ci: publish releases to GitHub and the AUR

commit: bde06e700086cf77aa9a7b60157bae19baf490b0
author: brice · 21d ago · 2026-10-01 02:58 UTC
committer: brice · 21d ago · 2026-10-01 03:03 UTC
parent: 351864e
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

4 files · +347 -0

A .github/workflows/release.yml +93 -0

@@ -0,0 +1,93 @@
	1	+	name: Release
	2	+	on:
	3	+	push:
	4	+	tags: ['v*']
	5	+	permissions:
	6	+	contents: read
	7	+	concurrency:
	8	+	group: release-${{ github.ref }}
	9	+	cancel-in-progress: false
	10	+	jobs:
	11	+	check:
	12	+	uses: ./.github/workflows/ci.yml
	13	+
	14	+	release:
	15	+	needs: check
	16	+	runs-on: ubuntu-latest
	17	+	permissions:
	18	+	contents: write # create the release
	19	+	id-token: write # sign the provenance attestation
	20	+	attestations: write
	21	+	steps:
	22	+	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	23	+	with:
	24	+	fetch-depth: 0
	25	+	persist-credentials: false
	26	+	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	27	+	with:
	28	+	go-version-file: go.mod
	29	+	- uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
	30	+	with:
	31	+	distribution: goreleaser
	32	+	version: '~> v2'
	33	+	args: release --clean
	34	+	env:
	35	+	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	36	+	- uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
	37	+	with:
	38	+	subject-path: \|
	39	+	dist/*.tar.gz
	40	+	dist/checksums.txt
	41	+	- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	42	+	with:
	43	+	name: aur-bin
	44	+	path: dist/aur/nefercap-bin.pkgbuild
	45	+	if-no-files-found: error
	46	+
	47	+	# makepkg must run on Arch as a non-root user. publish.sh builds each
	48	+	# package, verifies every source checksum, then pushes it.
	49	+	aur:
	50	+	needs: release
	51	+	runs-on: ubuntu-latest
	52	+	container:
	53	+	image: archlinux:latest
	54	+	strategy:
	55	+	fail-fast: false
	56	+	matrix:
	57	+	pkg: [nefercap-bin, nefercap-git]
	58	+	# Pre-releases (v0.2.0-rc1) stay off the AUR: pacman sorts 0.2.0.rc1
	59	+	# after 0.2.0, so the final release would not look like an upgrade.
	60	+	env:
	61	+	SKIP: ${{ contains(github.ref_name, '-') }}
	62	+	steps:
	63	+	- run: >-
	64	+	pacman -Syu --noconfirm --needed
	65	+	base-devel git openssh sudo
	66	+	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	67	+	with:
	68	+	persist-credentials: false
	69	+	- if: matrix.pkg == 'nefercap-bin' && env.SKIP != 'true'
	70	+	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	71	+	with:
	72	+	name: aur-bin
	73	+	path: aur-bin
	74	+	- name: Create the build user
	75	+	run: \|
	76	+	useradd -m builder
	77	+	echo 'builder ALL=(root) NOPASSWD: /usr/bin/pacman' >/etc/sudoers.d/builder
	78	+	- name: Build, verify and publish ${{ matrix.pkg }}
	79	+	if: env.SKIP != 'true'
	80	+	env:
	81	+	AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
	82	+	AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
	83	+	AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
	84	+	PKG: ${{ matrix.pkg }}
	85	+	run: \|
	86	+	if [ "$PKG" = nefercap-bin ]; then
	87	+	pkgbuild=aur-bin/nefercap-bin.pkgbuild
	88	+	else
	89	+	pkgbuild=packaging/aur/nefercap-git/PKGBUILD
	90	+	fi
	91	+	chmod -R a+rX "$GITHUB_WORKSPACE"
	92	+	sudo -u builder --preserve-env=AUR_SSH_PRIVATE_KEY,AUR_USERNAME,AUR_EMAIL \
	93	+	packaging/aur/publish.sh "$PKG" "$pkgbuild"

