gate every push to the candidate ref

A paths filter meant a push touching only the gate itself ran nothing.

.gitea/workflows/distribution.yml

@@ -19,3 +19,33 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Validate the release and installer graph
         run: python3 tools/validate-distribution.py distribution/manifest.toml
+
+  # The projection. Gitea is the only thing that publishes.
+  sync-public:
+    runs-on: ubuntu-latest
+    needs: [validate]
+    if: github.ref == 'refs/heads/public'
+    env:
+      PUBLIC_FORGE_TOKEN: ${{ secrets.PUBLIC_FORGE_TOKEN }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - name: Publish and verify exact SHA
+        run: |
+          set -euo pipefail
+          : "${PUBLIC_FORGE_TOKEN:?PUBLIC_FORGE_TOKEN is required}"
+          expected="${GITHUB_SHA}"
+          forge_url='https://forge.caseytunturi.com/Fimeg/SouveraineOS.git'
+          remote_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"
+          if [ -n "$remote_sha" ]; then
+            git cat-file -e "${remote_sha}^{commit}" 2>/dev/null || {
+              echo "[publish] remote public SHA is not in tested history" >&2; exit 1; }
+            git merge-base --is-ancestor "$remote_sha" "$expected" || {
+              echo "[publish] refusing non-fast-forward public history" >&2; exit 1; }
+          fi
+          auth="$(printf 'publisher-souveraineos:%s' "$PUBLIC_FORGE_TOKEN" | base64 -w0)"
+          git -c "http.https://forge.caseytunturi.com/.extraheader=Authorization: Basic $auth" \
+            push "$forge_url" public:public
+          test "$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')" = "$expected"
+          echo "[publish] exact SHA is anonymous on Forgejo: $expected"