pkg: spotatui #9
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 Travis Lyons | |
| # SPDX-License-Identifier: MIT | |
| name: Update package metadata | |
| on: | |
| pull_request: | |
| types: | |
| - opened | |
| - synchronize | |
| branches: | |
| - main | |
| paths: | |
| - '*/PKGBUILD' | |
| concurrency: | |
| group: package-metadata-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| update: | |
| name: Update checksums and .SRCINFO | |
| if: >- | |
| github.actor == 'renovate[bot]' && | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| container: | |
| image: archlinux:base-devel@sha256:c1829f370be8434135f43fb3acaef1256780804ac3b2d2eec90dfb1232e1ffdf | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Install tools | |
| run: pacman -Syu --noconfirm --needed git github-cli pacman-contrib sudo | |
| - name: Check out Renovate branch | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - name: Trust GitHub workspace | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Configure build user | |
| shell: bash | |
| run: | | |
| useradd --create-home builder | |
| chown -R builder:builder "$GITHUB_WORKSPACE" | |
| - name: Update package metadata | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| changed_paths=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" -- '*/PKGBUILD') | |
| mapfile -t packages < <( | |
| while IFS= read -r path; do | |
| package=${path%/PKGBUILD} | |
| [[ $package != "$path" && -f "$package/PKGBUILD" ]] || continue | |
| printf '%s\n' "$package" | |
| done <<< "$changed_paths" | sort -u | |
| ) | |
| if (( ${#packages[@]} == 0 )); then | |
| echo 'No changed package PKGBUILD files found.' | |
| exit 0 | |
| fi | |
| for package in "${packages[@]}"; do | |
| ( | |
| sudo --user=builder --set-home bash -c ' | |
| cd "$1" | |
| updpkgsums | |
| makepkg --printsrcinfo > .SRCINFO | |
| ' -- "$package" | |
| ) | |
| done | |
| - name: Commit updated metadata | |
| id: commit_updated_metadata | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| echo 'created=false' >> "$GITHUB_OUTPUT" | |
| git config user.name 'renovate[bot]' | |
| git config user.email '29139614+renovate[bot]@users.noreply.github.com' | |
| git add -- '*/PKGBUILD' '*/.SRCINFO' | |
| if git diff --cached --quiet; then | |
| echo 'Package metadata is already current.' | |
| exit 0 | |
| fi | |
| git commit -m 'chore: update package metadata' | |
| echo 'created=true' >> "$GITHUB_OUTPUT" | |
| # GITHUB_TOKEN commits do not trigger another workflow run, so the | |
| # narrowly scoped PAT is used only for this final push. | |
| - name: Push updated metadata | |
| if: steps.commit_updated_metadata.outputs.created == 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| METADATA_PUSH_TOKEN: ${{ secrets.METADATA_PUSH_TOKEN }} | |
| GITHUB_HEAD_REF: ${{ github.head_ref }} | |
| EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| current_head_sha=$(gh api \ | |
| "repos/${GITHUB_REPOSITORY}/git/ref/heads/${GITHUB_HEAD_REF}" \ | |
| --jq .object.sha) | |
| if [[ "$current_head_sha" != "$EXPECTED_HEAD_SHA" ]]; then | |
| echo "Refusing to update superseded branch $GITHUB_HEAD_REF; expected $EXPECTED_HEAD_SHA, found $current_head_sha" >&2 | |
| exit 1 | |
| fi | |
| auth_header=$(printf 'x-access-token:%s' "$METADATA_PUSH_TOKEN" | base64 --wrap=0) | |
| git -c "http.extraheader=AUTHORIZATION: basic $auth_header" \ | |
| push --force-with-lease="refs/heads/${GITHUB_HEAD_REF}:${EXPECTED_HEAD_SHA}" \ | |
| origin "HEAD:refs/heads/${GITHUB_HEAD_REF}" |