ci: take the package list from the UPDATE_PACKAGES variable instead of the matrix

.gitea/workflows/update.yaml

@@ -31,7 +31,86 @@ defaults:
     shell: bash
 
 jobs:
+  # Resolves the package list for the update matrix below, so adding or
+  # dropping a package is a variable edit on the org, not a commit here.
+  # See README "Package list".
+  plan:
+    runs-on: ubuntu-latest
+    outputs:
+      packages: ${{ steps.resolve.outputs.packages }}
+    steps:
+      - name: Resolve the package list
+        id: resolve
+        # Both go through the environment, never pasted into the script: the
+        # variable is free-form multi-line text.
+        env:
+          UPDATE_PACKAGES: ${{ vars.UPDATE_PACKAGES }}
+          PACKAGE_INPUT: ${{ inputs.package }}
+        run: |
+          set -euo pipefail
+          export LC_ALL=C
+          : "${UPDATE_PACKAGES:=}" "${PACKAGE_INPUT:=}"
+          re='^[A-Za-z0-9][A-Za-z0-9._+-]*$'
+          pkgs=()
+          declare -A seen=()
+
+          # add NAME: validate, then append unless already listed.
+          add() {
+            if [[ ! $1 =~ $re ]]; then
+              echo "::error::${from}: invalid package name '$1' (letters, digits and . _ + - only, starting with a letter or digit)" >&2
+              exit 1
+            fi
+            if [ -z "${seen[$1]:-}" ]; then
+              seen[$1]=1
+              pkgs+=("$1")
+            fi
+          }
+
+          if [ -n "${PACKAGE_INPUT//[[:space:]]/}" ]; then
+            # workflow_dispatch with a package name runs only that one,
+            # whatever UPDATE_PACKAGES says. Surrounding whitespace is
+            # trimmed; the rest must be a single valid name.
+            from="workflow_dispatch input 'package'"
+            want=${PACKAGE_INPUT#"${PACKAGE_INPUT%%[![:space:]]*}"}
+            want=${want%"${want##*[![:space:]]}"}
+            add "${want}"
+          else
+            # "- a\n- b", "a\nb", "- a - b" and "a b" are the same list:
+            # comments go first, then every whitespace run (CR included, in
+            # case the value was saved with CRLF line ends) becomes a line
+            # break. Each line is then a name, a lone "-" list marker, or a
+            # "-" glued to a name.
+            from="UPDATE_PACKAGES"
+            while IFS= read -r tok; do
+              case ${tok} in
+                "" | -) continue ;;
+                -*) tok=${tok#-} ;;
+              esac
+              add "${tok}"
+            done <<< "$(printf '%s\n' "${UPDATE_PACKAGES}" | sed -e 's/#.*$//' | tr -s '[:space:]' '\n')"
+          fi
+
+          # Fail rather than run nothing: an empty matrix would pass and look
+          # exactly like a night with nothing to update.
+          if [ "${#pkgs[@]}" -eq 0 ]; then
+            echo '::error::UPDATE_PACKAGES is not set: add an org or repo variable with one package per line (leading "- " optional)' >&2
+            exit 1
+          fi
+
+          # Names are validated above, so none needs JSON escaping.
+          json=
+          for p in "${pkgs[@]}"; do
+            json+="${json:+,}\"${p}\""
+          done
+          json="[${json}]"
+
+          echo "${#pkgs[@]} package(s) from ${from}:"
+          printf '  - %s\n' "${pkgs[@]}"
+          echo "matrix: ${json}"
+          echo "packages=${json}" >> "${GITHUB_OUTPUT}"
+
   update:
+    needs: plan
     runs-on: ubuntu-latest
     # dpkg-buildpackage runs as the unprivileged `builder` user inside a Debian
     # bookworm image, so the result installs on bookworm and everything newer.
@@ -48,8 +127,9 @@ jobs:
       # One broken package must not cancel the rest of the matrix.
       fail-fast: false
       matrix:
-        package:
-          - skeptical-updater
+        # One entry per package, resolved by the plan job above from
+        # vars.UPDATE_PACKAGES or the dispatch input.
+        package: ${{ fromJSON(needs.plan.outputs.packages) }}
 
     steps:
       # No bootstrap step: node, git, jq, curl and the packaging toolchain all
@@ -105,12 +185,6 @@ jobs:
           NO_GIT_PUSH: ${{ (inputs.no_git_push == true || inputs.no_git_push == 'true') && '1' || '' }}
         run: |
           set -euo pipefail
-          # workflow_dispatch with a package name runs only that one.
-          want="${{ inputs.package }}"
-          if [ -n "${want}" ] && [ "${want}" != "${{ matrix.package }}" ]; then
-            echo "skipping ${{ matrix.package }} (dispatch asked for ${want})"
-            exit 0
-          fi
           runuser -u builder -- env \
             GIT_HOST="${GIT_HOST}" \
             FORCE_REBUILD="${FORCE_REBUILD}" \