detached c21f374

#1 ci(release): publish neferafk releases on ermite

state
merged · c21f374 · fast-forward
branch
ci/ermite-release → main
opened
bnema ·
updated

Moves neferafk releases to ermite.

  • GoReleaser publishes to git.bnema.dev (templated github_urls, git changelog).
  • neferafk-bin PKGBUILD uses public ermite download URLs (url_template); neferafk-git clones from ermite.
  • Drops attest-build-provenance (GitHub-only); release notes use curl instead of gh.
  • Release jobs are skipped on the GitHub mirror (no duplicate release or AUR push).

Checks: goreleaser check, snapshot build with the CI relay URL (PKGBUILD sources stay public).

CommitSubjectAuthorDateSignatureStatus
c21f374ci(release): publish releases on ermite instead of GitHubbriceGPG Verified

Checks 2

4 files · +22 -20
Unified
UnifiedSplit
2/2
⋯

Merge settings

modes
fast-forward, squash, merge commit
checks
failing or unfinished checks block the merge
M .github/workflows/release.yml +3 -7
@@ -8,7 +8,10 @@ concurrency:
88 group: release-${{ github.ref }}
99 cancel-in-progress: false
1010 jobs:
11+ # Releases are published by ermite (git.bnema.dev); the GitHub mirror
12+ # receives the tags but must not publish a second release or AUR push.
1113 check:
14+ if: github.server_url != 'https://github.com'
1215 uses: ./.github/workflows/ci.yml
1316
1417 release:
@@ -16,8 +19,6 @@ jobs:
1619 runs-on: ubuntu-latest
1720 permissions:
1821 contents: write # create the release
19- id-token: write # sign the provenance attestation
20- attestations: write
2122 steps:
2223 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2324 with:
@@ -33,11 +34,6 @@ jobs:
3334 args: release --clean
3435 env:
3536 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36- - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
37- with:
38- subject-path: |
39- dist/*.tar.gz
40- dist/checksums.txt
4137 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
4238 with:
4339 name: aur-bin
@@ -8,7 +8,10 @@ concurrency:
8 group: release-${{ github.ref }}8 group: release-${{ github.ref }}
9 cancel-in-progress: false9 cancel-in-progress: false
10 jobs:10 jobs:
11+ # Releases are published by ermite (git.bnema.dev); the GitHub mirror
12+ # receives the tags but must not publish a second release or AUR push.
11 check:13 check:
14+ if: github.server_url != 'https://github.com'
12 uses: ./.github/workflows/ci.yml15 uses: ./.github/workflows/ci.yml
13 16
14 release:17 release:
@@ -16,8 +19,6 @@ jobs:
16 runs-on: ubuntu-latest19 runs-on: ubuntu-latest
17 permissions:20 permissions:
18 contents: write # create the release21 contents: write # create the release
19- id-token: write # sign the provenance attestation
20- attestations: write
21 steps:22 steps:
22 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.123 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23 with:24 with:
@@ -33,11 +34,6 @@ jobs:
33 args: release --clean34 args: release --clean
34 env:35 env:
35 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}36 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36- - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
37- with:
38- subject-path: |
39- dist/*.tar.gz
40- dist/checksums.txt
41 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.137 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
42 with:38 with:
43 name: aur-bin39 name: aur-bin
M .goreleaser.yaml +16 -10
@@ -1,10 +1,18 @@
1-# Builds the GitHub release for a pushed v* tag (.github/workflows/release.yml)
1+# Builds the ermite release for a pushed v* tag (.github/workflows/release.yml)
22 # and generates the neferafk-bin PKGBUILD. The workflow verifies that PKGBUILD
33 # with makepkg before it pushes it to the AUR, so GoReleaser never uploads it.
44 version: 2
55
66 project_name: neferafk
77
8+# Releases are published on ermite. In CI the runner sets GITHUB_API_URL and
9+# GITHUB_SERVER_URL to an address the job can reach; the public URLs are the
10+# fallback for a local run.
11+github_urls:
12+ api: '{{ or (index .Env "GITHUB_API_URL") "https://git.bnema.dev/-/github/api" }}/'
13+ upload: '{{ or (index .Env "GITHUB_API_URL") "https://git.bnema.dev/-/github/api" }}/uploads/'
14+ download: '{{ or (index .Env "GITHUB_SERVER_URL") "https://git.bnema.dev" }}/'
15+
816 before:
917 hooks:
1018 - go mod verify
@@ -49,7 +57,7 @@ git:
4957
5058 changelog:
