From db2b57cc40c7e2fc9617ce3476b54293eac6f4fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Mon, 26 Oct 2026 15:57:52 +0100
Subject: [PATCH 01/17] fix(pages): download the repository artifact to its
 expected path

Select the x86_64 artifact by name and extract it directly into the
architecture directory used by the signing step. download-artifact
v8 extracts a single pattern match into the supplied path rather
than adding an artifact-name directory, so the previous settings
left validation looking in the wrong directory.
---
 .github/workflows/pages-flatpak-repo.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pages-flatpak-repo.yml b/.github/workflows/pages-flatpak-repo.yml
index 5edddfb..5c6f7bb 100644
--- a/.github/workflows/pages-flatpak-repo.yml
+++ b/.github/workflows/pages-flatpak-repo.yml
@@ -162,9 +162,8 @@ jobs:
       - name: Download unsigned architecture repository
         uses: actions/download-artifact@v8
         with:
-          pattern: t3code-ostree-*
-          path: inputs
-          merge-multiple: false
+          name: t3code-ostree-x86_64
+          path: inputs/t3code-ostree-x86_64
 
       - name: Restore previous final repository
         id: repo-cache

From e6e3fc2b5233b3a376450388d39801d015347fde Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Mon, 26 Oct 2026 15:49:00 +0100
Subject: [PATCH 02/17] ci: upload GitHub Flatpak builds with SHA-256 checksums

Generate a checksum after the existing Flatpak build and upload
both files as one workflow artifact. Keep automatic builder uploads
disabled so the bundle and checksum are published together, and
skip artifact compression because the bundle is already compressed.

Limit this change to GitHub Actions; the Forgejo workflow remains
unchanged.
---
 .github/workflows/build.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6069d5c..999ab82 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,3 +26,16 @@ jobs:
           cache-key: flatpak-builder-${{ github.sha }}
           arch: ${{ matrix.variant.arch }}
           verbose: true
+
+      - name: Create checksum
+        run: sha256sum t3code.flatpak > t3code.flatpak.sha256
+
+      - name: Upload Flatpak and checksum
+        uses: actions/upload-artifact@v4
+        with:
+          name: t3code-flatpak
+          path: |
+            t3code.flatpak
+            t3code.flatpak.sha256
+          if-no-files-found: error
+          compression-level: 0

From 0bb0a97b50d3981900bfccdaf7a4fa317500503e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Mon, 26 Oct 2026 21:28:20 +0100
Subject: [PATCH 03/17] fix(ci): run GitHub automation without a mandatory
 personal token

Use the repository token for AppImage updates when GH_TOKEN is not
configured and explicitly dispatch downstream workflows after token
pushes. Keep PAT-based automatic triggers when a custom token is
available. Serialize each updater to avoid overlapping branch writes
and refresh the runtime update branch before force-with-lease.

Build contributor branches and retain downloadable CI bundles for
three days to limit storage use. Document the main default branch
required for consistent scheduled updates and publication.
---
 .github/workflows/build.yml                   |  3 +-
 .../workflows/update-bundled-runtime-pins.yml |  9 +++++
 .github/workflows/update-t3code-appimage.yml  | 40 ++++++++++++++-----
 README.md                                     | 11 +++--
 4 files changed, 48 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 999ab82..fba467d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,7 +1,7 @@
 name: CI Build Flatpak
 on:
   push:
-    branches: [main]
+    branches: ['**']
   pull_request:
   workflow_dispatch:
 jobs:
@@ -39,3 +39,4 @@ jobs:
             t3code.flatpak.sha256
           if-no-files-found: error
           compression-level: 0
+          retention-days: 3
diff --git a/.github/workflows/update-bundled-runtime-pins.yml b/.github/workflows/update-bundled-runtime-pins.yml
index 549fe94..ee30b82 100644
--- a/.github/workflows/update-bundled-runtime-pins.yml
+++ b/.github/workflows/update-bundled-runtime-pins.yml
@@ -15,6 +15,10 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  group: update-bundled-runtime-pins
+  cancel-in-progress: false
+
 jobs:
   update:
     name: Check bundled runtime pins
@@ -59,6 +63,11 @@ jobs:
 
