Add winget, Scoop, AUR, deb, and rpm release channels
Covers the OS package managers sigit had no presence in. Windows users get winget and Scoop, Arch users get sigit-bin from the AUR, and Debian and Fedora users get a .deb and .rpm attached to each GitHub release. All four of the new channels read checksums off the GitHub release, so release-github.yml now writes a .sha256 next to every asset rather than only the macOS Homebrew tarball, and dispatches the packaging workflows once the release exists. A dispatch that fails is a warning, not a failed release, so a channel nobody has configured yet cannot block the others. The .deb and .rpm are built with nfpm from the binary the matrix already produced, so each Linux target still compiles once. One config covers both formats. AUR publishes sigit-bin rather than a source package. Building sigit from source pulls in the whole on-device inference stack, which is a lot to ask of someone installing a CLI. Scoop and the AUR follow the existing Homebrew tap shape: generate the manifest, push it to a sibling repo. winget is different because its manifests live in microsoft/winget-pkgs, so that workflow submits a PR through wingetcreate and only handles updates. The first submission has to be made by hand, since wingetcreate cannot update a package that does not exist yet. Still needs credentials before any of it publishes: a getsigit/scoop-bucket repo with SCOOP_BUCKET_TOKEN, WINGET_TOKEN, and the three AUR_* secrets.
paydii committed
Jul 28, 2026 at 08:39 UTC
c75bf635307d1ff42e008d08c6c3560a8454116e
8 files changed
+496
-21
.agents/AGENTS.md
+36
-11
@@ -249,22 +249,47 @@ mutating tools; the escape hatch for clients without permission-request support)
249
250
## Releasing
251
252
-Version lives in `Cargo.toml`. The binary is published to six registries via separate workflows
253
-(`release-crates`, `release-github`, `release-homebrew`, `release-npm`, `release-nuget`,
254
-`release-pypi`); the `npm/`, `nuget/`, and `pypi/` dirs hold the wrapper-package templates. Update
255
-`CHANGELOG.md` for releases.
252
+Version lives in `Cargo.toml`. Update `CHANGELOG.md` for releases.
253
+
254
+Publishing splits into two groups. **Language registries** each get their own tag-triggered
255
+workflow: `release-crates`, `release-npm`, `release-nuget`, `release-pypi`. The `npm/`, `nuget/`,
256
+and `pypi/` dirs hold their wrapper-package templates.
257
+
258
+**OS package managers** all publish somewhere outside this repo and all need checksums from the
259
+GitHub release, so `release-github` builds the binaries, attaches the assets, and then dispatches
260
+`release-homebrew`, `release-scoop`, `release-winget`, and `release-aur`. A dispatch failure in one
261
+is logged as a warning rather than failing the others, so an unconfigured channel does not block a
262
+release. Their inputs live in `packaging/`.
263
+
264
+Every release asset now carries a `.sha256` sidecar, not just the macOS Homebrew tarball. Scoop,
265
+winget, and the AUR PKGBUILD each need one, and they consume the raw binaries rather than the
266
+tarball. `release-github` also builds a `.deb` and `.rpm` per Linux target with nfpm
267
+(`packaging/nfpm.yaml`), packaging the already-built binary rather than re-invoking cargo.
268
+
269
+Three of these need credentials or a one-time manual step before they work:
270
+
271
+- Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
272
+ Homebrew tap setup.
273
+- winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
274
+ `microsoft/winget-pkgs`. The workflow only handles *updates*; the first submission has to be made
275
+ by hand with `wingetcreate new`, since a package must exist before it can be updated.
276
+- The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
277
+ (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
278
+ CLI.
279
280
`[profile.release]` sets `strip = "symbols"` because binary size is a distribution constraint, not
258
-just a nicety — see the NuGet note below.
281
+just a nicety. See the NuGet note below.