@@ -0,0 +1,93 @@
	1	+	name: Release
	2	+	on:
	3	+	push:
	4	+	tags: ['v*']
	5	+	permissions:
	6	+	contents: read
	7	+	concurrency:
	8	+	group: release-${{ github.ref }}
	9	+	cancel-in-progress: false
	10	+	jobs:
	11	+	check:
	12	+	uses: ./.github/workflows/ci.yml
	13	+
	14	+	release:
	15	+	needs: check
	16	+	runs-on: ubuntu-latest
	17	+	permissions:
	18	+	contents: write # create the release
	19	+	id-token: write # sign the provenance attestation
	20	+	attestations: write
	21	+	steps:
	22	+	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	23	+	with:
	24	+	fetch-depth: 0
	25	+	persist-credentials: false
	26	+	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	27	+	with:
	28	+	go-version-file: go.mod
	29	+	- uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
	30	+	with:
	31	+	distribution: goreleaser
	32	+	version: '~> v2'
	33	+	args: release --clean
	34	+	env:
	35	+	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	36	+	- uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
	37	+	with:
	38	+	subject-path: \|
	39	+	dist/*.tar.gz
	40	+	dist/checksums.txt
	41	+	- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	42	+	with:
	43	+	name: aur-bin
	44	+	path: dist/aur/nefercap-bin.pkgbuild
	45	+	if-no-files-found: error
	46	+
	47	+	# makepkg must run on Arch as a non-root user. publish.sh builds each
	48	+	# package, verifies every source checksum, then pushes it.
	49	+	aur:
	50	+	needs: release
	51	+	runs-on: ubuntu-latest
	52	+	container:
	53	+	image: archlinux:latest
	54	+	strategy:
	55	+	fail-fast: false
	56	+	matrix:
	57	+	pkg: [nefercap-bin, nefercap-git]
	58	+	# Pre-releases (v0.2.0-rc1) stay off the AUR: pacman sorts 0.2.0.rc1
	59	+	# after 0.2.0, so the final release would not look like an upgrade.
	60	+	env:
	61	+	SKIP: ${{ contains(github.ref_name, '-') }}
	62	+	steps:
	63	+	- run: >-
	64	+	pacman -Syu --noconfirm --needed
	65	+	base-devel git openssh sudo
	66	+	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	67	+	with:
	68	+	persist-credentials: false
	69	+	- if: matrix.pkg == 'nefercap-bin' && env.SKIP != 'true'
	70	+	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	71	+	with:
	72	+	name: aur-bin
	73	+	path: aur-bin
	74	+	- name: Create the build user
	75	+	run: \|
	76	+	useradd -m builder
	77	+	echo 'builder ALL=(root) NOPASSWD: /usr/bin/pacman' >/etc/sudoers.d/builder
	78	+	- name: Build, verify and publish ${{ matrix.pkg }}
	79	+	if: env.SKIP != 'true'
	80	+	env:
	81	+	AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
	82	+	AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
	83	+	AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
	84	+	PKG: ${{ matrix.pkg }}
	85	+	run: \|
	86	+	if [ "$PKG" = nefercap-bin ]; then
	87	+	pkgbuild=aur-bin/nefercap-bin.pkgbuild
	88	+	else
	89	+	pkgbuild=packaging/aur/nefercap-git/PKGBUILD
	90	+	fi
	91	+	chmod -R a+rX "$GITHUB_WORKSPACE"
	92	+	sudo -u builder --preserve-env=AUR_SSH_PRIVATE_KEY,AUR_USERNAME,AUR_EMAIL \
	93	+	packaging/aur/publish.sh "$PKG" "$pkgbuild"

A .goreleaser.yaml +136 -0

@@ -0,0 +1,136 @@
	1	+	# Builds the GitHub release for a pushed v* tag (.github/workflows/release.yml)
	2	+	# and generates the nefercap-bin PKGBUILD. The workflow verifies that PKGBUILD
	3	+	# with makepkg before it pushes it to the AUR, so GoReleaser never uploads it.