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          # Refresh the remote-tracking ref before a leased update of an
+          # existing automation branch.
+          if git ls-remote --exit-code --heads origin "$branch" >/dev/null 2>&1; then
+            git fetch origin "refs/heads/$branch:refs/remotes/origin/$branch"
+          fi
           git switch -c "$branch"
           git add com.t3tools.t3code.yml
           git commit -m "chore: update bundled runtime pins"
diff --git a/.github/workflows/update-t3code-appimage.yml b/.github/workflows/update-t3code-appimage.yml
index d276fdb..9c91755 100644
--- a/.github/workflows/update-t3code-appimage.yml
+++ b/.github/workflows/update-t3code-appimage.yml
@@ -7,26 +7,22 @@ on:
 
 permissions:
   contents: write
+  actions: write
+
+concurrency:
+  group: update-t3code-appimage
+  cancel-in-progress: false
 
 jobs:
   update:
     name: Check latest upstream AppImage
     runs-on: ubuntu-24.04
     steps:
-      - name: Verify downstream workflow token
-        env:
-          DOWNSTREAM_WORKFLOW_TOKEN: ${{ secrets.GH_TOKEN }}
-        run: |
-          if [ -z "${DOWNSTREAM_WORKFLOW_TOKEN:-}" ]; then
-            echo "Set the GH_TOKEN secret so updater pushes trigger CI, release, and Pages workflows." >&2
-            exit 1
-          fi
-
       - uses: actions/checkout@v5
         with:
           ref: main
           fetch-depth: 0
-          token: ${{ secrets.GH_TOKEN }}
+          token: ${{ secrets.GH_TOKEN || github.token }}
 
       - uses: actions/setup-node@v5
         with:
@@ -39,6 +35,7 @@ jobs:
         run: node scripts/update-t3code-appimage.js
 
       - name: Commit update and tag release
+        id: publish
         env:
           VERSION: ${{ steps.update.outputs.version }}
         run: |
@@ -49,6 +46,7 @@ jobs:
             *) tag="t3code-v${VERSION}" ;;
           esac
 
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
@@ -61,6 +59,7 @@ jobs:
             echo "Manifest already points at T3 Code ${VERSION}; creating missing release tag ${tag}."
             git tag -a "$tag" -m "T3 Code ${VERSION}"
             git push origin "$tag"
+            echo "release=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
@@ -74,3 +73,24 @@ jobs:
           git tag -a "$tag" -m "T3 Code ${VERSION}"
           git push origin HEAD:main
           git push origin "$tag"
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          echo "updated=true" >> "$GITHUB_OUTPUT"
+
+      - name: Dispatch downstream workflows for the default token
+        if: steps.publish.outputs.release == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CUSTOM_TOKEN: ${{ secrets.GH_TOKEN }}
+          RELEASE_TAG: ${{ steps.publish.outputs.tag }}
+          UPDATED: ${{ steps.publish.outputs.updated }}
+        run: |
+          set -euo pipefail
+          # PAT pushes trigger workflows automatically; GITHUB_TOKEN pushes do not.
+          if [ -n "$CUSTOM_TOKEN" ]; then
+            exit 0
+          fi
+          gh workflow run release.yml --repo "$GITHUB_REPOSITORY" --ref main -f tag="$RELEASE_TAG"
+          if [ "$UPDATED" = true ]; then
+            gh workflow run build.yml --repo "$GITHUB_REPOSITORY" --ref main
+            gh workflow run pages-flatpak-repo.yml --repo "$GITHUB_REPOSITORY" --ref main
+          fi
diff --git a/README.md b/README.md
index 3328918..1af4ace 100644
--- a/README.md
+++ b/README.md
@@ -146,10 +146,13 @@ Before the first publish:
    key securely; users trust its public key from the generated descriptors.
 2. Add `FLATPAK_GPG_PRIVATE_KEY` as an ASCII-armored GitHub Actions secret.
 3. Add `FLATPAK_GPG_KEY_ID` as the signing key ID or fingerprint secret.
-4. Add `GH_TOKEN` as a token authorized to push commits and tags. The updater
-   uses it because pushes made with the default `github.token` do not trigger
-   downstream CI, release, and Pages workflows. The updater fails before
-   changing anything when this secret is absent.
+4. The AppImage updater uses the default `github.token` to push commits and
+   tags, then explicitly dispatches downstream CI, release, and Pages workflows.
+   Optionally add `GH_TOKEN` as a token authorized to push commits and tags;
+   its pushes trigger downstream workflows automatically instead. Allow GitHub
+   Actions to create pull requests for the bundled-runtime updater.
+   Set the repository's default branch to `main` so scheduled workflows use
+   the same maintained branch as builds and publishing.
 5. Set the public repository variable `PUBLISH_FLATPAK_REPO` to `true` after
    the signing secrets are ready. Automatic publication is restricted to
    `refs/heads/main`; manual dispatch is also restricted to that ref.