5159 sort: asc
52- use: github
60+ use: git
5361 filters:
5462 exclude:
5563 - "^style(\\([^)]+\\))?:"
@@ -98,21 +106,19 @@ release:
98106 Linux amd64 and arm64. Replace `amd64` with `arm64` on ARM.
99107
100108 ```sh
101- gh release download {{ .Tag }} -R bnema/neferafk -p 'neferafk_{{ .Version }}_linux_amd64.tar.gz' -p checksums.txt
109+ curl -fLO https://git.bnema.dev/neferafk/releases/download/{{ .Tag }}/neferafk_{{ .Version }}_linux_amd64.tar.gz
110+ curl -fLO https://git.bnema.dev/neferafk/releases/download/{{ .Tag }}/checksums.txt
102111 sha256sum -c --ignore-missing checksums.txt
103- gh attestation verify neferafk_{{ .Version }}_linux_amd64.tar.gz -R bnema/neferafk
104112 ```
105113
106- The archive holds the `neferafk` binary, the PAM service file `neferafk.pam` (install it as `/etc/pam.d/neferafk` for password mode), an example config, the README and the license. See the [README](https://github.com/bnema/neferafk#readme) for runtime dependencies.
107- footer: |
108- ---
109-
110- **Full changelog**: https://github.com/bnema/neferafk/compare/{{ .PreviousTag }}...{{ .Tag }}
114+ The archive holds the `neferafk` binary, the PAM service file `neferafk.pam` (install it as `/etc/pam.d/neferafk` for password mode), an example config, the README and the license. See the [README](https://git.bnema.dev/neferafk) for runtime dependencies.
111115
112116 aurs:
113117 - name: neferafk-bin
114118 ids: [neferafk]
115- homepage: https://github.com/bnema/neferafk
119+ homepage: https://git.bnema.dev/neferafk
120+ # Public URL: github_urls.download is the CI-only relay address.
121+ url_template: 'https://git.bnema.dev/neferafk/releases/download/{{ .Tag }}/{{ .ArtifactName }}'
116122 description: "Idle daemon for Wayland: fade, session lock, screens off and suspend"
117123 maintainers:
118124 - "bnema <b at bnema dot dev>"
@@ -1,10 +1,18 @@
1-# Builds the GitHub release for a pushed v* tag (.github/workflows/release.yml)1+# Builds the ermite release for a pushed v* tag (.github/workflows/release.yml)
2 # and generates the neferafk-bin PKGBUILD. The workflow verifies that PKGBUILD2 # and generates the neferafk-bin PKGBUILD. The workflow verifies that PKGBUILD
3 # with makepkg before it pushes it to the AUR, so GoReleaser never uploads it.3 # with makepkg before it pushes it to the AUR, so GoReleaser never uploads it.
4 version: 24 version: 2
5 5
6 project_name: neferafk6 project_name: neferafk
7 7
8+# Releases are published on ermite. In CI the runner sets GITHUB_API_URL and
9+# GITHUB_SERVER_URL to an address the job can reach; the public URLs are the
10+# fallback for a local run.
11+github_urls:
12+ api: '{{ or (index .Env "GITHUB_API_URL") "https://git.bnema.dev/-/github/api" }}/'
13+ upload: '{{ or (index .Env "GITHUB_API_URL") "https://git.bnema.dev/-/github/api" }}/uploads/'
14+ download: '{{ or (index .Env "GITHUB_SERVER_URL") "https://git.bnema.dev" }}/'
15+
8 before:16 before:
9 hooks:17 hooks:
10 - go mod verify18 - go mod verify
@@ -49,7 +57,7 @@ git:
49 57
50 changelog:58 changelog:
51 sort: asc59 sort: asc
52- use: github60+ use: git
53 filters:61 filters:
54 exclude:62 exclude:
55 - "^style(\\([^)]+\\))?:"63 - "^style(\\([^)]+\\))?:"
@@ -98,21 +106,19 @@ release:
98 Linux amd64 and arm64. Replace `amd64` with `arm64` on ARM.106 Linux amd64 and arm64. Replace `amd64` with `arm64` on ARM.
99 107
100 ```sh108 ```sh
101- gh release download {{ .Tag }} -R bnema/neferafk -p 'neferafk_{{ .Version }}_linux_amd64.tar.gz' -p checksums.txt109+ curl -fLO https://git.bnema.dev/neferafk/releases/download/{{ .Tag }}/neferafk_{{ .Version }}_linux_amd64.tar.gz
110+ curl -fLO https://git.bnema.dev/neferafk/releases/download/{{ .Tag }}/checksums.txt
102 sha256sum -c --ignore-missing checksums.txt111 sha256sum -c --ignore-missing checksums.txt
103- gh attestation verify neferafk_{{ .Version }}_linux_amd64.tar.gz -R bnema/neferafk
104 ```112 ```
105 113
106- The archive holds the `neferafk` binary, the PAM service file `neferafk.pam` (install it as `/etc/pam.d/neferafk` for password mode), an example config, the README and the license. See the [README](https://github.com/bnema/neferafk#readme) for runtime dependencies.114+ The archive holds the `neferafk` binary, the PAM service file `neferafk.pam` (install it as `/etc/pam.d/neferafk` for password mode), an example config, the README and the license. See the [README](https://git.bnema.dev/neferafk) for runtime dependencies.
