1name: Publish AUR package
2
3# See packaging/aur/README.md.
4
5on:
6 workflow_call:
7 inputs:
8 release_tag:
9 required: true
10 type: string
11 pkgrel:
12 required: false
13 default: "1"
14 type: string
15 secrets:
16 AUR_SSH_PRIVATE_KEY:
17 required: true
18 workflow_dispatch:
19 inputs:
20 release_tag:
21 description: "Release tag to publish"
22 required: true
23 type: string
24 pkgrel:
25 description: "Arch package release override"
26 required: false
27 default: "1"
28 type: string
29
30permissions:
31 contents: read
32
33concurrency:
34 group: publish-aur
35 cancel-in-progress: false
36
37jobs:
38 publish:
39 name: Validate and publish
40 runs-on: blacksmith-8vcpu-ubuntu-2404
41 timeout-minutes: 30
42 container:
43 image: archlinux:base-devel
44
45 steps:
46 - name: Install Arch packaging tools
47 run: pacman -Syu --noconfirm --needed git github-cli jq namcap openssh sudo
48
49 - name: Checkout packaging sources
50 uses: actions/checkout@v6
51
52 - name: Create unprivileged build user
53 run: |
54 useradd --create-home builder
55 install -Dm0440 /dev/stdin /etc/sudoers.d/builder <<'EOF'
56 builder ALL=(root) NOPASSWD: /usr/bin/pacman
57 EOF
58
59 - name: Validate and publish package sources
60 env:
61 GH_TOKEN: ${{ github.token }}
62 RELEASE_TAG: ${{ inputs.release_tag }}
63 PKGREL: ${{ inputs.pkgrel || '1' }}
64 AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
65 run: packaging/aur/scripts/release.sh