Align AUR publishing with the existing pi3-smart-workspace pattern
Reuse the established conventions rather than inventing new ones: the AUR_SSH_PRIVATE_KEY secret name, pushing from an archlinux:base-devel job container instead of docker-in-docker, and the existing git identity. The AUR job only needs the PKGBUILD, so the 1.5 GB tarball never crosses a job boundary - it goes straight to GitHub Releases from the build job. Also correct the Gitea job-timeout setting name to ENDLESS_TASK_TIMEOUT.
This commit is contained in:
agw
+37
-17
@@ -18,12 +18,6 @@ on:
|
||||
description: 'Build even if nothing changed'
|
||||
type: boolean
|
||||
default: false
|
||||
push:
|
||||
paths:
|
||||
- '.gitea/workflows/build.yml'
|
||||
- 'build/**'
|
||||
- 'packaging/**'
|
||||
- 'scripts/**'
|
||||
|
||||
concurrency:
|
||||
group: jasp-build
|
||||
@@ -57,8 +51,8 @@ jobs:
|
||||
if: needs.check.outputs.needs_build == 'true'
|
||||
runs-on: ubuntu-latest
|
||||
# The R module tree is several hundred packages compiled from source; the
|
||||
# full build runs for hours. The runner and Gitea job timeouts must allow
|
||||
# for this too (see README).
|
||||
# full build runs for hours. The act_runner timeout and Gitea's
|
||||
# ENDLESS_TASK_TIMEOUT must both allow for this (see README).
|
||||
timeout-minutes: 900
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
@@ -93,14 +87,15 @@ jobs:
|
||||
|
||||
- name: Generate PKGBUILD
|
||||
run: |
|
||||
sudo cp "${WORK_DIR}/out/build-info.json" .
|
||||
python3 scripts/gen-pkgbuild.py \
|
||||
--build-info "${WORK_DIR}/out/build-info.json" \
|
||||
--build-info build-info.json \
|
||||
--template packaging/PKGBUILD.in \
|
||||
--out "${WORK_DIR}/out/PKGBUILD" \
|
||||
--out PKGBUILD \
|
||||
--gh-owner "${GH_OWNER}" \
|
||||
--gh-repo "${GH_REPO}" \
|
||||
--maintainer "${AUR_MAINTAINER}"
|
||||
cat "${WORK_DIR}/out/PKGBUILD"
|
||||
cat PKGBUILD
|
||||
|
||||
- name: Publish tarball to GitHub Releases
|
||||
env:
|
||||
@@ -108,16 +103,21 @@ jobs:
|
||||
run: |
|
||||
TAG="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tag"])')"
|
||||
ASSET="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tarball"])')"
|
||||
RELEASE_NOTES="Automated build of JASP ${{ needs.check.outputs.jasp_tag }} for Arch Linux.
|
||||
export RELEASE_NOTES="Automated build of JASP ${{ needs.check.outputs.jasp_tag }} for Arch Linux.
|
||||
Consumed by the AUR package jasp-desktop-bin.
|
||||
Trigger: ${{ needs.check.outputs.reasons }}" \
|
||||
Trigger: ${{ needs.check.outputs.reasons }}"
|
||||
TAG="$TAG" ASSET="${WORK_DIR}/out/${ASSET}" \
|
||||
bash scripts/publish-github-release.sh
|
||||
|
||||
- name: Push to AUR
|
||||
env:
|
||||
AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
|
||||
run: bash scripts/push-aur.sh "${WORK_DIR}/out/PKGBUILD"
