ci(aur): require arming before an unattended publish

`schedule` fires every six hours off the default branch and set
publish=true unconditionally. Merging this workflow was therefore enough
to make mcpp start writing to the AUR on its own, within six hours, on a
path that had never completed a real push — only a makepkg --verifysource
dry-run. Merging is a decision about code; publishing to a third-party
service is a decision about the outside world, and they should not be
the same act.

Both automatic triggers now plan and report but withhold the push unless
the repository variable AUR_AUTOPUBLISH is exactly "true", so a typo
fails closed. Dry runs still validate payloads, render .SRCINFO, query
the AUR and print the diff — only the push is withheld, so nothing is
lost but the surprise. workflow_dispatch keeps its explicit per-run
switch, which is how the first watched publish is meant to happen, and
unsetting the variable is a kill switch that needs no revert.

The contract test runs the workflow's own decision shell rather than a
paraphrase of it, so the guarantee cannot drift from the YAML.

Author: speak-agent

.github/workflows/aur-publish.yml

@@ -57,6 +57,9 @@ jobs:
         env:
           TRIGGER: ${{ github.event_name }}
           MANUAL_PUBLISH: ${{ inputs.publish }}
+          # Repository variable, absent until a human has watched one publish
+          # succeed. See "Arming the automatic triggers" in scripts/aur/README.md.
+          AUTOPUBLISH: ${{ vars.AUR_AUTOPUBLISH }}
         run: |
           args=(
             --trigger "$TRIGGER"
@@ -66,11 +69,27 @@ jobs:
           [[ -z "$REQUESTED_TAG" ]] || args+=(--tag "$REQUESTED_TAG")
           python3 scripts/aur/reconcile_mcpp_bin.py "${args[@]}"
 
-          if [[ "$TRIGGER" == workflow_run || "$TRIGGER" == schedule ]]; then
-            publish=true
-          else
-            publish=${MANUAL_PUBLISH:-false}
-          fi
+          # An unattended push to a third-party service must be ARMED, not
+          # inherited from a merge. `schedule` fires every six hours off the
+          # default branch, so merging this workflow used to be enough to make
+          # mcpp start writing to the AUR on its own — before anyone had seen
+          # the reconciler complete a real push even once. Both automatic
+          # triggers therefore plan-and-report until AUR_AUTOPUBLISH is set;
+          # `workflow_dispatch` keeps its explicit per-run switch, which is how
+          # that first push is meant to happen.
+          case "$TRIGGER" in
+              workflow_run | schedule)
+                  if [[ "${AUTOPUBLISH:-}" == "true" ]]; then
+                      publish=true
+                  else
+                      publish=false
+                      echo "::notice::AUR_AUTOPUBLISH is not set — reporting the desired state without publishing."
+                  fi
+                  ;;
+              *)
+                  publish=${MANUAL_PUBLISH:-false}
+                  ;;
+          esac
           echo "needs_publish=$(jq -r '.needs_publish' "$RUNNER_TEMP/aur-plan.json")" >> "$GITHUB_OUTPUT"
           echo "publish=$publish" >> "$GITHUB_OUTPUT"
 

scripts/aur/README.md

@@ -128,9 +128,11 @@ mcpp --version
 
 [`.github/workflows/aur-publish.yml`](../../.github/workflows/aur-publish.yml)
 reconciles `mcpp-bin` only. It runs after a successful `release` workflow, every
-six hours to recover from transient AUR outages, and on manual dispatch. Event
-and schedule runs publish automatically; manual dispatch defaults to dry-run
-and requires `publish=true` to push.
+six hours to recover from transient AUR outages, and on manual dispatch. Manual
+dispatch defaults to dry-run and requires `publish=true` to push; the two
+automatic triggers plan and report but do **not** push until the repository
+variable `AUR_AUTOPUBLISH` is set — see
+[Arming the automatic triggers](#arming-the-automatic-triggers).
 
 Every trigger follows the same state machine:
 
@@ -183,6 +185,32 @@ The server host key is checked against the vendored ED25519 key sourced from
 Arch Linux's infrastructure repository; the workflow never uses
 `ssh-keyscan` as a trust decision.
 
