101 lines
3.9 KiB
YAML
Executable File
101 lines
3.9 KiB
YAML
Executable File
name: bump-and-build
|
|
|
|
# Triggers:
|
|
# - schedule: a daily cron (Gitea cron is UTC). Tune to taste.
|
|
# - workflow_dispatch: run it manually from the Actions tab.
|
|
on:
|
|
schedule:
|
|
- cron: '17 4 * * *' # 04:17 UTC daily
|
|
workflow_dispatch: {}
|
|
|
|
# The auto-provided GITEA_TOKEN needs write access to push the bump back.
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
update:
|
|
# Label must match a runner that can run containers. `ubuntu-latest` is the
|
|
# default act_runner label; swap for `docker` (or your runner's label) if needed.
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: archlinux:base-devel
|
|
|
|
steps:
|
|
- name: Install build tooling
|
|
run: |
|
|
set -euo pipefail
|
|
pacman -Sy --noconfirm --needed curl libarchive git sudo
|
|
|
|
- name: Checkout
|
|
uses: https://gitea.com/actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
# Mirror PKGBUILD's pkgver() exactly: pull the .deb, read control's Version,
|
|
# strip the trailing "-release". Compare against the hardcoded pkgver line.
|
|
- name: Detect upstream version
|
|
id: ver
|
|
run: |
|
|
set -euo pipefail
|
|
deb_url=$(grep -m1 '^_deb_url=' PKGBUILD | cut -d"'" -f2)
|
|
upstream=$(curl -fsSL "$deb_url" \
|
|
| bsdtar -xOf - control.tar.xz \
|
|
| bsdtar -xOf - control \
|
|
| awk -F': ' '/^Version:/ { print $2 }' \
|
|
| sed 's/-release$//' \
|
|
| tr -d '[:space:]')
|
|
current=$(grep -m1 '^pkgver=' PKGBUILD | cut -d= -f2)
|
|
echo "upstream=${upstream}" >> "$GITHUB_OUTPUT"
|
|
echo "current=${current}" >> "$GITHUB_OUTPUT"
|
|
echo "Upstream: ${upstream} Current: ${current}"
|
|
|
|
- name: Bump PKGBUILD and regenerate .SRCINFO
|
|
if: ${{ steps.ver.outputs.upstream != steps.ver.outputs.current }}
|
|
env:
|
|
UPSTREAM: ${{ steps.ver.outputs.upstream }}
|
|
run: |
|
|
set -euo pipefail
|
|
sed -i "s/^pkgver=.*/pkgver=${UPSTREAM}/" PKGBUILD
|
|
sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
|
|
# Pin the upstream .deb's sha256 so the build is integrity-checked.
|
|
deb_url=$(grep -m1 '^_deb_url=' PKGBUILD | cut -d"'" -f2)
|
|
curl -fsSL "$deb_url" -o /tmp/cato-client-install.deb
|
|
deb_sha=$(sha256sum /tmp/cato-client-install.deb | cut -d' ' -f1)
|
|
sed -i "s/^ 'SKIP'$/ '${deb_sha}'/" PKGBUILD
|
|
makepkg --printsrcinfo > .SRCINFO
|
|
|
|
# makepkg refuses to run as root, so build as an unprivileged user.
|
|
- name: Build package (makepkg)
|
|
if: ${{ steps.ver.outputs.upstream != steps.ver.outputs.current }}
|
|
run: |
|
|
set -euo pipefail
|
|
useradd -m builder
|
|
echo 'builder ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
|
|
chown -R builder .
|
|
sudo -u builder makepkg -s --noconfirm
|
|
- name: Upload built package as artifact
|
|
if: ${{ steps.ver.outputs.upstream != steps.ver.outputs.current }}
|
|
continue-on-error: true
|
|
uses: https://gitea.com/actions/upload-artifact@v4
|
|
with:
|
|
name: cato-client-bin-${{ steps.ver.outputs.upstream }}
|
|
path: '*.pkg.tar.zst'
|
|
if-no-files-found: warn
|
|
|
|
- name: Commit and push the version bump
|
|
if: ${{ steps.ver.outputs.upstream != steps.ver.outputs.current }}
|
|
env:
|
|
UPSTREAM: ${{ steps.ver.outputs.upstream }}
|
|
TOKEN: ${{ env.GITEA_TOKEN }}
|
|
SERVER: ${{ env.GITEA_SERVER_URL }}
|
|
run: |
|
|
set -euo pipefail
|
|
git config user.email "actions@tesserakt.pro"
|
|
git config user.name "Gitea Actions"
|
|
git add PKGBUILD .SRCINFO
|
|
git commit -m "cato-client-bin: bump to ${UPSTREAM}"
|
|
# Push over HTTPS using the workflow token. If your instance rejects the
|
|
# 'oauth2' username, switch to '${{ gitea.actor }}:${TOKEN}'.
|
|
remote="https://oauth2:${TOKEN}@${SERVER#https://}/${{ gitea.repository }}.git"
|
|
git push "${remote}" HEAD:${{ gitea.ref_name }}
|