aur.yml

name: Publish to AUR
run-name: |
  Publish to AUR ${{ github.event.inputs.tag || github.event.workflow_run.head_branch || github.ref_name }}

# Picks up after a successful Release run. Determines which binary was
# released from the tag and pushes the corresponding -bin package to AUR:
#   sss_cli/v*      → sss-bin / sss-nvidia-bin / sss-rocm-bin / sss-noocr-bin
#   sss_code/v*     → sss_code-bin
#
# The PKGBUILD + .SRCINFO + source tarball are produced by the archlinux
# format of nix-bundle-app (in dist/aur/ of the GitHub release). We just
# download them and push.

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to push to AUR (e.g. sss_cli/v0.2.1 or sss_code/v0.3.0)."
        required: true
        type: string
  workflow_run:
    workflows: ["Release"]
    types:
      - completed

permissions:
  contents: read

jobs:
  publish_aur:
    name: Push ${{ matrix.aur_pkg }} to AUR
    runs-on: ubuntu-latest
    container: archlinux:multilib-devel
    if: >
      ${{
        github.event_name == 'workflow_dispatch'
        || github.event.workflow_run.conclusion == 'success'
      }}
    strategy:
      fail-fast: false
      matrix:
        aur_pkg: [sss-bin, sss-nvidia-bin, sss-rocm-bin, sss-noocr-bin, sss_code-bin]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve tag + filter package
        id: plan
        shell: bash
        run: |
          if [ -n "${{ github.event.inputs.tag }}" ]; then
            tag="${{ github.event.inputs.tag }}"
          else
            # workflow_run gives us the head_branch of the triggering run
            # which is the tag ref (e.g. 'refs/tags/v0.1.5' → 'v0.1.5').
            tag="${{ github.event.workflow_run.head_branch }}"
          fi
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          # Each AUR pkg only matches one tag stream:
          #   sss_cli/v*   → sss-bin, sss-nvidia-bin, sss-rocm-bin, sss-noocr-bin
          #   sss_code/v*  → sss_code-bin
          # Set `skip=true` for jobs that don't match the current tag.
          aur_pkg="${{ matrix.aur_pkg }}"
          skip=true
          if [[ "$tag" == sss_code/v* ]] && [ "$aur_pkg" = "sss_code-bin" ]; then
            skip=false
          elif [[ "$tag" == sss_cli/v* ]] && [ "$aur_pkg" != "sss_code-bin" ]; then
            skip=false
          fi
          echo "skip=$skip" >> "$GITHUB_OUTPUT"
          echo "aur_pkg=$aur_pkg" >> "$GITHUB_OUTPUT"

      - name: Install bootstrap tools
        if: steps.plan.outputs.skip == 'false'
        run: |
          pacman -Syu --noconfirm git base-devel openssh pacman-contrib curl jq

      - name: Download AUR tarball from release
        if: steps.plan.outputs.skip == 'false'
        id: download
        shell: bash
        run: |
          tag="${{ steps.plan.outputs.tag }}"
          aur_pkg="${{ steps.plan.outputs.aur_pkg }}"

          mkdir -p work && cd work
          # release.yml packs the archlinux format's `aur/` subdir into
          # `<pkg>-bin-<ver>-aur.tar.gz` and uploads it as a release asset.
          api="https://api.github.com/repos/${{ github.repository }}/releases/tags/$tag"
          curl -fsSL -H "Accept: application/vnd.github+json" "$api" > release.json
          url=$(jq -r '.assets[] | .browser_download_url' release.json \
                | grep -E "${aur_pkg}-.+-aur\.tar\.gz$" | head -n1)
          if [ -z "$url" ]; then
            echo "::error::No <pkg>-bin-<ver>-aur.tar.gz asset on release $tag."
            exit 1
          fi
          echo "Downloading $url"
          curl -fsSL -O "$url"
          tar xzf "${aur_pkg}"-*-aur.tar.gz
          ls -la

          if [ ! -f PKGBUILD ]; then
            echo "::error::PKGBUILD missing after extracting AUR tarball."
            exit 1
          fi

      - name: Configure SSH for AUR
        if: steps.plan.outputs.skip == 'false'
        shell: bash
        run: |
          useradd -m builder
          echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
          mkdir -p /home/builder/.ssh
          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > /home/builder/.ssh/id_rsa
          chmod 600 /home/builder/.ssh/id_rsa
          ssh-keyscan aur.archlinux.org >> /home/builder/.ssh/known_hosts
          chown -R builder:builder /home/builder/.ssh

      - name: Push to AUR
        if: steps.plan.outputs.skip == 'false'
        shell: bash
        run: |
          aur_pkg="${{ steps.plan.outputs.aur_pkg }}"
          tag="${{ steps.plan.outputs.tag }}"
          version="${tag#sss_cli/v}"
          version="${version#sss_code/v}"

          chown -R builder:builder "$PWD"
          chmod -R 755 "$PWD"
          REPO_DIR="$PWD"

          # Use a login shell (`su - builder`) so `$HOME` resolves to
          # `/home/builder`. `--preserve-environment` kept root's HOME
          # which made the `git clone` target land under `/root` and
          # blew up with `Permission denied`.
          su - builder -c "
            set -e
            cd \$HOME
            git clone ssh://aur@aur.archlinux.org/${aur_pkg}.git aur-repo
            cd aur-repo
            cp '$REPO_DIR/work/'*PKGBUILD* . 2>/dev/null || true
            cp '$REPO_DIR/work/'*.SRCINFO . 2>/dev/null || true
            cp '$REPO_DIR/work/'*.tar.gz . 2>/dev/null || true
            cp '$REPO_DIR/work/PKGBUILD' .

            updpkgsums
            makepkg --printsrcinfo > .SRCINFO

            git config user.name '${{ secrets.AUR_USERNAME }}'
            git config user.email '${{ secrets.AUR_EMAIL }}'
            git add PKGBUILD .SRCINFO
            git commit -m 'Release ${version}' || echo 'No changes to commit'
            git push origin master
          "