detached d1416a2

ci: publish releases to GitHub and the AUR

commit
d1416a22a222f14e142dcd8b95161ce9b32fbdd1
author
brice · · 2026-10-01 03:06 UTC
parent
266860c
signature
GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email
3 files · +301 -0
Unified
UnifiedSplit
A .github/workflows/release.yml +93 -0
@@ -0,0 +1,93 @@
1+name: Release
2+on:
3+ push:
4+ tags: ['v*']
5+permissions:
6+ contents: read
7+concurrency:
8+ group: release-${{ github.ref }}
9+ cancel-in-progress: false
10+jobs:
11+ check:
12+ uses: ./.github/workflows/ci.yml
13+
14+ release:
15+ needs: check
16+ runs-on: ubuntu-latest
17+ permissions:
18+ contents: write # create the release
19+ id-token: write # sign the provenance attestation
20+ attestations: write
21+ steps:
22+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23+ with:
24+ fetch-depth: 0
25+ persist-credentials: false
26+ - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
27+ with:
28+ go-version-file: go.mod
29+ - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
30+ with:
31+ distribution: goreleaser
32+ version: '~> v2'
33+ args: release --clean
34+ env:
35+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36+ - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
37+ with:
38+ subject-path: |
39+ dist/*.tar.gz
40+ dist/checksums.txt
41+ - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
42+ with:
43+ name: aur-bin
44+ path: dist/aur/neferafk-bin.pkgbuild
45+ if-no-files-found: error
46+
47+ # makepkg must run on Arch as a non-root user. publish.sh builds each
48+ # package, verifies every source checksum, then pushes it.
49+ aur:
50+ needs: release
51+ runs-on: ubuntu-latest
52+ container:
53+ image: archlinux:latest
54+ strategy:
55+ fail-fast: false
56+ matrix:
57+ pkg: [neferafk-bin, neferafk-git]
58+ # Pre-releases (v0.2.0-rc1) stay off the AUR: pacman sorts 0.2.0.rc1
59+ # after 0.2.0, so the final release would not look like an upgrade.
60+ env:
61+ SKIP: ${{ contains(github.ref_name, '-') }}
62+ steps:
63+ - run: >-
64+ pacman -Syu --noconfirm --needed
65+ base-devel git openssh sudo
66+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
67+ with:
68+ persist-credentials: false
69+ - if: matrix.pkg == 'neferafk-bin' && env.SKIP != 'true'
70+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
71+ with:
72+ name: aur-bin
73+ path: aur-bin
74+ - name: Create the build user
75+ run: |
76+ useradd -m builder
77+ echo 'builder ALL=(root) NOPASSWD: /usr/bin/pacman' >/etc/sudoers.d/builder
78+ - name: Build, verify and publish ${{ matrix.pkg }}
79+ if: env.SKIP != 'true'
80+ env:
81+ AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
82+ AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
83+ AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
84+ PKG: ${{ matrix.pkg }}
85+ run: |
86+ if [ "$PKG" = neferafk-bin ]; then
87+ pkgbuild=aur-bin/neferafk-bin.pkgbuild
88+ else
89+ pkgbuild=packaging/aur/neferafk-git/PKGBUILD
90+ fi
91+ chmod -R a+rX "$GITHUB_WORKSPACE"
92+ sudo -u builder --preserve-env=AUR_SSH_PRIVATE_KEY,AUR_USERNAME,AUR_EMAIL \
93+ packaging/aur/publish.sh "$PKG" "$pkgbuild"
@@ -0,0 +1,93 @@
1+name: Release
2+on:
3+ push:
4+ tags: ['v*']
5+permissions:
6+ contents: read
7+concurrency:
8+ group: release-${{ github.ref }}
9+ cancel-in-progress: false
10+jobs:
11+ check:
12+ uses: ./.github/workflows/ci.yml
13+
14+ release:
15+ needs: check
16+ runs-on: ubuntu-latest
17+ permissions:
18+ contents: write # create the release
19+ id-token: write # sign the provenance attestation
20+ attestations: write
21+ steps:
22+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23+ with:
24+ fetch-depth: 0
25+ persist-credentials: false
26+ - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
27+ with:
28+ go-version-file: go.mod
29+ - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
30+ with:
31+ distribution: goreleaser
32+ version: '~> v2'
33+ args: release --clean
34+ env:
35+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36+ - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
37+ with:
38+ subject-path: |
39+ dist/*.tar.gz
40+ dist/checksums.txt
41+ - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
42+ with:
43+ name: aur-bin
44+ path: dist/aur/neferafk-bin.pkgbuild
45+ if-no-files-found: error
46+
47+ # makepkg must run on Arch as a non-root user. publish.sh builds each
48+ # package, verifies every source checksum, then pushes it.