+### Arming the automatic triggers
+
+`schedule` fires every six hours off the default branch. That means merging
+this workflow is, by itself, enough to start writing to a third-party service
+unattended — potentially before anyone has watched the reconciler complete a
+real push even once. Merging is a decision about code; publishing to the AUR is
+a decision about the outside world, and the two should not be the same act.
+
+So both automatic triggers (`workflow_run` after a release, and `schedule`)
+stop after the plan-and-report step unless the repository variable
+`AUR_AUTOPUBLISH` is set to `true`. Dry runs still validate payloads, render
+`.SRCINFO`, query the AUR and print the exact diff, so the reporting value is
+unchanged — only the push is withheld.
+
+To arm it, once:
+
+1. Run the workflow manually with `publish=false` and read the summary: it must
+   show the intended version and a clean diff.
+2. Run it manually with `publish=true` and confirm the push, the AUR RPC row,
+   and a clean install in an Arch container.
+3. Only then set *Settings → Secrets and variables → Actions → Variables →*
+   `AUR_AUTOPUBLISH = true`.
+
+Unsetting the variable is the kill switch: automatic runs immediately fall back
+to reporting without publishing, with no code change and no revert.
+
 ### First publish
 
 The reconciler treats `mcpp-bin` as a known existing package. A failed clone or

tests/scripts/test_aur_reconcile.py

@@ -6,6 +6,8 @@
 import hashlib
 import importlib.util
 import json
+import os
+import re
 import subprocess
 import sys
 import tempfile
@@ -322,6 +324,67 @@ def test_publish_uses_public_speak_agent_identity(self) -> None:
             "speak-agent@users.noreply.github.com",
         )
 
+    def _publish_decision(
+        self,
+        trigger: str,
+        autopublish: str = "",
+        manual: str = "",
+    ) -> str:
+        """Run the workflow's own publish-decision shell, not a paraphrase of it."""
+        workflow = (
+            REPO_ROOT / ".github" / "workflows" / "aur-publish.yml"
+        ).read_text(encoding="utf-8")
+        match = re.search(r'^\s*case "\$TRIGGER" in$.*?^\s*esac$',
+                          workflow, re.MULTILINE | re.DOTALL)
+        self.assertIsNotNone(match, "publish decision block not found")
+        # The block also emits a `::notice::` line, so mark the value rather
+        # than reading whatever happens to be on stdout.
+        script = f'{match.group(0)}\nprintf "<publish>%s</publish>" "$publish"'
+        result = subprocess.run(
+            ["bash", "-c", script],
+            check=False,
+            capture_output=True,
+            text=True,
+            env={
+                "PATH": os.environ.get("PATH", ""),
+                "TRIGGER": trigger,
+                "AUTOPUBLISH": autopublish,
+                "MANUAL_PUBLISH": manual,
+            },
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        value = re.search(r"<publish>(.*?)</publish>", result.stdout)
+        self.assertIsNotNone(value, result.stdout)
+        return value.group(1)
+
+    def test_automatic_triggers_do_not_publish_until_armed(self) -> None:
+        # Merging a workflow is a decision about code. Pushing to the AUR is a
+        # decision about the outside world. `schedule` runs every six hours off
+        # the default branch, so without this gate the two are the same act:
+        # merge, wait six hours, and mcpp has written to a third-party service
+        # with nobody watching — on a path that had never completed a real push.
+        for trigger in ("workflow_run", "schedule"):
+            with self.subTest(trigger=trigger, armed=False):
+                self.assertEqual(self._publish_decision(trigger), "false")
+            with self.subTest(trigger=trigger, armed=True):
+                self.assertEqual(
+                    self._publish_decision(trigger, autopublish="true"), "true")
+            # Anything other than an exact "true" leaves it disarmed, so a typo
+            # in the repository variable fails closed.
+            with self.subTest(trigger=trigger, armed="typo"):
+                self.assertEqual(
+                    self._publish_decision(trigger, autopublish="yes"), "false")
+
+        # Manual dispatch keeps its explicit per-run switch: that is how the
+        # first, watched publish is meant to happen.
+        self.assertEqual(self._publish_decision("workflow_dispatch"), "false")
+        self.assertEqual(
+            self._publish_decision("workflow_dispatch", manual="true"), "true")
+        # …and arming the automatic triggers must not silently arm dispatch.
+        self.assertEqual(
+            self._publish_decision("workflow_dispatch", autopublish="true"),
+            "false")
+
     def test_workflow_uses_pinned_host_key_and_recovery_triggers(self) -> None:
         workflow = (
             REPO_ROOT / ".github" / "workflows" / "aur-publish.yml"