From d7354a76574e5162b9208d1c0bb328c32cab8768 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Mon, 26 Oct 2026 21:29:32 +0100
Subject: [PATCH 04/17] fix(updater): address the fork pull-request endpoint
 explicitly

Use REST pull-request lookup and creation against GITHUB_REPOSITORY
instead of CLI fork discovery. Keep the base and head owner explicit
so the repository-scoped workflow token never needs access to the
upstream repository when maintaining a contributor fork.
---
 .../workflows/update-bundled-runtime-pins.yml | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/update-bundled-runtime-pins.yml b/.github/workflows/update-bundled-runtime-pins.yml
index ee30b82..1f7a0be 100644
--- a/.github/workflows/update-bundled-runtime-pins.yml
+++ b/.github/workflows/update-bundled-runtime-pins.yml
@@ -75,14 +75,16 @@ jobs:
 
           body="$(printf 'Updates bundled runtime source pins for the T3 Code Flatpak.\n\n- Node.js: %s\n- Git: %s\n- OpenSSH: %s\n\nThis workflow keeps updates separate from upstream T3 Code AppImage repinning.' "$NODE_VERSION" "$GIT_VERSION" "$OPENSSH_VERSION")"
 
-          if gh pr view "$branch" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            gh pr edit "$branch" --repo "$GITHUB_REPOSITORY" \
-              --title "chore: update bundled runtime pins" \
-              --body "$body"
+          # Use the repository endpoint explicitly, including in contributor
+          # forks where PR discovery must not select the parent repository.
+          owner="${GITHUB_REPOSITORY%%/*}"
+          pr_number="$(gh api --method GET "repos/$GITHUB_REPOSITORY/pulls" \
+            -f state=open -f base=main -f "head=$owner:$branch" --jq '.[0].number // empty')"
+          if [ -n "$pr_number" ]; then
+            gh api --method PATCH "repos/$GITHUB_REPOSITORY/pulls/$pr_number" \
+              -f title="chore: update bundled runtime pins" -f body="$body"
           else
-            gh pr create --repo "$GITHUB_REPOSITORY" \
-              --base main \
-              --head "$branch" \
-              --title "chore: update bundled runtime pins" \
-              --body "$body"
+            gh api --method POST "repos/$GITHUB_REPOSITORY/pulls" \
+              -f base=main -f "head=$owner:$branch" \
+              -f title="chore: update bundled runtime pins" -f body="$body"
           fi

From 31ffe3ef63d6b2c4073e0f7d62ece6d3113a24f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Mon, 26 Oct 2026 21:31:13 +0100
Subject: [PATCH 05/17] fix(flatpak): retain the C-only Git build for runtime
 updates

Disable optional Rust components explicitly when building Git, as
validated in the Forgejo build. The runtime updater now proposes
Git 2.56, whose default build otherwise needs a Rust toolchain not
provided by this manifest. Older Git versions ignore the variable.
---
 com.t3tools.t3code.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/com.t3tools.t3code.yml b/com.t3tools.t3code.yml
index e91d98f..7e36782 100644
--- a/com.t3tools.t3code.yml
+++ b/com.t3tools.t3code.yml
@@ -39,8 +39,8 @@ modules:
   - name: git
     buildsystem: simple
     build-commands:
-      - make prefix=/app NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PERL=YesPlease all
-      - make prefix=/app NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PERL=YesPlease install
+      - make prefix=/app NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PERL=YesPlease NO_RUST=YesPlease all
+      - make prefix=/app NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PERL=YesPlease NO_RUST=YesPlease install
     sources:
       - type: archive
         url: https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.54.0.tar.xz

