fix: make OTA workflow YAML valid and remove debug files

.gitea/workflows/ota-build.yml

@@ -1,10 +1,83 @@
 name: OTA build
+
 permissions:
   contents: read
   packages: write
-on: [push]
+
+on:
+  push:
+    branches:
+      - '**'
+  workflow_dispatch:
+
 jobs:
   build-ota:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
-      - run: echo "minimal ota repro with permissions"
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install PlatformIO
+        run: |
+          python -m pip install --upgrade pip
+          pip install platformio
+
+      - name: Build OTA firmware binaries
+        run: pio run
+
+      - name: Prepare direct OTA files
+        run: |
+          set -eu
+          project_name="${GITHUB_REPOSITORY#*/}"
+          project_name="${project_name#PlatformIO_}"
+          timestamp="$(date -u +%Y-%m-%dT%H-%M-%SZ)"
+          mkdir -p dist/ota
+          found=0
+          for fw in .pio/build/*/firmware.bin; do
+            [ -f "$fw" ] || continue
+            env_name="$(basename "$(dirname "$fw")")"
+            cp "$fw" "dist/ota/${project_name}_${env_name}_${timestamp}.bin"
+            found=1
+          done
+          if [ "$found" -eq 0 ]; then
+            echo 'No firmware.bin artifacts were produced.' >&2
+            exit 1
+          fi
+          find dist/ota -maxdepth 1 -type f | sort
+
+      - name: Upload direct OTA files to Gitea Packages
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          package_name="$(printf '%s' "${GITHUB_REPOSITORY#*/}" | tr '[:upper:]' '[:lower:]')-ota"
+          package_version="${GITHUB_SHA}"
+          base_url="${GITHUB_SERVER_URL}/api/packages/${GITHUB_REPOSITORY_OWNER}/generic/${package_name}/${package_version}"
+          for file in dist/ota/*; do
+            [ -f "$file" ] || continue
+            curl --fail --silent --show-error --user "${GITHUB_ACTOR}:${GITEA_TOKEN}" --upload-file "$file" "${base_url}/$(basename "$file")"
+            echo "Uploaded $(basename "$file")"
+          done
+
+      - name: Verify uploaded OTA files
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          package_name="$(printf '%s' "${GITHUB_REPOSITORY#*/}" | tr '[:upper:]' '[:lower:]')-ota"
+          package_version="${GITHUB_SHA}"
+          curl --fail --silent --show-error --user "${GITHUB_ACTOR}:${GITEA_TOKEN}" "${GITHUB_SERVER_URL}/api/v1/packages/${GITHUB_REPOSITORY_OWNER}/generic/${package_name}/${package_version}/files" > /tmp/package-files.json
+          python3 - <<'PY'
+          import json
+          from pathlib import Path
+          files = json.loads(Path('/tmp/package-files.json').read_text())
+          assert files, 'no package files returned'
+          for item in files:
+              print(item.get('name') or item.get('file_name') or item)
+          PY

.gitea/workflows/ping.yml

@@ -1,7 +0,0 @@
-name: ping
-on: [push]
-jobs:
-  ping:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "ping from simple workflow"

.hermes-ota-verification.txt

@@ -1 +0,0 @@
-2026-08-30T02:53:27Z trigger push-based OTA verification

PING_TRIGGER_TEST.txt

@@ -1,4 +0,0 @@
-touch 2026-08-30T10:03:33-05:00
-post-update trigger 2026-08-30T10:06:16-05:00
-minimal ota repro trigger 2026-08-30T10:11:01-05:00
-permissions repro 2026-08-30T10:14:57-05:00