Skip to content

Commit da273f9

Browse files
anand-testcompareanand-testcompare
committed
initial import: SHPIT arch PKGBUILDs
PKGBUILDs for tabex-bin and osyrra-bin (linux amd64, private GitHub release assets pulled with gh release download) plus three workflows: - version-bumps.yml: scheduled/manual PR that refreshes pkgver, sha256, and .SRCINFO using repo-owned updater scripts. - validate.yml: non-mutating PR check that parses PKGBUILDs and diffs the generated .SRCINFO against what's committed. - publish.yml: post-merge per-package push to the matching AUR repo, gated on AUR_USERNAME / AUR_EMAIL / AUR_SSH_PRIVATE_KEY secrets. Both packages require SHPIT_GH_TOKEN in Actions to read the private upstream releases; without it the bump job silently no-ops so the repo is safe to land before the secret is attached.
0 parents  commit da273f9

18 files changed

Lines changed: 808 additions & 0 deletions

‎.github/workflows/publish.yml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
name: publish
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- '*/PKGBUILD'
10+
- '*/.SRCINFO'
11+
- '*/*.install'
12+
13+
jobs:
14+
detect:
15+
runs-on: ubuntu-latest
16+
outputs:
17+
packages: ${{ steps.collect.outputs.packages }}
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
21+
with:
22+
fetch-depth: 0
23+
24+
- name: Find updated packages
25+
id: collect
26+
run: |
27+
#!/usr/bin/env bash
28+
set -euo pipefail
29+
30+
before="${{ github.event.before }}"
31+
if [[ -z "${before}" || "${before}" =~ ^0+$ ]]; then
32+
before="$(git rev-list --max-parents=0 HEAD)"
33+
fi
34+
35+
mapfile -t packages < <(
36+
git diff --name-only "${before}" "${GITHUB_SHA}" -- '*/PKGBUILD' '*/.SRCINFO' '*/*.install' \
37+
| xargs -r -n1 dirname \
38+
| sort -u
39+
)
40+
41+
if ((${#packages[@]} == 0)); then
42+
echo 'packages=[]' >> "${GITHUB_OUTPUT}"
43+
exit 0
44+
fi
45+
46+
json="$(printf '%s\n' "${packages[@]}" | jq -R . | jq -s -c .)"
47+
echo "packages=${json}" >> "${GITHUB_OUTPUT}"
48+
49+
publish:
50+
needs: detect
51+
if: ${{ needs.detect.outputs.packages != '[]' }}
52+
runs-on: ubuntu-latest
53+
strategy:
54+
fail-fast: false
55+
matrix:
56+
package: ${{ fromJson(needs.detect.outputs.packages) }}
57+
permissions:
58+
contents: read
59+
env:
60+
AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
61+
AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
62+
AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
63+
steps:
64+
- name: Checkout
65+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
66+
67+
- name: Check publishing configuration
68+
id: config
69+
run: |
70+
#!/usr/bin/env bash
71+
set -euo pipefail
72+
if [[ -n "${AUR_USERNAME}" && -n "${AUR_EMAIL}" && -n "${AUR_SSH_PRIVATE_KEY}" ]]; then
73+
echo 'enabled=true' >> "${GITHUB_OUTPUT}"
74+
else
75+
echo 'enabled=false' >> "${GITHUB_OUTPUT}"
76+
echo "AUR publish skipped: AUR secrets are not configured."
77+
fi
78+
79+
- name: Install publish dependencies
80+
if: ${{ steps.config.outputs.enabled == 'true' }}
81+
run: |
82+
sudo apt-get update
83+
sudo apt-get install --yes openssh-client rsync
84+
85+
- name: Start ssh-agent
86+
if: ${{ steps.config.outputs.enabled == 'true' }}
87+
env:
88+
AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
89+
run: |
90+
#!/usr/bin/env bash
91+
set -euo pipefail
92+
install -d -m 700 ~/.ssh
93+
ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts
94+
eval "$(ssh-agent -s)"
95+
ssh-add - <<< "${AUR_SSH_PRIVATE_KEY}"
96+
{
97+
echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}"
98+
echo "SSH_AGENT_PID=${SSH_AGENT_PID}"
99+
} >> "${GITHUB_ENV}"
100+
101+
- name: Publish package
102+
if: ${{ steps.config.outputs.enabled == 'true' }}
103+
run: ./scripts/publish-package.sh "${{ matrix.package }}"

