feat(packaging): AUR -bin package publishing with per-arch digests (#879)
* feat(aur): add vocalinux-bin PKGBUILD shipping the AppImage Closes #817 * fix(aur): hard-dep injection tools, pin real digests, gate the -bin package * fix(aur): pin both-arch -bin digests and build the binpkg as builder updpkgsums in the publish action only regenerates the x86_64 sum array, leaving aarch64 stale after every tag; release.yml now pins both AppImage digests itself and publishes with updpkgsums off. The AUR gate also created $WORKDIR/binpkg as root after handing WORKDIR to builder, so makepkg could not write there. AUR.md now matches the published -bin package. * fix(ci): wait for aarch64 AppImage before publishing vocalinux-bin publish-aur only needed build-and-release, so on a tag the digest-pinning step could curl the aarch64 AppImage before build-appimage-arm64 attached it — a 404 that failed the job between the source and -bin publishes. Split the -bin bump/pin/publish steps into publish-aur-bin, which needs [publish-aur, build-appimage-arm64]: the source package still ships as early as before while the binary package only runs once both AppImages exist on the release. * fix(ci): ship -bin local sources and wait for the aarch64 asset on AUR publish Split the -bin bump/pin/publish into publish-aur-bin needing [publish-aur, build-appimage-arm64] so the digest-pinning step can no longer curl a 404 for the not-yet-attached aarch64 AppImage mid-release, and publish with asset_dir so the PKGBUILD's local sources (vocalinux.desktop, vocalinux.svg, LICENSE) reach the AUR repo instead of a lone PKGBUILD users cannot build. * style(tests): apply black formatting to aur packaging test --------- Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>
This commit is contained in:
devin-ai-integration[bot]
co-authored by
Jatin K Malik
Jatin K Malik
parent
5c031e64fb
commit
b4babcaeca
@@ -746,9 +746,10 @@ jobs:
|
||||
run: |
|
||||
set -euo pipefail
|
||||
TAG="${GITHUB_REF#refs/tags/v}"
|
||||
PKGBUILD=packaging/aur/vocalinux/PKGBUILD
|
||||
sed -i "s/^pkgver=.*/pkgver=${TAG//-/}/; s/^_tag=.*/_tag=${TAG}/; s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
|
||||
grep -E '^(pkgver|_tag|pkgrel)=' "$PKGBUILD"
|
||||
for PKGBUILD in packaging/aur/vocalinux/PKGBUILD packaging/aur/vocalinux-bin/PKGBUILD; do
|
||||
sed -i "s/^pkgver=.*/pkgver=${TAG//-/}/; s/^_tag=.*/_tag=${TAG}/; s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
|
||||
grep -E '^(pkgver|_tag|pkgrel)=' "$PKGBUILD"
|
||||
done
|
||||
|
||||
- name: Publish AUR package
|
||||
if: steps.aur.outputs.configured == 'true'
|
||||
@@ -762,6 +763,74 @@ jobs:
|
||||
ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
|
||||
commit_message: 'Release ${{ github.ref_name }}'
|
||||
|
||||
# Separate job: the -bin PKGBUILD pins digests of BOTH AppImages, and the
|
||||
# aarch64 build attaches its asset after build-and-release returns. Waiting
|
||||
# for it here keeps the source package publishing early while the binary
|
||||
# package never curls a 404.
|
||||
publish-aur-bin:
|
||||
name: Publish -bin to AUR
|
||||
needs: [publish-aur, build-appimage-arm64]
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
steps:
|
||||
- name: Check for AUR credentials
|
||||
id: aur
|
||||
env:
|
||||
AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
|
||||
run: |
|
||||
if [ -z "$AUR_SSH_PRIVATE_KEY" ]; then
|
||||
echo "configured=false" >> "$GITHUB_OUTPUT"
|
||||
echo "AUR_SSH_PRIVATE_KEY not set; skipping (docs/AUR.md)"
|
||||
else
|
||||
echo "configured=true" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Checkout code
|
||||
if: steps.aur.outputs.configured == 'true'
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
|
||||
- name: Bump PKGBUILD version
|
||||
if: steps.aur.outputs.configured == 'true'
|
||||
run: |
|
||||
set -euo pipefail
|
||||
TAG="${GITHUB_REF#refs/tags/v}"
|
||||
PKGBUILD=packaging/aur/vocalinux-bin/PKGBUILD
|
||||
sed -i "s/^pkgver=.*/pkgver=${TAG//-/}/; s/^_tag=.*/_tag=${TAG}/; s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
|
||||
grep -E '^(pkgver|_tag|pkgrel)=' "$PKGBUILD"
|
||||
|
||||
# The -bin PKGBUILD carries per-arch sum arrays, but updpkgsums inside
|
||||
# the publish action only regenerates the x86_64 one — pin both here so
|
||||
# the published PKGBUILD never ships a stale aarch64 digest.
|
||||
- name: Pin per-arch AppImage digests in the -bin PKGBUILD
|
||||
if: steps.aur.outputs.configured == 'true'
|
||||
run: |
|
||||
set -euo pipefail
|
||||
tag="${GITHUB_REF_NAME#v}"
|
||||
for arch in x86_64 aarch64; do
|
||||
url="https://github.com/VocaHQ/vocalinux/releases/download/${GITHUB_REF_NAME}/Vocalinux-${tag}-${arch}.AppImage"
|
||||
sum="$(curl -fsSL "$url" | sha256sum | cut -d' ' -f1)"
|
||||
sed -i "s/^sha256sums_${arch}=('[0-9a-f]*')/sha256sums_${arch}=('${sum}')/" \
|
||||
packaging/aur/vocalinux-bin/PKGBUILD
|
||||
done
|
||||
|
||||
- name: Publish AUR -bin package
|
||||
if: steps.aur.outputs.configured == 'true'
|
||||
uses: KSXGitHub/github-actions-deploy-aur@084b0d9b15415bf9cdb65d44dad1efe37a354050 # v4.2.0
|
||||
with:
|
||||
pkgname: vocalinux-bin
|
||||
# The -bin PKGBUILD names local sources (vocalinux.desktop,
|
||||
# vocalinux.svg, LICENSE); publishing the whole directory mirrors
|
||||
# them into the AUR repo instead of shipping a lone PKGBUILD.
|
||||
asset_dir: packaging/aur/vocalinux-bin
|
||||
# Sums are pinned in the step above for BOTH arches; regenerating
|
||||
# here would only refresh the x86_64 array.
|
||||
updpkgsums: 'false'
|
||||
commit_username: ${{ secrets.AUR_USERNAME }}
|
||||
commit_email: ${{ secrets.AUR_EMAIL }}
|
||||
ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
|
||||
commit_message: 'Release ${{ github.ref_name }}'
|
||||
|
||||
# GitHub Release first, Store second. uinput is super-privileged, so the
|
||||
# Store can queue a human review and refuse edge/candidate; the .snap still
|
||||
# has to land on the tag for sideload. grade: stable allows candidate; do
|
||||
|
||||
Reference in New Issue
Block a user