feat: GitHub Pages testing dist track; retire Cloudsmith testing (#272)

build.yml:
- New "Publish to GitHub Pages testing dist" step — runs on beta/alpha
  channel builds (pushes to release/3.x and master); replaces pool/testing/
  with the latest build so the dist always has exactly one version
- Cloudsmith now receives v2.x stable only; beta/alpha no longer published
  to Cloudsmith testing channel

README:
- Replace Cloudsmith testing install instructions with GitHub Pages testing
  dist track; same GPG key as stable, just different dist name

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -269,12 +269,11 @@ jobs:
           name: packages-${{ needs.build.outputs.version }}
 
       - name: Publish truenas-proxmox to Cloudsmith
-        # Stable v3+ goes to GitHub Pages only. Keep Cloudsmith for:
+        # Cloudsmith now serves v2.x stable only. v3+ stable → GitHub Pages.
-        #   - v2.x stable releases (existing user base)
+        # beta/alpha → GitHub Pages testing dist (see step below).
-        #   - beta/alpha/dev builds (testing channel, until GitHub Pages testing track ships)
         if: >-
-          needs.build.outputs.channel != 'stable' ||
+          startsWith(needs.build.outputs.version, '2.') &&
-          startsWith(needs.build.outputs.version, '2.')
+          needs.build.outputs.channel == 'stable'
         uses: cloudsmith-io/action@v0.6.14
         with:
           api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
@@ -288,8 +287,8 @@ jobs:
 
       - name: Publish transitional freenas-proxmox to Cloudsmith
         if: >-
-          needs.build.outputs.channel != 'stable' ||
+          startsWith(needs.build.outputs.version, '2.') &&
-          startsWith(needs.build.outputs.version, '2.')
+          needs.build.outputs.channel == 'stable'
         uses: cloudsmith-io/action@v0.6.14
         with:
           api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
@@ -394,6 +393,79 @@ jobs:
             git commit -m "apt: publish ${VERSION} to dist(s): ${DISTS}"
           git push
 
