From 92961bd7b387ae06b3c1fa91d80fb20f877bd14f Mon Sep 17 00:00:00 2001 From: agw Date: Tue, 1 Sep 2026 21:10:00 +0200 Subject: [PATCH] Align AUR publishing with the existing pi3-smart-workspace pattern Reuse the established conventions rather than inventing new ones: the AUR_SSH_PRIVATE_KEY secret name, pushing from an archlinux:base-devel job container instead of docker-in-docker, and the existing git identity. The AUR job only needs the PKGBUILD, so the 1.5 GB tarball never crosses a job boundary - it goes straight to GitHub Releases from the build job. Also correct the Gitea job-timeout setting name to ENDLESS_TASK_TIMEOUT. --- .gitea/workflows/build.yml | 54 ++++++++++++++++++++++----------- README.md | 8 ++--- scripts/push-aur.sh | 62 ++++++++++++++++++++++++-------------- 3 files changed, 80 insertions(+), 44 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index c308774..c9d4f05 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -18,12 +18,6 @@ on: description: 'Build even if nothing changed' type: boolean default: false - push: - paths: - - '.gitea/workflows/build.yml' - - 'build/**' - - 'packaging/**' - - 'scripts/**' concurrency: group: jasp-build @@ -57,8 +51,8 @@ jobs: if: needs.check.outputs.needs_build == 'true' runs-on: ubuntu-latest # The R module tree is several hundred packages compiled from source; the - # full build runs for hours. The runner and Gitea job timeouts must allow - # for this too (see README). + # full build runs for hours. The act_runner timeout and Gitea's + # ENDLESS_TASK_TIMEOUT must both allow for this (see README). timeout-minutes: 900 steps: - uses: actions/checkout@v4 @@ -93,14 +87,15 @@ jobs: - name: Generate PKGBUILD run: | + sudo cp "${WORK_DIR}/out/build-info.json" . python3 scripts/gen-pkgbuild.py \ - --build-info "${WORK_DIR}/out/build-info.json" \ + --build-info build-info.json \ --template packaging/PKGBUILD.in \ - --out "${WORK_DIR}/out/PKGBUILD" \ + --out PKGBUILD \ --gh-owner "${GH_OWNER}" \ --gh-repo "${GH_REPO}" \ --maintainer "${AUR_MAINTAINER}" - cat "${WORK_DIR}/out/PKGBUILD" + cat PKGBUILD - name: Publish tarball to GitHub Releases env: @@ -108,16 +103,21 @@ jobs: run: | TAG="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tag"])')" ASSET="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tarball"])')" - RELEASE_NOTES="Automated build of JASP ${{ needs.check.outputs.jasp_tag }} for Arch Linux. + export RELEASE_NOTES="Automated build of JASP ${{ needs.check.outputs.jasp_tag }} for Arch Linux. Consumed by the AUR package jasp-desktop-bin. - Trigger: ${{ needs.check.outputs.reasons }}" \ + Trigger: ${{ needs.check.outputs.reasons }}" TAG="$TAG" ASSET="${WORK_DIR}/out/${ASSET}" \ bash scripts/publish-github-release.sh - - name: Push to AUR - env: - AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }} - run: bash scripts/push-aur.sh "${WORK_DIR}/out/PKGBUILD" + # Only the PKGBUILD and metadata cross the job boundary — the tarball + # itself already lives on GitHub Releases. + - name: Hand PKGBUILD to the AUR job + uses: actions/upload-artifact@v3 + with: + name: aur-package + path: | + PKGBUILD + release-meta.json - name: Record built state env: @@ -129,3 +129,23 @@ jobs: run: | sudo rm -rf "${WORK_DIR}/jasp-desktop" "${WORK_DIR}/build" "${WORK_DIR}/stage" || true df -h / + + aur: + needs: [check, build] + runs-on: ubuntu-latest + container: + image: archlinux:base-devel + steps: + - name: Install base tools + run: pacman -Syu --noconfirm git openssh pacman-contrib nodejs sudo + + - uses: actions/checkout@v4 + + - uses: actions/download-artifact@v3 + with: + name: aur-package + + - name: Push to AUR + env: + AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }} + run: bash scripts/push-aur.sh PKGBUILD diff --git a/README.md b/README.md index 682daab..abcb84f 100644 --- a/README.md +++ b/README.md @@ -69,14 +69,14 @@ Set these in the Gitea repo before the first run. | --- | --- | --- | | `GH_OWNER` | `asgerw` | GitHub account hosting the release repo | | `GH_REPO` | `jasp-desktop-bin` | Release repo name | -| `AUR_MAINTAINER` | `Asger W ` | Written into the PKGBUILD header | +| `AUR_MAINTAINER` | `Asger Geel Weirsoe ` | Written into the PKGBUILD header | **Secrets** (Settings → Actions → Secrets): | Name | Meaning | | --- | --- | | `GH_TOKEN` | GitHub PAT with `contents: write` on the release repo | -| `AUR_SSH_KEY` | Private SSH key registered