Publish ahfail-bin, hosted on the tarballz index

A second AUR package with the same release prebuilt. The workflow builds the tag into a staged meson install tree (--prefix=/usr, no update check), names the tarball after its sha256 so a published name never changes bytes, uploads it to asger.weirsoe.dk/tarballz with a key that may only write ahfail-* tarballs, checks that the public URL serves the same bytes, and only then pushes ahfail-bin to the AUR. A manual run can now publish source, bin or both. Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG
2026-09-30 21:41:11 +02:00
parent a1a9a741cc
commit 1934b86c13
3 changed files with 220 additions and 0 deletions
@@ -15,9 +15,14 @@ on:
        description: 'Package release number'
        required: true
        default: '1'
+      packages:
+        description: 'Which AUR packages: both, source (ahfail) or bin (ahfail-bin)'
+        required: true
+        default: 'both'

 jobs:
  aur:
+    if: github.event_name != 'workflow_dispatch' || inputs.packages != 'bin'
    runs-on: ubuntu-latest
    container:
      image: archlinux:base-devel
@@ -112,3 +117,131 @@ jobs:
          chmod 600 ~/.ssh/tarballz
          ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
            root@192.168.10.148 < aur-pkg/PKGBUILD
+
+  # ahfail-bin: the same release, prebuilt. The binary is built from the TAG
+  # (also when this runs by hand from master), staged as a `meson install` tree,
+  # hosted on https://asger.weirsøe.dk/tarballz/ next to the other packages, and
+  # the AUR package only unpacks it.
+  aur-bin:
+    if: github.event_name != 'workflow_dispatch' || inputs.packages != 'source'
+    runs-on: ubuntu-latest
+    container:
+      image: archlinux:base-devel
+    steps:
+      - name: Install build and packaging tools
+        run: >
+          pacman -Syu --noconfirm --needed git openssh nodejs sudo pacman-contrib curl
+          rust meson ninja gtk3 gtk-session-lock gstreamer gst-plugins-base
+          gst-plugins-good gst-plugins-bad-libs pam
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve version
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="${{ inputs.version }}"
+            PKGREL="${{ inputs.pkgrel }}"
+          else
+            VERSION="${GITHUB_REF#refs/tags/v}"
+            PKGREL=1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "pkgrel=$PKGREL" >> "$GITHUB_OUTPUT"
+
+      - name: Build the tagged source into a staged tree
+        run: |
+          # The packaging files come from this checkout; the binary from the tag.
+          cp -r packaging/aur-bin /tmp/aur-bin
+          git -c advice.detachedHead=false checkout "v${{ steps.version.outputs.version }}"
+          meson setup build --prefix=/usr --buildtype=release -Dupdate_check=false
+          meson compile -C build
+          DESTDIR="$PWD/stage" meson install -C build
+          find stage -type f | sort
+
+      - name: Pack the tarball
+        id: tarball
+        run: |
+          # Reproducible-ish: fixed owner, sorted entries, mtime of the tagged commit.
+          EPOCH="$(git log -1 --format=%ct)"
+          tar --sort=name --owner=0 --group=0 --numeric-owner --mtime="@$EPOCH" \
+              --zstd -cf ahfail.tar.zst -C stage usr etc
+          SHA="$(sha256sum ahfail.tar.zst | cut -d' ' -f1)"
+          # The hash is part of the name, so a published name never changes bytes.
+          NAME="ahfail-${{ steps.version.outputs.version }}-${SHA:0:12}-x86_64.tar.zst"
+          mv ahfail.tar.zst "$NAME"
+          echo "name=$NAME" >> "$GITHUB_OUTPUT"
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          ls -l "$NAME"
+
+      - name: Upload the tarball to tarballz
+        env:
+          TARBALLZ_BIN_SSH_KEY: ${{ secrets.TARBALLZ_BIN_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "$TARBALLZ_BIN_SSH_KEY" > ~/.ssh/tarballz-bin
+          chmod 600 ~/.ssh/tarballz-bin
+          # Forced command on the web host: this key may only write ahfail-*.tar.*
+          # and ahfail-bin.PKGBUILD, and keeps the newest three tarballs.
+          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
+            root@192.168.10.148 "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
+
+      - name: Verify the public URL serves the same bytes
+        run: |
+          URL="https://asger.weirsoe.dk/tarballz/${{ steps.tarball.outputs.name }}"
+          GOT="$(curl -fsSL --retry 3 "$URL" | sha256sum | cut -d' ' -f1)"
+          if [ "$GOT" != "${{ steps.tarball.outputs.sha }}" ]; then
+            echo "error: $URL does not serve the uploaded tarball" >&2
+            exit 1
+          fi
+
+      - name: Configure SSH for AUR
+        run: |
+          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/aur
+          chmod 600 ~/.ssh/aur
+          ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
+          cat > ~/.ssh/config <<'EOF'
+          Host aur.archlinux.org
+            User aur
+            IdentityFile ~/.ssh/aur
+            StrictHostKeyChecking accept-new
+          EOF
+          useradd -m builder
+
+      - name: Render PKGBUILD and .SRCINFO
+        run: |
+          git clone ssh://aur@aur.archlinux.org/ahfail-bin.git aur-bin-pkg 2>&1 || true
+          if [ ! -d aur-bin-pkg/.git ]; then
+            mkdir -p aur-bin-pkg && cd aur-bin-pkg
+            git init -b master
+            git remote add origin ssh://aur@aur.archlinux.org/ahfail-bin.git
+            cd ..
+          fi
+          cp /tmp/aur-bin/PKGBUILD /tmp/aur-bin/ahfail.install aur-bin-pkg/
+          cd aur-bin-pkg
+          sed -i "s/@TARBALL@/${{ steps.tarball.outputs.name }}/g; s/@SHA256@/${{ steps.tarball.outputs.sha }}/" PKGBUILD
+          sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/; s/^pkgrel=.*/pkgrel=${{ steps.version.outputs.pkgrel }}/" PKGBUILD
+          chown -R builder: .
+          sudo -u builder makepkg --printsrcinfo > .SRCINFO
+          cat PKGBUILD | tail -20
+
+      - name: Commit and push to AUR
+        run: |
+          cd aur-bin-pkg
+          git config user.name "Asger Geel Weirsoe"
+          git config user.email "asger@weircon.dk"
+          git add PKGBUILD .SRCINFO ahfail.install
+          if git diff --staged --quiet; then
+            echo "No changes, nothing to push."
+            exit 0
+          fi
+          git commit -m "Update to ${{ steps.version.outputs.version }}-${{ steps.version.outputs.pkgrel }}"
+          git push -u origin master
+
+      - name: Publish PKGBUILD to the tarballz index
+        continue-on-error: true
+        run: |
+          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
+            root@192.168.10.148 < aur-bin-pkg/PKGBUILD