From 02ab98fc20a870ac10083e5d61172bf361c79e1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Mon, 26 Oct 2026 21:32:06 +0100
Subject: [PATCH 06/17] fix(ci): make publication validation failures explicit

Report missing repository inputs instead of exiting silently and
reject unresolved descriptor placeholders with an explicit branch.
A bare negated command does not trigger errexit, so the old check
could let placeholders through. Quote the release commit expression
and use option-safe checksum globs to pass actionlint and shellcheck.
---
 .github/workflows/pages-flatpak-repo.yml | 9 ++++++---
 .github/workflows/release.yml            | 6 +++---
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/pages-flatpak-repo.yml b/.github/workflows/pages-flatpak-repo.yml
index 5c6f7bb..bbf00ee 100644
--- a/.github/workflows/pages-flatpak-repo.yml
+++ b/.github/workflows/pages-flatpak-repo.yml
@@ -195,8 +195,8 @@ jobs:
           ref_file="$artifact_dir/t3code-ref-${arch}.txt"
           expected_ref="app/${APP_ID}/${arch}/master"
 
-          test -s "$archive"
-          test -s "$ref_file"
+          test -s "$archive" || { echo "Missing repository archive: $archive" >&2; exit 1; }
+          test -s "$ref_file" || { echo "Missing application ref: $ref_file" >&2; exit 1; }
           test "$(<"$ref_file")" = "$expected_ref"
 
           extract_dir="$RUNNER_TEMP/t3code-${arch}"
@@ -337,7 +337,10 @@ jobs:
           grep -Eq '^RuntimeRepo=https://flathub\.org/repo/flathub\.flatpakrepo$' site/t3code.flatpakref
           grep -Eq '^IsRuntime=false$' site/t3code.flatpakref
           grep -Eq '^GPGKey=[A-Za-z0-9+/=]+$' site/t3code.flatpakref
-          ! grep -Eq '@[A-Z_]+@' site/t3code.flatpakrepo site/t3code.flatpakref
+          if grep -Eq '@[A-Z_]+@' site/t3code.flatpakrepo site/t3code.flatpakref; then
+            echo "Unexpanded placeholders remain in repository descriptors." >&2
+            exit 1
+          fi
           grep -Fq 't3code.flatpakrepo' site/index.html
           grep -Fq 't3code.flatpakref' site/index.html
           grep -Fq 'flatpak install --user t3code com.t3tools.t3code' site/index.html
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 21b820a..e4f9625 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
 
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
-          commit="$(git rev-parse --verify HEAD^{commit})"
+          commit="$(git rev-parse --verify 'HEAD^{commit}')"
           source_date_epoch="$(git show -s --format=%ct "$commit")"
 
           if [[ ! "$source_date_epoch" =~ ^[0-9]+$ ]]; then
@@ -151,8 +151,8 @@ jobs:
         run: |
           set -euo pipefail
 
-          sha256sum -c *.sha256
-          sha256sum *.flatpak > SHA256SUMS
+          sha256sum -c ./*.sha256
+          sha256sum ./*.flatpak > SHA256SUMS
 
       - name: Create or update release
         env:

From 15d96a2d4447cb3e083160d7fc2bebc5d63f7c38 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 20:31:27 +0000
Subject: [PATCH 07/17] chore: update bundled runtime pins

---
 com.t3tools.t3code.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/com.t3tools.t3code.yml b/com.t3tools.t3code.yml
index 7e36782..366edff 100644
--- a/com.t3tools.t3code.yml
+++ b/com.t3tools.t3code.yml
@@ -32,8 +32,8 @@ modules:
       - ln -s ../lib/nodejs/bin/corepack /app/bin/corepack
     sources:
       - type: archive
-        url: https://nodejs.org/dist/v24.17.0/node-v24.17.0-linux-x64.tar.xz
-        sha256: ab343a1b747c7cbf3630dfd7dbf818c5423fab2eb4f5ad1afc896f6bd121a917
+        url: https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.xz
+        sha256: 6c172a9ab6718f7b801fb5a7bd486af2ee5e32758086a04b84fcce2aa77095e6
         only-arches: [x86_64]
 
