Tighten the CodeQL rules #1263

	name: RPM Packages
	permissions: read-all
	on:
	workflow_dispatch:
	push:
	tags:
	- '[0-9]+.[0-9]+.[0-9]+'
	pull_request:
	branches: [ main ]
	jobs:
	test-package:
	if: github.event.pull_request
	name: Test Packages
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Build RPM Package
	run: make rpm
	- name: List generated files
	run: ls -l *.rpm
	build-package-manually:
	if: github.event_name != 'pull_request' && github.event_name != 'push'
	name: Build Packages Manually
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Build RPM Package
	run: make rpm
	- name: Upload package
	uses: actions/upload-artifact@v4
	with:
	name: packages
	path: "*.rpm"
	if-no-files-found: error
	retention-days: 3
	publish-package:
	if: github.event_name == 'push'
	name: Publish Packages
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Build RPM Package
	run: make rpm
	- name: List generated files
	run: ls -l *.rpm
	- name: Upload package to repository
	env:
	FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
	run: for f in *.rpm; do curl -F package=@$f https://[email protected]/miniflux/; done

Provide feedback