80caedc7fd
Pin bread-theme/bread-utils to bread-ecosystem tag v0.7.2. Subscribe from the locker and from `breadlock listen` so the command works while unlocked; start breadlock the same way hypridle does. Emit bread.lock.lock.done / .failed. Document loginctl lock-session as the Super+L equivalent. Optional GPG detach-sign of the .pkg.tar.zst when GPG_PRIVATE_KEY is set; ISO [breadway] stays SigLevel = Never until a signed db exists.
86 lines
4.1 KiB
YAML
86 lines
4.1 KiB
YAML
name: Build and publish package
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
jobs:
|
|
package:
|
|
runs-on: [self-hosted, hestia]
|
|
# Forgejo's Arch package registry does not GPG-sign a pacman db.
|
|
# BOS ISO [breadway] stays SigLevel = Never until a signed db exists.
|
|
# Do not flip that here — flipping without a signed db breaks pacman.
|
|
# Keep publishing the unsigned .pkg.tar.zst to the registry below.
|
|
container:
|
|
image: archlinux:latest
|
|
steps:
|
|
# Note: no actions/checkout — the archlinux image has no Node, which JS
|
|
# actions require. Everything runs as shell steps and clones manually.
|
|
- name: Build and publish
|
|
env:
|
|
PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
pacman -Syu --noconfirm base-devel git rust cargo libgit2 openssl pam wayland libxkbcommon gtk4
|
|
useradd -m builder
|
|
git config --global --add safe.directory '*'
|
|
git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
|
|
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
|
|
cd /home/builder/src
|
|
git archive --format=tar.gz --prefix="breadlock-${VERSION}/" HEAD \
|
|
> packaging/arch/breadlock-${VERSION}.tar.gz
|
|
SHA=$(sha256sum packaging/arch/breadlock-${VERSION}.tar.gz | awk '{print $1}')
|
|
sed -i "s/^pkgver=.*/pkgver=${VERSION}/" packaging/arch/PKGBUILD
|
|
sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" packaging/arch/PKGBUILD
|
|
chown -R builder:builder /home/builder/src
|
|
# --nocheck: packaging builds the artifact; tests belong in a CI job.
|
|
su builder -c "cd /home/builder/src/packaging/arch && makepkg -f --noconfirm --nocheck"
|
|
PKG=$(find /home/builder/src/packaging/arch -name '*.pkg.tar.zst' | head -1)
|
|
mkdir -p /tmp/breadlock-pkg
|
|
cp "$PKG" /tmp/breadlock-pkg/
|
|
echo "${VERSION}" > /tmp/breadlock-pkg/VERSION
|
|
curl -fsS -X PUT \
|
|
-H "Authorization: token ${PUBLISH_TOKEN}" \
|
|
-H "Content-Type: application/octet-stream" \
|
|
--data-binary "@${PKG}" \
|
|
"https://git.breadway.dev/api/packages/Breadway/arch/os"
|
|
|
|
# Optional detach-sign. secrets.GPG_PRIVATE_KEY is the same BOS
|
|
# release-signing key (releases@breadway.dev). If the secret is
|
|
# missing, skip — the registry PUT above already published the
|
|
# unsigned package. A lone .sig is not a signed repo: ISO
|
|
# [breadway] stays SigLevel = Never until a signed db exists.
|
|
# The .sig is uploaded as a generic-package artifact next to that
|
|
# PUT, not injected into the Arch repo (which would not make
|
|
# pacman verify anything without a signed db).
|
|
- name: Detach-sign package (optional)
|
|
env:
|
|
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
|
PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
|
|
echo "GPG_PRIVATE_KEY unset; skipping detach-sign."
|
|
echo "ISO [breadway] stays SigLevel = Never until a signed db exists."
|
|
exit 0
|
|
fi
|
|
PKG=$(find /tmp/breadlock-pkg -name '*.pkg.tar.zst' | head -1)
|
|
if [ -z "$PKG" ]; then
|
|
echo "no package in /tmp/breadlock-pkg; cannot sign" >&2
|
|
exit 1
|
|
fi
|
|
VERSION=$(cat /tmp/breadlock-pkg/VERSION)
|
|
pacman -S --noconfirm --needed gnupg
|
|
export GNUPGHOME=/tmp/gnupg-breadlock
|
|
mkdir -m 700 -p "$GNUPGHOME"
|
|
echo "$GPG_PRIVATE_KEY" | gpg --batch --import
|
|
gpg --batch --yes --detach-sign -o "${PKG}.sig" "$PKG"
|
|
echo "Signed $(basename "$PKG") -> $(basename "$PKG").sig"
|
|
# Generic package: workflow artifact alongside the Arch PUT.
|
|
# Does not change [breadway] / pacman SigLevel.
|
|
curl -fsS -X PUT \
|
|
-H "Authorization: token ${PUBLISH_TOKEN}" \
|
|
-H "Content-Type: application/octet-stream" \
|
|
--data-binary "@${PKG}.sig" \
|
|
"https://git.breadway.dev/api/packages/Breadway/generic/breadlock/${VERSION}/$(basename "$PKG").sig"
|