From cba0975a904c36ed690140b3b50009ae9ac6347f Mon Sep 17 00:00:00 2001
From: Hein <hein.puth@gmail.com>
Date: Mon, 12 Oct 2026 22:08:05 +0200
Subject: [PATCH] ci(release): set umask and pipefail for .deb package build

---
 .gitea/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 53d8d10..484a0c0 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -123,6 +123,9 @@ jobs:
 
       - name: Build .deb packages
         run: |
+          set -euo pipefail
+          # Runner umask can be 000; dpkg-deb rejects group/world-writable package dirs.
+          umask 022
           VERSION="${{ github.event.inputs.tag || github.ref_name }}"
           PKGVER="${VERSION#v}"