agw
8f5bd0953f
JASP 0.98.8 requires the Qt NetworkAuth component, so the build installs qt6-networkauth and the package depends on it at runtime. Without it CMake stopped at configure and the run failed every evening. The scheduled run now starts at 22:00 Danish time instead of 18:00, so the hours-long build no longer competes with evening use of the runner host. Claude-Session: https://claude.ai/code/session_01JmhJG6JnhXfzNiKv8f2vHu
215 lines
8.0 KiB
YAML
215 lines
8.0 KiB
YAML
name: Build JASP binary and publish to AUR
|
|
|
|
# JASP publishes no Linux binary of its own, so this builds one on Arch and
|
|
# ships it as jasp-desktop-bin. Because JASP links against the system R and Qt6,
|
|
# a rebuild is needed both when JASP releases and when Arch bumps R or Qt6 —
|
|
# check-upstream.py decides which.
|
|
|
|
on:
|
|
schedule:
|
|
# 22:00 Danish time, all year: the build saturates the runner host for
|
|
# hours, so it runs when nobody is using it. The TZ prefix keeps the start
|
|
# at 22:00 across daylight saving time instead of drifting with UTC.
|
|
- cron: 'TZ=Europe/Copenhagen 0 22 * * *'
|
|
workflow_dispatch:
|
|
inputs:
|
|
jasp_tag:
|
|
description: 'Specific JASP tag to build (blank = latest release)'
|
|
required: false
|
|
default: ''
|
|
force:
|
|
description: 'Build even if nothing changed'
|
|
type: boolean
|
|
default: false
|
|
|
|
concurrency:
|
|
group: jasp-build
|
|
cancel-in-progress: false
|
|
|
|
# Nothing leaves the runner unless the repo variable PUBLISH is 'true'. Without
|
|
# it a run builds, verifies and generates the PKGBUILD, and leaves the tarball
|
|
# in ${WORK_DIR}/out for inspection: a dry run that cannot touch the tarball
|
|
# host, state.json or the AUR.
|
|
env:
|
|
AUR_MAINTAINER: ${{ vars.AUR_MAINTAINER }}
|
|
TARBALL_BASE_URL: ${{ vars.TARBALL_BASE_URL }}
|
|
WORK_DIR: /work
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
needs_build: ${{ steps.decide.outputs.needs_build }}
|
|
jasp_tag: ${{ steps.decide.outputs.jasp_tag }}
|
|
reasons: ${{ steps.decide.outputs.reasons }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Decide whether a rebuild is needed
|
|
id: decide
|
|
env:
|
|
JASP_TAG: ${{ inputs.jasp_tag }}
|
|
FORCE_BUILD: ${{ inputs.force }}
|
|
run: python3 scripts/check-upstream.py
|
|
|
|
build:
|
|
needs: check
|
|
if: needs.check.outputs.needs_build == 'true'
|
|
runs-on: ubuntu-latest
|
|
# The R module tree is several hundred packages compiled from source; the
|
|
# full build runs for hours. The act_runner timeout and Gitea's
|
|
# ENDLESS_TASK_TIMEOUT must both allow for this (see README).
|
|
timeout-minutes: 900
|
|
# The build step's `docker run` talks to the runner's docker daemon, not to
|
|
# this job container, so the two only share files through a Docker volume.
|
|
# Without it the scripts prepared here never reach the build and the
|
|
# tarball the build writes is invisible to the publish steps. Named volumes
|
|
# rather than host paths: the runner does not expand ${{ vars }} in
|
|
# container.volumes, and a host path would put runner internals in the repo.
|
|
container:
|
|
image: docker.gitea.com/runner-images:ubuntu-latest
|
|
volumes:
|
|
- jasp-build:/work
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Report plan
|
|
run: |
|
|
echo "Building JASP ${{ needs.check.outputs.jasp_tag }}"
|
|
echo "Reasons: ${{ needs.check.outputs.reasons }}"
|
|
|
|
- name: Prepare work directory
|
|
run: |
|
|
# WORK_DIR is a volume mount point, so empty it rather than removing it.
|
|
sudo find "${WORK_DIR}" -mindepth 1 -delete
|
|
sudo mkdir -p "${WORK_DIR}/out"
|
|
sudo cp -a build packaging scripts "${WORK_DIR}/"
|
|
df -h /
|
|
|
|
- name: Build JASP in an Arch container
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GH_TOKEN }}
|
|
run: |
|
|
docker rm -f jasp-build 2>/dev/null || true
|
|
docker run --rm --name jasp-build \
|
|
-v jasp-build:/work \
|
|
-v jasp-cache:/cache \
|
|
-e JASP_TAG="${{ needs.check.outputs.jasp_tag }}" \
|
|
-e OUT_DIR=/work/out \
|
|
-e JOBS=5 \
|
|
-e GITHUB_PAT="${GH_TOKEN}" \
|
|
archlinux:base-devel \
|
|
bash /work/build/build-jasp.sh
|
|
|
|
- name: Show build result
|
|
run: |
|
|
cat "${WORK_DIR}/out/build-info.json"
|
|
ls -lh "${WORK_DIR}/out/"
|
|
|
|
- name: Generate PKGBUILD
|
|
run: |
|
|
sudo cp "${WORK_DIR}/out/build-info.json" .