282
283
The NuGet package (`SiGit.Code`, installed with `dotnet tool install --global SiGit.Code`) is the
261
-odd one out: npm and PyPI publish one artifact per platform, but a .NET tool is a single package,
262
-so `nuget/sigit/` bundles all six binaries under `native/<os>-<arch>/` and a small managed shim
263
-(`Program.cs`) execs the right one. That shim leaves stdin/stdout/stderr unredirected on purpose,
264
-since siGit Code chooses TUI or ACP mode by testing whether stdin is a TTY.
284
+odd one out among the language registries: npm and PyPI publish one artifact per platform, but a
285
+.NET tool is a single package, so `nuget/sigit/` bundles all six binaries under
286
+`native/<os>-<arch>/` and a small managed shim (`Program.cs`) execs the right one. That shim leaves
287
+stdin/stdout/stderr unredirected on purpose, since siGit Code chooses TUI or ACP mode by testing
288
+whether stdin is a TTY. It also sets `RollForward=Major`: it targets `net8.0`, and without that a
289
+machine carrying only the .NET 10 runtime installs a tool that refuses to start.
290
291
Bundling every target means the package is large, so `release-nuget.yml` fails the pack job if the
292
`.nupkg` crosses nuget.org's 250 MB limit. At v1.5.1 it lands around 160 MB. If a future release
293
trips that check, the fix is not to drop targets but to split into RID-specific tool packages
269
-(.NET 10's `DotnetToolRidPackage`), which ship one binary per platform the way npm already does —
270
-that also needs a fallback package for pre-.NET-10 SDKs.
294
+(.NET 10's `DotnetToolRidPackage`), which ship one binary per platform the way npm already does.
295
+That also needs a fallback package for pre-.NET-10 SDKs.
.github/workflows/release-aur.yml
new
+99
@@ -0,0 +1,99 @@
1
+name: AUR Release
2
+
3
+# Dispatched by release-github.yml once the release and its checksums exist.
4
+#
5
+# Publishes the `sigit-bin` package: a prebuilt binary rather than a source
6
+# build, so Arch users are not compiling the whole dependency tree (and the
7
+# on-device inference stack in particular) to install a CLI.
8
+on:
9
+ workflow_dispatch:
10
+ inputs:
11
+ tag:
12
+ description: "Release tag (e.g. v1.5.2)"
13
+ required: true
14
+
15
+permissions:
16
+ contents: read
17
+
18
+env:
19
+ REPO: getsigit/sigit
20
+
21
+jobs:
22
+ publish-aur-package:
23
+ name: Publish sigit-bin to the AUR
24
+ runs-on: ubuntu-latest
25
+
26
+ steps:
27
+ - name: Checkout
28
+ uses: actions/checkout@v6
29
+ with:
30
+ ref: ${{ github.event.inputs.tag }}
31
+
32
+ - name: Resolve tag and version
33
+ id: release
34
+ shell: bash
35
+ run: |
36
+ TAG="${{ github.event.inputs.tag }}"
37
+ VERSION="${TAG#v}"
38
+
39
+ echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
40
+ echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
41
+
42
+ - name: Read SHA256 checksums from release
43
+ id: sha
44
+ env:
45
+ GH_TOKEN: ${{ github.token }}
46
+ shell: bash
47
+ run: |
48
+ mkdir -p artifacts
49
+
50
+ gh release download "${{ steps.release.outputs.tag }}" \
51
+ --repo "${{ env.REPO }}" \
52
+ --pattern "sigit-linux-*.sha256" \
53
+ --dir artifacts/
54
+
55
+ X86_64_SHA=$(cat artifacts/sigit-linux-amd64.sha256)
56
+ AARCH64_SHA=$(cat artifacts/sigit-linux-arm64.sha256)
57
+
58
+ echo "x86_64=${X86_64_SHA}" >> "$GITHUB_OUTPUT"
59
+ echo "aarch64=${AARCH64_SHA}" >> "$GITHUB_OUTPUT"
60
+
61
+ echo "x86_64 SHA256: ${X86_64_SHA}"
62
+ echo "aarch64 SHA256: ${AARCH64_SHA}"
63
+
64
+ - name: Render PKGBUILD
65
+ shell: bash
66
+ run: |
67
+ mkdir -p aur-build
68
+
69
+ sed \
70
+ -e "s/@VERSION@/${{ steps.release.outputs.version }}/g" \
71
+ -e "s/@SHA256_X86_64@/${{ steps.sha.outputs.x86_64 }}/g" \
72
+ -e "s/@SHA256_AARCH64@/${{ steps.sha.outputs.aarch64 }}/g" \
73
+ packaging/aur/PKGBUILD.in > aur-build/PKGBUILD
74
+
75
+ if grep -q '@[A-Z0-9_]*@' aur-build/PKGBUILD; then
76
+ echo "::error::PKGBUILD still contains unsubstituted placeholders" >&2
77
+ grep -n '@[A-Z0-9_]*@' aur-build/PKGBUILD >&2
78
+ exit 1
79
+ fi
80
+
81
+ # Catches an unbalanced quote or paren before it reaches the AUR.
