publish-aur.yml

name: Publish to AUR

# Runs after Release succeeds (PyPI already uploaded), or manually.
# Publishes the updated PKGBUILD to aur.archlinux.org and keeps the
# Create-Python-App/aur-package GitHub mirror in sync.
on:
  workflow_run:
    workflows: ["Release"]
    types: [completed]
  workflow_dispatch:
    inputs:
      version:
        description: "Package version (e.g. 0.1.0)"
        required: true

permissions:
  contents: read

concurrency:
  group: publish-aur
  cancel-in-progress: false

env:
  AUR_PACKAGE: create-awesome-python-app
  AUR_RPC_URL: https://aur.archlinux.org/rpc/v5/info?arg=create-awesome-python-app
  PYPI_PACKAGE: create-awesome-python-app

jobs:
  aur:
    name: Update AUR package
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
      startsWith(github.event.workflow_run.head_branch, 'create-awesome-python-app@'))
    runs-on: ubuntu-latest
    environment: pypi
    timeout-minutes: 20
    steps:
      - name: Resolve version
        id: version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          RUN_BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: |
          set -euo pipefail
          if [ -n "${INPUT_VERSION:-}" ]; then
            VERSION="$INPUT_VERSION"
          else
            VERSION="${RUN_BRANCH#create-awesome-python-app@}"
          fi
          if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([a-zA-Z0-9.-]+)?$'; then
            echo "::error::Invalid AUR package version: $VERSION"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Checkout aur-package mirror repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: Create-Python-App/aur-package
          token: ${{ secrets.AUR_REPO_TOKEN }}
          path: aur-package

      - name: Update PKGBUILD (version + sha256 from PyPI)
        working-directory: aur-package
        env:
          NEW_VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          retry() {
            local attempts="$1"
            local delay="$2"
            shift 2
            for attempt in $(seq 1 "$attempts"); do
              if "$@"; then
                return 0
              fi
              if [ "$attempt" = "$attempts" ]; then
                return 1
              fi
              echo "::warning::Attempt $attempt/$attempts failed: $*; retrying in ${delay}s" >&2
              sleep "$delay"
            done
          }

          # Reset pkgver and pkgrel; source URL already interpolates ${pkgver}.
          sed -i "s/^pkgver=.*/pkgver=${NEW_VERSION}/" PKGBUILD
          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD

          # PyPI CDN can lag the upload response; poll for indexing.
          META=$(retry 24 15 curl -sfL "https://pypi.org/pypi/${PYPI_PACKAGE}/${NEW_VERSION}/json")
          SHA=$(echo "$META" | jq -r '.urls[] | select(.packagetype=="sdist") | .digests.sha256')
          if [ -z "$SHA" ] || [ "$SHA" = "null" ]; then
            echo "::error::Failed to resolve PyPI sdist sha256 for v${NEW_VERSION}" >&2
            exit 1
          fi
          sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" PKGBUILD

          echo "----- Updated PKGBUILD -----"
          cat PKGBUILD

      - name: Preflight AUR availability
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          retry() {
            local attempts="$1"
            local delay="$2"
            shift 2
            for attempt in $(seq 1 "$attempts"); do
              if "$@"; then
                return 0
              fi
              if [ "$attempt" = "$attempts" ]; then
                return 1
              fi
              echo "::warning::Attempt $attempt/$attempts failed: $*; retrying in ${delay}s" >&2
              sleep "$delay"
            done
          }

          test -n "$AUR_SSH_PRIVATE_KEY" || {
            echo "::error::AUR_SSH_PRIVATE_KEY is empty or unavailable in the pypi environment"
            exit 1
          }

          retry 5 15 curl -fsSL "$AUR_RPC_URL" >/tmp/aur-rpc.json
          python3 - <<'PY'
          import json
          from pathlib import Path

          data = json.loads(Path("/tmp/aur-rpc.json").read_text())
          print(f"AUR RPC resultcount={data.get('resultcount')}")
          PY

          mkdir -p ~/.ssh
          retry 5 10 ssh-keyscan -T 30 -t rsa,ecdsa,ed25519 aur.archlinux.org >> ~/.ssh/known_hosts
          retry 5 15 git ls-remote "https://aur.archlinux.org/${AUR_PACKAGE}.git" >/dev/null

      - name: Publish to AUR
        uses: ulises-jeremias/github-actions-aur-publish@507f0dba7755bdc2ad351232405bd7e4cd4a4a67 # v1
        with:
          pkgname: create-awesome-python-app
          pkgbuild: aur-package/PKGBUILD
          commit_username: "Create Python App Bot"
          commit_email: "ulisescf.24@gmail.com"
          commit_message: "Update to version ${{ steps.version.outputs.version }}"
          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          allow_empty_commits: "false"
          ssh_keyscan_types: "rsa,ecdsa,ed25519"

      - name: Verify AUR RPC after publish
        env:
          EXPECTED_VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          retry() {
            local attempts="$1"
            local delay="$2"
            shift 2
            for attempt in $(seq 1 "$attempts"); do
              if "$@"; then
                return 0
              fi
              if [ "$attempt" = "$attempts" ]; then
                return 1
              fi
              echo "::warning::Attempt $attempt/$attempts failed: $*; retrying in ${delay}s" >&2
              sleep "$delay"
            done
          }

          retry 6 20 curl -fsSL "$AUR_RPC_URL" >/tmp/aur-rpc.json
          AUR_VERSION=$(
            python3 - <<'PY'
          import json
          from pathlib import Path

          data = json.loads(Path("/tmp/aur-rpc.json").read_text())
          results = data.get("results") or []
          print(results[0]["Version"].split("-", 1)[0] if results else "")
          PY
          )
          echo "AUR version: $AUR_VERSION"
          echo "Expected version: $EXPECTED_VERSION"
          if [ "$AUR_VERSION" != "$EXPECTED_VERSION" ]; then
            echo "::warning::AUR RPC has not reflected ${EXPECTED_VERSION} yet (current: ${AUR_VERSION:-missing})"
          fi
          {
            echo "## AUR publish verification"
            echo
            echo "- Expected version: \`$EXPECTED_VERSION\`"
            echo "- AUR RPC version: \`${AUR_VERSION:-missing}\`"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Sync updated PKGBUILD to GitHub mirror
        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
        with:
          repository: aur-package
          commit_message: "chore: sync PKGBUILD for v${{ steps.version.outputs.version }}"
          commit_user_name: "Create Python App Bot"
          commit_user_email: "ulisescf.24@gmail.com"
          file_pattern: "PKGBUILD"