   - name: git
@@ -43,8 +43,8 @@ modules:
       - make prefix=/app NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PERL=YesPlease NO_RUST=YesPlease install
     sources:
       - type: archive
-        url: https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.54.0.tar.xz
-        sha256: f689162364c10de79ef89aa8dbf48731eb057e34edbbd20aca510ce0154681a3
+        url: https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.56.0.tar.xz
+        sha256: 26c56c296b38c0695b26fa95f475f1d01704d2d38e73465ca30b0b2f5dc789d3
 
   - name: openssh
     buildsystem: simple
@@ -56,8 +56,8 @@ modules:
       - install -m644 ssh_config /app/etc/ssh/ssh_config
     sources:
       - type: archive
-        url: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-10.3p1.tar.gz
-        sha256: 56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4
+        url: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-10.6p1.tar.gz
+        sha256: a9dc9565dffe8640f64d863cd29a32bc4a3dbdec0566a7fc44c5d6ee767d5f39
 
   - name: t3code
     buildsystem: simple

From 3ec9274f978aff0ce279fe253d2904475ad55065 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Mon, 26 Oct 2026 22:42:31 +0100
Subject: [PATCH 08/17] ci: upload Flatpak build artifacts with the Node.js 24
 action

Upgrade upload-artifact from v4 to v7 in the build workflow to remove
the Node.js 20 deprecation warning. The release and Pages workflows
already use v7, and the existing upload inputs remain supported.
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fba467d..e06a10f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -31,7 +31,7 @@ jobs:
         run: sha256sum t3code.flatpak > t3code.flatpak.sha256
 
       - name: Upload Flatpak and checksum
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: t3code-flatpak
           path: |

From 73fa92d45abe65a03d9b157913613d1940c1c918 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 12:15:56 +0000
Subject: [PATCH 09/17] chore: update T3 Code AppImage to v0.1.3

---
 com.t3tools.t3code.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/com.t3tools.t3code.yml b/com.t3tools.t3code.yml
index 56e85ca..1a6344d 100644
--- a/com.t3tools.t3code.yml
+++ b/com.t3tools.t3code.yml
@@ -181,9 +181,9 @@ modules:
         path: com.t3tools.t3code.metainfo.xml
 
       - type: file
-        url: https://github.com/pingdotgg/t3code/releases/download/v0.1.2/T3-Code-0.1.2-x86_64.AppImage
+        url: https://github.com/pingdotgg/t3code/releases/download/v0.1.3/T3-Code-0.1.3-x86_64.AppImage
         dest-filename: T3-Code.AppImage
-        sha256: cf01e2d167eff9d01c4c1004d31b2c0da9e2522cc94262e41644d1cb15dfdb5c
+        sha256: 801cce482d2085da1bfba1d0e301c0a2d75a7c8d0efd24865c2261948342df21
         only-arches: [x86_64]
         x-checker-data:
           type: electron-updater

From 08160eb226b3f5ccf96daba3c3976dc5f6272b78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Thu, 29 Oct 2026 11:03:32 +0100
Subject: [PATCH 10/17] docs: update published repository URLs

Point the Flatpak remote, app reference, and Pages configuration at the openSUSE-Python GitHub organization.
---
 README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index f31c1d1..8e8f0ec 100644
--- a/README.md
+++ b/README.md
@@ -240,12 +240,12 @@ The container needs network access to Flathub and the upstream source hosts. `--
 
 This repository publishes a signed x86_64 Flatpak repository at:
 
-<https://0cwa.github.io/t3-flatpak/>
+<https://openSUSE-Python.github.io/t3-flatpak/>
 
 Add the remote and install T3 Code with:
 
 ```bash
-flatpak remote-add --user --if-not-exists t3code https://0cwa.github.io/t3-flatpak/t3code.flatpakrepo
+flatpak remote-add --user --if-not-exists t3code https://openSUSE-Python.github.io/t3-flatpak/t3code.flatpakrepo
 flatpak install --user t3code com.t3tools.t3code
 ```
 