	4	+	version: 2
	5	+
	6	+	project_name: nefercap
	7	+
	8	+	before:
	9	+	hooks:
	10	+	- go mod verify
	11	+
	12	+	builds:
	13	+	- id: nefercap
	14	+	main: ./cmd/nefercap
	15	+	binary: nefercap
	16	+	env:
	17	+	- CGO_ENABLED=0
	18	+	goos: [linux]
	19	+	goarch: [amd64, arm64]
	20	+	flags:
	21	+	- -trimpath
	22	+	- -buildmode=pie
	23	+	ldflags:
	24	+	- -s -w -X main.version={{ .Version }}
	25	+	# Same inputs give the same binary.
	26	+	mod_timestamp: "{{ .CommitTimestamp }}"
	27	+
	28	+	archives:
	29	+	- id: nefercap
	30	+	ids: [nefercap]
	31	+	name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
	32	+	formats: [tar.gz]
	33	+	# Everything the PKGBUILD package() installs, at the paths of the repo.
	34	+	files:
	35	+	- LICENSE
	36	+	- README.md
	37	+
	38	+	checksum:
	39	+	name_template: checksums.txt
	40	+	algorithm: sha256
	41	+
	42	+	snapshot:
	43	+	version_template: "{{ incpatch .Version }}-next"
	44	+
	45	+	git:
	46	+	tag_sort: -version:refname
	47	+
	48	+	changelog:
	49	+	sort: asc
	50	+	use: github
	51	+	filters:
	52	+	exclude:
	53	+	- "^style(\$[^)]+\$)?:"
	54	+	- "^test(\$[^)]+\$)?:"
	55	+	groups:
	56	+	- title: Added
	57	+	regexp: "^feat(\$[^)]+\$)?!?:"
	58	+	order: 0
	59	+	- title: Fixed
	60	+	regexp: "^fix(\$[^)]+\$)?!?:"
	61	+	order: 1
	62	+	- title: Performance
	63	+	regexp: "^perf(\$[^)]+\$)?!?:"
	64	+	order: 2
	65	+	- title: Changed
	66	+	regexp: "^(refactor\|build)(\$[^)]+\$)?!?:"
	67	+	order: 3
	68	+	- title: Documentation
	69	+	regexp: "^docs(\$[^)]+\$)?!?:"
	70	+	order: 4
	71	+	- title: Maintenance
	72	+	regexp: "^(chore\|ci)(\$[^)]+\$)?!?:"
	73	+	order: 5
	74	+	- title: Other changes
	75	+	order: 999
	76	+
	77	+	release:
	78	+	github:
	79	+	owner: bnema
	80	+	name: nefercap
	81	+	draft: false
	82	+	prerelease: auto
	83	+	mode: replace
	84	+	header: \|
	85	+	## nefercap {{ .Tag }}
	86	+
	87	+	### Install on Arch Linux
	88	+
	89	+	```sh
	90	+	paru -S nefercap-bin # this release, pre-built (x86_64, aarch64)
	91	+	paru -S nefercap-git # latest main, built from source
	92	+	```
	93	+
	94	+	### Install the pre-built archive
	95	+
	96	+	Linux amd64 and arm64. Replace `amd64` with `arm64` on ARM.
	97	+
	98	+	```sh
	99	+	gh release download {{ .Tag }} -R bnema/nefercap -p 'nefercap_{{ .Version }}_linux_amd64.tar.gz' -p checksums.txt
	100	+	sha256sum -c --ignore-missing checksums.txt
	101	+	gh attestation verify nefercap_{{ .Version }}_linux_amd64.tar.gz -R bnema/nefercap
	102	+	```
	103	+
	104	+	The archive holds the `nefercap` binary, the README and the license. Install the binary as `/usr/bin/nefercap`: NeferWL allows that path to capture by default. See the [README](https://github.com/bnema/nefercap#readme) for runtime dependencies.
	105	+	footer: \|
	106	+	---
	107	+
	108	+	Full changelog: https://github.com/bnema/nefercap/compare/{{ .PreviousTag }}...{{ .Tag }}
	109	+
	110	+	aurs:
	111	+	- name: nefercap-bin
	112	+	ids: [nefercap]
	113	+	homepage: https://github.com/bnema/nefercap
	114	+	description: Screenshots and silent screen recording for Wayland, from one shortcut
	115	+	maintainers:
	116	+	- "bnema <b at bnema dot dev>"
	117	+	license: GPL-3.0-only
	118	+	# The release workflow verifies and publishes the generated PKGBUILD.