with your AUR account | +| `AUR_SSH_PRIVATE_KEY` | Private SSH key registered with your AUR account. Copy the value already set on `agw/pi3-smart-workspace`. | | `GITEA_TOKEN` | Token with write access to this repo, for committing `state.json` | The GitHub repo `GH_OWNER/GH_REPO` must exist and be public — the AUR PKGBUILD @@ -88,8 +88,8 @@ The build runs for hours and needs disk. On the Gitea runner host: - `runner.timeout` in `/var/lib/gitea-worker/config.yaml` must exceed the build time (set to `16h`). -- Gitea's own job timeout (`[actions] DEFAULT_ACTIONS_TIMEOUT` in `app.ini`) must - match, otherwise Gitea kills the job at 3h regardless of the runner. +- Gitea's own job timeout (`[actions] ENDLESS_TASK_TIMEOUT` in `app.ini`, default + 3h) must match, otherwise Gitea kills the job at 3h regardless of the runner. - Roughly 40–60 GB of free disk for the build tree and staged install. ## Running it by hand diff --git a/scripts/push-aur.sh b/scripts/push-aur.sh index 1753ca5..c7aa1ec 100755 --- a/scripts/push-aur.sh +++ b/scripts/push-aur.sh @@ -1,50 +1,66 @@ #!/bin/bash # Publish the generated PKGBUILD to the AUR. # -# AUR_SSH_KEY private key registered with aur.archlinux.org (required) -# $1 path to the generated PKGBUILD +# Runs natively inside an `archlinux:base-devel` container (so makepkg is +# available), matching the pattern already used by agw/pi3-smart-workspace. # -# .SRCINFO is generated with makepkg inside an Arch container, because makepkg -# does not exist on the Ubuntu runner image. +# AUR_SSH_PRIVATE_KEY private key registered with aur.archlinux.org +# $1 path to the generated PKGBUILD set -euo pipefail PKGBUILD_PATH="${1:?path to PKGBUILD is required}" -: "${AUR_SSH_KEY:?AUR_SSH_KEY is required}" +: "${AUR_SSH_PRIVATE_KEY:?AUR_SSH_PRIVATE_KEY is required}" PKGNAME="${PKGNAME:-jasp-desktop-bin}" +mkdir -p ~/.ssh +printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur +chmod 600 ~/.ssh/aur +ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null || true +cat > ~/.ssh/config <<'EOF' +Host aur.archlinux.org + User aur + IdentityFile ~/.ssh/aur + StrictHostKeyChecking accept-new +EOF + workdir="$(mktemp -d)" -trap 'rm -rf "$workdir"' EXIT - -install -m600 /dev/stdin "$workdir/aur_key" <<<"$AUR_SSH_KEY" - -export GIT_SSH_COMMAND="ssh -i $workdir/aur_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" echo ":: cloning AUR repo $PKGNAME" -# A package that does not exist yet clones as an empty repo, which is fine. -git clone "ssh://aur@aur.archlinux.org/${PKGNAME}.git" "$workdir/aur" +# A package that does not exist on the AUR yet clones as an empty repo. +git clone "ssh://aur@aur.archlinux.org/${PKGNAME}.git" "$workdir/aur" 2>&1 || true +if [[ ! -d "$workdir/aur/.git" ]]; then + mkdir -p "$workdir/aur" + git -C "$workdir/aur" init -b master + git -C "$workdir/aur" remote add origin "ssh://aur@aur.archlinux.org/${PKGNAME}.git" +fi cp "$PKGBUILD_PATH" "$workdir/aur/PKGBUILD" -echo ":: generating .SRCINFO" -docker run --rm -v "$workdir/aur:/pkg" -w /pkg archlinux:base-devel bash -euc ' +# makepkg refuses to run as root. +if ! id builder &>/dev/null; then useradd -m builder - chown -R builder /pkg - sudo -u builder makepkg --printsrcinfo > /pkg/.SRCINFO -' + echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers +fi +chown -R builder:builder "$workdir/aur" + +echo ":: generating .SRCINFO" +# The sha256sum is already correct from gen-pkgbuild.py (taken from the file we +# just uploaded), so there is no need to re-download ~1.5 GB with updpkgsums. +sudo -u builder bash -c "cd '$workdir/aur' && makepkg --printsrcinfo > .SRCINFO" cd "$workdir/aur" -git config user.name "${AUR_GIT_NAME:-JASP bin autobuilder}" -git config user.email "${AUR_GIT_EMAIL:-noreply@weircon.dk}" +git config user.name "${AUR_GIT_NAME:-Asger Geel Weirsoe}" +git config user.email "${AUR_GIT_EMAIL:-asger@weircon.dk}" +git add PKGBUILD .SRCINFO -if git diff --quiet && git diff --cached --quiet && [[ -z "$(git status --porcelain)" ]]; then - echo ":: AUR already up to date, nothing to push" +if git diff --staged --quiet; then + echo ":: no changes — nothing to push" exit 0 fi version="$(awk -F= '/^pkgver=/{v=$2} /^pkgrel=/{r=$2} END{print v"-"r}' PKGBUILD)" -git add PKGBUILD .SRCINFO git commit -m "Update to ${version}" -git push origin HEAD:master +git push -u origin master echo ":: pushed ${PKGNAME} ${version} to the AUR"