Align AUR publishing with the existing pi3-smart-workspace pattern

Reuse the established conventions rather than inventing new ones: the
AUR_SSH_PRIVATE_KEY secret name, pushing from an archlinux:base-devel
job container instead of docker-in-docker, and the existing git identity.

The AUR job only needs the PKGBUILD, so the 1.5 GB tarball never crosses
a job boundary - it goes straight to GitHub Releases from the build job.

Also correct the Gitea job-timeout setting name to ENDLESS_TASK_TIMEOUT.

scripts/push-aur.sh

@@ -1,50 +1,66 @@
 #!/bin/bash
 # Publish the generated PKGBUILD to the AUR.
 #
-#   AUR_SSH_KEY   private key registered with aur.archlinux.org (required)
-#   $1            path to the generated PKGBUILD
+# Runs natively inside an `archlinux:base-devel` container (so makepkg is
+# available), matching the pattern already used by agw/pi3-smart-workspace.
 #
-# .SRCINFO is generated with makepkg inside an Arch container, because makepkg
-# does not exist on the Ubuntu runner image.
+#   AUR_SSH_PRIVATE_KEY   private key registered with aur.archlinux.org
+#   $1                    path to the generated PKGBUILD
 
 set -euo pipefail
 
 PKGBUILD_PATH="${1:?path to PKGBUILD is required}"
-: "${AUR_SSH_KEY:?AUR_SSH_KEY is required}"
+: "${AUR_SSH_PRIVATE_KEY:?AUR_SSH_PRIVATE_KEY is required}"
 PKGNAME="${PKGNAME:-jasp-desktop-bin}"
 
+mkdir -p ~/.ssh
+printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
+chmod 600 ~/.ssh/aur
+ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null || true
+cat > ~/.ssh/config <<'EOF'
+Host aur.archlinux.org
+  User aur
+  IdentityFile ~/.ssh/aur
+  StrictHostKeyChecking accept-new
+EOF
+
 workdir="$(mktemp -d)"
-trap 'rm -rf "$workdir"' EXIT
-
-install -m600 /dev/stdin "$workdir/aur_key" <<<"$AUR_SSH_KEY"
-
-export GIT_SSH_COMMAND="ssh -i $workdir/aur_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
 
 echo ":: cloning AUR repo $PKGNAME"
-# A package that does not exist yet clones as an empty repo, which is fine.
-git clone "ssh://aur@aur.archlinux.org/${PKGNAME}.git" "$workdir/aur"
+# A package that does not exist on the AUR yet clones as an empty repo.
+git clone "ssh://aur@aur.archlinux.org/${PKGNAME}.git" "$workdir/aur" 2>&1 || true
+if [[ ! -d "$workdir/aur/.git" ]]; then
+  mkdir -p "$workdir/aur"
+  git -C "$workdir/aur" init -b master
+  git -C "$workdir/aur" remote add origin "ssh://aur@aur.archlinux.org/${PKGNAME}.git"
+fi
 
 cp "$PKGBUILD_PATH" "$workdir/aur/PKGBUILD"
 
-echo ":: generating .SRCINFO"
-docker run --rm -v "$workdir/aur:/pkg" -w /pkg archlinux:base-devel bash -euc '
+# makepkg refuses to run as root.
+if ! id builder &>/dev/null; then
   useradd -m builder
-  chown -R builder /pkg
-  sudo -u builder makepkg --printsrcinfo > /pkg/.SRCINFO
-'
+  echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
+fi
+chown -R builder:builder "$workdir/aur"
+
+echo ":: generating .SRCINFO"
+# The sha256sum is already correct from gen-pkgbuild.py (taken from the file we
+# just uploaded), so there is no need to re-download ~1.5 GB with updpkgsums.
+sudo -u builder bash -c "cd '$workdir/aur' && makepkg --printsrcinfo > .SRCINFO"
 
 cd "$workdir/aur"
-git config user.name "${AUR_GIT_NAME:-JASP bin autobuilder}"
-git config user.email "${AUR_GIT_EMAIL:-noreply@weircon.dk}"
+git config user.name "${AUR_GIT_NAME:-Asger Geel Weirsoe}"
+git config user.email "${AUR_GIT_EMAIL:-asger@weircon.dk}"
+git add PKGBUILD .SRCINFO
 
-if git diff --quiet && git diff --cached --quiet && [[ -z "$(git status --porcelain)" ]]; then
-  echo ":: AUR already up to date, nothing to push"
+if git diff --staged --quiet; then
+  echo ":: no changes — nothing to push"
   exit 0
 fi
 
 version="$(awk -F= '/^pkgver=/{v=$2} /^pkgrel=/{r=$2} END{print v"-"r}' PKGBUILD)"
-git add PKGBUILD .SRCINFO
 git commit -m "Update to ${version}"
-git push origin HEAD:master
+git push -u origin master
 
 echo ":: pushed ${PKGNAME} ${version} to the AUR"