From a9d6e0280d7c4e6376bcbef97ef1e6db275676b4 Mon Sep 17 00:00:00 2001 From: Nils Pukropp Date: Wed, 23 Sep 2026 11:02:30 +0200 Subject: [PATCH] ci(aur): publish the AUR packages from CI A release tag now updates and pushes all three AUR packages once the GitHub release exists, then commits the refreshed recipes back to main. A push to main that changes the -git recipe publishes that package alone; plain upstream commits need no AUR push because its pkgver() follows git at build time. Needs the AUR_SSH_PRIVATE_KEY repository secret. --- .github/workflows/aur.yml | 101 ++++++++++++++++++++++++++++++++++ .github/workflows/release.yml | 10 ++++ packaging/aur/README.md | 19 ++++++- 3 files changed, 129 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/aur.yml diff --git a/.github/workflows/aur.yml b/.github/workflows/aur.yml new file mode 100644 index 0000000..854b775 --- /dev/null +++ b/.github/workflows/aur.yml @@ -0,0 +1,101 @@ +name: AUR + +on: + # The -git package computes its pkgver from git at build time, so a new commit + # upstream needs no AUR push. Only a changed -git recipe is published. + push: + branches: [main] + paths: + - 'packaging/aur/proton-drive-for-linux-git/**' + # Called by release.yml once the GitHub release and its assets exist. + workflow_call: + inputs: + version: + required: true + type: string + secrets: + AUR_SSH_PRIVATE_KEY: + required: true + workflow_dispatch: + inputs: + version: + description: 'Release to publish, such as 2.1.0. Leave empty to publish only the -git package.' + required: false + type: string + +permissions: + contents: write + +concurrency: + group: aur + cancel-in-progress: false + +jobs: + publish: + name: Publish AUR packages + runs-on: ubuntu-24.04 + container: archlinux:base-devel + env: + # makepkg refuses to run as root, so the packaging steps run as `builder`. + HOME: /home/builder + VERSION: ${{ inputs.version }} + + steps: + - name: Install packaging tools + run: pacman -Syu --noconfirm --needed git openssh pacman-contrib + + - name: Checkout repository + uses: actions/checkout@v4 + with: + # The updated recipes are committed back to main, not to the tag. + ref: main + + - name: Create build user + run: | + useradd --create-home builder + chown -R builder: "$GITHUB_WORKSPACE" + + - name: Configure AUR access + env: + AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }} + run: | + install -d -m700 -o builder -g builder "$HOME/.ssh" + printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$HOME/.ssh/aur" + cat > "$HOME/.ssh/config" <<'EOF' + Host aur.archlinux.org + IdentityFile ~/.ssh/aur + User aur + EOF + # Pin the host key to the fingerprint published on aur.archlinux.org. + ssh-keyscan -t ed25519 aur.archlinux.org > "$HOME/.ssh/known_hosts" + ssh-keygen -lf "$HOME/.ssh/known_hosts" | grep -q 'SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4' + chown -R builder: "$HOME/.ssh" + chmod 600 "$HOME/.ssh/aur" + runuser -u builder -- git config --global user.name 'Nils Pukropp' + runuser -u builder -- git config --global user.email 'contact@narl.io' + + - name: Update release packages + if: env.VERSION != '' + run: runuser -u builder -- packaging/aur/update.sh "${VERSION#v}" + + - name: Refresh the -git metadata + if: env.VERSION == '' + working-directory: packaging/aur/proton-drive-for-linux-git + run: runuser -u builder -- sh -c 'makepkg --printsrcinfo > .SRCINFO' + + - name: Publish to the AUR + run: | + if [ -n "$VERSION" ]; then + runuser -u builder -- packaging/aur/push.sh + else + runuser -u builder -- packaging/aur/push.sh proton-drive-for-linux-git + fi + + - name: Commit the updated recipes to main + if: env.VERSION != '' + run: | + runuser -u builder -- git add packaging/aur + if ! runuser -u builder -- git diff --cached --quiet; then + runuser -u builder -- git commit -m "chore(aur): update packages to ${VERSION#v}" + runuser -u builder -- git push origin HEAD:main + fi diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5352a79..f7301d6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -202,3 +202,13 @@ jobs: prerelease: false env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + aur: + name: Publish AUR packages + needs: build-release + if: startsWith(github.ref, 'refs/tags/') + uses: ./.github/workflows/aur.yml + with: + version: ${{ github.ref_name }} + secrets: + AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }} diff --git a/packaging/aur/README.md b/packaging/aur/README.md index 1c9f08a..d725b50 100644 --- a/packaging/aur/README.md +++ b/packaging/aur/README.md @@ -21,6 +21,22 @@ built packages never reach the AUR. ## Releasing a new version +`.github/workflows/aur.yml` does this automatically: + +- **On a release tag**, `release.yml` calls it after the GitHub release is + published. It runs `./update.sh `, pushes all three packages with + `./push.sh`, and commits the updated recipes back to `main` as + `chore(aur): update packages to `. +- **On a push to `main` that changes `proton-drive-for-linux-git/`**, it + regenerates that package's `.SRCINFO` and pushes only the -git package. +- **By hand**, run the workflow from the Actions tab. Give a version to publish + a release, or leave it empty to publish only the -git package. + +It needs the `AUR_SSH_PRIVATE_KEY` repository secret: a private key whose public +half is registered with the AUR account. + +To do the same by hand: + 1. Tag and publish the upstream release, so the source tarball and the `proton-drive-linux--x86_64.tar.gz` release asset exist. 2. Run `./update.sh ` — it rewrites `pkgver`, resets `pkgrel=1`, @@ -32,7 +48,8 @@ built packages never reach the AUR. for a single package). `proton-drive-for-linux-git` carries a `pkgver()` function, so its `pkgver` is -computed at build time; do not push a commit that only bumps it. +computed at build time; do not push a commit that only bumps it. This is why new +commits on `main` do not trigger an AUR push. ## Requirements for pushing