release.yml RawHistoryFolder

1name: Release
2on:
3  push:
4    tags: ['v*']
5permissions:
6  contents: read
7concurrency:
8  group: release-${{ github.ref }}
9  cancel-in-progress: false
10jobs:
11  check:
12    uses: ./.github/workflows/ci.yml
13
14  release:
15    needs: check
16    runs-on: ubuntu-latest
17    permissions:
18      contents: write     # create the release
19      id-token: write     # sign the provenance attestation
20      attestations: write
21    steps:
22      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23        with:
24          fetch-depth: 0
25          persist-credentials: false
26      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
27        with:
28          go-version-file: go.mod
29      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
30        with:
31          distribution: goreleaser
32          version: '~> v2'
33          # Snapshot first: the .deb is installed on Ubuntu before anything ships.
34          args: release --snapshot --clean --skip=aur
35      - name: Smoke-test the .deb on Ubuntu LTS
36        run: |
37          for v in 24.04 26.04; do
38            packaging/deb/smoke-test.sh "$v" dist/neferwl_*_amd64.deb
39          done
40      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
41        with:
42          distribution: goreleaser
43          version: '~> v2'
44          args: release --clean
45        env:
46          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
47      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
48        with:
49          subject-path: |
50            dist/*.tar.gz
51            dist/*.deb
52            dist/checksums.txt
53      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
54        with:
55          name: aur-bin
56          path: dist/aur/neferwl-bin.pkgbuild
57          if-no-files-found: error
58
59  # makepkg must run on Arch as a non-root user. publish.sh builds each
60  # package, verifies every source checksum, then pushes it.
61  aur:
62    needs: release
63    runs-on: ubuntu-latest
64    container:
65      image: archlinux:latest
66    strategy:
67      fail-fast: false
68      matrix:
69        pkg: [neferwl-bin, neferwl-git]
70    # Pre-releases (v0.2.0-rc1) stay off the AUR: pacman sorts 0.2.0.rc1
71    # after 0.2.0, so the final release would not look like an upgrade.
72    env:
73      SKIP: ${{ contains(github.ref_name, '-') }}
74    steps:
75      - run: >-
76          pacman -Syu --noconfirm --needed
77          base-devel git openssh sudo
78      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
79        with:
80          persist-credentials: false
81      - if: matrix.pkg == 'neferwl-bin' && env.SKIP != 'true'
82        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
83        with:
84          name: aur-bin
85          path: aur-bin
86      - name: Create the build user
87        run: |
88          useradd -m builder
89          echo 'builder ALL=(root) NOPASSWD: /usr/bin/pacman' >/etc/sudoers.d/builder
90      - name: Build, verify and publish ${{ matrix.pkg }}
91        if: env.SKIP != 'true'
92        env:
93          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
94          AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
95          AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
96          PKG: ${{ matrix.pkg }}
97        run: |
98          if [ "$PKG" = neferwl-bin ]; then
99            pkgbuild=aur-bin/neferwl-bin.pkgbuild
100          else
101            pkgbuild=packaging/aur/neferwl-git/PKGBUILD
102          fi
103          chmod -R a+rX "$GITHUB_WORKSPACE"
104          sudo -u builder --preserve-env=AUR_SSH_PRIVATE_KEY,AUR_USERNAME,AUR_EMAIL \
105            packaging/aur/publish.sh "$PKG" "$pkgbuild"