‎.github/workflows/validate.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: validate
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- '*/PKGBUILD'
9+
- '*/.SRCINFO'
10+
- '*/*.install'
11+
- '.github/workflows/**'
12+
- 'scripts/**'
13+
- 'README.md'
14+
workflow_dispatch:
15+
16+
jobs:
17+
validate:
18+
runs-on: ubuntu-latest
19+
container:
20+
image: archlinux:base-devel
21+
steps:
22+
- name: Install validation dependencies
23+
run: pacman -Syu --noconfirm git github-cli jq unzip
24+
25+
- name: Checkout
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
28+
- name: Mark workspace as safe
29+
run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
30+
31+
- name: Validate packages
32+
run: ./scripts/validate-packages.sh

‎.github/workflows/version-bumps.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: version-bumps
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: '23 6 * * *'
7+
8+
permissions:
9+
contents: write
10+
pull-requests: write
11+
12+
jobs:
13+
update:
14+
runs-on: ubuntu-latest
15+
container:
16+
image: archlinux:base-devel
17+
env:
18+
GH_TOKEN: ${{ github.token }}
19+
SHPIT_GH_TOKEN: ${{ secrets.SHPIT_GH_TOKEN }}
20+
UPDATE_BRANCH: automation/version-bumps
21+
steps:
22+
- name: Install updater dependencies
23+
run: pacman -Syu --noconfirm git github-cli jq unzip
24+
25+
- name: Checkout
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
with:
28+
fetch-depth: 0
29+
30+
- name: Mark workspace as safe
31+
run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
32+
33+
- name: Configure git identity
34+
run: |
35+
git config user.name "shpit-bot"
36+
git config user.email "opensource@shpit.dev"
37+
38+
- name: Update packages
39+
run: ./scripts/update-packages.sh auto
40+
41+
- name: Detect changes
42+
id: detect
43+
run: |
44+
if git diff --quiet; then
45+
echo 'changed=false' >> "${GITHUB_OUTPUT}"
46+
else
47+
echo 'changed=true' >> "${GITHUB_OUTPUT}"
48+
fi
49+
50+
- name: Commit and push branch
51+
if: ${{ steps.detect.outputs.changed == 'true' }}
52+
run: |
53+
git checkout -B "${UPDATE_BRANCH}"
54+
git add README.md docs scripts .github/workflows tabex-bin osyrra-bin
55+
git commit -m "chore(pkgbuilds): bump package versions"
56+
git push --force --set-upstream origin "${UPDATE_BRANCH}"
57+
58+
- name: Open or update pull request
59+
if: ${{ steps.detect.outputs.changed == 'true' }}
60+
run: |
61+
#!/usr/bin/env bash
62+
set -euo pipefail
63+
64+
pr_number="$(gh pr list \
65+
--head "${UPDATE_BRANCH}" \
66+
--base main \
67+
--json number \
68+
--jq '.[0].number // empty')"
69+
70+
title="chore(pkgbuilds): bump package versions"
71+
body_file="$(mktemp)"
72+
cat <<'EOF' > "${body_file}"
73+
## Summary
74+
75+
- update SHPIT package definitions to the latest discovered upstream versions
76+
- refresh checksums and `.SRCINFO`
77+
- keep the public repo metadata aligned with the package automation flow
78+
EOF
79+
80+
if [[ -n "${pr_number}" ]]; then
81+
gh pr edit "${pr_number}" --title "${title}" --body-file "${body_file}"
82+
else
83+
gh pr create \
84+
--base main \
85+
--head "${UPDATE_BRANCH}" \
86+
--title "${title}" \
87+
--body-file "${body_file}"
88+
fi