+      - name: Publish to GitHub Pages testing dist
+        if: >-
+          needs.build.outputs.channel == 'beta' ||
+          needs.build.outputs.channel == 'alpha'
+        env:
+          APT_SIGNING_KEY: ${{ secrets.APT_SIGNING_KEY }}
+          APT_SIGNING_KEY_PASSPHRASE: ${{ secrets.APT_SIGNING_KEY_PASSPHRASE }}
+          GH_TOKEN: ${{ secrets.ACCESS_TOKEN }}
+        run: |
+          if [[ -z "$APT_SIGNING_KEY" ]]; then
+            echo "::error::APT_SIGNING_KEY secret is not set"
+            exit 1
+          fi
+
+          VERSION="${{ needs.build.outputs.version }}"
+
+          echo "$APT_SIGNING_KEY" | base64 -d | gpg --batch --import
+          GPG_KEY_ID="$(gpg --list-secret-keys --with-colons 2>/dev/null \
+            | awk -F: '/^sec/{print $5; exit}')"
+
+          PAGES_DIR="$(mktemp -d)"
+          git clone --branch gh-pages \
+            "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" \
+            "$PAGES_DIR"
+
+          # Replace pool/testing/ contents with the latest build only
+          rm -rf "${PAGES_DIR}/pool/testing"
+          mkdir -p "${PAGES_DIR}/pool/testing"
+          cp "${{ needs.build.outputs.deb_file }}" "${PAGES_DIR}/pool/testing/"
+          cp "${{ needs.build.outputs.transitional_deb_file }}" "${PAGES_DIR}/pool/testing/"
+
+          sudo apt-get install -y --no-install-recommends dpkg-dev apt-utils
+
+          DIST="testing"
+          mkdir -p "${PAGES_DIR}/dists/${DIST}/main/binary-all"
+          mkdir -p "${PAGES_DIR}/dists/${DIST}/main/binary-amd64"
+          mkdir -p "${PAGES_DIR}/dists/${DIST}/main/binary-arm64"
+
+          dpkg-scanpackages --multiversion "${PAGES_DIR}/pool/testing" \
+            | sed "s|^Filename: ${PAGES_DIR}/||" \
+            > "${PAGES_DIR}/dists/${DIST}/main/binary-all/Packages"
+          gzip -kf "${PAGES_DIR}/dists/${DIST}/main/binary-all/Packages"
+
+          touch "${PAGES_DIR}/dists/${DIST}/main/binary-amd64/Packages"
+          gzip -kf "${PAGES_DIR}/dists/${DIST}/main/binary-amd64/Packages"
+          touch "${PAGES_DIR}/dists/${DIST}/main/binary-arm64/Packages"
+          gzip -kf "${PAGES_DIR}/dists/${DIST}/main/binary-arm64/Packages"
+
+          apt-ftparchive \
+            -o "APT::FTPArchive::Release::Origin=truenas-proxmox" \
+            -o "APT::FTPArchive::Release::Label=truenas-proxmox" \
+            -o "APT::FTPArchive::Release::Suite=${DIST}" \
+            -o "APT::FTPArchive::Release::Codename=${DIST}" \
+            -o "APT::FTPArchive::Release::Components=main" \
+            -o "APT::FTPArchive::Release::Architectures=all amd64 arm64" \
+            release "${PAGES_DIR}/dists/${DIST}" \
+            > "${PAGES_DIR}/dists/${DIST}/Release"
+
+          gpg --batch --yes \
+            --passphrase "${APT_SIGNING_KEY_PASSPHRASE}" \
+            --default-key "${GPG_KEY_ID}" \
+            --clearsign \
+            -o "${PAGES_DIR}/dists/${DIST}/InRelease" \
+            "${PAGES_DIR}/dists/${DIST}/Release"
+
+          cd "$PAGES_DIR"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add .
+          git diff --staged --quiet || \
+            git commit -m "apt: publish ${VERSION} to testing dist"
+          git push
+
       - name: Create draft GitHub Release
         if: needs.build.outputs.is_release == 'true'
         uses: softprops/action-gh-release@v3

README.md

@@ -214,22 +214,25 @@ For a full upgrade path matrix — including what to do when v4 ships — see [d
 
 ### Testing / Beta Release
 
-For early access to new features (may be unstable):
+For early access to new features (may be unstable). Beta builds are published on
+every push to `release/3.x` — always the latest build, not accumulated history.
 
 ```bash
-# Cloudsmith testing channel (beta builds from release/3.x branch)
+# Import the GPG key (skip if already done for the stable track)
-curl -fsSL https://dl.cloudsmith.io/public/ksatechnologies/truenas-proxmox-testing/gpg.CACC9EE03F2DFFCC.key \
+curl -fsSL https://thegrandwazoo.github.io/freenas-proxmox/public.gpg.key \
   | gpg --dearmor \
-  | sudo tee /usr/share/keyrings/ksatechnologies-truenas-proxmox-testing-keyring.gpg > /dev/null
+  | sudo tee /etc/apt/keyrings/truenas-proxmox.gpg > /dev/null
 
-cat > /etc/apt/sources.list.d/truenas-proxmox-testing.list << 'EOF'
+# Add the testing dist track
-deb [signed-by=/usr/share/keyrings/ksatechnologies-truenas-proxmox-testing-keyring.gpg] \
+echo "deb [signed-by=/etc/apt/keyrings/truenas-proxmox.gpg] \
-  https://dl.cloudsmith.io/public/ksatechnologies/truenas-proxmox-testing/deb/debian any-version main
+https://thegrandwazoo.github.io/freenas-proxmox testing main" \
-EOF
+  | sudo tee /etc/apt/sources.list.d/truenas-proxmox.list
 
 sudo apt update && sudo apt install truenas-proxmox
 ```
 
+To switch back to stable, replace `testing` with `v3` in your sources.list and run `apt update`.
+
 ---
 
 ## Configuration