From 9bf9701d925406a714b69c78a64743d802d0cdfd Mon Sep 17 00:00:00 2001 From: Arjen <18398758+Origami74@users.noreply.github.com> Date: Tue, 12 May 2026 17:52:11 +0000 Subject: [PATCH] ci: fix AUR publish for fips, add fips-git publish workflow The v0.3.0 stable AUR push silently failed: with updpkgsums: true, makepkg downloaded fips-.tar.gz into the AUR working tree, where it was then staged by the deploy action and rejected by AUR's 488 KiB max-blob hook. Fetch the upstream source tarball and compute its b2sum in CI, patch pkgver and the b2sums SKIP placeholder in PKGBUILD in-place, then publish with updpkgsums: false so the AUR clone stays metadata-only. Recompute and patch the fips.sysusers / fips.tmpfiles asset b2sums in the same step so they stay in sync with the local files; this safety net was previously provided by updpkgsums. Add aur-publish-git.yml for the VCS fips-git PKGBUILD, triggered on master pushes that touch PKGBUILD-git or its companion files plus workflow_dispatch. pkgver is computed at build time by the PKGBUILD's pkgver() function, so this workflow is not tied to release tags. Add a workflow_dispatch tag input on the stable workflow so historical release tags can be re-published manually, and drop continue-on-error: true so future regressions surface in CI. --- .github/workflows/aur-publish-git.yml | 57 +++++++++++++++++++++ .github/workflows/aur-publish.yml | 71 ++++++++++++++++++++++++--- 2 files changed, 120 insertions(+), 8 deletions(-) create mode 100644 .github/workflows/aur-publish-git.yml diff --git a/.github/workflows/aur-publish-git.yml b/.github/workflows/aur-publish-git.yml new file mode 100644 index 0000000..2788e1a --- /dev/null +++ b/.github/workflows/aur-publish-git.yml @@ -0,0 +1,57 @@ +name: AUR Publish (fips-git) + +on: + workflow_dispatch: + push: + branches: + - master + paths: + - 'packaging/aur/PKGBUILD-git' + - 'packaging/aur/fips.sysusers' + - 'packaging/aur/fips.tmpfiles' + - 'packaging/aur/fips.install' + +jobs: + aur-publish-fips-git: + name: Publish fips-git to AUR + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: Patch PKGBUILD-git b2sums for local assets + run: | + set -euo pipefail + SYSUSERS_SUM=$(b2sum packaging/aur/fips.sysusers | awk '{print $1}') + TMPFILES_SUM=$(b2sum packaging/aur/fips.tmpfiles | awk '{print $1}') + if [ -z "$SYSUSERS_SUM" ] || [ -z "$TMPFILES_SUM" ]; then + echo "Failed to compute asset b2sums"; exit 1 + fi + awk -v s1="$SYSUSERS_SUM" -v s2="$TMPFILES_SUM" ' + /^b2sums=\(/ { in_block=1; count=0 } + in_block { + count++ + if (count == 2) sub(/[a-f0-9]{128}/, s1) + if (count == 3) sub(/[a-f0-9]{128}/, s2) + if ($0 ~ /\)/) in_block=0 + } + { print } + ' packaging/aur/PKGBUILD-git > packaging/aur/PKGBUILD-git.new + mv packaging/aur/PKGBUILD-git.new packaging/aur/PKGBUILD-git + echo "Patched PKGBUILD-git b2sums:" + awk '/^b2sums=\(/,/\)$/' packaging/aur/PKGBUILD-git + + - name: Publish to AUR + uses: KSXGitHub/github-actions-deploy-aur@v4.1.2 + with: + pkgname: fips-git + pkgbuild: packaging/aur/PKGBUILD-git + updpkgsums: false + assets: | + packaging/aur/fips.sysusers + packaging/aur/fips.tmpfiles + packaging/aur/fips.install + commit_username: ${{ github.repository_owner }} + commit_email: ${{ secrets.AUR_EMAIL }} + ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }} + commit_message: "Update PKGBUILD-git (${{ github.sha }})" diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml index d0613bc..d91dceb 100644 --- a/.github/workflows/aur-publish.yml +++ b/.github/workflows/aur-publish.yml @@ -2,6 +2,11 @@ name: AUR Publish on: workflow_dispatch: + inputs: + tag: + description: 'Release tag to publish (e.g. v0.3.0). Defaults to the tag the workflow was dispatched from.' + required: false + default: '' push: tags: - 'v*' @@ -10,23 +15,73 @@ jobs: aur-publish-fips: name: Publish fips to AUR runs-on: ubuntu-latest - continue-on-error: true - if: "!contains(github.ref_name, '-')" + if: github.event_name == 'workflow_dispatch' || !contains(github.ref_name, '-') steps: - - uses: actions/checkout@v4 - - - name: Update pkgver in PKGBUILD + - name: Resolve release tag + id: tag + env: + INPUT_TAG: ${{ inputs.tag }} run: | - VERSION="${GITHUB_REF_NAME#v}" + set -euo pipefail + TAG="${INPUT_TAG:-$GITHUB_REF_NAME}" + case "$TAG" in + v*) ;; + *) echo "Tag '$TAG' does not look like a release tag (vX.Y.Z)"; exit 1 ;; + esac + case "$TAG" in + *-*) + if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ]; then + echo "Pre-release tag '$TAG' — skipping AUR publish" + exit 1 + fi + ;; + esac + echo "tag=${TAG}" >> "$GITHUB_OUTPUT" + echo "version=${TAG#v}" >> "$GITHUB_OUTPUT" + + - uses: actions/checkout@v4 + with: + ref: ${{ steps.tag.outputs.tag }} + + - name: Patch PKGBUILD with pkgver and b2sums + env: + TAG: ${{ steps.tag.outputs.tag }} + VERSION: ${{ steps.tag.outputs.version }} + run: | + set -euo pipefail + URL="https://github.com/${GITHUB_REPOSITORY}/archive/${TAG}.tar.gz" + echo "Fetching $URL" + SOURCE_SUM=$(curl -fsSL --retry 3 "$URL" | b2sum | awk '{print $1}') + SYSUSERS_SUM=$(b2sum packaging/aur/fips.sysusers | awk '{print $1}') + TMPFILES_SUM=$(b2sum packaging/aur/fips.tmpfiles | awk '{print $1}') + for v in SOURCE_SUM SYSUSERS_SUM TMPFILES_SUM; do + eval val=\$$v + if [ -z "$val" ]; then echo "$v is empty"; exit 1; fi + done sed -i "s/^pkgver=.*/pkgver=${VERSION}/" packaging/aur/PKGBUILD + sed -i "s|^b2sums=('SKIP'.*|b2sums=('${SOURCE_SUM}'|" packaging/aur/PKGBUILD + awk -v s1="$SYSUSERS_SUM" -v s2="$TMPFILES_SUM" ' + /^b2sums=\(/ { in_block=1; count=0 } + in_block { + count++ + if (count == 2) sub(/[a-f0-9]{128}/, s1) + if (count == 3) sub(/[a-f0-9]{128}/, s2) + if ($0 ~ /\)/) in_block=0 + } + { print } + ' packaging/aur/PKGBUILD > packaging/aur/PKGBUILD.new + mv packaging/aur/PKGBUILD.new packaging/aur/PKGBUILD + echo "Patched PKGBUILD:" + grep -E "^pkgver=" packaging/aur/PKGBUILD + awk '/^b2sums=\(/,/\)$/' packaging/aur/PKGBUILD - name: Publish to AUR uses: KSXGitHub/github-actions-deploy-aur@v4.1.2 with: pkgname: fips pkgbuild: packaging/aur/PKGBUILD - updpkgsums: true + updpkgsums: false assets: | packaging/aur/fips.sysusers packaging/aur/fips.tmpfiles @@ -34,4 +89,4 @@ jobs: commit_username: ${{ github.repository_owner }} commit_email: ${{ secrets.AUR_EMAIL }} ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }} - commit_message: "Update to ${{ github.ref_name }}" + commit_message: "Update to ${{ steps.tag.outputs.tag }}"