Publish to AUR #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to AUR | |
| # Triggers on release tags for the CLI package. | |
| # Publishes the updated PKGBUILD to aur.archlinux.org and keeps the | |
| # Create-Python-App/aur-package GitHub mirror in sync. | |
| on: | |
| push: | |
| tags: | |
| - "create-awesome-python-app@*" | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Package version (e.g. 0.1.0)" | |
| required: true | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: publish-aur | |
| cancel-in-progress: false | |
| env: | |
| AUR_PACKAGE: create-awesome-python-app | |
| AUR_RPC_URL: https://aur.archlinux.org/rpc/v5/info?arg=create-awesome-python-app | |
| PYPI_PACKAGE: create-awesome-python-app | |
| jobs: | |
| aur: | |
| name: Update AUR package | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Resolve version | |
| id: version | |
| env: | |
| TAG_REF: ${{ github.ref_name }} | |
| INPUT_VERSION: ${{ github.event.inputs.version }} | |
| run: | | |
| if [ -n "$INPUT_VERSION" ]; then | |
| VERSION="$INPUT_VERSION" | |
| else | |
| VERSION="${TAG_REF#create-awesome-python-app@}" | |
| fi | |
| if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([a-zA-Z0-9.-]+)?$'; then | |
| echo "::error::Invalid AUR package version: $VERSION" | |
| exit 1 | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Checkout aur-package mirror repo | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: Create-Python-App/aur-package | |
| token: ${{ secrets.AUR_REPO_TOKEN }} | |
| path: aur-package | |
| - name: Update PKGBUILD (version + sha256 from PyPI) | |
| working-directory: aur-package | |
| env: | |
| NEW_VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| set -euo pipefail | |
| retry() { | |
| local attempts="$1" | |
| local delay="$2" | |
| shift 2 | |
| for attempt in $(seq 1 "$attempts"); do | |
| if "$@"; then | |
| return 0 | |
| fi | |
| if [ "$attempt" = "$attempts" ]; then | |
| return 1 | |
| fi | |
| echo "::warning::Attempt $attempt/$attempts failed: $*; retrying in ${delay}s" >&2 | |
| sleep "$delay" | |
| done | |
| } | |
| # Reset pkgver and pkgrel; source URL already interpolates ${pkgver}. | |
| sed -i "s/^pkgver=.*/pkgver=${NEW_VERSION}/" PKGBUILD | |
| sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD | |
| META=$(retry 5 10 curl -sfL "https://pypi.org/pypi/${PYPI_PACKAGE}/${NEW_VERSION}/json") | |
| SHA=$(echo "$META" | jq -r '.urls[] | select(.packagetype=="sdist") | .digests.sha256') | |
| if [ -z "$SHA" ] || [ "$SHA" = "null" ]; then | |
| echo "::error::Failed to resolve PyPI sdist sha256 for v${NEW_VERSION}" >&2 | |
| exit 1 | |
| fi | |
| sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" PKGBUILD | |
| echo "----- Updated PKGBUILD -----" | |
| cat PKGBUILD | |
| - name: Preflight AUR availability | |
| env: | |
| AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }} | |
| run: | | |
| set -euo pipefail | |
| retry() { | |
| local attempts="$1" | |
| local delay="$2" | |
| shift 2 | |
| for attempt in $(seq 1 "$attempts"); do | |
| if "$@"; then | |
| return 0 | |
| fi | |
| if [ "$attempt" = "$attempts" ]; then | |
| return 1 | |
| fi | |
| echo "::warning::Attempt $attempt/$attempts failed: $*; retrying in ${delay}s" >&2 | |
| sleep "$delay" | |
| done | |
| } | |
