716c77f93b
All checks were successful
Build and publish python-pywal / python-pywal (push) Successful in 1m21s
python-pywal was dropped from Arch's [extra] repo (AUR-only now), so `pacstrap` can no longer resolve it and every ISO build fails with "target not found: python-pywal". The `wal` binary is load-bearing — bread-theme shells out to it to extract the colour palette from the user's wallpaper. Republish it the same way as calamares / bibata / powerlevel10k / yay-bin: - `packaging/python-pywal/PKGBUILD` — in-house copy of the AUR PKGBUILD (Morten Linderud's), modernised to `python -m build` / `installer` instead of the removed `setup.py install`, sha256-only sources like the sibling PKGBUILDs. Test-built locally: 28 unit tests pass, package ships `/usr/bin/wal`. - `.forgejo/workflows/python-pywal.yml` — builds + PUTs to the Forgejo Arch registry on a push to `packaging/python-pywal/**`. - `signed-repo.yml` gains it as a `workflow_run` trigger; `ci-publish-signed-repo.sh` gains it in `PACKAGES` so the signed dl.breadway.dev/arch db picks it up. - packages.x86_64 keeps the `python-pywal` line (now sourced from [breadway]) with a note. Ordering: `python-pywal.yml` must publish to the registry once before `signed-repo.yml` runs, or the collect step errors "registry db missing packages: python-pywal".
53 lines
1.8 KiB
YAML
53 lines
1.8 KiB
YAML
name: Publish signed [breadway] repo
|
|
|
|
# Host job on hestia (no container:) so it can write /srv/breadway-dl, same
|
|
# as bakery releases. breadlock package.yml uses archlinux:latest and cannot
|
|
# see host /srv — do not add container: here.
|
|
#
|
|
# Collects breadlock + the ISO AUR republishes from the Forgejo Arch
|
|
# registry, detach-signs each .pkg.tar.zst, repo-add -s, publishes
|
|
# https://dl.breadway.dev/arch/x86_64/. Does not PUT to the registry
|
|
# (existing packaging workflows keep doing that). Does not flip ISO SigLevel.
|
|
#
|
|
# Required secret: GPG_PRIVATE_KEY (same BOS release key as release-iso.yml).
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
repository_dispatch:
|
|
types: [publish-signed-repo]
|
|
workflow_run:
|
|
workflows:
|
|
- Build and publish calamares
|
|
- Build and publish bibata-cursor-theme
|
|
- Build and publish powerlevel10k
|
|
- Build and publish yay-bin
|
|
- Build and publish python-pywal
|
|
types: [completed]
|
|
|
|
concurrency:
|
|
group: signed-repo
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
|
|
runs-on: [self-hosted, hestia]
|
|
steps:
|
|
- name: Clone repository
|
|
run: |
|
|
set -euo pipefail
|
|
REF="${GITHUB_REF_NAME:-main}"
|
|
rm -rf src
|
|
git clone --depth 1 --branch "$REF" \
|
|
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
|
|
|
|
- name: Sign packages and publish repo
|
|
env:
|
|
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
|
|
echo "GPG_PRIVATE_KEY secret is missing; refusing to publish an unsigned [breadway] repo." >&2
|
|
exit 1
|
|
fi
|
|
bash src/scripts/ci-publish-signed-repo.sh
|