Centralize Tensamin packages modules and release automation

.forgejo/workflows/metadata.yml

@@ -0,0 +1,47 @@
+name: Refresh signed metadata
+
+on:
+  schedule:
+    - cron: '17 4 * * *'
+
+concurrency:
+  group: tensamin-central-releases
+  cancel-in-progress: false
+
+jobs:
+  refresh:
+    runs-on: nixos
+    env:
+      NIX_CONFIG: experimental-features = nix-command flakes
+      FORGEJO_SERVER_URL: ${{ forgejo.server_url }}
+      FORGEJO_REPOSITORY: ${{ forgejo.repository }}
+      FORGEJO_RUN_ID: ${{ forgejo.run_id }}
+      RELEASE_TOKEN: ${{ secrets.TENSAMIN_RELEASE_TOKEN }}
+      IOTA_RELEASE_SIGNING_KEY: ${{ secrets.IOTA_RELEASE_SIGNING_KEY }}
+      IOTA_RELEASE_PUBLIC_KEY: ${{ vars.IOTA_RELEASE_PUBLIC_KEY }}
+      IOTA_RELEASE_SIGNING_KEY_ID: ${{ vars.IOTA_RELEASE_SIGNING_KEY_ID || 'primary' }}
+      IOTA_BASE_VERSION: ${{ vars.IOTA_BASE_VERSION || '0.1.0' }}
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Bootstrap pinned tools and source credentials
+        uses: ./.forgejo/workflows/source-access
+        with:
+          source-key: ${{ secrets.TENSAMIN_SOURCE_SSH_KEY }}
+          known-hosts: ${{ vars.TENSAMIN_SSH_KNOWN_HOSTS }}
+      - name: Refresh signed metadata
+        run: |
+          set -euo pipefail
+          root=$PWD
+          revision=$(git rev-parse HEAD)
+          for channel in stable canary; do
+            git checkout --detach "$revision"
+            nix develop --impure --expr "import $root/scripts/release-env.nix { root = builtins.toPath \"$root\"; }" --command python3 scripts/release.py refresh --channel "$channel" --directory "$RUNNER_TEMP/refresh-$FORGEJO_RUN_ID-$channel"
+          done
+      - name: Remove source credentials
+        if: always()
+        run: |
+          if [[ -n ${SSH_AGENT_PID:-} ]]; then kill "$SSH_AGENT_PID"; fi
+          rm -rf "$RUNNER_TEMP/tensamin-source"