release.yml RawHistoryFolder

1name: Release
2on:
3  push:
4    tags: ['v*']
5permissions:
6  contents: read
7concurrency:
8  group: release-${{ github.ref }}
9  cancel-in-progress: false
10jobs:
11  # Releases are published by ermite (git.bnema.dev); the GitHub mirror
12  # receives the tags but must not publish a second release or AUR push.
13  check:
14    if: github.server_url != 'https://github.com'
15    uses: ./.github/workflows/ci.yml
16
17  release:
18    needs: check
19    runs-on: ubuntu-latest
20    permissions:
21      contents: write     # create the release
22    steps:
23      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
24        with:
25          fetch-depth: 0
26          persist-credentials: false
27      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
28        with:
29          go-version-file: go.mod
30      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
31        with:
32          distribution: goreleaser
33          version: '~> v2'
34          args: release --clean
35        env:
36          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
37      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
38        with:
39          name: aur-bin
40          path: dist/aur/neferbar-bin.pkgbuild
41          if-no-files-found: error
42
43  # makepkg must run on Arch as a non-root user. publish.sh builds each
44  # package, verifies every source checksum, then pushes it.
45  aur:
46    needs: release
47    runs-on: ubuntu-latest
48    container:
49      image: archlinux:latest
50    strategy:
51      fail-fast: false
52      matrix:
53        pkg: [neferbar-bin, neferbar-git]
54    # Pre-releases (v0.2.0-rc1) stay off the AUR: pacman sorts 0.2.0.rc1
55    # after 0.2.0, so the final release would not look like an upgrade.
56    env:
57      SKIP: ${{ contains(github.ref_name, '-') }}
58    steps:
59      - run: >-
60          pacman -Syu --noconfirm --needed
61          base-devel git openssh sudo
62      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
63        with:
64          persist-credentials: false
65      - if: matrix.pkg == 'neferbar-bin' && env.SKIP != 'true'
66        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
67        with:
68          name: aur-bin
69          path: aur-bin
70      - name: Create the build user
71        run: |
72          useradd -m builder
73          echo 'builder ALL=(root) NOPASSWD: /usr/bin/pacman' >/etc/sudoers.d/builder
74      - name: Build, verify and publish ${{ matrix.pkg }}
75        if: env.SKIP != 'true'
76        env:
77          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
78          AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
79          AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
80          PKG: ${{ matrix.pkg }}
81        run: |
82          if [ "$PKG" = neferbar-bin ]; then
83            pkgbuild=aur-bin/neferbar-bin.pkgbuild
84          else
85            pkgbuild=packaging/aur/neferbar-git/PKGBUILD
86          fi
87          chmod -R a+rX "$GITHUB_WORKSPACE"
88          sudo -u builder --preserve-env=AUR_SSH_PRIVATE_KEY,AUR_USERNAME,AUR_EMAIL \
89            packaging/aur/publish.sh "$PKG" "$pkgbuild"