82
+ bash -n aur-build/PKGBUILD
83
+
84
+ echo "Rendered PKGBUILD:"
85
+ cat aur-build/PKGBUILD
86
+
87
+ # The action runs makepkg in an Arch container to generate .SRCINFO and
88
+ # pushes over SSH. Generating .SRCINFO by hand is possible but drifts
89
+ # from the PKGBUILD the moment a field is added.
90
+ - name: Publish to the AUR
91
+ uses: KSXGitHub/github-actions-deploy-aur@v3
92
+ with:
93
+ pkgname: sigit-bin
94
+ pkgbuild: aur-build/PKGBUILD
95
+ commit_username: ${{ secrets.AUR_USERNAME }}
96
+ commit_email: ${{ secrets.AUR_EMAIL }}
97
+ ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
98
+ commit_message: "Update sigit-bin to ${{ steps.release.outputs.version }}"
99
+ updpkgsums: false
.github/workflows/release-github.yml
+77
-10
@@ -119,6 +119,54 @@ jobs:
119
echo "Archive: ${ARCHIVE_NAME}"
120
echo "SHA256: $(cat "${ARCHIVE_NAME}.sha256")"
121
122
+ # Debian and RPM packages are built from the binary staged above rather
123
+ # than by re-invoking cargo, so each Linux target compiles once and gets
124
+ # packaged twice.
125
+ - name: Build Linux packages
126
+ if: contains(matrix.target, 'linux')
127
+ shell: bash
128
+ env:
129
+ NFPM_VERSION: "2.43.0"
130
+ run: |
131
+ case "$(uname -m)" in
132
+ x86_64) nfpm_arch="x86_64"; export PKG_ARCH="amd64" ;;
133
+ aarch64) nfpm_arch="arm64"; export PKG_ARCH="arm64" ;;
134
+ *) echo "Unsupported Linux build host $(uname -m)" >&2; exit 1 ;;
135
+ esac
136
+
137
+ curl -sSfL \
138
+ "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_${nfpm_arch}.tar.gz" \
139
+ | tar -xz -C /tmp nfpm
140
+
141
+ export PKG_VERSION="${RELEASE_VERSION}"
142
+ export PKG_BINARY="./release/${PROJECT_NAME}-${{ matrix.name }}"
143
+
144
+ /tmp/nfpm package --config packaging/nfpm.yaml --packager deb --target ./release/
145
+ /tmp/nfpm package --config packaging/nfpm.yaml --packager rpm --target ./release/
146
+
147
+ ls -la ./release/
148
+
149
+ # Homebrew has always had a checksum because the tap needs one. Scoop,
150
+ # winget, and the AUR PKGBUILD each need one too, and they consume the
151
+ # raw binaries rather than the macOS tarball, so every asset gets a
152
+ # sidecar. Windows runners use bash from Git for Windows, which has
153
+ # sha256sum; macOS only has shasum.