	119	+	skip_upload: true
	120	+	provides: [nefercap]
	121	+	conflicts: [nefercap, nefercap-git]
	122	+	# Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
	123	+	depends:
	124	+	- glibc
	125	+	- wayland
	126	+	- libxkbcommon
	127	+	- vulkan-icd-loader
	128	+	- vulkan-driver
	129	+	optdepends:
	130	+	- "ffmpeg: screen recording (libx264)"
	131	+	- "wl-clipboard: copy screenshots to the clipboard"
	132	+	- "neferwl: hidden-workspace capture, HUD exclusion and capture indicator"
	133	+	package: \|-
	134	+	install -Dm755 ./nefercap "${pkgdir}/usr/bin/nefercap"
	135	+	install -Dm644 ./README.md "${pkgdir}/usr/share/doc/nefercap/README.md"
	136	+	install -Dm644 ./LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"

@@ -0,0 +1,136 @@
	1	+	# Builds the GitHub release for a pushed v* tag (.github/workflows/release.yml)
	2	+	# and generates the nefercap-bin PKGBUILD. The workflow verifies that PKGBUILD
	3	+	# with makepkg before it pushes it to the AUR, so GoReleaser never uploads it.
	4	+	version: 2
	5	+
	6	+	project_name: nefercap
	7	+
	8	+	before:
	9	+	hooks:
	10	+	- go mod verify
	11	+
	12	+	builds:
	13	+	- id: nefercap
	14	+	main: ./cmd/nefercap
	15	+	binary: nefercap
	16	+	env:
	17	+	- CGO_ENABLED=0
	18	+	goos: [linux]
	19	+	goarch: [amd64, arm64]
	20	+	flags:
	21	+	- -trimpath
	22	+	- -buildmode=pie
	23	+	ldflags:
	24	+	- -s -w -X main.version={{ .Version }}
	25	+	# Same inputs give the same binary.
	26	+	mod_timestamp: "{{ .CommitTimestamp }}"
	27	+
	28	+	archives:
	29	+	- id: nefercap
	30	+	ids: [nefercap]
	31	+	name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
	32	+	formats: [tar.gz]
	33	+	# Everything the PKGBUILD package() installs, at the paths of the repo.
	34	+	files:
	35	+	- LICENSE
	36	+	- README.md
	37	+
	38	+	checksum:
	39	+	name_template: checksums.txt
	40	+	algorithm: sha256
	41	+
	42	+	snapshot:
	43	+	version_template: "{{ incpatch .Version }}-next"
	44	+
	45	+	git:
	46	+	tag_sort: -version:refname
	47	+
	48	+	changelog:
	49	+	sort: asc
	50	+	use: github
	51	+	filters:
	52	+	exclude:
	53	+	- "^style(\$[^)]+\$)?:"
	54	+	- "^test(\$[^)]+\$)?:"
	55	+	groups:
	56	+	- title: Added
	57	+	regexp: "^feat(\$[^)]+\$)?!?:"
	58	+	order: 0
	59	+	- title: Fixed
	60	+	regexp: "^fix(\$[^)]+\$)?!?:"
	61	+	order: 1
	62	+	- title: Performance
	63	+	regexp: "^perf(\$[^)]+\$)?!?:"
	64	+	order: 2
	65	+	- title: Changed
	66	+	regexp: "^(refactor\|build)(\$[^)]+\$)?!?:"
	67	+	order: 3
	68	+	- title: Documentation
	69	+	regexp: "^docs(\$[^)]+\$)?!?:"
	70	+	order: 4
	71	+	- title: Maintenance
	72	+	regexp: "^(chore\|ci)(\$[^)]+\$)?!?:"
	73	+	order: 5
	74	+	- title: Other changes
	75	+	order: 999
	76	+
	77	+	release:
	78	+	github:
	79	+	owner: bnema
	80	+	name: nefercap
	81	+	draft: false
	82	+	prerelease: auto
	83	+	mode: replace
	84	+	header: \|
	85	+	## nefercap {{ .Tag }}
	86	+
	87	+	### Install on Arch Linux
	88	+
	89	+	```sh
	90	+	paru -S nefercap-bin # this release, pre-built (x86_64, aarch64)
	91	+	paru -S nefercap-git # latest main, built from source
	92	+	```
	93	+
	94	+	### Install the pre-built archive
	95	+
	96	+	Linux amd64 and arm64. Replace `amd64` with `arm64` on ARM.
