sloppak

A Forgejo action that republishes flatpak bundles from GitHub releases as a flatpak repo, so apps install and auto-update with plain flatpak update.

Apps are listed in apps.json. Each entry has a GitHub repository URL (or owner/repo) and a regex that must match exactly one release asset:

{
  "repo": "https://github.com/storytold/photocraft",
  "asset": "^photocraft-[0-9.]+-linux-x86_64\\.flatpak$"
}

How it works

The workflow runs daily or manually. It clones the published flatpak-repo branch and loops through apps.json, downloading and signing only bundles whose GitHub asset ID has changed. The last imported ID is kept in OSTree's existing repository config. Existing apps are imported once to record their IDs.

When something changes, the workflow prunes old objects, signs the repository, and replaces the published branch with one Git commit. Removing a list entry stops updating that app; it does not remove its published version.

Setup (one-time)

1. Add a Forgejo secret GPG_KEY_SECRET containing the armored private key (GPG_KEY_SECRET in the gitignored .env backup). Keep that backup safe. Its public key is committed in sloppak.flatpakrepo.
2. Run the workflow manually. Forgejo's automatic FORGEJO_TOKEN provides push access. Publishing runs only through CI.

Client setup

flatpak remote-add --if-not-exists sloppak \
  https://git.jacksonbarker.ca/jackson/sloppak/raw/branch/flatpak-repo/sloppak.flatpakrepo
flatpak install sloppak ai.storyteller.photocraft

The app then shows up in normal updates (flatpak update / software center).