154
+ - name: Checksum release assets
155
+ shell: bash
156
+ run: |
157
+ cd release
158
+ for asset in *; do
159
+ case "${asset}" in *.sha256) continue ;; esac
160
+
161
+ if command -v sha256sum >/dev/null 2>&1; then
162
+ sha256sum "${asset}" | awk '{print $1}' > "${asset}.sha256"
163
+ else
164
+ shasum -a 256 "${asset}" | awk '{print $1}' > "${asset}.sha256"
165
+ fi
166
+
167
+ echo "${asset}: $(cat "${asset}.sha256")"
168
+ done
169
+
170
- name: Upload binary artifact
171
uses: actions/upload-artifact@v4
172
with:
@@ -171,17 +219,36 @@ jobs:
219
tag_name: ${{ steps.tag.outputs.tag }}
220
files: release/*
221
174
- - name: Trigger Homebrew release
222
+ # These channels all publish somewhere outside this repo (a tap, a Scoop
223
+ # bucket, microsoft/winget-pkgs, the AUR) and every one of them reads
224
+ # checksums off the release created above, so they hang off this job
225
+ # rather than firing on the tag directly.
226
+ - name: Trigger OS package manager releases
227
uses: actions/github-script@v7
228
with:
229
script: |
178
- await github.rest.actions.createWorkflowDispatch({
179
- owner: context.repo.owner,
180
- repo: context.repo.repo,
181
- workflow_id: 'release-homebrew.yml',
182
- ref: 'main',
183
- inputs: {
184
- tag: '${{ steps.tag.outputs.tag }}'
230
+ const tag = '${{ steps.tag.outputs.tag }}'
231
+ const workflows = [
232
+ 'release-homebrew.yml',
233
+ 'release-scoop.yml',
234
+ 'release-winget.yml',
235
+ 'release-aur.yml',
236
+ ]
237
+
238
+ for (const workflow_id of workflows) {
239
+ try {
240
+ await github.rest.actions.createWorkflowDispatch({
241
+ owner: context.repo.owner,
242
+ repo: context.repo.repo,
243
+ workflow_id,
244
+ ref: 'main',
245
+ inputs: { tag },
246
+ })
247
+ console.log(`Dispatched ${workflow_id} for tag ${tag}`)
248
+ } catch (error) {
249
+ // One packaging channel being unconfigured (a missing secret,
250
+ // a bucket repo that does not exist yet) should not take the
251
+ // rest of the fan-out down with it.
252
+ core.warning(`Failed to dispatch ${workflow_id}: ${error.message}`)
253
}
186
- })
187
- console.log('Dispatched release-homebrew.yml for tag ${{ steps.tag.outputs.tag }}')
254
+ }
.github/workflows/release-scoop.yml
new
+140
@@ -0,0 +1,140 @@
1
+name: Scoop Release
2
+
3
+# Dispatched by release-github.yml once the release and its checksums exist.
