fix(ci): inject API secrets into Flatpak manifest before build

flatpak-builder doesn't support --env-var, so we inject the secrets
directly into the manifest's build-options.env before building.

cc

.github/workflows/release-flatpak.yml

@@ -85,7 +85,7 @@ jobs:
             org.freedesktop.Sdk.Extension.node20//25.08 \
             org.freedesktop.Sdk.Extension.rust-stable//25.08
 
-      - name: Build Flatpak
+      - name: Inject API secrets into Flatpak manifest
         env:
           SPOTIFY_API_CLIENT_ID: ${{ secrets.SPOTIFY_API_CLIENT_ID }}
           SPOTIFY_API_CLIENT_SECRET: ${{ secrets.SPOTIFY_API_CLIENT_SECRET }}
@@ -95,17 +95,43 @@ jobs:
           DISCOGS_API_CLIENT_SECRET: ${{ secrets.DISCOGS_API_CLIENT_SECRET }}
           LAST_FM_API_KEY: ${{ secrets.LAST_FM_API_KEY }}
           LAST_FM_API_SHARED_SECRET: ${{ secrets.LAST_FM_API_SHARED_SECRET }}
+        run: |
+          # Inject env vars into the qbz module's build-options.env in the manifest
+          python3 << 'PY'
+          import yaml
+          import os
+
+          with open('packaging/flatpak/com.blitzkriegfc.qbz.yml', 'r') as f:
+              manifest = yaml.safe_load(f)
+
+          # Find the qbz module and add env vars
+          for module in manifest.get('modules', []):
+              if module.get('name') == 'qbz':
+                  if 'build-options' not in module:
+                      module['build-options'] = {}
+                  if 'env' not in module['build-options']:
+                      module['build-options']['env'] = {}
+
+                  env_vars = [
+                      'SPOTIFY_API_CLIENT_ID', 'SPOTIFY_API_CLIENT_SECRET',
+                      'TIDAL_API_CLIENT_ID', 'TIDAL_API_CLIENT_SECRET',
+                      'DISCOGS_API_CLIENT_KEY', 'DISCOGS_API_CLIENT_SECRET',
+                      'LAST_FM_API_KEY', 'LAST_FM_API_SHARED_SECRET'
+                  ]
+                  for var in env_vars:
+                      val = os.environ.get(var, '')
+                      if val:
+                          module['build-options']['env'][var] = val
+                  break
+
+          with open('packaging/flatpak/com.blitzkriegfc.qbz.yml', 'w') as f:
+              yaml.dump(manifest, f, default_flow_style=False, sort_keys=False)
+          PY
+
+      - name: Build Flatpak
         run: |
           mkdir -p flatpak-build flatpak-repo dist
           flatpak-builder --user --force-clean --repo=flatpak-repo \
-            --env-var=SPOTIFY_API_CLIENT_ID="$SPOTIFY_API_CLIENT_ID" \
-            --env-var=SPOTIFY_API_CLIENT_SECRET="$SPOTIFY_API_CLIENT_SECRET" \
-            --env-var=TIDAL_API_CLIENT_ID="$TIDAL_API_CLIENT_ID" \
-            --env-var=TIDAL_API_CLIENT_SECRET="$TIDAL_API_CLIENT_SECRET" \
-            --env-var=DISCOGS_API_CLIENT_KEY="$DISCOGS_API_CLIENT_KEY" \
-            --env-var=DISCOGS_API_CLIENT_SECRET="$DISCOGS_API_CLIENT_SECRET" \
-            --env-var=LAST_FM_API_KEY="$LAST_FM_API_KEY" \
-            --env-var=LAST_FM_API_SHARED_SECRET="$LAST_FM_API_SHARED_SECRET" \
             flatpak-build packaging/flatpak/com.blitzkriegfc.qbz.yml
           flatpak build-bundle flatpak-repo dist/QBZ.flatpak com.blitzkriegfc.qbz