@@ -259,7 +259,7 @@ flatpak update --user com.t3tools.t3code
 The standalone app reference is also available for one-click installation:
 
 ```bash
-flatpak install --user https://0cwa.github.io/t3-flatpak/t3code.flatpakref
+flatpak install --user https://openSUSE-Python.github.io/t3-flatpak/t3code.flatpakref
 ```
 
 This package intentionally supports x86_64 only. The manifest and Pages
@@ -294,7 +294,7 @@ Before the first publish:
    the trailing slash or `/repo/`. The workflow appends `/repo/` when it
    generates repository metadata. To keep the documented URL when the GitHub
    repository slug is not `t3-flatpak`, set it to
-   `https://0cwa.github.io/t3-flatpak`.
+   `https://openSUSE-Python.github.io/t3-flatpak`.
 7. In repository Settings → Pages, set the source to **GitHub Actions**. A
    branch/folder Pages source will not deploy this workflow's artifact.
 

From aa02799016f6be7a1239c1632035dc827c20f893 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Thu, 29 Oct 2026 11:25:55 +0100
Subject: [PATCH 11/17] ci: avoid duplicate builds for pull request branches

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index caed875..e2decb8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,7 +1,7 @@
 name: CI Build Flatpak
 on:
   push:
-    branches: ['**']
+    branches: ['main']
   pull_request:
   workflow_dispatch:
 jobs:

From fc313d0c04311c2089b7e191d2096f3de8d0943f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Thu, 29 Oct 2026 11:43:09 +0100
Subject: [PATCH 12/17] feat(flatpak): replace tea with the Gitea CLI gt

- Bundle gitea-cli 0.2.0 as `gt` and note it is not Graphite
- Verify gh, glab, and gt are executable in /app/bin before export
---
 README.md              |  2 +-
 com.t3tools.t3code.yml | 19 ++++++++++++++-----
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 8e8f0ec..8953368 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ Project directory access still requires an explicit per-path override.
 
 ## Sandbox runtime tools
 
-The Flatpak bundles sandbox-local `node`, `npm`, `npx`, `corepack`, `git`, GNU make, OpenSSH client tools, and the `gh`, `glab`, and `tea` hosting CLIs. These are real binaries inside `/app`, not host wrappers. Managed commands precede optional extension commands in `PATH`, without adding host `~/.local/bin`. The manifest does not grant host command execution, home access, or SSH-agent access.
+The Flatpak bundles sandbox-local `node`, `npm`, `npx`, `corepack`, `git`, GNU make, OpenSSH client tools, and the `gh`, `glab`, and `gt` hosting CLIs. `gt` is [Gitea CLI](https://gitea.com/gitea/cli), not Graphite. These are real binaries inside `/app`, not host wrappers. Before export, the build checks that all three hosting CLIs exist in `/app/bin` and can print their versions. Managed commands precede optional extension commands in `PATH`, without adding host `~/.local/bin`. The manifest does not grant host command execution, home access, or SSH-agent access.
 
 The launcher configures npm globals and cache under T3 Code app data:
 
diff --git a/com.t3tools.t3code.yml b/com.t3tools.t3code.yml
index 1a6344d..e0be441 100644
--- a/com.t3tools.t3code.yml
+++ b/com.t3tools.t3code.yml
@@ -11,6 +11,15 @@ command: startt3code
 branch: master
 separate-locales: false
 
+# Check the finished /app tree before exporting any repository or bundle.
+cleanup-commands:
+  - |
+    set -eu
+    for cli in gh glab gt; do
+      test -x "/app/bin/$cli"
+      "/app/bin/$cli" --version
+    done
+
 add-extensions:
   com.t3tools.t3code.Tools:
     directory: tools
@@ -92,15 +101,15 @@ modules:
         sha256: 4e6c59de9f7ed2f304bf93aad01ea8f8a69584f0450ce90ad696ef81f69c69aa
         only-arches: [x86_64]
 
