- name: Sync files using .gitea/workflows/openbuild-keep.txt (debug)
        run: |
          set -euo pipefail
          set -x

          KEEP_FILE=".gitea/workflows/openbuild-keep.txt"   # <- change if you use another name
          INCLUDE_FILE="$(pwd)/.oss-include.rsync"

          # Show what exists in the source
          echo "== Source tree (top) =="
          ls -la
          echo "== Source include/* (2 levels) =="
          find include -maxdepth 2 -type f -print 2>/dev/null || true

          # Build rsync include file
          : > "$INCLUDE_FILE"
          echo "## Generated from $KEEP_FILE" >> "$INCLUDE_FILE"
          echo "+ */" >> "$INCLUDE_FILE"        # allow directory descent
          # Always include the directory entry itself when using /** patterns
          echo "+ include/" >> "$INCLUDE_FILE"  # safe even if not present

          while IFS= read -r line; do
            line="${line%%#*}"
            line="$(echo "$line" | xargs || true)"
            [ -z "$line" ] && continue
            case "$line" in
              !*) echo "- ${line#!}" >> "$INCLUDE_FILE" ;;
              *)  echo "+ $line"      >> "$INCLUDE_FILE" ;;
            esac
          done < "$KEEP_FILE"

          echo "- *" >> "$INCLUDE_FILE"   # exclude everything else

          echo "== Rsync include rules =="
          cat "$INCLUDE_FILE"

          rsync -av --delete --prune-empty-dirs \
            --exclude '.git/' \
            --include-from="$INCLUDE_FILE" \
            ./ /tmp/public/

          cd /tmp/public
          git config user.name  "Gitea CI"
          git config user.email "ci@bausager.org"
          git add -A
          if git diff --cached --quiet; then
            echo "No public-eligible changes to push."
          else
            git commit -m "Sync public subset from Flux (private)"
            git push origin HEAD:main
          fi