Publish #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| # Bump one package and publish it to the AUR. Fired by a project's release | |
| # workflow (repository_dispatch: aur-bump) or manually. The payload's `package` | |
| # is a single package directory (e.g. `cnvrt` or `cnvrt-bin`); a release fires | |
| # one dispatch per variant. | |
| on: | |
| repository_dispatch: | |
| types: [aur-bump] | |
| workflow_dispatch: | |
| inputs: | |
| package: | |
| description: Package directory (e.g. cnvrt or cnvrt-bin) | |
| required: true | |
| version: | |
| description: Version, with or without a leading v | |
| required: true | |
| # Serialize so concurrent bumps do not race on the main branch. | |
| concurrency: | |
| group: aur-publish | |
| permissions: | |
| contents: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| env: | |
| PKG: ${{ github.event.client_payload.package || inputs.package }} | |
| VERSION: ${{ github.event.client_payload.version || inputs.version }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Validate inputs | |
| run: | | |
| [[ "$PKG" =~ ^[a-z0-9][a-z0-9-]*$ ]] || { echo "bad package: $PKG"; exit 1; } | |
| [[ "$VERSION" =~ ^v?[0-9][0-9A-Za-z._-]*$ ]] || { echo "bad version: $VERSION"; exit 1; } | |
| [[ -f "$PKG/PKGBUILD" ]] || { echo "no such package dir: $PKG"; exit 1; } | |
| - name: Bump and build-test in an Arch container | |
| run: | | |
| docker run --rm -e PKG -e VERSION -v "$PWD:/aur" archlinux:base-devel bash -c ' | |
| set -e | |
| pacman -Syu --noconfirm --needed base-devel namcap pacman-contrib go git >/dev/null | |
| useradd -m builder | |
| chown -R builder:builder /aur | |
| su builder -c "cd /aur && scripts/bump.sh $PKG $VERSION \ | |
| && cd $PKG && namcap PKGBUILD \ | |
| && makepkg -f --noconfirm --nodeps \ | |
| && namcap ./*.pkg.tar.zst" | |
| ' | |
| sudo chown -R "$USER" . | |
| - name: Commit bump to main | |
| run: | | |
| git config user.name 'shellcell-bot' | |
| git config user.email '[email protected]' | |
| git add "$PKG/PKGBUILD" "$PKG/.SRCINFO" | |
| if git diff --cached --quiet; then | |
| echo "no metadata change; nothing to publish"; exit 0 | |
| fi | |
| git commit -m "$PKG: ${VERSION#v}" | |
| git push | |
| - name: Publish to the AUR | |
| env: | |
| AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }} | |
| run: | | |
| mkdir -p ~/.ssh && chmod 700 ~/.ssh | |
| printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur | |
| chmod 600 ~/.ssh/aur | |
| cat > ~/.ssh/config <<'EOF' | |
| Host aur.archlinux.org | |
| User aur | |
| IdentityFile ~/.ssh/aur | |
| IdentitiesOnly yes | |
| EOF | |
| # Pin the AUR host key rather than trusting on first use. | |
| ssh-keyscan -t ed25519 aur.archlinux.org > ~/.ssh/known_hosts 2>/dev/null | |
| fp=$(ssh-keygen -lf ~/.ssh/known_hosts | awk '{print $2}') | |
| expected='SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4' | |
| if [[ "$fp" != "$expected" ]]; then | |
| echo "AUR host key fingerprint mismatch: got $fp"; exit 1 | |
| fi | |
| tmp=$(mktemp -d) | |
| if ! git clone "ssh://[email protected]/${PKG}.git" "$tmp" 2>/dev/null; then | |
| # Package does not exist yet; first push registers it. | |
| git -C "$tmp" init -q -b master | |
| git -C "$tmp" remote add origin "ssh://[email protected]/${PKG}.git" | |
| fi | |
| cp "$PKG/PKGBUILD" "$PKG/.SRCINFO" "$tmp/" | |
| git -C "$tmp" add PKGBUILD .SRCINFO | |
| if git -C "$tmp" diff --cached --quiet; then | |
| echo "AUR already up to date"; exit 0 | |
| fi | |
| git -C "$tmp" -c user.name='shellcell-bot' \ | |
| -c user.email='[email protected]' \ | |
| commit -q -m "${VERSION#v}" | |
| git -C "$tmp" push origin HEAD:master |