-  - name: tea
+  - name: gt
     buildsystem: simple
     build-commands:
-      - install -Dm755 tea-0.16.0-linux-amd64 /app/bin/tea
+      - install -Dm755 gitea-cli-0.2.0-linux-amd64 /app/bin/gt
     sources:
       - type: file
-        url: https://gitea.com/gitea/tea/releases/download/v0.16.0/tea-0.16.0-linux-amd64
-        dest-filename: tea-0.16.0-linux-amd64
-        sha256: 9c142c8a0b31485eea2387031c1c404f12b7141075eb4ffbd7ced49441590636
+        url: https://gitea.com/gitea/cli/releases/download/v0.2.0/gitea-cli-0.2.0-linux-amd64
+        dest-filename: gitea-cli-0.2.0-linux-amd64
+        sha256: 220f329cbc08f55f623aa0814000eabab2fe76271c57ffb12fdb6311ab358e36
         only-arches: [x86_64]
 
   - name: openssh

From 66c67a96547f7f725b6902a918945eda8723573d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= <mcepl@cepl.eu>
Date: Thu, 29 Oct 2026 13:26:34 +0100
Subject: [PATCH 13/17] docs: explain optional GPG and SSH agent overrides

---
 README.md | 42 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 8953368..e3d9576 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,9 @@ socket.
 The default sandbox grants display, IPC, network, portal-based file picking, and
 cursor theme access. It does not grant access to the full home directory, SSH
 agent, host command execution, host private keys, or broad host filesystems.
-SSH-agent access is available through an explicit user override described below.
+SSH-agent and GPG-agent access are available through explicit user overrides
+described below. These are optional authentication permissions, not requirements
+for launching T3 Code or using every provider.
 
 Provider CLIs can be installed into app data with the sandbox-local helper below.
 Project directory access still requires an explicit per-path override.
@@ -129,6 +131,13 @@ Restart T3 Code. On the host, ensure the agent contains the intended key.
 Inside T3 Code's terminal, `ssh-add -l` lists the available agent identities.
 Git then uses the bundled SSH client for authentication.
 
+The package already includes `--persist=.ssh`, so current builds do not need a
+separate persistence override. For an older build without it, use:
+
+```bash
+flatpak override --user --persist=.ssh --socket=ssh-auth com.t3tools.t3code
+```
+
 Every provider, extension, and project subprocess inherits agent access. An
 agent does not normally disclose private-key material, but those processes can
 request authentication with its loaded keys while access lasts. Prefer a
@@ -161,6 +170,37 @@ These revocations cannot undo earlier credential disclosure. Agent access is a
 separate permission and does not require any of those directory or D-Bus grants.
 See [the disposable SSH boundary checks](tests/ssh-boundary.md) for runtime validation.
 
+## Optional GPG-agent access
+
+If your workflow needs the host GPG agent, for example for GPG-signed Git
+commits, grant access and preserve sandbox-local GnuPG state with:
+
+```bash
+flatpak override --user --socket=gpg-agent --persist=.gnupg com.t3tools.t3code
+```
+
+Restart T3 Code after changing permissions. This preserves the sandbox's own
+`~/.gnupg` under `~/.var/app/com.t3tools.t3code/.gnupg`; it does not expose or
+import the host's `~/.gnupg`, public keyring, or configuration. The socket grant
+alone does not install a GPG client or configure Git signing. Check that `gpg`
+is available inside T3 Code's terminal and configure the required public keys
+and signing identity there. This package does not explicitly bundle GnuPG, and
+the SSH boundary test does not validate GPG signing.
+
+All sandbox processes gain access to the agent socket, including providers,
+extensions, and project commands. They can request operations permitted by the
+agent; do not assume that every request requires fresh confirmation. Only
+enable this permission if you trust those processes with that access.
+
+To revoke GPG-agent access:
+
+```bash
+flatpak override --user --nosocket=gpg-agent com.t3tools.t3code
+```
+
+Restart T3 Code after revoking access. Revocation does not delete the persisted
+sandbox-local GnuPG state.
+
 ## Project access
 
 T3 Code's private app data lives under `~/.var/app/com.t3tools.t3code` (see

From 9820a21052ef347eea4685f04c51862c2b5ed56c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 29 Oct 2026 13:05:33 +0000
Subject: [PATCH 14/17] chore: update T3 Code AppImage to v0.1.4

---
 com.t3tools.t3code.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/com.t3tools.t3code.yml b/com.t3tools.t3code.yml
index e0be441..f4b7281 100644
--- a/com.t3tools.t3code.yml
+++ b/com.t3tools.t3code.yml
@@ -190,9 +190,9 @@ modules:
         path: com.t3tools.t3code.metainfo.xml
 