4
+on:
5
+ workflow_dispatch:
6
+ inputs:
7
+ tag:
8
+ description: "Release tag (e.g. v1.5.2)"
9
+ required: true
10
+
11
+permissions:
12
+ contents: read
13
+
14
+env:
15
+ REPO: getsigit/sigit
16
+
17
+jobs:
18
+ update-scoop-bucket:
19
+ name: Update Scoop bucket
20
+ runs-on: ubuntu-latest
21
+
22
+ steps:
23
+ - name: Resolve tag and version
24
+ id: release
25
+ shell: bash
26
+ run: |
27
+ TAG="${{ github.event.inputs.tag }}"
28
+ VERSION="${TAG#v}"
29
+
30
+ echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
31
+ echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
32
+
33
+ - name: Read SHA256 checksums from release
34
+ id: sha
35
+ env:
36
+ GH_TOKEN: ${{ github.token }}
37
+ shell: bash
38
+ run: |
39
+ mkdir -p artifacts
40
+
41
+ gh release download "${{ steps.release.outputs.tag }}" \
42
+ --repo "${{ env.REPO }}" \
43
+ --pattern "sigit-win-*.exe.sha256" \
44
+ --dir artifacts/
45
+
46
+ AMD64_SHA=$(cat artifacts/sigit-win-amd64.exe.sha256)
47
+ ARM64_SHA=$(cat artifacts/sigit-win-arm64.exe.sha256)
48
+
49
+ echo "amd64=${AMD64_SHA}" >> "$GITHUB_OUTPUT"
50
+ echo "arm64=${ARM64_SHA}" >> "$GITHUB_OUTPUT"
51
+
52
+ echo "AMD64 SHA256: ${AMD64_SHA}"
53
+ echo "ARM64 SHA256: ${ARM64_SHA}"
54
+
55
+ - name: Checkout Scoop bucket
56
+ uses: actions/checkout@v6
57
+ with:
58
+ repository: getsigit/scoop-bucket
59
+ token: ${{ secrets.SCOOP_BUCKET_TOKEN }}
60
+ path: scoop-bucket
61
+
62
+ - name: Generate manifest
63
+ shell: bash
64
+ run: |
65
+ VERSION="${{ steps.release.outputs.version }}"
66
+ TAG="${{ steps.release.outputs.tag }}"
67
+ AMD64_SHA="${{ steps.sha.outputs.amd64 }}"
68
+ ARM64_SHA="${{ steps.sha.outputs.arm64 }}"
69
+
70
+ mkdir -p scoop-bucket/bucket
71
+
72
+ # The `#/sigit.exe` URL fragment is Scoop's rename-on-download
73
+ # syntax: the release asset is sigit-win-amd64.exe, but the shim has
74
+ # to end up as sigit.exe for `sigit` to work on PATH.
75
+ cat > scoop-bucket/bucket/sigit.json <<MANIFEST
76
+ {
77
+ "version": "${VERSION}",
78
+ "description": "siGit Code, an AI coding agent that runs on your machine.",
79
+ "homepage": "https://sigit.si",
80
+ "license": "Apache-2.0",
81
+ "architecture": {
82
+ "64bit": {
83
+ "url": "https://github.com/${REPO}/releases/download/${TAG}/sigit-win-amd64.exe#/sigit.exe",
84
+ "hash": "${AMD64_SHA}"
85
+ },
86
+ "arm64": {
87
+ "url": "https://github.com/${REPO}/releases/download/${TAG}/sigit-win-arm64.exe#/sigit.exe",
88
+ "hash": "${ARM64_SHA}"
89
+ }
90
+ },
91
+ "bin": "sigit.exe",
92
+ "checkver": {
93
+ "github": "https://github.com/${REPO}"
94
+ },
95
+ "autoupdate": {
96
+ "architecture": {
97
+ "64bit": {
98
+ "url": "https://github.com/${REPO}/releases/download/v\$version/sigit-win-amd64.exe#/sigit.exe"
99
+ },
100
+ "arm64": {
101
+ "url": "https://github.com/${REPO}/releases/download/v\$version/sigit-win-arm64.exe#/sigit.exe"
102
+ }
103
+ },
104
+ "hash": {
105
+ "url": "\$url.sha256"
106
+ }
107
+ }
108
+ }
109
+ MANIFEST
110
+
111
+ echo "Generated manifest:"
112
+ cat scoop-bucket/bucket/sigit.json
113
+
114
+ - name: Validate manifest JSON
115
+ shell: bash
116
+ run: |
117
+ if ! jq empty scoop-bucket/bucket/sigit.json; then
118
+ echo "::error::Generated Scoop manifest is not valid JSON" >&2
119
+ exit 1
120
+ fi
121
+
122
+ for field in version bin architecture; do
123
+ if [ "$(jq -r "has(\"${field}\")" scoop-bucket/bucket/sigit.json)" != "true" ]; then
124
+ echo "::error::Scoop manifest is missing the '${field}' field" >&2
125
+ exit 1
126
+ fi
127
+ done
128
+
129
+ - name: Commit and push
130
+ shell: bash
131
+ run: |
132
+ VERSION="${{ steps.release.outputs.version }}"
133
+
134
+ cd scoop-bucket
135
+ git config user.name "github-actions[bot]"
136
+ git config user.email "github-actions[bot]@users.noreply.github.com"
137
+ git add bucket/sigit.json
138
+ git diff --cached --quiet && echo "No changes to commit" && exit 0
139
+ git commit -m "Update sigit to ${VERSION}"
140
+ git push
.github/workflows/release-winget.yml
new
+71
@@ -0,0 +1,71 @@
1
+name: winget Release
2
+
3
+# Dispatched by release-github.yml once the release and its checksums exist.
