- name: Sync files using .gitea/workflows/oss-keep.txt
        run: |
          set -euo pipefail

          KEEP_FILE=".gitea/workflows/oss-keep.txt"
          INCLUDE_FILE="$(pwd)/.oss-include.rsync"

          echo "Generating rsync include list from $KEEP_FILE"
          : > "$INCLUDE_FILE"
          echo "## Generated from $KEEP_FILE" >> "$INCLUDE_FILE"
          echo "+ */" >> "$INCLUDE_FILE"   # allow directory traversal

          while IFS= read -r line; do
            line="${line%%#*}"   # strip comments
            line="$(echo "$line" | xargs || true)"
            [ -z "$line" ] && continue
            case "$line" in
              !*)
                pat="${line#!}"
                echo "- $pat" >> "$INCLUDE_FILE"
                ;;
              *)
                echo "+ $line" >> "$INCLUDE_FILE"
                ;;
            esac
          done < "$KEEP_FILE"

          echo "- *" >> "$INCLUDE_FILE"    # exclude everything else

          echo "Rsync include rules:"
          cat "$INCLUDE_FILE"

          # Sync only allowed files to the public repo
          rsync -a --delete --prune-empty-dirs \
            --include-from="$INCLUDE_FILE" \
            ./ /tmp/public/

          cd /tmp/public
          git config user.name  "Gitea CI"
          git config user.email "ci@bausager.org"

          git add -A
          if git diff --cached --quiet; then
            echo "No public-eligible changes to push."
          else
            echo "Pushing filtered subset to Flux-oss..."
            git commit -m "Sync public subset from Flux (private)"
            git push origin HEAD:main
          fi