release.yml RawHistoryFolder

1name: Release
2on:
3  push:
4    tags: ['v*']
5permissions:
6  contents: read
7concurrency:
8  group: release-${{ github.ref }}
9  cancel-in-progress: false
10jobs:
11  check:
12    uses: ./.github/workflows/ci.yml
13
14  release:
15    needs: check
16    runs-on: ubuntu-latest
17    permissions:
18      contents: write     # create the release
19      id-token: write     # sign the provenance attestation
20      attestations: write
21    steps:
22      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23        with:
24          fetch-depth: 0
25          persist-credentials: false
26      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
27        with:
28          go-version-file: go.mod
29      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
30        with:
31          distribution: goreleaser
32          version: '~> v2'
33          args: release --clean
34        env:
35          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
37        with:
38          subject-path: |
39            dist/*.tar.gz
40            dist/checksums.txt
41      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
42        with:
43          name: aur-bin
44          path: dist/aur/neferwl-bin.pkgbuild
45          if-no-files-found: error
46
47  # makepkg must run on Arch as a non-root user. publish.sh builds each
48  # package, verifies every source checksum, then pushes it.
49  aur:
50    needs: release
51    runs-on: ubuntu-latest
52    container:
53      image: archlinux:latest
54    strategy:
55      fail-fast: false
56      matrix:
57        pkg: [neferwl-bin, neferwl-git]
58    # Pre-releases (v0.2.0-rc1) stay off the AUR: pacman sorts 0.2.0.rc1
59    # after 0.2.0, so the final release would not look like an upgrade.
60    env:
61      SKIP: ${{ contains(github.ref_name, '-') }}
62    steps:
63      - run: >-
64          pacman -Syu --noconfirm --needed
65          base-devel git openssh sudo
66      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
67        with:
68          persist-credentials: false
69      - if: matrix.pkg == 'neferwl-bin' && env.SKIP != 'true'
70        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
71        with:
72          name: aur-bin
73          path: aur-bin
74      - name: Create the build user
75        run: |
76          useradd -m builder
77          echo 'builder ALL=(root) NOPASSWD: /usr/bin/pacman' >/etc/sudoers.d/builder
78      - name: Build, verify and publish ${{ matrix.pkg }}
79        if: env.SKIP != 'true'
80        env:
81          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
82          AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
83          AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
84          PKG: ${{ matrix.pkg }}
85        run: |
86          if [ "$PKG" = neferwl-bin ]; then
87            pkgbuild=aur-bin/neferwl-bin.pkgbuild
88          else
89            pkgbuild=packaging/aur/neferwl-git/PKGBUILD
90          fi
91          chmod -R a+rX "$GITHUB_WORKSPACE"
92          sudo -u builder --preserve-env=AUR_SSH_PRIVATE_KEY,AUR_USERNAME,AUR_EMAIL \
93            packaging/aur/publish.sh "$PKG" "$pkgbuild"