm"

DESCRIPTION="Halos packages for Debian Bookworm (unstable)"

;;

trixie-stable)

SUITE="stable"

CODENAME="trixie"

DESCRIPTION="Halos packages for Debian Trixie (stable)"

;;

trixie-unstable)

SUITE="unstable"

CODENAME="trixie"

DESCRIPTION="Halos packages for Debian Trixie (unstable)"

;;

*)

SUITE="$DIST"

CODENAME="$DIST"

DESCRIPTION="Halos packages for Debian $DIST"

Copilot · 2025-11-15T22:01:30Z

+
+        cat > Release <<EOF
+Origin: Hat Labs
+Label: Hat Labs


The Label field value "Hat Labs" is inconsistent with the existing update-repo.yml workflow, which uses "Hat Labs APT Repository" (line 315). This inconsistency could cause confusion. Consider using "Hat Labs APT Repository" to match the existing workflow.

Suggested change

Label: Hat Labs

Label: Hat Labs APT Repository

Copilot · 2025-11-15T22:01:30Z

+        cat > Release <<EOF
+Origin: Hat Labs
+Label: Hat Labs
+Suite: $SUITE
+Codename: $CODENAME
+Architectures: arm64 all
+Components: main
+Description: $DESCRIPTION
+Date: $(date -Ru)
+EOF


The Release file is missing the "Version: 1.0" field that's present in the update-repo.yml workflow (line 318). For consistency across workflows, consider adding this field after the Codename line.

Copilot AI review requested due to automatic review settings November 15, 2025 21:44

Copilot started reviewing on behalf of mairas November 15, 2025 21:44 View session

Copilot finished reviewing on behalf of mairas November 15, 2025 21:47

Copilot AI reviewed Nov 15, 2025

View reviewed changes

mairas requested a review from Copilot November 15, 2025 21:53

Copilot started reviewing on behalf of mairas November 15, 2025 21:53 View session

Copilot finished reviewing on behalf of mairas November 15, 2025 21:55

Copilot AI reviewed Nov 15, 2025

View reviewed changes

Comment thread .github/workflows/remove-package.yml

Comment thread .github/workflows/remove-package.yml Outdated

Update .github/workflows/remove-package.yml

a3cb739

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings November 15, 2025 21:57

Update .github/workflows/remove-package.yml

4de12a1

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of mairas November 15, 2025 21:57 View session

mairas merged commit 169df0f into main Nov 15, 2025

mairas deleted the feat/add-package-removal-workflow branch November 15, 2025 21:58

Copilot finished reviewing on behalf of mairas November 15, 2025 22:00

Copilot AI reviewed Nov 15, 2025

View reviewed changes

	gpg --default-key "$GPG_KEY_ID" --armor --detach-sign --yes -o Release.gpg Release
	gpg --batch --default-key "$GPG_KEY_ID" --armor --detach-sign --yes -o Release.gpg Release

+        # Validate package name (only allow alphanumeric, dot, dash, underscore, plus)
+        if ! [[ "$PACKAGE" =~ ^[a-zA-Z0-9._+-]+$ ]]; then
+          echo "❌ Invalid package name. Only alphanumeric characters, dots, dashes, underscores, and plus signs are allowed."
+          exit 1
+        fi

	dpkg-scanpackages --arch $arch "pool/$DIST/main" /dev/null > "$ARCH_DIR/Packages"
	dpkg-scanpackages --arch $arch "pool/$DIST/" /dev/null > "$ARCH_DIR/Packages" 2>/dev/null \|\| touch "$ARCH_DIR/Packages"

	gzip -9c "$ARCH_DIR/Packages" > "$ARCH_DIR/Packages.gz"
	gzip -kf "$ARCH_DIR/Packages"

	gpg --default-key "$GPG_KEY_ID" --armor --detach-sign --yes --clearsign -o InRelease Release
	gpg --default-key "$GPG_KEY_ID" --batch --yes --clear-sign -o InRelease Release

Conversation

mairas commented Nov 15, 2025

Summary

Use Case

Features

Usage

Example: Remove cockpit-apt from unstable

Safety

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development