feat: add GitHub Actions CI and repo setup

- Nightly build workflow that checks for upstream changes
- Deploys Flatpak repo to GitHub Pages
- setup-repo.sh for local repo initialization
- .flatpakrepo and .flatpakref descriptors

.github/workflows/build-flatpak.yml

@@ -0,0 +1,108 @@
+name: Build Flatpak
+
+on:
+  schedule:
+    # Nightly at 04:00 UTC
+    - cron: '0 4 * * *'
+  workflow_dispatch:
+  push:
+    paths:
+      - 'gsd-pi-config/**'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    container:
+      image: bilelmoussaoui/flatpak-github-actions:gnome-48
+      options: --privileged
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check upstream changes
+        id: check
+        run: |
+          # Get latest commit from upstream
+          UPSTREAM_COMMIT=$(git ls-remote https://github.com/open-gsd/gsd-pi-config.git HEAD | cut -f1)
+          echo "upstream_commit=$UPSTREAM_COMMIT" >> "$GITHUB_OUTPUT"
+
+          # Read the commit in our manifest
+          CURRENT_COMMIT=$(grep 'commit:' gsd-pi-config/com.opengsd.pi.yaml | awk '{print $2}')
+          echo "current_commit=$CURRENT_COMMIT" >> "$GITHUB_OUTPUT"
+
+          if [ "$UPSTREAM_COMMIT" = "$CURRENT_COMMIT" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "No upstream changes detected."
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "Upstream changed: $CURRENT_COMMIT -> $UPSTREAM_COMMIT"
+          fi
+
+      - name: Update manifest commit
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          cd gsd-pi-config
+          sed -i "s/commit: .*/commit: ${{ steps.check.outputs.upstream_commit }}/" com.opengsd.pi.yaml
+          echo "Updated manifest to commit ${{ steps.check.outputs.upstream_commit }}"
+
+      - name: Vendor dependencies
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          cd gsd-pi-config
+
+          # Clone upstream at the target commit
+          git clone --depth 1 https://github.com/open-gsd/gsd-pi-config.git gsd-pi-config-src
+          cd gsd-pi-config-src
+          git fetch --depth 1 origin ${{ steps.check.outputs.upstream_commit }}
+          git checkout ${{ steps.check.outputs.upstream_commit }}
+          cd ..
+
+          # Vendor npm
+          cd gsd-pi-config-src
+          npm ci
+          cd ..
+
+          # Vendor cargo
+          cargo vendor --versioned-dirs --manifest-path gsd-pi-config-src/src-tauri/Cargo.toml gsd-pi-config/cargo-vendor
+
+          # Cleanup source clone
+          rm -rf gsd-pi-config/gsd-pi-config-src
+
+      - name: Build Flatpak
+        if: steps.check.outputs.changed == 'true'
+        uses: flatpak/flatpak-github-actions/flatpak-builder@v6
+        with:
+          manifest-path: gsd-pi-config/com.opengsd.pi.yaml
+          cache-key: flatpak-builder-${{ github.sha }}
+
+      - name: Upload repo artifact
+        if: steps.check.outputs.changed == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: flatpak-repo
+          path: repo/
+
+  deploy:
+    needs: build
+    if: needs.build.result == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Download repo artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: flatpak-repo
+          path: repo/
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: repo/

setup-repo.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+# Setup script for the heretek-flathub Flatpak repository.
+# Run once to initialize the repo, then use build.sh to populate it.
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_DIR="$SCRIPT_DIR/repo"
+
+echo "=== Initializing Flatpak repository ==="
+if [ -d "$REPO_DIR" ]; then
+    echo "Repo already exists at $REPO_DIR"
+else
+    flatpak build-init "$REPO_DIR" com.opengsd.pi org.gnome.Sdk org.gnome.Platform 48 2>/dev/null || true
+    # build-init creates an app dir, not a repo — use remote-add pattern instead
+    rm -rf "$REPO_DIR"
+    echo "Creating new OSTree repo..."
+fi
+
+# The repo is created by flatpak-builder --repo=repo during build.sh
+# This script just sets up the .flatpakrepo and .flatpakref files
+
+echo ""
+echo "=== Writing .flatpakrepo descriptor ==="
+cat > "$SCRIPT_DIR/heretek-flathub.flatpakrepo" << 'EOF'
+[Flatpak Repo]
+Title=Heretek Flathub
+Url=https://billyoutlast.github.io/heretek-flathub/
+Homepage=https://github.com/BillyOutlast/heretek-flathub
+Comment=Flatpak packages for GSD tools
+Description=Nightly-built Flatpak packages for GSD Pi Config and other tools.
+EOF
+
+echo ""
+echo "=== Writing .flatpakref for GSD Pi Config ==="
+cat > "$SCRIPT_DIR/gsd-pi-config/com.opengsd.pi.flatpakref" << 'EOF'
+[Flatpak Ref]
+Name=com.opengsd.pi
+Branch=master
+Title=GSD Pi Config
+Url=https://billyoutlast.github.io/heretek-flathub/
+RuntimeRepo=https://dl.flathub.org/repo/flathub.flatpakrepo
+IsRuntime=false
+EOF
+
+echo ""
+echo "Done!"
+echo ""
+echo "To add this repo locally:"
+echo "  flatpak remote-add --if-not-exists heretek-flathub repo/"
+echo "  flatpak install heretek-flathub com.opengsd.pi"
+echo ""
+echo "Users can also install via .flatpakref:"
+echo "  flatpak install https://billyoutlast.github.io/heretek-flathub/gsd-pi-config/com.opengsd.pi.flatpakref"