49+ aur:
50+ needs: release
51+ runs-on: ubuntu-latest
52+ container:
53+ image: archlinux:latest
54+ strategy:
55+ fail-fast: false
56+ matrix:
57+ pkg: [neferafk-bin, neferafk-git]
58+ # Pre-releases (v0.2.0-rc1) stay off the AUR: pacman sorts 0.2.0.rc1
59+ # after 0.2.0, so the final release would not look like an upgrade.
60+ env:
61+ SKIP: ${{ contains(github.ref_name, '-') }}
62+ steps:
63+ - run: >-
64+ pacman -Syu --noconfirm --needed
65+ base-devel git openssh sudo
66+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
67+ with:
68+ persist-credentials: false
69+ - if: matrix.pkg == 'neferafk-bin' && env.SKIP != 'true'
70+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
71+ with:
72+ name: aur-bin
73+ path: aur-bin
74+ - name: Create the build user
75+ run: |
76+ useradd -m builder
77+ echo 'builder ALL=(root) NOPASSWD: /usr/bin/pacman' >/etc/sudoers.d/builder
78+ - name: Build, verify and publish ${{ matrix.pkg }}
79+ if: env.SKIP != 'true'
80+ env:
81+ AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
82+ AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
83+ AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
84+ PKG: ${{ matrix.pkg }}
85+ run: |
86+ if [ "$PKG" = neferafk-bin ]; then
87+ pkgbuild=aur-bin/neferafk-bin.pkgbuild
88+ else
89+ pkgbuild=packaging/aur/neferafk-git/PKGBUILD
90+ fi
91+ chmod -R a+rX "$GITHUB_WORKSPACE"
92+ sudo -u builder --preserve-env=AUR_SSH_PRIVATE_KEY,AUR_USERNAME,AUR_EMAIL \
93+ packaging/aur/publish.sh "$PKG" "$pkgbuild"
A .goreleaser.yaml +142 -0
@@ -0,0 +1,142 @@
1+# Builds the GitHub release for a pushed v* tag (.github/workflows/release.yml)
2+# and generates the neferafk-bin PKGBUILD. The workflow verifies that PKGBUILD
3+# with makepkg before it pushes it to the AUR, so GoReleaser never uploads it.
4+version: 2
5+
6+project_name: neferafk
7+
8+before:
9+ hooks:
10+ - go mod verify
11+
12+builds:
13+ - id: neferafk
14+ main: ./cmd/neferafk
15+ binary: neferafk
16+ env:
17+ - CGO_ENABLED=0
18+ goos: [linux]
19+ goarch: [amd64, arm64]
20+ flags:
21+ - -trimpath
22+ - -buildmode=pie
23+ ldflags:
24+ - -s -w -X main.version={{ .Version }}
25+ # Same inputs give the same binary.
26+ mod_timestamp: "{{ .CommitTimestamp }}"
27+
28+archives:
29+ - id: neferafk
30+ ids: [neferafk]
31+ name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
32+ formats: [tar.gz]
33+ # Everything the PKGBUILD package() installs, at the paths of the repo.
