packaging: 2.39.0 (AUR, Nix) #148
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: AUR package check | |
| # Verifies packaging/aur/PKGBUILD actually builds, in a real Arch container — | |
| # so the AUR package can be validated without owning a Linux machine. | |
| on: | |
| push: | |
| paths: | |
| - "packaging/aur/**" | |
| - ".github/workflows/aur-check.yml" | |
| pull_request: | |
| paths: | |
| - "packaging/aur/**" | |
| workflow_dispatch: | |
| jobs: | |
| makepkg: | |
| name: makepkg (Arch) | |
| runs-on: ubuntu-latest | |
| container: archlinux:base-devel | |
| steps: | |
| # base-devel has makepkg but not git; install it before checkout. | |
| - name: Install tooling | |
| run: pacman -Syu --noconfirm git sudo namcap | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up build user | |
| run: | | |
| set -euxo pipefail | |
| # makepkg refuses to run as root — build as an unprivileged user with | |
| # passwordless sudo so `-s` can install the declared dependencies. | |
| useradd -m builder | |
| printf 'builder ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/builder | |
| install -d -o builder -g builder /tmp/build | |
| cp packaging/aur/PKGBUILD packaging/aur/.SRCINFO /tmp/build/ | |
| chown -R builder:builder /tmp/build | |
| # The PKGBUILD always points at the upcoming release's tarball, which does | |
| # not exist until that release is published. Skip the full build (which has | |
| # to download it) when the asset isn't up yet, rather than failing — the | |
| # metadata + .SRCINFO are still checked, and the real build runs once the | |
| # release exists. | |
| - name: Check whether the release asset is published | |
| id: asset | |
| run: | | |
| set -uo pipefail | |
| # shellcheck disable=SC1091 | |
| source packaging/aur/PKGBUILD | |
| url="${source[0]#*::}" | |
| echo "url=$url" | |
| if curl -fsIL -o /dev/null "$url"; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice title=AUR build skipped::Release asset not published yet ($url). PKGBUILD metadata + .SRCINFO are still validated; the full makepkg build runs once the release exists." | |
| fi | |
| - name: Build the package | |
| if: steps.asset.outputs.exists == 'true' | |
| run: | | |
| set -euxo pipefail | |
| cd /tmp/build | |
| sudo -u builder makepkg -s --noconfirm --noprogressbar | |
| ls -la ./*.pkg.tar.* | |
| - name: Lint (non-blocking) | |
| if: steps.asset.outputs.exists == 'true' | |
| run: | | |
| cd /tmp/build | |
| namcap PKGBUILD || true | |
| namcap ./*.pkg.tar.* || true | |
| - name: Verify .SRCINFO is in sync | |
| run: | | |
| set -euxo pipefail | |
| cd /tmp/build | |
| sudo -u builder makepkg --printsrcinfo > .SRCINFO.generated | |
| if ! diff -u .SRCINFO .SRCINFO.generated; then | |
| echo "::error::.SRCINFO is out of date — run 'makepkg --printsrcinfo > .SRCINFO'." >&2 | |
| exit 1 | |
| fi |