Fix the two publishing steps that had never run for real

push-aur.sh: mktemp -d creates the work directory as 0700 root, so the
builder user could not enter it to run makepkg ('cd: Permission denied'),
and the git steps afterwards would refuse a tree owned by another user. Give
builder the whole tree for makepkg and hand it back to root before git.

record-state.sh: 'git diff --quiet' ignores untracked files, so the first
state.json was reported as unchanged and never committed, which would have
rebuilt and republished every night. Stage it before comparing.

Both were found by the first publishing run; push-aur.sh was then tested end
to end in a clean Arch container with a dummy key.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9

scripts/push-aur.sh

@@ -42,12 +42,17 @@ if ! id builder &>/dev/null; then
   useradd -m builder
   echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
 fi
-chown -R builder:builder "$workdir/aur"
+# The whole tree, not just aur/: mktemp -d creates $workdir as 0700 root, and
+# builder could not even enter it to run makepkg ("cd: Permission denied").
+chown -R builder:builder "$workdir"
 
 echo ":: generating .SRCINFO"
 # The sha256sum is already correct from gen-pkgbuild.py (taken from the file we
 # just uploaded), so there is no need to re-download ~1.5 GB with updpkgsums.
 sudo -u builder bash -c "cd '$workdir/aur' && makepkg --printsrcinfo > .SRCINFO"
+# Hand the tree back to root: the git commands below run as root, and git
+# refuses to work in a repository owned by another user ("dubious ownership").
+chown -R root:root "$workdir"
 
 cd "$workdir/aur"
 git config user.name "${AUR_GIT_NAME:-Asger Geel Weirsoe}"

scripts/record-state.sh

@@ -28,14 +28,17 @@ with open("state.json", "w") as fh:
 print(json.dumps(state, indent=2))
 PY
 
-if git diff --quiet -- state.json; then
+# Stage first: `git diff` ignores untracked files, so on the very first run
+# (no state.json in the repo yet) it reported "unchanged" and nothing was ever
+# recorded, which would have rebuilt and republished every night.
+git add state.json
+if git diff --cached --quiet -- state.json; then
   echo ":: state.json unchanged"
   exit 0
 fi
 
 git config user.name "jasp-bin autobuilder"
 git config user.email "noreply@weircon.dk"
-git add state.json
 git commit -m "Record build of ${GITHUB_REF_NAME:-build}: $(python3 -c 'import json;print(json.load(open("state.json"))["jasp_version"])')"
 
 origin="$(git remote get-url origin)"