|
||||
# Only the PKGBUILD and metadata cross the job boundary — the tarball
|
||||
# itself already lives on GitHub Releases.
|
||||
- name: Hand PKGBUILD to the AUR job
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: aur-package
|
||||
path: |
|
||||
PKGBUILD
|
||||
release-meta.json
|
||||
|
||||
- name: Record built state
|
||||
env:
|
||||
@@ -129,3 +129,23 @@ jobs:
|
||||
run: |
|
||||
sudo rm -rf "${WORK_DIR}/jasp-desktop" "${WORK_DIR}/build" "${WORK_DIR}/stage" || true
|
||||
df -h /
|
||||
|
||||
aur:
|
||||
needs: [check, build]
|
||||
runs-on: ubuntu-latest
|
||||
container:
|
||||
image: archlinux:base-devel
|
||||
steps:
|
||||
- name: Install base tools
|
||||
run: pacman -Syu --noconfirm git openssh pacman-contrib nodejs sudo
|
||||
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: aur-package
|
||||
|
||||
- name: Push to AUR
|
||||
env:
|
||||
AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
|
||||
run: bash scripts/push-aur.sh PKGBUILD
|
||||
|
||||
@@ -69,14 +69,14 @@ Set these in the Gitea repo before the first run.
|
||||
| --- | --- | --- |
|
||||
| `GH_OWNER` | `asgerw` | GitHub account hosting the release repo |
|
||||
| `GH_REPO` | `jasp-desktop-bin` | Release repo name |
|
||||
| `AUR_MAINTAINER` | `Asger W <cla@weircon.dk>` | Written into the PKGBUILD header |
|
||||
| `AUR_MAINTAINER` | `Asger Geel Weirsoe <asger@weircon.dk>` | Written into the PKGBUILD header |
|
||||
|
||||
**Secrets** (Settings → Actions → Secrets):
|
||||
|
||||
| Name | Meaning |
|
||||
| --- | --- |
|
||||
| `GH_TOKEN` | GitHub PAT with `contents: write` on the release repo |
|
||||
| `AUR_SSH_KEY` | Private SSH key registered with your AUR account |
|
||||
| `AUR_SSH_PRIVATE_KEY` | Private SSH key registered with your AUR account. Copy the value already set on `agw/pi3-smart-workspace`. |
|
||||
| `GITEA_TOKEN` | Token with write access to this repo, for committing `state.json` |
|
||||
|
||||
The GitHub repo `GH_OWNER/GH_REPO` must exist and be public — the AUR PKGBUILD
|
||||
@@ -88,8 +88,8 @@ The build runs for hours and needs disk. On the Gitea runner host:
|
||||
|
||||
- `runner.timeout` in `/var/lib/gitea-worker/config.yaml` must exceed the build
|
||||
time (set to `16h`).
|
||||
- Gitea's own job timeout (`[actions] DEFAULT_ACTIONS_TIMEOUT` in `app.ini`) must
|
||||
match, otherwise Gitea kills the job at 3h regardless of the runner.
|
||||
- Gitea's own job timeout (`[actions] ENDLESS_TASK_TIMEOUT` in `app.ini`, default
|
||||
3h) must match, otherwise Gitea kills the job at 3h regardless of the runner.
|
||||
- Roughly 40–60 GB of free disk for the build tree and staged install.