4
+#
5
+# This workflow only handles *updates*. winget manifests live in
6
+# microsoft/winget-pkgs, and a package has to exist there before it can be
7
+# updated, so the very first submission is a one-time manual step:
8
+#
9
+# wingetcreate new https://github.com/getsigit/sigit/releases/download/vX.Y.Z/sigit-win-amd64.exe
10
+#
11
+# answering `portable` for the installer type and `smbCloud.siGitCode` for the
12
+# package identifier. Every release after that is automated here.
13
+on:
14
+ workflow_dispatch:
15
+ inputs:
16
+ tag:
17
+ description: "Release tag (e.g. v1.5.2)"
18
+ required: true
19
+
20
+permissions:
21
+ contents: read
22
+
23
+env:
24
+ REPO: getsigit/sigit
25
+ PACKAGE_IDENTIFIER: smbCloud.siGitCode
26
+
27
+jobs:
28
+ submit-winget-manifest:
29
+ name: Submit winget manifest
30
+ # wingetcreate is a Windows-only tool.
31
+ runs-on: windows-latest
32
+
33
+ steps:
34
+ - name: Resolve tag and version
35
+ id: release
36
+ shell: bash
37
+ run: |
38
+ TAG="${{ github.event.inputs.tag }}"
39
+ VERSION="${TAG#v}"
40
+
41
+ echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
42
+ echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
43
+
44
+ - name: Submit manifest update
45
+ shell: pwsh
46
+ env:
47
+ WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
48
+ run: |
49
+ if (-not $env:WINGET_TOKEN) {
50
+ Write-Error "WINGET_TOKEN is not set. It needs a PAT with public_repo scope so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR."
51
+ }
52
+
53
+ $tag = "${{ steps.release.outputs.tag }}"
54
+ $version = "${{ steps.release.outputs.version }}"
55
+ $base = "https://github.com/${env:REPO}/releases/download/$tag"
56
+
57
+ Invoke-WebRequest -Uri "https://aka.ms/wingetcreate/latest" -OutFile wingetcreate.exe
58
+
59
+ # The trailing |x64 and |arm64 tell wingetcreate which installer
60
+ # entry each URL replaces. Without them it guesses from the file
61
+ # name, and "sigit-win-amd64.exe" is not a spelling it recognises.
