mirror of
https://github.com/praktimarc/kst4contest.git
synced 2026-08-23 18:47:34 +02:00
229 lines
8.3 KiB
YAML
229 lines
8.3 KiB
YAML
name: Publish AUR Packages
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ["Tagged Release Build"]
|
|
types: [completed]
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Release tag (e.g. v1.41.1) — defaults to latest stable release"
|
|
required: false
|
|
default: ""
|
|
dry_run:
|
|
description: "Dry run — skip AUR push and repo commit (for testing)"
|
|
type: choice
|
|
options: ["false", "true"]
|
|
default: "false"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
|
|
AUR_SSH_DIR: /tmp/aur-ssh
|
|
|
|
jobs:
|
|
publish-aur:
|
|
if: >-
|
|
github.event_name == 'workflow_dispatch' ||
|
|
github.event.workflow_run.conclusion == 'success'
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: archlinux:latest
|
|
|
|
steps:
|
|
- name: Install dependencies
|
|
run: |
|
|
pacman -Sy --noconfirm git openssh curl base-devel nodejs
|
|
useradd -m builder
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v4.1.7
|
|
with:
|
|
fetch-depth: 0
|
|
ssh-key: ${{ secrets.WEBSITE_DEPLOY_KEY }}
|
|
|
|
- name: Mark workspace as safe Git directory
|
|
run: |
|
|
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
|
|
- name: Resolve release version
|
|
id: ver
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
INPUT_VERSION: ${{ inputs.version }}
|
|
run: |
|
|
if [[ -n "${INPUT_VERSION}" ]]; then
|
|
TAG="${INPUT_VERSION}"
|
|
else
|
|
TAG=$(curl -sf \
|
|
-H "Authorization: Bearer ${GH_TOKEN}" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"https://api.github.com/repos/${{ github.repository }}/releases/latest" \
|
|
| grep '"tag_name"' | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
|
|
fi
|
|
PKGVER="${TAG#v}"
|
|
echo "tag=${TAG} → pkgver=${PKGVER}"
|
|
echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
|
|
echo "pkgver=${PKGVER}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Compute SHA256 checksums
|
|
id: sha
|
|
run: |
|
|
TAG="${{ steps.ver.outputs.tag }}"
|
|
REPO="${{ github.repository }}"
|
|
|
|
echo "Hashing pre-built Arch package..."
|
|
SHA_BIN=$(curl -sfL \
|
|
"https://github.com/${REPO}/releases/download/${TAG}/KST4Contest-${TAG}-archlinux-x86_64.pkg.tar.zst" \
|
|
| sha256sum | awk '{print $1}')
|
|
echo "bin: ${SHA_BIN}"
|
|
|
|
echo "Hashing source tarball..."
|
|
SHA_SRC=$(curl -sfL \
|
|
"https://github.com/${REPO}/archive/refs/tags/${TAG}.tar.gz" \
|
|
| sha256sum | awk '{print $1}')
|
|
echo "src: ${SHA_SRC}"
|
|
|
|
echo "bin=${SHA_BIN}" >> "$GITHUB_OUTPUT"
|
|
echo "src=${SHA_SRC}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Update PKGBUILDs
|
|
env:
|
|
PKGVER: ${{ steps.ver.outputs.pkgver }}
|
|
SHA_BIN: ${{ steps.sha.outputs.bin }}
|
|
SHA_SRC: ${{ steps.sha.outputs.src }}
|
|
run: |
|
|
# kst4contest-bin
|
|
sed -i "s/^pkgver=.*/pkgver=${PKGVER}/" packaging/aur/kst4contest-bin/PKGBUILD
|
|
sed -i "s/^sha256sums=.*/sha256sums=('${SHA_BIN}')/" packaging/aur/kst4contest-bin/PKGBUILD
|
|
|
|
# kst4contest (source build)
|
|
sed -i "s/^pkgver=.*/pkgver=${PKGVER}/" packaging/aur/kst4contest/PKGBUILD
|
|
sed -i "s/^sha256sums=.*/sha256sums=('${SHA_SRC}')/" packaging/aur/kst4contest/PKGBUILD
