mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
ArjenandJohnathan Corgan
9bf9701d92
The v0.3.0 stable AUR push silently failed: with updpkgsums: true, makepkg downloaded fips-<ver>.tar.gz into the AUR working tree, where it was then staged by the deploy action and rejected by AUR's 488 KiB max-blob hook. Fetch the upstream source tarball and compute its b2sum in CI, patch pkgver and the b2sums SKIP placeholder in PKGBUILD in-place, then publish with updpkgsums: false so the AUR clone stays metadata-only. Recompute and patch the fips.sysusers / fips.tmpfiles asset b2sums in the same step so they stay in sync with the local files; this safety net was previously provided by updpkgsums. Add aur-publish-git.yml for the VCS fips-git PKGBUILD, triggered on master pushes that touch PKGBUILD-git or its companion files plus workflow_dispatch. pkgver is computed at build time by the PKGBUILD's pkgver() function, so this workflow is not tied to release tags. Add a workflow_dispatch tag input on the stable workflow so historical release tags can be re-published manually, and drop continue-on-error: true so future regressions surface in CI.
93 lines
3.2 KiB
YAML
93 lines
3.2 KiB
YAML
name: AUR Publish
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Release tag to publish (e.g. v0.3.0). Defaults to the tag the workflow was dispatched from.'
|
|
required: false
|
|
default: ''
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
aur-publish-fips:
|
|
name: Publish fips to AUR
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'workflow_dispatch' || !contains(github.ref_name, '-')
|
|
|
|
steps:
|
|
- name: Resolve release tag
|
|
id: tag
|
|
env:
|
|
INPUT_TAG: ${{ inputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
TAG="${INPUT_TAG:-$GITHUB_REF_NAME}"
|
|
case "$TAG" in
|
|
v*) ;;
|
|
*) echo "Tag '$TAG' does not look like a release tag (vX.Y.Z)"; exit 1 ;;
|
|
esac
|
|
case "$TAG" in
|
|
*-*)
|
|
if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ]; then
|
|
echo "Pre-release tag '$TAG' — skipping AUR publish"
|
|
exit 1
|
|
fi
|
|
;;
|
|
esac
|
|
echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
|
|
echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ steps.tag.outputs.tag }}
|
|
|
|
- name: Patch PKGBUILD with pkgver and b2sums
|
|
env:
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
VERSION: ${{ steps.tag.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
URL="https://github.com/${GITHUB_REPOSITORY}/archive/${TAG}.tar.gz"
|
|
echo "Fetching $URL"
|
|
SOURCE_SUM=$(curl -fsSL --retry 3 "$URL" | b2sum | awk '{print $1}')
|
|
SYSUSERS_SUM=$(b2sum packaging/aur/fips.sysusers | awk '{print $1}')
|
|
TMPFILES_SUM=$(b2sum packaging/aur/fips.tmpfiles | awk '{print $1}')
|
|
for v in SOURCE_SUM SYSUSERS_SUM TMPFILES_SUM; do
|
|
eval val=\$$v
|
|
if [ -z "$val" ]; then echo "$v is empty"; exit 1; fi
|
|
done
|
|
sed -i "s/^pkgver=.*/pkgver=${VERSION}/" packaging/aur/PKGBUILD
|
|
sed -i "s|^b2sums=('SKIP'.*|b2sums=('${SOURCE_SUM}'|" packaging/aur/PKGBUILD
|
|
awk -v s1="$SYSUSERS_SUM" -v s2="$TMPFILES_SUM" '
|
|
/^b2sums=\(/ { in_block=1; count=0 }
|
|
in_block {
|
|
count++
|
|
if (count == 2) sub(/[a-f0-9]{128}/, s1)
|
|
if (count == 3) sub(/[a-f0-9]{128}/, s2)
|
|
if ($0 ~ /\)/) in_block=0
|
|
}
|
|
{ print }
|
|
' packaging/aur/PKGBUILD > packaging/aur/PKGBUILD.new
|
|
mv packaging/aur/PKGBUILD.new packaging/aur/PKGBUILD
|
|
echo "Patched PKGBUILD:"
|
|
grep -E "^pkgver=" packaging/aur/PKGBUILD
|
|
awk '/^b2sums=\(/,/\)$/' packaging/aur/PKGBUILD
|
|
|
|
- name: Publish to AUR
|
|
uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
|
|
with:
|
|
pkgname: fips
|
|
pkgbuild: packaging/aur/PKGBUILD
|
|
updpkgsums: false
|
|
assets: |
|
|
packaging/aur/fips.sysusers
|
|
packaging/aur/fips.tmpfiles
|
|
packaging/aur/fips.install
|
|
commit_username: ${{ github.repository_owner }}
|
|
commit_email: ${{ secrets.AUR_EMAIL }}
|
|
ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
|
|
commit_message: "Update to ${{ steps.tag.outputs.tag }}"
|