	97	+
	98	+	```sh
	99	+	gh release download {{ .Tag }} -R bnema/nefercap -p 'nefercap_{{ .Version }}_linux_amd64.tar.gz' -p checksums.txt
	100	+	sha256sum -c --ignore-missing checksums.txt
	101	+	gh attestation verify nefercap_{{ .Version }}_linux_amd64.tar.gz -R bnema/nefercap
	102	+	```
	103	+
	104	+	The archive holds the `nefercap` binary, the README and the license. Install the binary as `/usr/bin/nefercap`: NeferWL allows that path to capture by default. See the [README](https://github.com/bnema/nefercap#readme) for runtime dependencies.
	105	+	footer: \|
	106	+	---
	107	+
	108	+	Full changelog: https://github.com/bnema/nefercap/compare/{{ .PreviousTag }}...{{ .Tag }}
	109	+
	110	+	aurs:
	111	+	- name: nefercap-bin
	112	+	ids: [nefercap]
	113	+	homepage: https://github.com/bnema/nefercap
	114	+	description: Screenshots and silent screen recording for Wayland, from one shortcut
	115	+	maintainers:
	116	+	- "bnema <b at bnema dot dev>"
	117	+	license: GPL-3.0-only
	118	+	# The release workflow verifies and publishes the generated PKGBUILD.
	119	+	skip_upload: true
	120	+	provides: [nefercap]
	121	+	conflicts: [nefercap, nefercap-git]
	122	+	# Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
	123	+	depends:
	124	+	- glibc
	125	+	- wayland
	126	+	- libxkbcommon
	127	+	- vulkan-icd-loader
	128	+	- vulkan-driver
	129	+	optdepends:
	130	+	- "ffmpeg: screen recording (libx264)"
	131	+	- "wl-clipboard: copy screenshots to the clipboard"
	132	+	- "neferwl: hidden-workspace capture, HUD exclusion and capture indicator"
	133	+	package: \|-
	134	+	install -Dm755 ./nefercap "${pkgdir}/usr/bin/nefercap"
	135	+	install -Dm644 ./README.md "${pkgdir}/usr/share/doc/nefercap/README.md"
	136	+	install -Dm644 ./LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"

A packaging/aur/nefercap-git/PKGBUILD +52 -0

@@ -0,0 +1,52 @@
	1	+	# Maintainer: bnema <b at bnema dot dev>
	2	+	# The release workflow sets pkgver and publishes this file to the AUR on every
	3	+	# release tag, so the AUR version never falls behind the latest tag.
	4	+	pkgname=nefercap-git
	5	+	pkgver=0.0.0.r0.g0000000
	6	+	pkgrel=1
	7	+	pkgdesc='Screenshots and silent screen recording for Wayland, from one shortcut (git version)'
	8	+	arch=('x86_64' 'aarch64')
	9	+	url='https://github.com/bnema/nefercap'
	10	+	license=('GPL-3.0-only')
	11	+	# Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
	12	+	depends=('glibc' 'wayland' 'libxkbcommon' 'vulkan-icd-loader' 'vulkan-driver')
	13	+	makedepends=('go>=2:1.27' 'git')
	14	+	optdepends=('ffmpeg: screen recording (libx264)'
	15	+	'wl-clipboard: copy screenshots to the clipboard'
	16	+	'neferwl: hidden-workspace capture, HUD exclusion and capture indicator')
	17	+	provides=('nefercap')
	18	+	conflicts=('nefercap' 'nefercap-bin')
	19	+	source=('git+https://github.com/bnema/nefercap.git')
	20	+	sha256sums=('SKIP')
	21	+
	22	+	pkgver() {
	23	+	cd nefercap
	24	+	# v0.2.0-5-gabc1234 -> 0.2.0.r5.gabc1234. Pre-release tags (v0.3.0-rc1)
	25	+	# are skipped: pacman sorts 0.3.0.rc1 after 0.3.0.