107- footer: |
108- ---
109-
110- **Full changelog**: https://github.com/bnema/neferafk/compare/{{ .PreviousTag }}...{{ .Tag }}
111 115
112 aurs:116 aurs:
113 - name: neferafk-bin117 - name: neferafk-bin
114 ids: [neferafk]118 ids: [neferafk]
115- homepage: https://github.com/bnema/neferafk119+ homepage: https://git.bnema.dev/neferafk
120+ # Public URL: github_urls.download is the CI-only relay address.
121+ url_template: 'https://git.bnema.dev/neferafk/releases/download/{{ .Tag }}/{{ .ArtifactName }}'
116 description: "Idle daemon for Wayland: fade, session lock, screens off and suspend"122 description: "Idle daemon for Wayland: fade, session lock, screens off and suspend"
117 maintainers:123 maintainers:
118 - "bnema <b at bnema dot dev>"124 - "bnema <b at bnema dot dev>"
M README.md +1 -1
@@ -31,7 +31,7 @@ paru -S neferafk-bin # latest release, pre-built
3131 paru -S neferafk-git # latest main, built from source
3232 ```
3333
34-Pre-built archives are on the [releases page](https://github.com/bnema/neferafk/releases). To build from a checkout:
34+Pre-built archives are on the [releases page](https://git.bnema.dev/neferafk/releases). To build from a checkout:
3535
3636 ```sh
3737 CGO_ENABLED=0 go build -o bin/neferafk ./cmd/neferafk # builds bin/neferafk
@@ -31,7 +31,7 @@ paru -S neferafk-bin # latest release, pre-built
31 paru -S neferafk-git # latest main, built from source31 paru -S neferafk-git # latest main, built from source
32 ```32 ```
33 33
34-Pre-built archives are on the [releases page](https://github.com/bnema/neferafk/releases). To build from a checkout:34+Pre-built archives are on the [releases page](https://git.bnema.dev/neferafk/releases). To build from a checkout:
35 35
36 ```sh36 ```sh
37 CGO_ENABLED=0 go build -o bin/neferafk ./cmd/neferafk # builds bin/neferafk37 CGO_ENABLED=0 go build -o bin/neferafk ./cmd/neferafk # builds bin/neferafk
M packaging/aur/neferafk-git/PKGBUILD +2 -2
@@ -6,7 +6,7 @@ pkgver=0.0.0.r0.g0000000
66 pkgrel=1
77 pkgdesc='Idle daemon for Wayland: fade, session lock, screens off and suspend (git version)'
88 arch=('x86_64' 'aarch64')
9-url='https://github.com/bnema/neferafk'
9+url='https://git.bnema.dev/neferafk'
1010 license=('GPL-3.0-only')
1111 # Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
1212 depends=('glibc' 'pam' 'libxkbcommon' 'vulkan-icd-loader' 'vulkan-driver' 'systemd'
@@ -16,7 +16,7 @@ optdepends=('pass: PIN source for auth.mode = pin')
1616 provides=('neferafk')
1717 conflicts=('neferafk' 'neferafk-bin')
1818 backup=('etc/pam.d/neferafk')
19-source=('git+https://github.com/bnema/neferafk.git')
19+source=('git+https://git.bnema.dev/neferafk.git')
2020 sha256sums=('SKIP')
2121
2222 pkgver() {
@@ -6,7 +6,7 @@ pkgver=0.0.0.r0.g0000000
6 pkgrel=16 pkgrel=1
7 pkgdesc='Idle daemon for Wayland: fade, session lock, screens off and suspend (git version)'7 pkgdesc='Idle daemon for Wayland: fade, session lock, screens off and suspend (git version)'
8 arch=('x86_64' 'aarch64')8 arch=('x86_64' 'aarch64')
9-url='https://github.com/bnema/neferafk'9+url='https://git.bnema.dev/neferafk'
10 license=('GPL-3.0-only')10 license=('GPL-3.0-only')
11 # Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.11 # Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
12 depends=('glibc' 'pam' 'libxkbcommon' 'vulkan-icd-loader' 'vulkan-driver' 'systemd'12 depends=('glibc' 'pam' 'libxkbcommon' 'vulkan-icd-loader' 'vulkan-driver' 'systemd'
@@ -16,7 +16,7 @@ optdepends=('pass: PIN source for auth.mode = pin')
16 provides=('neferafk')16 provides=('neferafk')
17 conflicts=('neferafk' 'neferafk-bin')17 conflicts=('neferafk' 'neferafk-bin')
18 backup=('etc/pam.d/neferafk')18 backup=('etc/pam.d/neferafk')
19-source=('git+https://github.com/bnema/neferafk.git')19+source=('git+https://git.bnema.dev/neferafk.git')
20 sha256sums=('SKIP')20 sha256sums=('SKIP')
21 21
22 pkgver() {22 pkgver() {

Comments0 open / 0

no comments yet.

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
l
merge request: the list of files (j k move, enter opens, esc back)
M
merge request: the merge menu; there 1–3 pick the mode, D deletes the branch, enter merges
R
merge request: mark the head read
esc
close a dialog, leave a field

Branches 2

Tags 9

↑↓ moveenter openesc close