34+ files:
35+ - LICENSE
36+ - README.md
37+ - examples/config
38+ - packaging/neferafk.pam
39+
40+checksum:
41+ name_template: checksums.txt
42+ algorithm: sha256
43+
44+snapshot:
45+ version_template: "{{ incpatch .Version }}-next"
46+
47+git:
48+ tag_sort: -version:refname
49+
50+changelog:
51+ sort: asc
52+ use: github
53+ filters:
54+ exclude:
55+ - "^style(\\([^)]+\\))?:"
56+ - "^test(\\([^)]+\\))?:"
57+ groups:
58+ - title: Added
59+ regexp: "^feat(\\([^)]+\\))?!?:"
60+ order: 0
61+ - title: Fixed
62+ regexp: "^fix(\\([^)]+\\))?!?:"
63+ order: 1
64+ - title: Performance
65+ regexp: "^perf(\\([^)]+\\))?!?:"
66+ order: 2
67+ - title: Changed
68+ regexp: "^(refactor|build)(\\([^)]+\\))?!?:"
69+ order: 3
70+ - title: Documentation
71+ regexp: "^docs(\\([^)]+\\))?!?:"
72+ order: 4
73+ - title: Maintenance
74+ regexp: "^(chore|ci)(\\([^)]+\\))?!?:"
75+ order: 5
76+ - title: Other changes
77+ order: 999
78+
79+release:
80+ github:
81+ owner: bnema
82+ name: neferafk
83+ draft: false
84+ prerelease: auto
85+ mode: replace
86+ header: |
87+ ## neferafk {{ .Tag }}
88+
89+ ### Install on Arch Linux
90+
91+ ```sh
92+ paru -S neferafk-bin # this release, pre-built (x86_64, aarch64)
93+ paru -S neferafk-git # latest main, built from source
94+ ```
95+
96+ ### Install the pre-built archive
97+
98+ Linux amd64 and arm64. Replace `amd64` with `arm64` on ARM.
99+
100+ ```sh
101+ gh release download {{ .Tag }} -R bnema/neferafk -p 'neferafk_{{ .Version }}_linux_amd64.tar.gz' -p checksums.txt
102+ sha256sum -c --ignore-missing checksums.txt
103+ gh attestation verify neferafk_{{ .Version }}_linux_amd64.tar.gz -R bnema/neferafk
104+ ```
105+
106+ The archive holds the `neferafk` binary, the PAM service file `neferafk.pam` (install it as `/etc/pam.d/neferafk` for password mode), an example config, the README and the license. See the [README](https://github.com/bnema/neferafk#readme) for runtime dependencies.
107+ footer: |
108+ ---
109+
110+ **Full changelog**: https://github.com/bnema/neferafk/compare/{{ .PreviousTag }}...{{ .Tag }}
111+
112+aurs:
113+ - name: neferafk-bin
114+ ids: [neferafk]
115+ homepage: https://github.com/bnema/neferafk
116+ description: "Idle daemon for Wayland: fade, session lock, screens off and suspend"
117+ maintainers:
118+ - "bnema <b at bnema dot dev>"
119+ license: GPL-3.0-only
120+ # The release workflow verifies and publishes the generated PKGBUILD.
121+ skip_upload: true
122+ provides: [neferafk]
123+ conflicts: [neferafk, neferafk-git]
124+ # Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
125+ depends:
126+ - glibc
127+ - pam
128+ - libxkbcommon
129+ - vulkan-icd-loader
130+ - vulkan-driver
131+ - systemd
132+ - ttf-dejavu # lock screen monospace font (DejaVu Sans Mono)
133+ optdepends:
134+ - "pass: PIN source for auth.mode = pin"
135+ backup:
136+ - etc/pam.d/neferafk
137+ package: |-
138+ install -Dm755 ./neferafk "${pkgdir}/usr/bin/neferafk"
139+ install -Dm644 ./packaging/neferafk.pam "${pkgdir}/etc/pam.d/neferafk"
140+ install -Dm644 ./examples/config "${pkgdir}/usr/share/doc/neferafk/config.example"
141+ install -Dm644 ./README.md "${pkgdir}/usr/share/doc/neferafk/README.md"
142+ install -Dm644 ./LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
@@ -0,0 +1,142 @@
1+# Builds the GitHub release for a pushed v* tag (.github/workflows/release.yml)
2+# and generates the neferafk-bin PKGBUILD. The workflow verifies that PKGBUILD
3+# with makepkg before it pushes it to the AUR, so GoReleaser never uploads it.