| test -n "$AUR_SSH_PRIVATE_KEY" || { | |
| echo "::error::AUR_SSH_PRIVATE_KEY is empty or unavailable in the pypi environment" | |
| exit 1 | |
| } | |
| retry 5 15 curl -fsSL "$AUR_RPC_URL" >/tmp/aur-rpc.json | |
| python3 - <<'PY' | |
| import json | |
| from pathlib import Path | |
| data = json.loads(Path("/tmp/aur-rpc.json").read_text()) | |
| print(f"AUR RPC resultcount={data.get('resultcount')}") | |
| PY | |
| mkdir -p ~/.ssh | |
| retry 5 10 ssh-keyscan -T 30 -t rsa,ecdsa,ed25519 aur.archlinux.org >> ~/.ssh/known_hosts | |
| retry 5 15 git ls-remote "https://aur.archlinux.org/${AUR_PACKAGE}.git" >/dev/null | |
| - name: Publish to AUR | |
| # Pushes to aur.archlinux.org via SSH. The action reads the | |
| # updated PKGBUILD, regenerates .SRCINFO, and pushes. | |
| uses: ulises-jeremias/github-actions-aur-publish@217e4e2abbbee9ecc942bdc0681302e233656d9f # v1 | |
| with: | |
| pkgname: create-awesome-python-app | |
| pkgbuild: aur-package/PKGBUILD | |
| commit_username: "Create Python App Bot" | |
| commit_email: "ulisescf.24@gmail.com" | |
| commit_message: "Update to version ${{ steps.version.outputs.version }}" | |
| ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }} | |
| allow_empty_commits: "false" | |
| # dsa is no longer supported in modern OpenSSH; omit it to | |
| # avoid "Unknown key type" errors during keyscan. | |
| ssh_keyscan_types: "rsa,ecdsa,ed25519" | |
| - name: Verify AUR RPC after publish | |
| env: | |
| EXPECTED_VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| set -euo pipefail | |
| retry() { | |
| local attempts="$1" | |
| local delay="$2" | |
| shift 2 | |
| for attempt in $(seq 1 "$attempts"); do | |
| if "$@"; then | |
| return 0 | |
| fi | |
| if [ "$attempt" = "$attempts" ]; then | |
| return 1 | |
| fi | |
| echo "::warning::Attempt $attempt/$attempts failed: $*; retrying in ${delay}s" >&2 | |
| sleep "$delay" | |
| done | |
| } | |
| retry 6 20 curl -fsSL "$AUR_RPC_URL" >/tmp/aur-rpc.json | |
| AUR_VERSION=$( | |
| python3 - <<'PY' | |
| import json | |
| from pathlib import Path | |
| data = json.loads(Path("/tmp/aur-rpc.json").read_text()) | |
| results = data.get("results") or [] | |
| print(results[0]["Version"].split("-", 1)[0] if results else "") | |
| PY | |
| ) | |
| echo "AUR version: $AUR_VERSION" | |
| echo "Expected version: $EXPECTED_VERSION" | |
| if [ "$AUR_VERSION" != "$EXPECTED_VERSION" ]; then | |
| echo "::warning::AUR RPC has not reflected ${EXPECTED_VERSION} yet (current: ${AUR_VERSION:-missing})" | |
| fi | |
| { | |
| echo "## AUR publish verification" | |
| echo | |
| echo "- Expected version: \`$EXPECTED_VERSION\`" | |
| echo "- AUR RPC version: \`${AUR_VERSION:-missing}\`" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Sync updated PKGBUILD to GitHub mirror | |
| # Keep the aur-package GitHub mirror in sync with what's live | |
| # on AUR. Only PKGBUILD needs to be committed here — .SRCINFO | |
| # is regenerated automatically by AUR from PKGBUILD. | |
| uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 | |
| with: | |
| repository: aur-package | |
| commit_message: "chore: sync PKGBUILD for v${{ steps.version.outputs.version }}" | |
| commit_user_name: "Create Python App Bot" | |
| commit_user_email: "ulisescf.24@gmail.com" | |
| file_pattern: "PKGBUILD" |