|
|
python3 scripts/gen-pkgbuild.py \
|
|
--build-info build-info.json \
|
|
--template packaging/PKGBUILD.in \
|
|
--out PKGBUILD \
|
|
--base-url "${TARBALL_BASE_URL}" \
|
|
--maintainer "${AUR_MAINTAINER}"
|
|
cat PKGBUILD
|
|
|
|
# Must run before the AUR push: the PKGBUILD's sha256sum refers to this
|
|
# file, so publishing the package before the tarball exists would leave
|
|
# users with a 404.
|
|
- name: Publish tarball to asger.weirsoe.dk
|
|
if: vars.PUBLISH == 'true'
|
|
env:
|
|
TARBALL_SSH_KEY: ${{ secrets.TARBALL_SSH_KEY }}
|
|
# Secrets, not variables: run logs of a public repo are public, and
|
|
# Gitea prints variables in them but masks secrets.
|
|
TARBALL_HOST: ${{ secrets.TARBALL_HOST }}
|
|
TARBALL_PATH: ${{ secrets.TARBALL_PATH }}
|
|
run: |
|
|
ASSET="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tarball"])')"
|
|
bash scripts/publish-tarball.sh "${WORK_DIR}/out/${ASSET}"
|
|
|
|
- name: Verify the published URL actually serves the tarball
|
|
if: vars.PUBLISH == 'true'
|
|
run: |
|
|
URL="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["download_url"])')"
|
|
WANT="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["sha256"])')"
|
|
echo "checking $URL"
|
|
GOT="$(curl -fsSL --retry 3 "$URL" | sha256sum | awk '{print $1}')"
|
|
if [ "$GOT" != "$WANT" ]; then
|
|
echo "error: what the public URL serves does not match the PKGBUILD sha256" >&2
|
|
echo " want $WANT" >&2
|
|
echo " got $GOT" >&2
|
|
exit 1
|
|
fi
|
|
echo "public URL serves the expected bytes"
|
|
|
|
# The same PKGBUILD the AUR gets, next to the tarball, so the copy on
|
|
# the tarball host always matches the AUR package. Written to a dotfile
|
|
# first and renamed, so the host's index never sees a half-written file.
|
|
# Cosmetic for the AUR release, so a failure here does not stop it.
|
|
- name: Publish PKGBUILD next to the tarball
|
|
if: vars.PUBLISH == 'true'
|
|
continue-on-error: true
|
|
env:
|
|
TARBALL_SSH_KEY: ${{ secrets.TARBALL_SSH_KEY }}
|
|
TARBALL_HOST: ${{ secrets.TARBALL_HOST }}
|
|
TARBALL_PATH: ${{ secrets.TARBALL_PATH }}
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "$TARBALL_SSH_KEY" > ~/.ssh/pkgbuild_key
|
|
chmod 600 ~/.ssh/pkgbuild_key
|
|
dest="${TARBALL_PATH}/jasp-desktop-bin.PKGBUILD"
|
|
ssh -i ~/.ssh/pkgbuild_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
|
|
"root@${TARBALL_HOST}" \
|
|
"cat > '${TARBALL_PATH}/.jasp-desktop-bin.PKGBUILD.part' && mv '${TARBALL_PATH}/.jasp-desktop-bin.PKGBUILD.part' '$dest' && chmod 644 '$dest'" \
|
|
< PKGBUILD
|
|
echo "PKGBUILD published next to the tarball"
|
|
|
|
# Only the PKGBUILD and metadata cross the job boundary; the tarball
|
|
# itself already lives on the tarball host.
|
|
- name: Hand PKGBUILD to the AUR job
|
|
if: vars.PUBLISH == 'true'
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: aur-package
|
|
path: |
|
|
PKGBUILD
|
|
release-meta.json
|
|
|
|
- name: Record built state
|
|
if: vars.PUBLISH == 'true'
|
|
env:
|
|
STATE_PUSH_TOKEN: ${{ secrets.STATE_PUSH_TOKEN }}
|
|
run: bash scripts/record-state.sh
|
|
|
|
- name: Clean up build tree
|
|
if: always()
|
|
run: |
|
|
sudo rm -rf "${WORK_DIR}/jasp-desktop" "${WORK_DIR}/build" "${WORK_DIR}/stage" || true
|
|
df -h /
|
|
|
|
aur:
|
|
needs: [check, build]
|
|
if: vars.PUBLISH == 'true'
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: archlinux:base-devel
|
|
steps:
|
|
- name: Install base tools
|
|
run: pacman -Syu --noconfirm git openssh pacman-contrib nodejs sudo
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/download-artifact@v3
|
|
with:
|
|
name: aur-package
|
|
|
|
- name: Push to AUR
|
|
env:
|
|
AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
|
|
run: bash scripts/push-aur.sh PKGBUILD
|