4+version: 2
5+
6+project_name: neferafk
7+
8+before:
9+ hooks:
10+ - go mod verify
11+
12+builds:
13+ - id: neferafk
14+ main: ./cmd/neferafk
15+ binary: neferafk
16+ env:
17+ - CGO_ENABLED=0
18+ goos: [linux]
19+ goarch: [amd64, arm64]
20+ flags:
21+ - -trimpath
22+ - -buildmode=pie
23+ ldflags:
24+ - -s -w -X main.version={{ .Version }}
25+ # Same inputs give the same binary.
26+ mod_timestamp: "{{ .CommitTimestamp }}"
27+
28+archives:
29+ - id: neferafk
30+ ids: [neferafk]
31+ name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
32+ formats: [tar.gz]
33+ # Everything the PKGBUILD package() installs, at the paths of the repo.
34+ files:
35+ - LICENSE
36+ - README.md
37+ - examples/config
38+ - packaging/neferafk.pam
39+
40+checksum:
41+ name_template: checksums.txt
42+ algorithm: sha256
43+
44+snapshot:
45+ version_template: "{{ incpatch .Version }}-next"
46+
47+git:
48+ tag_sort: -version:refname
49+
50+changelog:
51+ sort: asc
52+ use: github
53+ filters:
54+ exclude:
55+ - "^style(\\([^)]+\\))?:"
56+ - "^test(\\([^)]+\\))?:"
57+ groups:
58+ - title: Added
59+ regexp: "^feat(\\([^)]+\\))?!?:"
60+ order: 0
61+ - title: Fixed
62+ regexp: "^fix(\\([^)]+\\))?!?:"
63+ order: 1
64+ - title: Performance
65+ regexp: "^perf(\\([^)]+\\))?!?:"
66+ order: 2
67+ - title: Changed
68+ regexp: "^(refactor|build)(\\([^)]+\\))?!?:"
69+ order: 3
70+ - title: Documentation
71+ regexp: "^docs(\\([^)]+\\))?!?:"
72+ order: 4
73+ - title: Maintenance
74+ regexp: "^(chore|ci)(\\([^)]+\\))?!?:"
75+ order: 5
76+ - title: Other changes
77+ order: 999
78+
79+release:
80+ github:
81+ owner: bnema
82+ name: neferafk
83+ draft: false
84+ prerelease: auto
85+ mode: replace
86+ header: |
87+ ## neferafk {{ .Tag }}
88+
89+ ### Install on Arch Linux
90+
91+ ```sh
92+ paru -S neferafk-bin # this release, pre-built (x86_64, aarch64)
93+ paru -S neferafk-git # latest main, built from source
94+ ```
95+
96+ ### Install the pre-built archive
97+
98+ Linux amd64 and arm64. Replace `amd64` with `arm64` on ARM.
99+
100+ ```sh
101+ gh release download {{ .Tag }} -R bnema/neferafk -p 'neferafk_{{ .Version }}_linux_amd64.tar.gz' -p checksums.txt
102+ sha256sum -c --ignore-missing checksums.txt
103+ gh attestation verify neferafk_{{ .Version }}_linux_amd64.tar.gz -R bnema/neferafk
104+ ```
105+
106+ The archive holds the `neferafk` binary, the PAM service file `neferafk.pam` (install it as `/etc/pam.d/neferafk` for password mode), an example config, the README and the license. See the [README](https://github.com/bnema/neferafk#readme) for runtime dependencies.
107+ footer: |
108+ ---
109+
110+ **Full changelog**: https://github.com/bnema/neferafk/compare/{{ .PreviousTag }}...{{ .Tag }}
111+
112+aurs:
113+ - name: neferafk-bin
114+ ids: [neferafk]
115+ homepage: https://github.com/bnema/neferafk
116+ description: "Idle daemon for Wayland: fade, session lock, screens off and suspend"
117+ maintainers:
118+ - "bnema <b at bnema dot dev>"
119+ license: GPL-3.0-only
120+ # The release workflow verifies and publishes the generated PKGBUILD.
