build: split current and legacy OpenWrt packages

docs/package-repository.md

@@ -1,7 +1,13 @@
 # Signed OpenWrt package repository
 
-Agent release tags publish a repository for every supported OpenWrt release and target.
-The default public base URL is:
+Agent release tags automatically publish the current OpenWrt support tier:
+
+- OpenWrt 24.10 and 25.12;
+- `x86/64`, `ramips/mt7621`, `ath79/generic`, `ipq40xx/generic` and
+  `mediatek/filogic`.
+
+OpenWrt 21.02, 22.03 and 23.05 packages are added to an existing agent release by the
+manual legacy workflow described below. The default public base URL is:
 
 ```text
 https://benya9669.github.io/openwrt-rmm/feeds/stable/openwrt
@@ -55,11 +61,43 @@ The public keys are committed under `keys/openwrt/`. Their expected identifiers
 The release build verifies that each private key matches the committed public key before
 publishing a signed feed.
 
-An `agent-v*` release fails closed when the key required by an OpenWrt generation is
-missing. Manual workflow runs may still create unsigned test artifacts. BuildKit secret
+An `agent-v*` release and the legacy publication workflow fail closed when a required
+native signing key is missing. A manual run of the general **Build and test** workflow
+may still create unsigned test artifacts, but it does not publish them. BuildKit secret
 mounts expose private keys only to the repository-index build step; private keys are not
 copied into images, artifacts or build cache.
 
+## Support tiers and legacy packages
+
+The normal `agent-v*` workflow builds ten current package targets. This keeps the release
+gate fast and prevents an obsolete SDK from blocking packages for supported OpenWrt
+versions.
+
+To extend the latest agent release with signed OpenWrt 21.02, 22.03 and 23.05 packages,
+run **Actions → Build legacy OpenWrt packages → Run workflow** from the default branch
+and enter its existing tag, for example `agent-v0.6.6`. The same operation is available
+through GitHub CLI:
+
+```sh
+gh workflow run build-legacy.yml -f agent_tag=agent-v0.6.6
+```
+
+Run it only after the main agent release has completed. The legacy workflow:
+
+1. checks out and builds the exact agent tag;
+2. signs the IPK repositories with the configured `usign` key;
+3. combines them with the current release and reconstructs the complete repository;
+4. refreshes signed checksums and uploads the legacy files to the existing GitHub Release;
+5. redeploys the complete current plus legacy repository to GitHub Pages.
+
+The workflow refuses an older agent tag because publishing it would roll the `stable`
+feed back from the latest agent version.
+
+The legacy matrix contains `x86/64`, `ramips/mt7621`, `ath79/generic` and
+`ipq40xx/generic`; OpenWrt 23.05 also contains `mediatek/filogic`.
+`bcm27xx/bcm2711` is intentionally on-demand and should be added only when a supported
+Raspberry Pi 4 installation needs a package.
+
 ## OpenWrt 24.10 and older: IPK/opkg
 
 Choose the directory matching the firmware release and target. For example MT7621 on
@@ -106,7 +144,7 @@ Release assets also include a keyless Sigstore bundle for the combined checksums
 cosign verify-blob \
   --bundle SHA256SUMS.sigstore.json \
   --certificate-identity-regexp \
-    '^https://github.com/Benya9669/openwrt-rmm/.github/workflows/build.yml@refs/tags/agent-v.*$' \
+    '^https://github.com/Benya9669/openwrt-rmm/.github/workflows/(build\.yml@refs/tags/agent-v.*|build-legacy\.yml@refs/heads/main)$' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   SHA256SUMS
 sha256sum --check SHA256SUMS