1 name: AUR Release
2
3 # Dispatched by release-github.yml once the release and its checksums exist.
4 #
5 # Publishes the `sigit-bin` package: a prebuilt binary rather than a source
6 # build, so Arch users are not compiling the whole dependency tree (and the
7 # on-device inference stack in particular) to install a CLI.
8 on:
9 workflow_dispatch:
10 inputs:
11 tag:
12 description: "Release tag (e.g. v1.5.2)"
13 required: true
14
15 permissions:
16 contents: read
17
18 env:
19 REPO: getsigit/sigit
20
21 jobs:
22 publish-aur-package:
23 name: Publish sigit-bin to the AUR
24 runs-on: ubuntu-latest
25
26 steps:
27 - name: Checkout
28 uses: actions/checkout@v6
29 with:
30 ref: ${{ github.event.inputs.tag }}
31
32 - name: Resolve tag and version
33 id: release
34 shell: bash
35 run: |
36 TAG="${{ github.event.inputs.tag }}"
37 VERSION="${TAG#v}"
38
39 echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
40 echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
41
42 - name: Read SHA256 checksums from release
43 id: sha
44 env:
45 GH_TOKEN: ${{ github.token }}
46 shell: bash
47 run: |
48 mkdir -p artifacts
49
50 gh release download "${{ steps.release.outputs.tag }}" \
51 --repo "${{ env.REPO }}" \
52 --pattern "sigit-linux-*.sha256" \
53 --dir artifacts/
54
55 X86_64_SHA=$(cat artifacts/sigit-linux-amd64.sha256)
56 AARCH64_SHA=$(cat artifacts/sigit-linux-arm64.sha256)
57
58 echo "x86_64=${X86_64_SHA}" >> "$GITHUB_OUTPUT"
59 echo "aarch64=${AARCH64_SHA}" >> "$GITHUB_OUTPUT"
60
61 echo "x86_64 SHA256: ${X86_64_SHA}"
62 echo "aarch64 SHA256: ${AARCH64_SHA}"
63
64 - name: Render PKGBUILD
65 shell: bash
66 run: |
67 mkdir -p aur-build
68
69 sed \
70 -e "s/@VERSION@/${{ steps.release.outputs.version }}/g" \
71 -e "s/@SHA256_X86_64@/${{ steps.sha.outputs.x86_64 }}/g" \
72 -e "s/@SHA256_AARCH64@/${{ steps.sha.outputs.aarch64 }}/g" \
73 packaging/aur/PKGBUILD.in > aur-build/PKGBUILD
74
75 if grep -q '@[A-Z0-9_]*@' aur-build/PKGBUILD; then
76 echo "::error::PKGBUILD still contains unsubstituted placeholders" >&2
77 grep -n '@[A-Z0-9_]*@' aur-build/PKGBUILD >&2
78 exit 1
79 fi
80
81 # Catches an unbalanced quote or paren before it reaches the AUR.
82 bash -n aur-build/PKGBUILD
83
84 echo "Rendered PKGBUILD:"
85 cat aur-build/PKGBUILD
86
87 # The action runs makepkg in an Arch container to generate .SRCINFO and
88 # pushes over SSH. Generating .SRCINFO by hand is possible but drifts
89 # from the PKGBUILD the moment a field is added.
90 - name: Publish to the AUR
91 uses: KSXGitHub/github-actions-deploy-aur@v3
92 with:
93 pkgname: sigit-bin
94 pkgbuild: aur-build/PKGBUILD
95 commit_username: ${{ secrets.AUR_USERNAME }}
96 commit_email: ${{ secrets.AUR_EMAIL }}
97 ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
98 commit_message: "Update sigit-bin to ${{ steps.release.outputs.version }}"
99 updpkgsums: false