121+ skip_upload: true
122+ provides: [neferafk]
123+ conflicts: [neferafk, neferafk-git]
124+ # Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
125+ depends:
126+ - glibc
127+ - pam
128+ - libxkbcommon
129+ - vulkan-icd-loader
130+ - vulkan-driver
131+ - systemd
132+ - ttf-dejavu # lock screen monospace font (DejaVu Sans Mono)
133+ optdepends:
134+ - "pass: PIN source for auth.mode = pin"
135+ backup:
136+ - etc/pam.d/neferafk
137+ package: |-
138+ install -Dm755 ./neferafk "${pkgdir}/usr/bin/neferafk"
139+ install -Dm644 ./packaging/neferafk.pam "${pkgdir}/etc/pam.d/neferafk"
140+ install -Dm644 ./examples/config "${pkgdir}/usr/share/doc/neferafk/config.example"
141+ install -Dm644 ./README.md "${pkgdir}/usr/share/doc/neferafk/README.md"
142+ install -Dm644 ./LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
A packaging/aur/publish.sh +66 -0
@@ -0,0 +1,66 @@
1+#!/usr/bin/env bash
2+# Builds an AUR package with makepkg, then pushes its PKGBUILD and .SRCINFO.
3+# makepkg downloads every source and checks its sha256sum, so a PKGBUILD that
4+# does not build, or does not match its release assets, is never published.
5+#
6+# Usage: publish.sh <pkgname> <PKGBUILD>
7+# Env: AUR_SSH_PRIVATE_KEY, AUR_USERNAME, AUR_EMAIL
8+# DRY_RUN=1 builds and prints the files without pushing.
9+# Runs as a non-root user that may run pacman through sudo (makepkg -s).
10+set -euo pipefail
11+CARCH=$(uname -m)
12+
13+pkgname=$1
14+work=$(mktemp -d)
15+trap 'rm -rf "$work"' EXIT
16+cp "$2" "$work/PKGBUILD"
17+cd "$work"
18+
19+makepkg --syncdeps --force --noconfirm
20+# A -git pkgver() rewrites pkgver in PKGBUILD; .SRCINFO must match it.
21+makepkg --printsrcinfo >.SRCINFO
22+pkgver=$(sed -n 's/^\tpkgver = //p' .SRCINFO)
23+
24+# makepkg only fetches the sources of this machine's arch: check the others too.
25+while read -r arch; do
26+ if [[ $arch == "$CARCH" ]] || ! grep -q "^source_$arch=" PKGBUILD; then
27+ continue
28+ fi
29+ { cat /etc/makepkg.conf; echo "CARCH=$arch"; } >"makepkg-$arch.conf"
30+ makepkg --config "makepkg-$arch.conf" --verifysource --noconfirm
31+done < <(sed -n 's/^\tarch = //p' .SRCINFO)
32+
33+# pacman versions use _ where the tag has - (0.2.0-rc1 -> 0.2.0_rc1).
34+got=$("pkg/$pkgname/usr/bin/neferafk" version)
35+if [[ $got != "$pkgver" && $got != "${pkgver//_/-}" ]]; then
36+ echo "packaged neferafk reports version $got, want $pkgver" >&2
37+ exit 1
38+fi
39+
40+if [[ ${DRY_RUN:-} == 1 ]]; then
41+ cat PKGBUILD .SRCINFO
42+ exit 0
43+fi
44+
45+ssh_dir=$HOME/.ssh
46+key=$ssh_dir/aur
47+install -d -m 700 "$ssh_dir"
48+(umask 077 && printf '%s\n' "$AUR_SSH_PRIVATE_KEY" >"$key")
49+# Pinned host key. Fingerprint SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4
50+# is published on https://aur.archlinux.org.
51+echo 'aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN' >"$ssh_dir/known_hosts"
52+export GIT_SSH_COMMAND="ssh -i $key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$ssh_dir/known_hosts"
53+
54+git clone "ssh://aur@aur.archlinux.org/$pkgname.git" aur
55+cp PKGBUILD .SRCINFO aur/
56+cd aur
57+git add PKGBUILD .SRCINFO
58+if git diff --cached --quiet; then
59+ echo "$pkgname $pkgver is already on the AUR"
60+ exit 0
61+fi
62+# Commits are signed with the AUR SSH key.
