v1.8.0-rc.5 #17
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to AUR | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Release tag to publish (e.g. v1.5.0)" | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| if: (github.event_name == 'workflow_dispatch' || !github.event.release.prerelease) && vars.AUR_PACKAGE_NAME != '' | |
| steps: | |
| - name: Resolve tag and version | |
| id: meta | |
| env: | |
| GH_EVENT_TAG: ${{ github.event.release.tag_name }} | |
| INPUT_TAG: ${{ inputs.tag }} | |
| run: | | |
| set -euo pipefail | |
| TAG="${GH_EVENT_TAG:-$INPUT_TAG}" | |
| if [[ -z "$TAG" ]]; then | |
| echo "::error::No tag resolved from release event or workflow input" | |
| exit 1 | |
| fi | |
| VERSION="${TAG#v}" | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Check AUR secrets | |
| id: aur_secret | |
| env: | |
| AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }} | |
| run: | | |
| if [[ -z "$AUR_SSH_PRIVATE_KEY" ]]; then | |
| echo "AUR_SSH_PRIVATE_KEY secret not set; skipping." | |
| echo "configured=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "configured=true" >> "$GITHUB_OUTPUT" | |
| - name: Find .pacman asset | |
| if: steps.aur_secret.outputs.configured == 'true' | |
| id: asset | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAG: ${{ steps.meta.outputs.tag }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| set -euo pipefail | |
| NAMES=$(gh release view "$TAG" --repo "$REPO" --json assets --jq '.assets[].name') | |
| PACMAN_NAME=$(echo "$NAMES" | grep -iE '\.pacman$' | head -n1 || true) | |
| if [[ -z "$PACMAN_NAME" ]]; then | |
| echo "::error::No .pacman asset found in release $TAG" | |
| echo "Available assets:" | |
| echo "$NAMES" | |
| exit 1 | |
| fi | |
| echo "name=$PACMAN_NAME" >> "$GITHUB_OUTPUT" | |
| echo "Found pacman asset: $PACMAN_NAME" | |
| - name: Download and compute sha256 | |
| if: steps.aur_secret.outputs.configured == 'true' | |
| id: sha | |
| env: | |
| REPO: ${{ github.repository }} | |
| TAG: ${{ steps.meta.outputs.tag }} | |
| ASSET: ${{ steps.asset.outputs.name }} | |
| run: | | |
| set -euo pipefail | |
| BASE="https://github.com/${REPO}/releases/download/${TAG}" | |
| curl -fsSL --retry 3 -o /tmp/pkg.pacman "${BASE}/${ASSET}" | |
| PKG_SHA=$(sha256sum /tmp/pkg.pacman | awk '{print $1}') | |
| echo "sha256=$PKG_SHA" >> "$GITHUB_OUTPUT" | |
| - name: Setup SSH for AUR | |
| if: steps.aur_secret.outputs.configured == 'true' | |
| env: | |
| AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }} | |
| AUR_KNOWN_HOSTS: ${{ vars.AUR_KNOWN_HOSTS }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "$AUR_KNOWN_HOSTS" ]]; then | |
| echo "::error::AUR_KNOWN_HOSTS variable is required for secure AUR SSH" | |
| exit 1 | |
| fi | |
| mkdir -p ~/.ssh | |
| echo "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur_key | |
| chmod 600 ~/.ssh/aur_key | |
| printf '%s\n' "$AUR_KNOWN_HOSTS" > ~/.ssh/aur_known_hosts | |
| cat >> ~/.ssh/config <<'SSHCONF' | |
| Host aur.archlinux.org | |
| HostName aur.archlinux.org | |
| User aur | |
| IdentityFile ~/.ssh/aur_key | |
| StrictHostKeyChecking yes | |
| UserKnownHostsFile ~/.ssh/aur_known_hosts | |
| SSHCONF | |
| - name: Clone AUR repository | |
| if: steps.aur_secret.outputs.configured == 'true' | |
| env: | |
| PACKAGE: ${{ vars.AUR_PACKAGE_NAME }} | |
| run: | | |
| set -euo pipefail | |
| git clone "ssh://aur@aur.archlinux.org/${PACKAGE}.git" aur-repo | |
| - name: Install makepkg | |
| if: steps.aur_secret.outputs.configured == 'true' | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update -qq | |
| sudo apt-get install -y -qq pacman-package-manager 2>/dev/null || \ | |
| sudo apt-get install -y -qq makepkg 2>/dev/null || { | |
| echo "::error::Unable to install makepkg. Install pacman-package-manager or makepkg." | |
| exit 1 | |
| } | |
| command -v makepkg >/dev/null || { | |
| echo "::error::makepkg still missing after install." | |
| exit 1 | |
| } | |
| - name: Update PKGBUILD and .SRCINFO | |
| if: steps.aur_secret.outputs.configured == 'true' | |
| working-directory: aur-repo | |
| env: | |
| VERSION: ${{ steps.meta.outputs.version }} | |
| SHA256: ${{ steps.sha.outputs.sha256 }} | |
| ASSET: ${{ steps.asset.outputs.name }} | |
| REPO: ${{ github.repository }} | |
| TAG: ${{ steps.meta.outputs.tag }} | |
| run: | | |
| set -euo pipefail | |
| sed -i -E "s|^pkgver=.*|pkgver=${VERSION}|" PKGBUILD | |
| sed -i -E "s|^pkgrel=.*|pkgrel=1|" PKGBUILD | |
| sed -i -E "s|^sha256sums=\('[^']*'|sha256sums=('${SHA256}'|" PKGBUILD | |
| makepkg --printsrcinfo > .SRCINFO | |
| echo "Updated .SRCINFO" | |
| - name: Commit and push | |
| if: steps.aur_secret.outputs.configured == 'true' | |
| working-directory: aur-repo | |
| env: | |
| VERSION: ${{ steps.meta.outputs.version }} | |
| run: | | |
| set -euo pipefail | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add PKGBUILD .SRCINFO | |
| if git diff --cached --quiet; then | |
| echo "PKGBUILD already up to date for ${VERSION} — nothing to commit." | |
| exit 0 | |
| fi | |
| git commit -m "Bump to ${VERSION}" | |
| git push |