Publish to COPR #48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to COPR | |
| # Fires after the Release workflow completes successfully, ensuring all | |
| # build artifacts are already uploaded before we try to fetch them. | |
| on: | |
| workflow_run: | |
| workflows: ["Release"] | |
| types: [completed] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Release tag (e.g. v3.1.4)' | |
| required: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| copr-publish: | |
| # For workflow_run: only proceed if the Release workflow succeeded. | |
| # For workflow_dispatch: always run (conclusion is empty). | |
| if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| # Run in a Fedora container so rpmbuild uses the correct macros. | |
| container: | |
| image: fedora:42 | |
| steps: | |
| - name: Install tools | |
| run: dnf install -y rpm-build rpmdevtools copr-cli gh git curl | |
| # Containers run as root; mark all directories safe so git/gh work. | |
| - name: Fix git safe directory | |
| run: git config --global --add safe.directory '*' | |
| - uses: actions/checkout@v6 | |
| - name: Extract version from tag | |
| id: version | |
| # workflow_run exposes the tag in head_branch; workflow_dispatch uses the input. | |
| # The value is passed via env (not inline ${{ }}) and validated against a strict | |
| # semver pattern before use so a malicious branch name cannot inject shell code. | |
| env: | |
| TAG_INPUT: ${{ github.event.workflow_run.head_branch || inputs.tag }} | |
| run: | | |
| TAG="$TAG_INPUT" | |
| if ! echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then | |
| echo "::error::Invalid tag format: '$TAG' (expected vX.Y.Z)" >&2 | |
| exit 1 | |
| fi | |
| echo "tag=$TAG" >> $GITHUB_OUTPUT | |
| echo "version=${TAG#v}" >> $GITHUB_OUTPUT | |
| # COPR_LOGIN is the "Login" field from copr.fedorainfracloud.org/api, | |
| # which may differ from your username. COPR_API_TOKEN is the token there. | |
| - name: Configure copr-cli | |
| run: | | |
| mkdir -p ~/.config | |
| { | |
| echo "[copr-cli]" | |
| echo "login = ${{ secrets.COPR_LOGIN }}" | |
| echo "username = fossisawesome" | |
| echo "token = ${{ secrets.COPR_API_TOKEN }}" | |
| echo "copr_url = https://copr.fedorainfracloud.org" | |
| } > ~/.config/copr | |
| - name: Build SRPM | |
| env: | |
| TAG: ${{ steps.version.outputs.tag }} | |
| VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| rpmdev-setuptree | |
| DATE=$(date "+%a %b %d %Y") | |
| sed \ | |
| -e "s/VERSION_PLACEHOLDER/$VERSION/g" \ | |
| -e "s/CHANGELOG_DATE_PLACEHOLDER/$DATE/g" \ | |
| packaging/firmium.spec > ~/rpmbuild/SPECS/firmium.spec | |
| curl -fsSL "https://github.com/fossisawesome/firmium/archive/${TAG}.tar.gz" \ | |
| -o ~/rpmbuild/SOURCES/${TAG}.tar.gz | |
| rpmbuild -bs ~/rpmbuild/SPECS/firmium.spec | |
| - name: Submit to COPR | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| SRPM=$(ls ~/rpmbuild/SRPMS/firmium-"$VERSION"-1.*.src.rpm) | |
| copr-cli build fossisawesome/Firmium "$SRPM" |