63+git -c user.name="$AUR_USERNAME" -c user.email="$AUR_EMAIL" \
64+ -c gpg.format=ssh -c user.signingkey="$key" \
65+ commit -S -m "Update to $pkgver"
66+git push origin HEAD:master
@@ -0,0 +1,66 @@
1+#!/usr/bin/env bash
2+# Builds an AUR package with makepkg, then pushes its PKGBUILD and .SRCINFO.
3+# makepkg downloads every source and checks its sha256sum, so a PKGBUILD that
4+# does not build, or does not match its release assets, is never published.
5+#
6+# Usage: publish.sh <pkgname> <PKGBUILD>
7+# Env: AUR_SSH_PRIVATE_KEY, AUR_USERNAME, AUR_EMAIL
8+# DRY_RUN=1 builds and prints the files without pushing.
9+# Runs as a non-root user that may run pacman through sudo (makepkg -s).
10+set -euo pipefail
11+CARCH=$(uname -m)
12+
13+pkgname=$1
14+work=$(mktemp -d)
15+trap 'rm -rf "$work"' EXIT
16+cp "$2" "$work/PKGBUILD"
17+cd "$work"
18+
19+makepkg --syncdeps --force --noconfirm
20+# A -git pkgver() rewrites pkgver in PKGBUILD; .SRCINFO must match it.
21+makepkg --printsrcinfo >.SRCINFO
22+pkgver=$(sed -n 's/^\tpkgver = //p' .SRCINFO)
23+
24+# makepkg only fetches the sources of this machine's arch: check the others too.
25+while read -r arch; do
26+ if [[ $arch == "$CARCH" ]] || ! grep -q "^source_$arch=" PKGBUILD; then
27+ continue
28+ fi
29+ { cat /etc/makepkg.conf; echo "CARCH=$arch"; } >"makepkg-$arch.conf"
30+ makepkg --config "makepkg-$arch.conf" --verifysource --noconfirm
31+done < <(sed -n 's/^\tarch = //p' .SRCINFO)
32+
33+# pacman versions use _ where the tag has - (0.2.0-rc1 -> 0.2.0_rc1).
34+got=$("pkg/$pkgname/usr/bin/neferafk" version)
35+if [[ $got != "$pkgver" && $got != "${pkgver//_/-}" ]]; then
36+ echo "packaged neferafk reports version $got, want $pkgver" >&2
37+ exit 1
38+fi
39+
40+if [[ ${DRY_RUN:-} == 1 ]]; then
41+ cat PKGBUILD .SRCINFO
42+ exit 0
43+fi
44+
45+ssh_dir=$HOME/.ssh
46+key=$ssh_dir/aur
47+install -d -m 700 "$ssh_dir"
48+(umask 077 && printf '%s\n' "$AUR_SSH_PRIVATE_KEY" >"$key")
49+# Pinned host key. Fingerprint SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4
50+# is published on https://aur.archlinux.org.
51+echo 'aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN' >"$ssh_dir/known_hosts"
52+export GIT_SSH_COMMAND="ssh -i $key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$ssh_dir/known_hosts"
53+
54+git clone "ssh://aur@aur.archlinux.org/$pkgname.git" aur
55+cp PKGBUILD .SRCINFO aur/
56+cd aur
57+git add PKGBUILD .SRCINFO
58+if git diff --cached --quiet; then
59+ echo "$pkgname $pkgver is already on the AUR"
60+ exit 0
61+fi
62+# Commits are signed with the AUR SSH key.
63+git -c user.name="$AUR_USERNAME" -c user.email="$AUR_EMAIL" \
64+ -c gpg.format=ssh -c user.signingkey="$key" \
65+ commit -S -m "Update to $pkgver"
66+git push origin HEAD:master

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 2

Tags 9

↑↓ moveenter openesc close