build(aur): gate the recipe against version drift, refresh it on release (GDK-115) - #12
Merged
Conversation
…release refresh (GDK-115) contrib/aur/gadak-bin/ already held a working PKGBUILD, .SRCINFO, update.sh and a container verify.sh. What it did not have was anything that notices pkgver drifting from the tag it claims, or anything that refreshes it when a release happens — both were steps a person had to remember. - contrib/aur/gadak-bin/check-pkgver.sh: offline gate, pkgver == the latest tag with the v stripped. Same version owner as tools/doc-checks.sh check 6 (git describe --tags --abbrev=0), not `gadak version`, which prints 0.0.0-dev in an unstamped tree. Skips on a tagless checkout and on a hyphenated prerelease tag, which cannot be a pkgver. - .github/workflows/aur.yml runs it, with fetch-depth: 0 so tags exist — a registered gate that always skips is worse than no gate. The workflow is path-scoped to contrib/aur/**, so it fires when the recipe is edited and not on every tag. - .github/workflows/release.yml gains aur-pkgbuild: after GoReleaser it runs update.sh for the published tag, prints the commit-ready diff, and uploads the PKGBUILD as an artifact. It does not push to aur.archlinux.org — that needs an account and an SSH key, and stays lead-only. .SRCINFO still needs makepkg, so it is regenerated by verify.sh, not here. FAIL-first: a copy of PKGBUILD with pkgver=0.0.0 gives "FAIL: PKGBUILD pkgver=0.0.0 does not match latest tag v0.15.2 (want 0.15.2)", exit 1. The real file was not mutated. Publishing is still blocked upstream: AUR closed new-package registration after the 2026-08 supply-chain attack (docs/INSTALL.md already records this), and aur.archlinux.org/rpc/v5/search/gadak is still resultcount 0. The recipe being correct and the recipe being installable are two different states. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
contrib/aur/gadak-bin/already had a working PKGBUILD,.SRCINFO,update.shand a containerverify.sh. What it lacked was anything that noticespkgverdrifting from the tag it claims, and anything that refreshes it when a release happens — both were steps a person had to remember.contrib/aur/gadak-bin/check-pkgver.sh— offline gate:pkgver== latest tag minusv. Same version owner astools/doc-checks.shcheck 6 (git describe --tags --abbrev=0), notgadak version(an unstamped tree prints0.0.0-dev). Skips a tagless checkout and a hyphenated prerelease tag, which cannot be apkgver..github/workflows/aur.ymlruns it withfetch-depth: 0, because a shallow clone has no tags and the gate would pass by skipping. Path-scoped tocontrib/aur/**, so it fires when the recipe is edited rather than on every tag..github/workflows/release.ymlgainsaur-pkgbuild: after GoReleaser it runsupdate.shfor the published tag, prints the commit-ready diff, and uploads the PKGBUILD as an artifact. It does not push to aur.archlinux.org (account + SSH key, lead-only), and.SRCINFOis still regenerated byverify.shbecause that needsmakepkg.FAIL-first: a copy of PKGBUILD with
pkgver=0.0.0givesFAIL: PKGBUILD pkgver=0.0.0 does not match latest tag v0.15.2 (want 0.15.2), exit 1. The real file was not mutated.Publishing remains blocked upstream: AUR closed new-package registration after the 2026-08 supply-chain attack (already recorded in
docs/INSTALL.md), andrpc/v5/search/gadakis stillresultcount 0. A correct recipe and an installable recipe are two different states.🤖 Generated with Claude Code