ci: harden update-pkgver workflow with fail-loud checks

.gitea/workflows/update-pkgver.yaml

@@ -13,7 +13,9 @@ jobs:
     runs-on: moonarch
     steps:
       - name: Checkout source repo
+        shell: bash
         run: |
+          set -euo pipefail
           git clone --bare http://gitea:3000/nevaforget/sshfs_connect.git source.git
           cd source.git
           PKGVER=$(git describe --long --tags | sed 's/^v//;s/-/.r/;s/-/./')
@@ -21,7 +23,18 @@ jobs:
           echo "$PKGVER" > /tmp/pkgver
 
       - name: Update PKGBUILD
+        shell: bash
+        env:
+          PKGBUILD_TOKEN: ${{ secrets.PKGBUILD_TOKEN }}
         run: |
+          set -euo pipefail
+
+          if [ -z "${PKGBUILD_TOKEN:-}" ]; then
+            echo "ERROR: PKGBUILD_TOKEN secret is empty or unset."
+            echo "Set it under Repo Settings -> Actions -> Secrets."
+            exit 1
+          fi
+
           PKGVER=$(cat /tmp/pkgver)
           git clone http://gitea:3000/nevaforget/moonarch-pkgbuilds.git pkgbuilds
           cd pkgbuilds
@@ -34,10 +47,13 @@ jobs:
 
           sed -i "s/^pkgver=.*/pkgver=$PKGVER/" sshfsc-git/PKGBUILD
           sed -i "s/^\tpkgver = .*/\tpkgver = $PKGVER/" sshfsc-git/.SRCINFO
-          echo "Updated pkgver: $OLD_VER → $PKGVER"
+          echo "Updated pkgver: $OLD_VER -> $PKGVER"
 
           git config user.name "pkgver-bot"
           git config user.email "gitea@moonarch.de"
           git add sshfsc-git/PKGBUILD sshfsc-git/.SRCINFO
           git commit -m "chore(sshfsc-git): bump pkgver to $PKGVER"
-          git -c http.extraHeader="Authorization: token ${{ secrets.PKGBUILD_TOKEN }}" push
+
+          echo "--- pushing ---"
+          git -c http.extraHeader="Authorization: token ${PKGBUILD_TOKEN}" push --verbose origin HEAD:main
+          echo "--- push done ---"