	26	+	git describe --long --tags --abbrev=7 --exclude='-' \| sed 's/^v//;s/$[^-]*-g$/r\1/;s/-/./g'
	27	+	}
	28	+
	29	+	prepare() {
	30	+	cd nefercap
	31	+	export GOPATH="$srcdir/gopath" GOFLAGS='-mod=readonly -modcacherw' GOTOOLCHAIN=local
	32	+	go mod download
	33	+	}
	34	+
	35	+	build() {
	36	+	cd nefercap
	37	+	export GOPATH="$srcdir/gopath" CGO_ENABLED=0 GOTOOLCHAIN=local GOPROXY=off
	38	+	export GOFLAGS='-mod=readonly -modcacherw -trimpath -buildvcs=false -buildmode=pie'
	39	+	go build -ldflags "-X main.version=$pkgver" -o nefercap ./cmd/nefercap
	40	+	}
	41	+
	42	+	check() {
	43	+	cd nefercap
	44	+	./nefercap version
	45	+	}
	46	+
	47	+	package() {
	48	+	cd nefercap
	49	+	install -Dm755 nefercap "$pkgdir/usr/bin/nefercap"
	50	+	install -Dm644 README.md "$pkgdir/usr/share/doc/nefercap/README.md"
	51	+	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
	52	+	}

@@ -0,0 +1,52 @@
	1	+	# Maintainer: bnema <b at bnema dot dev>
	2	+	# The release workflow sets pkgver and publishes this file to the AUR on every
	3	+	# release tag, so the AUR version never falls behind the latest tag.
	4	+	pkgname=nefercap-git
	5	+	pkgver=0.0.0.r0.g0000000
	6	+	pkgrel=1
	7	+	pkgdesc='Screenshots and silent screen recording for Wayland, from one shortcut (git version)'
	8	+	arch=('x86_64' 'aarch64')
	9	+	url='https://github.com/bnema/nefercap'
	10	+	license=('GPL-3.0-only')
	11	+	# Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
	12	+	depends=('glibc' 'wayland' 'libxkbcommon' 'vulkan-icd-loader' 'vulkan-driver')
	13	+	makedepends=('go>=2:1.27' 'git')
	14	+	optdepends=('ffmpeg: screen recording (libx264)'
	15	+	'wl-clipboard: copy screenshots to the clipboard'
	16	+	'neferwl: hidden-workspace capture, HUD exclusion and capture indicator')
	17	+	provides=('nefercap')
	18	+	conflicts=('nefercap' 'nefercap-bin')
	19	+	source=('git+https://github.com/bnema/nefercap.git')
	20	+	sha256sums=('SKIP')
	21	+
	22	+	pkgver() {
	23	+	cd nefercap
	24	+	# v0.2.0-5-gabc1234 -> 0.2.0.r5.gabc1234. Pre-release tags (v0.3.0-rc1)
	25	+	# are skipped: pacman sorts 0.3.0.rc1 after 0.3.0.
	26	+	git describe --long --tags --abbrev=7 --exclude='-' \| sed 's/^v//;s/$[^-]*-g$/r\1/;s/-/./g'
	27	+	}
	28	+
	29	+	prepare() {
	30	+	cd nefercap
	31	+	export GOPATH="$srcdir/gopath" GOFLAGS='-mod=readonly -modcacherw' GOTOOLCHAIN=local
	32	+	go mod download
	33	+	}
	34	+
	35	+	build() {
	36	+	cd nefercap
	37	+	export GOPATH="$srcdir/gopath" CGO_ENABLED=0 GOTOOLCHAIN=local GOPROXY=off
	38	+	export GOFLAGS='-mod=readonly -modcacherw -trimpath -buildvcs=false -buildmode=pie'
	39	+	go build -ldflags "-X main.version=$pkgver" -o nefercap ./cmd/nefercap
	40	+	}
	41	+
	42	+	check() {
	43	+	cd nefercap
	44	+	./nefercap version
	45	+	}
	46	+
	47	+	package() {
	48	+	cd nefercap
	49	+	install -Dm755 nefercap "$pkgdir/usr/bin/nefercap"
	50	+	install -Dm644 README.md "$pkgdir/usr/share/doc/nefercap/README.md"
	51	+	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
	52	+	}

A packaging/aur/publish.sh +66 -0

@@ -0,0 +1,66 @@
	1	+	#!/usr/bin/env bash
	2	+	# Builds an AUR package with makepkg, then pushes its PKGBUILD and .SRCINFO.