‎.gitignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# package src/pkg archives, downloaded sources
2+
*.tar*
3+
*.tgz
4+
*.zip
5+
*.oxt
6+
7+
# signed sources
8+
*.asc
9+
*.sig
10+
11+
# log files from makepkg --log (or extra-x86_64-build)
12+
*.log
13+
14+
# subfolders, e.g. source or built package trees, vcs
15+
*/**/
16+
!.github/**/
17+
18+
# backup files
19+
*~
20+
*.bak
21+
22+
# mkpkg status files
23+
.mkpkg_check

‎LICENSE.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2026 SHPIT LLC
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# SHPIT Arch Packages
2+
3+
Arch Linux package definitions for SHPIT-maintained command-line tools.
4+
5+
## Packages
6+
7+
| Package | Upstream | Notes |
8+
|---|---|---|
9+
| `tabex-bin` | `shpitdev/tabex` GitHub Releases | Private release assets. The PKGBUILD is public, but `makepkg` needs GitHub access to the `shpitdev` org to download the release tarball. |
10+
| `osyrra-bin` | `shpitdev/osyrra` GitHub Releases | Private release assets. Same auth model as `tabex-bin`. |
11+
12+
## Automation
13+
14+
- `.github/workflows/version-bumps.yml` runs on a schedule or manual dispatch, updates package versions/checksums via repo-owned scripts, regenerates `.SRCINFO`, and opens or updates a PR.
15+
- `.github/workflows/validate.yml` is non-mutating PR validation. It checks PKGBUILD syntax and confirms `.SRCINFO` is in sync.
16+
- `.github/workflows/publish.yml` publishes every changed package directory to the AUR after changes land on `main`, but cleanly skips publishing until AUR secrets exist.
17+
18+
## Local Usage
19+
20+
Update all packages:
21+
22+
```bash
23+
./scripts/update-packages.sh auto
24+
```
25+
26+
Validate package metadata:
27+
28+
```bash
29+
./scripts/validate-packages.sh
30+
```
31+
32+
Build a package locally:
33+
34+
```bash
35+
cd <package-dir>
36+
makepkg -si
37+
```
38+
39+
`gh auth login` must be configured with access to the `shpitdev` org before `makepkg` can download the private release assets.
40+
41+
## Temporary Mode
42+
43+
- You can use this repo immediately without creating the AUR repositories or AUR secrets.
44+
- The scheduled/manual bump workflow uses the repository `GITHUB_TOKEN` for branch and PR operations in this repo.
45+
- Without `SHPIT_GH_TOKEN`, the workflow skips the private package updates (both `tabex-bin` and `osyrra-bin` need it).
46+
- Without AUR secrets, the publish workflow exits successfully without pushing anywhere.
47+
48+
## Secrets
49+
50+
- `SHPIT_GH_TOKEN` — required for GitHub Actions to refresh private SHPIT packages from their GitHub releases.
51+
- `AUR_USERNAME`, `AUR_EMAIL`, `AUR_SSH_PRIVATE_KEY` — optional until you actually want to publish to AUR.
52+
53+
## Local Auth
54+
55+
- Local scripts use your normal `gh auth login` session when you run them from your machine.
56+
- GitHub-hosted Actions cannot reuse your personal interactive `gh` login session. They only get the repository `GITHUB_TOKEN` plus any secrets you explicitly configure.
57+
58+
## Adding a New Package
59+
60+
1. Create a directory with the package name and add a `PKGBUILD`.
61+
2. Add a dedicated updater script in `scripts/` if the package needs live version discovery.
62+
3. Regenerate `.SRCINFO` with `./scripts/render-srcinfo.sh <package-dir>`.
63+
4. Extend `./scripts/update-packages.sh` if the package should be included in automated bump PRs.
64+
65+
## Ultimate Setup
66+
67+
1. Create the GitHub repository and enable Actions.
68+
2. In `Settings -> Actions -> General`, set workflow permissions to read and write, and enable GitHub Actions to create pull requests.
69+
3. Attach the `SHPIT_GH_TOKEN` secret (org-level or repo-level) to this repo so the bump workflow can read the private release assets.
70+
4. When the AUR repos exist, add `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`.
71+
5. Run `version-bumps` manually once, confirm the PR output, then merge.
72+
6. After the first merge, `publish.yml` will start pushing package updates to AUR only if those AUR secrets are present.

0 commit comments

Comments
 (0)