t3code/.github/workflows/publish-aur.yml at main · s243a/t3code · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
name: Publish AUR package

# See packaging/aur/README.md.

on:
  workflow_call:
    inputs:
      release_tag:
        required: true
        type: string
      pkgrel:
        required: false
        default: "1"
        type: string
    secrets:
      AUR_SSH_PRIVATE_KEY:
        required: true
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Release tag to publish"
        required: true
        type: string
      pkgrel:
        description: "Arch package release override"
        required: false
        default: "1"
        type: string

permissions:
  contents: read

concurrency:
  group: publish-aur
  cancel-in-progress: false

jobs:
  publish:
    name: Validate and publish
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 30
    container:
      image: archlinux:base-devel

    steps:
      - name: Install Arch packaging tools
        run: pacman -Syu --noconfirm --needed git github-cli jq namcap openssh sudo

      - name: Checkout packaging sources
        uses: actions/checkout@v6

      - name: Create unprivileged build user
        run: |
          useradd --create-home builder
          install -Dm0440 /dev/stdin /etc/sudoers.d/builder <<'EOF'
          builder ALL=(root) NOPASSWD: /usr/bin/pacman
          EOF

      - name: Validate and publish package sources
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.release_tag }}
          PKGREL: ${{ inputs.pkgrel || '1' }}
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: packaging/aur/scripts/release.sh