The workflow_run path only ever prepared metadata, and its artifact skipped
.SRCINFO (a dotfile needs include-hidden-files), so a green run after a
release left AUR untouched — 2.1.1 sat at 2.1.0. Tag runs now publish when
the repository holds AUR_SSH_PRIVATE_KEY (a passphrase-less deploy key on
the maintainer's AUR account) and print a notice pointing at the manual path
otherwise. scripts/packaging/aur_publish.sh is that manual path in one
command: stamp from packaging/aur, hash the published assets at their final
URLs, regenerate .SRCINFO in a clean Arch container, commit per repo, and
push only with --push (the personal key's passkey is asked interactively).
cc
vicrodh
0674b2adeb