ci(release): allow Debian-only builds and explicit asset replacement

.github/workflows/publish_release.yml

@@ -11,7 +11,17 @@ on:
         required: true
         type: string
       windows-only:
-        description: Rebuild and upload only the Windows ZIP (skip OCI images)
+        description: Rebuild and upload only the Windows ZIP
+        required: false
+        type: boolean
+        default: false
+      deb-only:
+        description: Build and upload only the Debian package
+        required: false
+        type: boolean
+        default: false
+      replace-deb-assets:
+        description: Replace the Debian package and checksum already attached to this tag
         required: false
         type: boolean
         default: false
@@ -44,6 +54,8 @@ jobs:
         id: release
         env:
           RELEASE_TAG: ${{ github.event.client_payload.tag || inputs.tag }}
+          WINDOWS_ONLY: ${{ inputs.windows-only || false }}
+          DEB_ONLY: ${{ inputs.deb-only || false }}
         shell: bash
         run: |
           set -euo pipefail
@@ -52,6 +64,11 @@ jobs:
             exit 1
           fi
 
+          if [[ "$WINDOWS_ONLY" == true && "$DEB_ONLY" == true ]]; then
+            echo "Choose either windows-only or deb-only, not both" >&2
+            exit 1
+          fi
+
           version="${RELEASE_TAG#v}"
           {
             echo "tag=${RELEASE_TAG}"
@@ -60,6 +77,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
   build-windows:
+    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.deb-only) }}
     needs: prepare
     permissions:
       actions: read
@@ -168,16 +186,21 @@ jobs:
       - name: Attach Debian assets to the Gufo release
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPLACE_DEB_ASSETS: ${{ github.event_name == 'workflow_dispatch' && inputs.replace-deb-assets }}
         working-directory: release
         run: |
           sha256sum --check "gufo_${RELEASE_VERSION}-1_amd64.deb.sha256"
           gh release view "$RELEASE_TAG" --repo gufo-org/gufo
-          gh release upload "$RELEASE_TAG" --repo gufo-org/gufo \
+          upload_args=()
+          if [[ "$REPLACE_DEB_ASSETS" == true ]]; then
+            upload_args+=(--clobber)
+          fi
+          gh release upload "$RELEASE_TAG" --repo gufo-org/gufo "${upload_args[@]}" \
             "gufo_${RELEASE_VERSION}-1_amd64.deb" \
             "gufo_${RELEASE_VERSION}-1_amd64.deb.sha256"
 
   build-and-push:
-    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.windows-only) }}
+    if: ${{ !(github.event_name == 'workflow_dispatch' && (inputs.windows-only || inputs.deb-only)) }}
     needs: prepare
     runs-on: ubuntu-latest
     strategy:

deb/README.md

@@ -4,6 +4,9 @@ The stable release workflow builds `gufo_<version>-1_amd64.deb` and its SHA-256
 checksum from the exact Gufo release tag, tests installation and removal in a
 fresh Debian container, and attaches both files to that release in
 `gufo-org/gufo`. Publishing uses the same GitHub App as the Windows release.
+For a manual Debian-only release, run `Publish Stable Gufo Releases` with
+`tag=vX.Y.Z` and `deb-only=true`. To replace existing Debian assets explicitly,
+also set `replace-deb-assets=true`. Windows and OCI jobs are skipped in this mode.
 Existing release assets are never overwritten automatically.
 
 The package targets Debian 13 (trixie), amd64, and AMD Strix Halo (gfx1151).