62
+ .\wingetcreate.exe update $env:PACKAGE_IDENTIFIER `
63
+ --version $version `
64
+ --urls "$base/sigit-win-amd64.exe|x64" "$base/sigit-win-arm64.exe|arm64" `
65
+ --release-notes-url "https://github.com/${env:REPO}/releases/tag/$tag" `
66
+ --submit `
67
+ --token $env:WINGET_TOKEN
68
+
69
+ if ($LASTEXITCODE -ne 0) {
70
+ Write-Error "wingetcreate failed with exit code $LASTEXITCODE"
71
+ }
README.md
+5
@@ -38,6 +38,11 @@ cargo install sigit
38
| uv | `uvx --from sigit-code sigit` |
39
| npm | `npm install -g @smbcloud/sigit` |
40
| NuGet | `dotnet tool install --global SiGit.Code` |
41
+| winget | `winget install smbCloud.siGitCode` |
42
+| Scoop | `scoop bucket add getsigit https://github.com/getsigit/scoop-bucket && scoop install sigit` |
43
+| AUR | `yay -S sigit-bin` |
44
+| Debian/Ubuntu | download the `.deb` from [releases](https://github.com/getsigit/sigit/releases), then `sudo dpkg -i sigit_*.deb` |
45
+| Fedora/RHEL | download the `.rpm` from [releases](https://github.com/getsigit/sigit/releases), then `sudo rpm -i sigit-*.rpm` |
46
47
## First run
48
packaging/aur/PKGBUILD.in
new
+31
@@ -0,0 +1,31 @@
1
+# Maintainer: smbCloud <seto@sigit.si>
2
+#
3
+# Template for the sigit-bin AUR package. release-aur.yml substitutes the
4
+# at-sign-delimited placeholders below and pushes the result. The
5
+# $pkgver/${CARCH} references are makepkg's own and must survive substitution
6
+# untouched, which is why this lives in a file rather than a heredoc in the
7
+# workflow. Keep placeholder-shaped text out of the comments: the workflow
8
+# greps for leftovers and treats any hit as an unsubstituted value.
9
+
10
+pkgname=sigit-bin
11
+pkgver=@VERSION@
12
+pkgrel=1
13
+pkgdesc="siGit Code, an AI coding agent that runs on your machine"
14
+arch=('x86_64' 'aarch64')
15
+url="https://github.com/getsigit/sigit"
16
+license=('Apache-2.0')
17
+depends=('glibc' 'gcc-libs')
18
+provides=('sigit')
19
+conflicts=('sigit')
20
+# The released binary is already stripped by the release profile, and makepkg
21
+# should not rewrite a vendor binary it did not build.
22
+options=(!strip !debug)
23
+
24
+source_x86_64=("sigit-${pkgver}-x86_64::${url}/releases/download/v${pkgver}/sigit-linux-amd64")
25
+source_aarch64=("sigit-${pkgver}-aarch64::${url}/releases/download/v${pkgver}/sigit-linux-arm64")
26
+sha256sums_x86_64=('@SHA256_X86_64@')
27
+sha256sums_aarch64=('@SHA256_AARCH64@')
28
+
29
+package() {
30
+ install -Dm755 "${srcdir}/sigit-${pkgver}-${CARCH}" "${pkgdir}/usr/bin/sigit"
31
+}
packaging/nfpm.yaml
new
+37
@@ -0,0 +1,37 @@
1
+# nfpm builds the .deb and .rpm attached to each GitHub release.
2
+#
3
+# One config covers both formats. nfpm takes an already-built binary rather
4
+# than invoking cargo, so the release matrix compiles each Linux target once
5
+# and packages it twice. `arch` is a Go arch name (amd64/arm64) that nfpm
6
+# translates per format, so the rpm comes out tagged x86_64 without a second
7
+# config.
8
+#
9
+# PKG_ARCH and PKG_VERSION are set by release-github.yml; PKG_BINARY points at
10
+# the renamed binary already staged in release/.
11
+name: sigit
12
+arch: ${PKG_ARCH}
13
+platform: linux
14
+version: ${PKG_VERSION}
15
+section: devel
16
+priority: optional
17
+maintainer: smbCloud <seto@sigit.si>
18
+vendor: PT Sigit Mitra Bangun
19
+homepage: https://sigit.si
20
+license: Apache-2.0
21
+description: |
22
+ siGit Code, an AI coding agent that runs on your machine.
23
+ Speaks the Agent Client Protocol for editor integration, and runs inference
24
+ either on-device or against a hosted endpoint.
25
+contents:
26
+ - src: ${PKG_BINARY}
27
+ dst: /usr/bin/sigit
28
+ file_info:
29
+ mode: 0755
30
+ - src: ./LICENSE
31
+ dst: /usr/share/doc/sigit/LICENSE
32
+ file_info:
33
+ mode: 0644
34
+ - src: ./README.md
35
+ dst: /usr/share/doc/sigit/README.md
36
+ file_info:
37
+ mode: 0644