[hanthor]

The org secret FLATPAK_INDEX_TOKEN (a personal access token used to push the central Flatpak index into tuna-os/docs) has expired: the index push now fails with HTTP 401, so publishes fail. It is replaced by a write deploy key on tuna-os/docs whose private half is the org secret FLATPAK_INDEX_DEPLOY_KEY. tuna-os/.github#360 (4078f531) added an ssh-key input to the shared publish-flatpak-index action and made the reusable publish-flatpak.yml forward FLATPAK_INDEX_DEPLOY_KEY.

What changed

• publish-flatpak.yml: bump the reusable publish-flatpak.yml pin from fded0603 to 4078f531 (#360). It uses secrets: inherit, so it now gets the deploy key.

Refs tuna-os/.github#360.

[tuna-reef-hive]

7bb7e30

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 7bb7e30a4325) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/publish-flatpak.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.