	3	+	# makepkg downloads every source and checks its sha256sum, so a PKGBUILD that
	4	+	# does not build, or does not match its release assets, is never published.
	5	+	#
	6	+	# Usage: publish.sh <pkgname> <PKGBUILD>
	7	+	# Env: AUR_SSH_PRIVATE_KEY, AUR_USERNAME, AUR_EMAIL
	8	+	# DRY_RUN=1 builds and prints the files without pushing.
	9	+	# Runs as a non-root user that may run pacman through sudo (makepkg -s).
	10	+	set -euo pipefail
	11	+	CARCH=$(uname -m)
	12	+
	13	+	pkgname=$1
	14	+	work=$(mktemp -d)
	15	+	trap 'rm -rf "$work"' EXIT
	16	+	cp "$2" "$work/PKGBUILD"
	17	+	cd "$work"
	18	+
	19	+	makepkg --syncdeps --force --noconfirm
	20	+	# A -git pkgver() rewrites pkgver in PKGBUILD; .SRCINFO must match it.
	21	+	makepkg --printsrcinfo >.SRCINFO
	22	+	pkgver=$(sed -n 's/^\tpkgver = //p' .SRCINFO)
	23	+
	24	+	# makepkg only fetches the sources of this machine's arch: check the others too.
	25	+	while read -r arch; do
	26	+	if [[ $arch == "$CARCH" ]] \|\| ! grep -q "^source_$arch=" PKGBUILD; then
	27	+	continue
	28	+	fi
	29	+	{ cat /etc/makepkg.conf; echo "CARCH=$arch"; } >"makepkg-$arch.conf"
	30	+	makepkg --config "makepkg-$arch.conf" --verifysource --noconfirm
	31	+	done < <(sed -n 's/^\tarch = //p' .SRCINFO)
	32	+
	33	+	# pacman versions use _ where the tag has - (0.2.0-rc1 -> 0.2.0_rc1).
	34	+	got=$("pkg/$pkgname/usr/bin/nefercap" version)
	35	+	if [[ $got != "$pkgver" && $got != "${pkgver//_/-}" ]]; then
	36	+	echo "packaged nefercap reports version $got, want $pkgver" >&2
	37	+	exit 1
	38	+	fi
	39	+
	40	+	if [[ ${DRY_RUN:-} == 1 ]]; then
	41	+	cat PKGBUILD .SRCINFO
	42	+	exit 0
	43	+	fi
	44	+
	45	+	ssh_dir=$HOME/.ssh
	46	+	key=$ssh_dir/aur
	47	+	install -d -m 700 "$ssh_dir"
	48	+	(umask 077 && printf '%s\n' "$AUR_SSH_PRIVATE_KEY" >"$key")
	49	+	# Pinned host key. Fingerprint SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4
	50	+	# is published on https://aur.archlinux.org.
	51	+	echo 'aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN' >"$ssh_dir/known_hosts"
	52	+	export GIT_SSH_COMMAND="ssh -i $key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$ssh_dir/known_hosts"
	53	+
	54	+	git clone "ssh://aur@aur.archlinux.org/$pkgname.git" aur
	55	+	cp PKGBUILD .SRCINFO aur/
	56	+	cd aur
	57	+	git add PKGBUILD .SRCINFO
	58	+	if git diff --cached --quiet; then
	59	+	echo "$pkgname $pkgver is already on the AUR"
	60	+	exit 0
	61	+	fi
	62	+	# Commits are signed with the AUR SSH key.
