Asger Weirsøe
4338c8c034
Run logs of a public repository are public, and Gitea prints variables in them in clear text; only secrets are masked. Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
115 lines
4.0 KiB
YAML
115 lines
4.0 KiB
YAML
name: Publish to AUR
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
# Re-publish without a new upstream release, e.g. a PKGBUILD-only fix:
|
|
# run it on master with the released version and the next pkgrel.
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'Released version to package, without the v (e.g. 1.2.3)'
|
|
required: true
|
|
pkgrel:
|
|
description: 'Package release number'
|
|
required: true
|
|
default: '1'
|
|
|
|
jobs:
|
|
aur:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: archlinux:base-devel
|
|
steps:
|
|
- name: Install base tools
|
|
run: pacman -Syu --noconfirm git openssh pacman-contrib nodejs sudo
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Extract version from tag
|
|
id: version
|
|
run: |
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
VERSION="${{ inputs.version }}"
|
|
PKGREL="${{ inputs.pkgrel }}"
|
|
else
|
|
VERSION="${GITHUB_REF#refs/tags/v}"
|
|
PKGREL=1
|
|
fi
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
echo "pkgrel=$PKGREL" >> "$GITHUB_OUTPUT"
|
|
echo "Publishing $VERSION-$PKGREL to AUR"
|
|
|
|
- name: Configure SSH for AUR
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/aur
|
|
chmod 600 ~/.ssh/aur
|
|
ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
|
|
cat > ~/.ssh/config <<'EOF'
|
|
Host aur.archlinux.org
|
|
User aur
|
|
IdentityFile ~/.ssh/aur
|
|
StrictHostKeyChecking accept-new
|
|
EOF
|
|
|
|
- name: Create unprivileged build user
|
|
run: |
|
|
useradd -m builder
|
|
echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
|
|
mkdir -p /home/builder/.ssh
|
|
cp -r ~/.ssh/. /home/builder/.ssh/
|
|
chown -R builder:builder /home/builder/.ssh
|
|
chmod 600 /home/builder/.ssh/aur
|
|
|
|
- name: Clone existing AUR repo (or init new)
|
|
run: |
|
|
git clone ssh://aur@aur.archlinux.org/pi3-smart-workspace.git aur-pkg 2>&1 || true
|
|
if [ ! -d aur-pkg/.git ]; then
|
|
mkdir -p aur-pkg
|
|
cd aur-pkg
|
|
git init -b master
|
|
git remote add origin ssh://aur@aur.archlinux.org/pi3-smart-workspace.git
|
|
fi
|
|
|
|
- name: Render PKGBUILD for this release
|
|
run: |
|
|
cp packaging/aur/PKGBUILD aur-pkg/PKGBUILD
|
|
sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/" aur-pkg/PKGBUILD
|
|
sed -i "s/^pkgrel=.*/pkgrel=${{ steps.version.outputs.pkgrel }}/" aur-pkg/PKGBUILD
|
|
|
|
- name: Update checksums and regenerate .SRCINFO
|
|
run: |
|
|
chown -R builder:builder aur-pkg
|
|
cd aur-pkg
|
|
sudo -u builder updpkgsums
|
|
sudo -u builder makepkg --printsrcinfo > .SRCINFO
|
|
|
|
- name: Commit and push to AUR
|
|
run: |
|
|
cd aur-pkg
|
|
git config user.name "Asger Geel Weirsoe"
|
|
git config user.email "asger@weircon.dk"
|
|
git add PKGBUILD .SRCINFO
|
|
if git diff --staged --quiet; then
|
|
echo "No changes — nothing to push."
|
|
exit 0
|
|
fi
|
|
git commit -m "Update to ${{ steps.version.outputs.version }}-${{ steps.version.outputs.pkgrel }}"
|
|
git push -u origin master
|
|
|
|
# Mirror the same PKGBUILD to https://asger.weirsøe.dk/tarballz/, the
|
|
# human-readable package index. The key is pinned on the web host to a
|
|
# forced command that can only write this one file, and a failure there
|
|
# must never turn an otherwise good AUR release red.
|
|
- name: Publish PKGBUILD to the tarballz index
|
|
continue-on-error: true
|
|
env:
|
|
TARBALLZ_SSH_KEY: ${{ secrets.TARBALLZ_SSH_KEY }}
|
|
run: |
|
|
printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
|
|
chmod 600 ~/.ssh/tarballz
|
|
ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
|
|
"${{ secrets.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD
|