|
||||
|
||||
## Running it by hand
|
||||
|
||||
+39
-23
@@ -1,50 +1,66 @@
|
||||
#!/bin/bash
|
||||
# Publish the generated PKGBUILD to the AUR.
|
||||
#
|
||||
# AUR_SSH_KEY private key registered with aur.archlinux.org (required)
|
||||
# $1 path to the generated PKGBUILD
|
||||
# Runs natively inside an `archlinux:base-devel` container (so makepkg is
|
||||
# available), matching the pattern already used by agw/pi3-smart-workspace.
|
||||
#
|
||||
# .SRCINFO is generated with makepkg inside an Arch container, because makepkg
|
||||
# does not exist on the Ubuntu runner image.
|
||||
# AUR_SSH_PRIVATE_KEY private key registered with aur.archlinux.org
|
||||
# $1 path to the generated PKGBUILD
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
PKGBUILD_PATH="${1:?path to PKGBUILD is required}"
|
||||
: "${AUR_SSH_KEY:?AUR_SSH_KEY is required}"
|
||||
: "${AUR_SSH_PRIVATE_KEY:?AUR_SSH_PRIVATE_KEY is required}"
|
||||
PKGNAME="${PKGNAME:-jasp-desktop-bin}"
|
||||
|
||||
mkdir -p ~/.ssh
|
||||
printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
|
||||
chmod 600 ~/.ssh/aur
|
||||
ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
cat > ~/.ssh/config <<'EOF'
|
||||
Host aur.archlinux.org
|
||||
User aur
|
||||
IdentityFile ~/.ssh/aur
|
||||
StrictHostKeyChecking accept-new
|
||||
EOF
|
||||
|
||||
workdir="$(mktemp -d)"
|
||||
trap 'rm -rf "$workdir"' EXIT
|
||||
|
||||
install -m600 /dev/stdin "$workdir/aur_key" <<<"$AUR_SSH_KEY"
|
||||
|
||||
export GIT_SSH_COMMAND="ssh -i $workdir/aur_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
|
||||
|
||||
echo ":: cloning AUR repo $PKGNAME"
|
||||
# A package that does not exist yet clones as an empty repo, which is fine.
|
||||
git clone "ssh://aur@aur.archlinux.org/${PKGNAME}.git" "$workdir/aur"
|
||||
# A package that does not exist on the AUR yet clones as an empty repo.
|
||||
git clone "ssh://aur@aur.archlinux.org/${PKGNAME}.git" "$workdir/aur" 2>&1 || true
|
||||
if [[ ! -d "$workdir/aur/.git" ]]; then
|
||||
mkdir -p "$workdir/aur"
|
||||
git -C "$workdir/aur" init -b master
|
||||
git -C "$workdir/aur" remote add origin "ssh://aur@aur.archlinux.org/${PKGNAME}.git"
|
||||
fi
|
||||
|
||||
cp "$PKGBUILD_PATH" "$workdir/aur/PKGBUILD"
|
||||
|
||||
echo ":: generating .SRCINFO"
|
||||
docker run --rm -v "$workdir/aur:/pkg" -w /pkg archlinux:base-devel bash -euc '
|
||||
# makepkg refuses to run as root.
|
||||
if ! id builder &>/dev/null; then
|
||||
useradd -m builder
|
||||
chown -R builder /pkg
|
||||
sudo -u builder makepkg --printsrcinfo > /pkg/.SRCINFO
|
||||
'
|
||||
echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
|
||||
fi
|
||||
chown -R builder:builder "$workdir/aur"
|
||||
|
||||
echo ":: generating .SRCINFO"
|
||||
# The sha256sum is already correct from gen-pkgbuild.py (taken from the file we
|
||||
# just uploaded), so there is no need to re-download ~1.5 GB with updpkgsums.
|
||||
sudo -u builder bash -c "cd '$workdir/aur' && makepkg --printsrcinfo > .SRCINFO"
|
||||
|
||||
cd "$workdir/aur"
|
||||
git config user.name "${AUR_GIT_NAME:-JASP bin autobuilder}"
|
||||
git config user.email "${AUR_GIT_EMAIL:-noreply@weircon.dk}"
|
||||
git config user.name "${AUR_GIT_NAME:-Asger Geel Weirsoe}"
|
||||
git config user.email "${AUR_GIT_EMAIL:-asger@weircon.dk}"
|
||||
git add PKGBUILD .SRCINFO
|
||||
|
||||
if git diff --quiet && git diff --cached --quiet && [[ -z "$(git status --porcelain)" ]]; then
|
||||
echo ":: AUR already up to date, nothing to push"
|
||||
if git diff --staged --quiet; then
|
||||
echo ":: no changes — nothing to push"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
version="$(awk -F= '/^pkgver=/{v=$2} /^pkgrel=/{r=$2} END{print v"-"r}' PKGBUILD)"
|
||||
git add PKGBUILD .SRCINFO
|
||||
git commit -m "Update to ${version}"
|
||||
git push origin HEAD:master
|
||||
git push -u origin master
|
||||
|
||||
echo ":: pushed ${PKGNAME} ${version} to the AUR"
|
||||
|
||||
Reference in New Issue
Block a user