       - type: file
-        url: https://github.com/pingdotgg/t3code/releases/download/v0.1.3/T3-Code-0.1.3-x86_64.AppImage
+        url: https://github.com/pingdotgg/t3code/releases/download/v0.1.4/T3-Code-0.1.4-x86_64.AppImage
         dest-filename: T3-Code.AppImage
-        sha256: 801cce482d2085da1bfba1d0e301c0a2d75a7c8d0efd24865c2261948342df21
+        sha256: 79fae6056dd2a5af250168467d5175cf131bd8cdf216a45701962a9628e5c3e9
         only-arches: [x86_64]
         x-checker-data:
           type: electron-updater

From f723ad3b68a8f8971593b371a0cf0fa4e89c77c8 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:59:08 +0000
Subject: [PATCH 15/17] chore: update T3 Code AppImage to v0.1.5

---
 com.t3tools.t3code.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/com.t3tools.t3code.yml b/com.t3tools.t3code.yml
index f4b7281..b481e64 100644
--- a/com.t3tools.t3code.yml
+++ b/com.t3tools.t3code.yml
@@ -190,9 +190,9 @@ modules:
         path: com.t3tools.t3code.metainfo.xml
 
       - type: file
-        url: https://github.com/pingdotgg/t3code/releases/download/v0.1.4/T3-Code-0.1.4-x86_64.AppImage
+        url: https://github.com/pingdotgg/t3code/releases/download/v0.1.5/T3-Code-0.1.5-x86_64.AppImage
         dest-filename: T3-Code.AppImage
-        sha256: 79fae6056dd2a5af250168467d5175cf131bd8cdf216a45701962a9628e5c3e9
+        sha256: 933ff9dc4c650a75aa4087c98f2ae6c6540c233f0e2feb32ebff950b09be849d
         only-arches: [x86_64]
         x-checker-data:
           type: electron-updater

From 65008fca4f6fc6952797ced17dd8d6f78cf00fb0 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 31 Oct 2026 12:36:24 +0000
Subject: [PATCH 16/17] chore: update T3 Code AppImage to v0.1.6

---
 com.t3tools.t3code.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/com.t3tools.t3code.yml b/com.t3tools.t3code.yml
index b481e64..bd96d25 100644
--- a/com.t3tools.t3code.yml
+++ b/com.t3tools.t3code.yml
@@ -190,9 +190,9 @@ modules:
         path: com.t3tools.t3code.metainfo.xml
 
       - type: file
-        url: https://github.com/pingdotgg/t3code/releases/download/v0.1.5/T3-Code-0.1.5-x86_64.AppImage
+        url: https://github.com/pingdotgg/t3code/releases/download/v0.1.6/T3-Code-0.1.6-x86_64.AppImage
         dest-filename: T3-Code.AppImage
-        sha256: 933ff9dc4c650a75aa4087c98f2ae6c6540c233f0e2feb32ebff950b09be849d
+        sha256: 09e2507208c779309b396be846aea1d945144bd780606899c2f481c96ddf34d0
         only-arches: [x86_64]
         x-checker-data:
           type: electron-updater

From 5095659ce61f5ac1a63728ff4155874ae0776984 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 2 Nov 2026 17:21:41 +0000
Subject: [PATCH 17/17] chore: update bundled runtime pins

---
 com.t3tools.t3code.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/com.t3tools.t3code.yml b/com.t3tools.t3code.yml
index bd96d25..008fbcf 100644
--- a/com.t3tools.t3code.yml
+++ b/com.t3tools.t3code.yml
@@ -56,8 +56,8 @@ modules:
       - ln -s ../lib/nodejs/bin/corepack /app/bin/corepack
     sources:
       - type: archive
-        url: https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.xz
-        sha256: 6c172a9ab6718f7b801fb5a7bd486af2ee5e32758086a04b84fcce2aa77095e6
+        url: https://nodejs.org/dist/v24.22.2/node-v24.22.2-linux-x64.tar.xz
+        sha256: 48cc0e21e048790e54c0cf5749c2725005313d652651c40b7a21feb9697aaf75
         only-arches: [x86_64]
 
   - name: git