	63	+	git -c user.name="$AUR_USERNAME" -c user.email="$AUR_EMAIL" \
	64	+	-c gpg.format=ssh -c user.signingkey="$key" \
	65	+	commit -S -m "Update to $pkgver"
	66	+	git push origin HEAD:master

@@ -0,0 +1,66 @@
	1	+	#!/usr/bin/env bash
	2	+	# Builds an AUR package with makepkg, then pushes its PKGBUILD and .SRCINFO.
	3	+	# makepkg downloads every source and checks its sha256sum, so a PKGBUILD that
	4	+	# does not build, or does not match its release assets, is never published.
	5	+	#
	6	+	# Usage: publish.sh <pkgname> <PKGBUILD>
	7	+	# Env: AUR_SSH_PRIVATE_KEY, AUR_USERNAME, AUR_EMAIL
	8	+	# DRY_RUN=1 builds and prints the files without pushing.
	9	+	# Runs as a non-root user that may run pacman through sudo (makepkg -s).
	10	+	set -euo pipefail
	11	+	CARCH=$(uname -m)
	12	+
	13	+	pkgname=$1
	14	+	work=$(mktemp -d)
	15	+	trap 'rm -rf "$work"' EXIT
	16	+	cp "$2" "$work/PKGBUILD"
	17	+	cd "$work"
	18	+
	19	+	makepkg --syncdeps --force --noconfirm
	20	+	# A -git pkgver() rewrites pkgver in PKGBUILD; .SRCINFO must match it.
	21	+	makepkg --printsrcinfo >.SRCINFO
	22	+	pkgver=$(sed -n 's/^\tpkgver = //p' .SRCINFO)
	23	+
	24	+	# makepkg only fetches the sources of this machine's arch: check the others too.
	25	+	while read -r arch; do
	26	+	if [[ $arch == "$CARCH" ]] \|\| ! grep -q "^source_$arch=" PKGBUILD; then
	27	+	continue
	28	+	fi
	29	+	{ cat /etc/makepkg.conf; echo "CARCH=$arch"; } >"makepkg-$arch.conf"
	30	+	makepkg --config "makepkg-$arch.conf" --verifysource --noconfirm
	31	+	done < <(sed -n 's/^\tarch = //p' .SRCINFO)
	32	+
	33	+	# pacman versions use _ where the tag has - (0.2.0-rc1 -> 0.2.0_rc1).
	34	+	got=$("pkg/$pkgname/usr/bin/nefercap" version)
	35	+	if [[ $got != "$pkgver" && $got != "${pkgver//_/-}" ]]; then
	36	+	echo "packaged nefercap reports version $got, want $pkgver" >&2
	37	+	exit 1
	38	+	fi
	39	+
	40	+	if [[ ${DRY_RUN:-} == 1 ]]; then
	41	+	cat PKGBUILD .SRCINFO
	42	+	exit 0
	43	+	fi
	44	+
	45	+	ssh_dir=$HOME/.ssh
	46	+	key=$ssh_dir/aur
	47	+	install -d -m 700 "$ssh_dir"
	48	+	(umask 077 && printf '%s\n' "$AUR_SSH_PRIVATE_KEY" >"$key")
	49	+	# Pinned host key. Fingerprint SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4
	50	+	# is published on https://aur.archlinux.org.
	51	+	echo 'aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN' >"$ssh_dir/known_hosts"
	52	+	export GIT_SSH_COMMAND="ssh -i $key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$ssh_dir/known_hosts"
	53	+
	54	+	git clone "ssh://aur@aur.archlinux.org/$pkgname.git" aur
	55	+	cp PKGBUILD .SRCINFO aur/
	56	+	cd aur
	57	+	git add PKGBUILD .SRCINFO
	58	+	if git diff --cached --quiet; then
	59	+	echo "$pkgname $pkgver is already on the AUR"
	60	+	exit 0
	61	+	fi
	62	+	# Commits are signed with the AUR SSH key.
	63	+	git -c user.name="$AUR_USERNAME" -c user.email="$AUR_EMAIL" \
	64	+	-c gpg.format=ssh -c user.signingkey="$key" \
	65	+	commit -S -m "Update to $pkgver"
	66	+	git push origin HEAD:master