|
|
|
|
# A new pkgver supersedes any rebuild-only pkgrel bumps made in between.
|
|
sed -i "s/^pkgrel=.*/pkgrel=1/" packaging/aur/kst4contest-bin/PKGBUILD
|
|
sed -i "s/^pkgrel=.*/pkgrel=1/" packaging/aur/kst4contest/PKGBUILD
|
|
|
|
# kst4contest-git: Basis aus pom.xml, Suffix aus git
|
|
BASE_VER=$(grep -m1 '<version>' pom.xml \
|
|
| sed 's/.*<version>\(.*\)<\/version>.*/\1/' | sed 's/[-.]nightly//')
|
|
GIT_PKGVER="${BASE_VER}.r$(git rev-list --count HEAD).g$(git rev-parse --short HEAD)"
|
|
sed -i "s/^pkgver=.*/pkgver=${GIT_PKGVER}/" packaging/aur/kst4contest-git/PKGBUILD
|
|
|
|
echo "=== Updated PKGBUILD versions ==="
|
|
grep -H '^pkgver=\|^sha256sums=' packaging/aur/*/PKGBUILD
|
|
|
|
- name: Generate .SRCINFO files
|
|
run: |
|
|
for pkg in kst4contest-bin kst4contest kst4contest-git; do
|
|
cp -r "packaging/aur/${pkg}" "/tmp/${pkg}"
|
|
chown -R builder:builder "/tmp/${pkg}"
|
|
su builder -c "cd /tmp/${pkg} && makepkg --printsrcinfo > .SRCINFO"
|
|
cp "/tmp/${pkg}/.SRCINFO" "packaging/aur/${pkg}/.SRCINFO"
|
|
echo "=== ${pkg}/.SRCINFO ==="
|
|
cat "packaging/aur/${pkg}/.SRCINFO"
|
|
done
|
|
|
|
- name: Set up AUR SSH
|
|
if: inputs.dry_run != 'true'
|
|
env:
|
|
AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
|
|
run: |
|
|
mkdir -p "${AUR_SSH_DIR}"
|
|
|
|
printf '%s\n' "${AUR_SSH_PRIVATE_KEY}" \
|
|
> "${AUR_SSH_DIR}/aur_ed25519"
|
|
|
|
sed -i 's/\r$//' "${AUR_SSH_DIR}/aur_ed25519"
|
|
chmod 600 "${AUR_SSH_DIR}/aur_ed25519"
|
|
|
|
ssh-keygen -y \
|
|
-f "${AUR_SSH_DIR}/aur_ed25519" \
|
|
> /dev/null
|
|
|
|
ssh-keyscan \
|
|
-T 10 \
|
|
-t ed25519 \
|
|
aur.archlinux.org \
|
|
> "${AUR_SSH_DIR}/known_hosts"
|
|
|
|
if [ ! -s "${AUR_SSH_DIR}/known_hosts" ]; then
|
|
echo "::error::No SSH host key was received from aur.archlinux.org."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Received AUR host-key fingerprint:"
|
|
ssh-keygen -lf "${AUR_SSH_DIR}/known_hosts"
|
|
|
|
if ! ssh-keygen -lf "${AUR_SSH_DIR}/known_hosts" \
|
|
| grep -Fq "SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4"; then
|
|
echo "::error::The AUR SSH host-key fingerprint does not match the official fingerprint."
|
|
exit 1
|
|
fi
|
|
|
|
printf '%s\n' \
|
|
"Host aur.archlinux.org" \
|
|
" HostName aur.archlinux.org" \
|
|
" User aur" \
|
|
" IdentityFile ${AUR_SSH_DIR}/aur_ed25519" \
|
|
" IdentitiesOnly yes" \
|
|
" StrictHostKeyChecking yes" \
|
|
" UserKnownHostsFile ${AUR_SSH_DIR}/known_hosts" \
|
|
> "${AUR_SSH_DIR}/config"
|
|
|
|
chmod 600 "${AUR_SSH_DIR}/config"
|
|
chmod 600 "${AUR_SSH_DIR}/known_hosts"
|
|
|
|
- name: Push to AUR
|
|
if: inputs.dry_run != 'true'
|
|
env:
|
|
TAG: ${{ steps.ver.outputs.tag }}
|
|
GIT_SSH_COMMAND: ssh -F /tmp/aur-ssh/config
|
|
run: |
|
|
git config --global user.email "philipp@wagnersnetz.de"
|
|
git config --global user.name "Philipp Wagner"
|
|
|
|
mkdir -p /tmp/aur
|
|
|
|
push_to_aur() {
|
|
local pkg="$1"
|
|
local msg="$2"
|
|
local aur_dir="/tmp/aur/${pkg}"
|
|
|
|
git -c init.defaultBranch=master clone \
|
|
"ssh://aur@aur.archlinux.org/${pkg}.git" "${aur_dir}"
|
|
|
|
cp "packaging/aur/${pkg}/PKGBUILD" "${aur_dir}/"
|
|
cp "packaging/aur/${pkg}/.SRCINFO" "${aur_dir}/"
|
|
git -C "${aur_dir}" add PKGBUILD .SRCINFO
|
|
git -C "${aur_dir}" diff --cached --quiet \
|
|
&& echo "${pkg}: no changes, skipping push" && return 0
|
|
git -C "${aur_dir}" commit -m "${msg}"
|
|
git -C "${aur_dir}" push origin HEAD:master
|
|
echo "${pkg}: pushed to AUR"
|
|
}
|
|
|
|
push_to_aur kst4contest-bin "Update to ${TAG}"
|
|
push_to_aur kst4contest "Update to ${TAG}"
|
|
push_to_aur kst4contest-git \
|
|
"Update pkgver to $(grep '^pkgver=' packaging/aur/kst4contest-git/PKGBUILD | cut -d= -f2)"
|
|
|
|
- name: Commit updated PKGBUILDs to repo
|
|
if: inputs.dry_run != 'true'
|
|
run: |
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git config user.name "github-actions[bot]"
|
|
git add packaging/aur/
|
|
git diff --cached --quiet && echo "No PKGBUILD changes to commit." && exit 0
|
|
git commit -m "chore: update AUR packages to ${{ steps.ver.outputs.tag }} [skip ci]"
|
|
|
|
if ! git push; then
|
|
echo "::warning::PKGBUILD bookkeeping commit could not be pushed to main."
|
|
echo "The AUR packages were published; only the in-repo copy stays behind."
|
|
echo "Check that WEBSITE_DEPLOY_KEY still has write access and may bypass"
|
|
echo "the branch ruleset, or commit packaging/aur/ by hand."
|
|
fi
|