Publish to AUR sss_code/v0.3.1 #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to AUR | |
| run-name: | | |
| Publish to AUR ${{ github.event.inputs.tag || github.event.workflow_run.head_branch || github.ref_name }} | |
| # Picks up after a successful Release run. Determines which binary was | |
| # released from the tag and pushes the corresponding -bin package to AUR: | |
| # sss_cli/v* → sss-bin / sss-nvidia-bin / sss-rocm-bin / sss-noocr-bin | |
| # sss_code/v* → sss_code-bin | |
| # | |
| # The PKGBUILD + .SRCINFO + source tarball are produced by the archlinux | |
| # format of nix-bundle-app (in dist/aur/ of the GitHub release). We just | |
| # download them and push. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Tag to push to AUR (e.g. sss_cli/v0.2.1 or sss_code/v0.3.0)." | |
| required: true | |
| type: string | |
| workflow_run: | |
| workflows: ["Release"] | |
| types: | |
| - completed | |
| permissions: | |
| contents: read | |
| jobs: | |
| publish_aur: | |
| name: Push ${{ matrix.aur_pkg }} to AUR | |
| runs-on: ubuntu-latest | |
| container: archlinux:multilib-devel | |
| if: > | |
| ${{ | |
| github.event_name == 'workflow_dispatch' | |
| || github.event.workflow_run.conclusion == 'success' | |
| }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| aur_pkg: [sss-bin, sss-nvidia-bin, sss-rocm-bin, sss-noocr-bin, sss_code-bin] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Resolve tag + filter package | |
| id: plan | |
| shell: bash | |
| run: | | |
| if [ -n "${{ github.event.inputs.tag }}" ]; then | |
| tag="${{ github.event.inputs.tag }}" | |
| else | |
| # workflow_run gives us the head_branch of the triggering run | |
| # which is the tag ref (e.g. 'refs/tags/v0.1.5' → 'v0.1.5'). | |
| tag="${{ github.event.workflow_run.head_branch }}" | |
| fi | |
| echo "tag=$tag" >> "$GITHUB_OUTPUT" | |
| # Each AUR pkg only matches one tag stream: | |
| # sss_cli/v* → sss-bin, sss-nvidia-bin, sss-rocm-bin, sss-noocr-bin | |
| # sss_code/v* → sss_code-bin | |
| # Set `skip=true` for jobs that don't match the current tag. | |
| aur_pkg="${{ matrix.aur_pkg }}" | |
| skip=true | |
| if [[ "$tag" == sss_code/v* ]] && [ "$aur_pkg" = "sss_code-bin" ]; then | |
| skip=false | |
| elif [[ "$tag" == sss_cli/v* ]] && [ "$aur_pkg" != "sss_code-bin" ]; then | |
| skip=false | |
| fi | |
| echo "skip=$skip" >> "$GITHUB_OUTPUT" | |
| echo "aur_pkg=$aur_pkg" >> "$GITHUB_OUTPUT" | |
| - name: Install bootstrap tools | |
| if: steps.plan.outputs.skip == 'false' | |
| run: | | |
| pacman -Syu --noconfirm git base-devel openssh pacman-contrib curl jq | |
| - name: Download AUR tarball from release | |
| if: steps.plan.outputs.skip == 'false' | |
| id: download | |
| shell: bash | |
| run: | | |
| tag="${{ steps.plan.outputs.tag }}" | |
| aur_pkg="${{ steps.plan.outputs.aur_pkg }}" | |
| mkdir -p work && cd work | |
| # release.yml packs the archlinux format's `aur/` subdir into | |
| # `<pkg>-bin-<ver>-aur.tar.gz` and uploads it as a release asset. | |
| api="https://api.github.com/repos/${{ github.repository }}/releases/tags/$tag" | |
| curl -fsSL -H "Accept: application/vnd.github+json" "$api" > release.json | |
| url=$(jq -r '.assets[] | .browser_download_url' release.json \ | |
| | grep -E "${aur_pkg}-.+-aur\.tar\.gz$" | head -n1) | |
| if [ -z "$url" ]; then | |
| echo "::error::No <pkg>-bin-<ver>-aur.tar.gz asset on release $tag." | |
| exit 1 | |
| fi | |
| echo "Downloading $url" | |
| curl -fsSL -O "$url" | |
| tar xzf "${aur_pkg}"-*-aur.tar.gz | |
| ls -la | |
| if [ ! -f PKGBUILD ]; then | |
| echo "::error::PKGBUILD missing after extracting AUR tarball." | |
| exit 1 | |
| fi | |
| - name: Configure SSH for AUR | |
| if: steps.plan.outputs.skip == 'false' | |
| shell: bash | |
| run: | | |
| useradd -m builder | |
| echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers | |
| mkdir -p /home/builder/.ssh | |
| echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > /home/builder/.ssh/id_rsa | |
| chmod 600 /home/builder/.ssh/id_rsa | |
| ssh-keyscan aur.archlinux.org >> /home/builder/.ssh/known_hosts | |
| chown -R builder:builder /home/builder/.ssh | |
| - name: Push to AUR | |
| if: steps.plan.outputs.skip == 'false' | |
| shell: bash | |
| run: | | |
| aur_pkg="${{ steps.plan.outputs.aur_pkg }}" | |
| tag="${{ steps.plan.outputs.tag }}" | |
| version="${tag#sss_cli/v}" | |
| version="${version#sss_code/v}" | |
| chown -R builder:builder "$PWD" | |
| chmod -R 755 "$PWD" | |
| REPO_DIR="$PWD" | |
| # Use a login shell (`su - builder`) so `$HOME` resolves to | |
| # `/home/builder`. `--preserve-environment` kept root's HOME | |
| # which made the `git clone` target land under `/root` and | |
| # blew up with `Permission denied`. | |
| su - builder -c " | |
| set -e | |
| cd \$HOME | |
| git clone ssh://aur@aur.archlinux.org/${aur_pkg}.git aur-repo | |
| cd aur-repo | |
| cp '$REPO_DIR/work/'*PKGBUILD* . 2>/dev/null || true | |
| cp '$REPO_DIR/work/'*.SRCINFO . 2>/dev/null || true | |
| cp '$REPO_DIR/work/'*.tar.gz . 2>/dev/null || true | |
| cp '$REPO_DIR/work/PKGBUILD' . | |
| updpkgsums | |
| makepkg --printsrcinfo > .SRCINFO | |
| git config user.name '${{ secrets.AUR_USERNAME }}' | |
| git config user.email '${{ secrets.AUR_EMAIL }}' | |
| git add PKGBUILD .SRCINFO | |
| git commit -m 'Release ${version}' || echo 'No changes to commit' | |
| git push origin master | |
| " |