cd5bf1b546
- release-iso.yml's "Build bread-theme from source" step grepped
bos-settings/Cargo.toml for the bread-theme tag pin, but bos-settings was
split out into its own repo (git.breadway.dev/Breadway/bos-settings) --
that path no longer exists in this checkout, so the grep would fail (or
silently find nothing). Now fetches bos-settings' Cargo.toml directly from
its own repo (dev branch, the one its own CI actually publishes the
bos-settings pacman package from) via the Forgejo raw-file endpoint.
- calamares.yml cloned the repo's default branch instead of the branch/tag
that actually triggered the run -- bibata.yml, powerlevel10k.yml, and
yay-bin.yml (the other in-house-PKGBUILD workflows in this same family)
all correctly clone --branch "${GITHUB_REF_NAME}". Brought calamares.yml
in line with them.
- breadhelp-tour.lua interpolated an untrusted, client-controlled Wayland
window class / layer-shell namespace directly into a bread.exec shell
command string -- a session-level shell injection vector (verified
exploitable with a crafted window class before this fix, e.g.
"evil; touch ~/pwned #"). bread.exec only accepts a single shell string
(always run via `sh -lc`, per breadd/src/lua/mod.rs) -- there's no
array-exec form to bypass the shell with -- so the fix is a proper POSIX
shell_quote() helper wrapping every interpolated value in single quotes
before it reaches bread.exec.
40 lines
1.7 KiB
YAML
40 lines
1.7 KiB
YAML
name: Build and publish calamares
|
|
|
|
# Calamares is AUR-only (not in Arch's official repos), so BOS maintains an
|
|
# in-house PKGBUILD and publishes the built package to the [breadway] repo.
|
|
on:
|
|
push:
|
|
paths:
|
|
- 'packaging/calamares/**'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
calamares:
|
|
runs-on: [self-hosted, hestia]
|
|
container:
|
|
image: archlinux:latest
|
|
steps:
|
|
- name: Build and publish
|
|
env:
|
|
PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
pacman -Syu --noconfirm base-devel git cmake ninja \
|
|
extra-cmake-modules qt6-tools qt6-translations libglvnd \
|
|
kcoreaddons kpmcore libpwquality qt6-declarative qt6-svg yaml-cpp
|
|
useradd -m builder
|
|
git config --global --add safe.directory '*'
|
|
# Clone the branch/tag that triggered this run (not the default
|
|
# branch) — same as bibata.yml/powerlevel10k.yml/yay-bin.yml, so a
|
|
# push to a feature branch (or a release tag) builds and publishes
|
|
# from that ref, not whatever happens to be on the default branch.
|
|
git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
|
|
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
|
|
chown -R builder:builder /home/builder/src
|
|
su builder -c "cd /home/builder/src/packaging/calamares && makepkg -f --noconfirm --nocheck"
|
|
PKG=$(find /home/builder/src/packaging/calamares -name '*.pkg.tar.zst' | head -1)
|
|
curl -fsS -X PUT \
|
|
-H "Authorization: token ${PUBLISH_TOKEN}" \
|
|
-H "Content-Type: application/octet-stream" \
|
|
--data-binary "@${PKG}" \
|
|
"https://git.breadway.dev/api/packages/Breadway/arch/os"
|