Publish AUR Package #919
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish AUR Package | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - 'packaging/aur/**' | |
| - 'scripts/sync-aur-repo.sh' | |
| - '.github/workflows/publish-aur.yml' | |
| workflow_run: | |
| workflows: | |
| - Sync Upstream Frontend | |
| types: | |
| - completed | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: publish-aur-package | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| if: >- | |
| github.event_name != 'workflow_run' || | |
| (github.event.workflow_run.conclusion == 'success' && | |
| github.event.workflow_run.head_branch == 'main') | |
| runs-on: ubuntu-latest | |
| container: | |
| image: archlinux:base-devel | |
| env: | |
| AUR_PACKAGE_NAME: codex-native-git | |
| AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }} | |
| steps: | |
| - name: Check AUR secret availability | |
| id: aur_secret | |
| run: | | |
| if [[ -n "${AUR_SSH_PRIVATE_KEY}" ]]; then | |
| echo "present=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "present=false" >> "$GITHUB_OUTPUT" | |
| echo "AUR_SSH_PRIVATE_KEY is not configured; skipping publish." | |
| fi | |
| - name: Install tooling | |
| if: steps.aur_secret.outputs.present == 'true' | |
| run: pacman -Sy --noconfirm git openssh | |
| - name: Check out repository | |
| if: steps.aur_secret.outputs.present == 'true' | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: main | |
| - name: Mark workspace safe for git | |
| if: steps.aur_secret.outputs.present == 'true' | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Configure SSH for AUR | |
| if: steps.aur_secret.outputs.present == 'true' | |
| run: | | |
| ssh_dir="/root/.ssh" | |
| install -dm700 "${ssh_dir}" | |
| printf '%s\n' "${AUR_SSH_PRIVATE_KEY}" > "${ssh_dir}/aur" | |
| chmod 600 "${ssh_dir}/aur" | |
| ssh-keyscan -H aur.archlinux.org >> "${ssh_dir}/known_hosts" | |
| ssh-keyscan -H -p 22 aur.archlinux.org >> "${ssh_dir}/known_hosts" | |
| cat > "${ssh_dir}/config" <<'EOF' | |
| Host aur.archlinux.org | |
| User aur | |
| IdentityFile /root/.ssh/aur | |
| IdentitiesOnly yes | |
| StrictHostKeyChecking accept-new | |
| UserKnownHostsFile /root/.ssh/known_hosts | |
| EOF | |
| chmod 600 "${ssh_dir}/config" | |
| - name: Clone AUR repository | |
| if: steps.aur_secret.outputs.present == 'true' | |
| env: | |
| GIT_SSH_COMMAND: ssh -F /root/.ssh/config | |
| run: git clone "ssh://aur@aur.archlinux.org/${AUR_PACKAGE_NAME}.git" /tmp/aur-repo | |
| - name: Sync package files | |
| if: steps.aur_secret.outputs.present == 'true' | |
| run: ./scripts/sync-aur-repo.sh /tmp/aur-repo | |
| - name: Commit and push when packaging changed | |
| if: steps.aur_secret.outputs.present == 'true' | |
| env: | |
| GIT_SSH_COMMAND: ssh -F /root/.ssh/config | |
| run: | | |
| cd /tmp/aur-repo | |
| if git diff --quiet --exit-code; then | |
| echo "No AUR changes to publish." | |
| exit 0 | |
| fi | |
| version="$(sed -n 's/^pkgver=//p' PKGBUILD)" | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add PKGBUILD .SRCINFO codex-native.desktop codex-native-launcher README.md | |
| git commit -m "Update ${AUR_PACKAGE_NAME} to ${version}" | |
| git push origin master |