Skip to content

Publish to AUR

Publish to AUR #11

Workflow file for this run

name: Publish to AUR
# Runs after Release succeeds (PyPI already uploaded), or manually.
# Publishes the updated PKGBUILD to aur.archlinux.org and keeps the
# Create-Python-App/aur-package GitHub mirror in sync.
on:
workflow_run:
workflows: ["Release"]
types: [completed]
workflow_dispatch:
inputs:
version:
description: "Package version (e.g. 0.1.0)"
required: true
permissions:
contents: read
concurrency:
group: publish-aur
cancel-in-progress: false
env:
AUR_PACKAGE: create-awesome-python-app
AUR_RPC_URL: https://aur.archlinux.org/rpc/v5/info?arg=create-awesome-python-app
PYPI_PACKAGE: create-awesome-python-app
jobs:
aur:
name: Update AUR package
if: >-
github.event_name == 'workflow_dispatch' ||
(github.event.workflow_run.conclusion == 'success' &&
startsWith(github.event.workflow_run.head_branch, 'create-awesome-python-app@'))
runs-on: ubuntu-latest
environment: pypi
timeout-minutes: 20
steps:
- name: Resolve version
id: version
env:
INPUT_VERSION: ${{ github.event.inputs.version }}
RUN_BRANCH: ${{ github.event.workflow_run.head_branch }}
run: |
set -euo pipefail
if [ -n "${INPUT_VERSION:-}" ]; then
VERSION="$INPUT_VERSION"
else
VERSION="${RUN_BRANCH#create-awesome-python-app@}"
fi
if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([a-zA-Z0-9.-]+)?$'; then
echo "::error::Invalid AUR package version: $VERSION"
exit 1
fi
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
- name: Checkout aur-package mirror repo
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: Create-Python-App/aur-package
token: ${{ secrets.AUR_REPO_TOKEN }}
path: aur-package
- name: Update PKGBUILD (version + sha256 from PyPI)
working-directory: aur-package
env:
NEW_VERSION: ${{ steps.version.outputs.version }}
run: |
set -euo pipefail
retry() {
local attempts="$1"
local delay="$2"
shift 2
for attempt in $(seq 1 "$attempts"); do
if "$@"; then
return 0
fi
if [ "$attempt" = "$attempts" ]; then
return 1
fi
echo "::warning::Attempt $attempt/$attempts failed: $*; retrying in ${delay}s" >&2
sleep "$delay"
done
}
# Reset pkgver and pkgrel; source URL already interpolates ${pkgver}.
sed -i "s/^pkgver=.*/pkgver=${NEW_VERSION}/" PKGBUILD
sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
# PyPI CDN can lag the upload response; poll for indexing.
META=$(retry 24 15 curl -sfL "https://pypi.org/pypi/${PYPI_PACKAGE}/${NEW_VERSION}/json")
SHA=$(echo "$META" | jq -r '.urls[] | select(.packagetype=="sdist") | .digests.sha256')
if [ -z "$SHA" ] || [ "$SHA" = "null" ]; then
echo "::error::Failed to resolve PyPI sdist sha256 for v${NEW_VERSION}" >&2
exit 1
fi
sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" PKGBUILD
echo "----- Updated PKGBUILD -----"
cat PKGBUILD
- name: Preflight AUR availability
env:
AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
run: |
set -euo pipefail
retry() {
local attempts="$1"
local delay="$2"
shift 2
for attempt in $(seq 1 "$attempts"); do
if "$@"; then
return 0
fi
if [ "$attempt" = "$attempts" ]; then
return 1
fi
echo "::warning::Attempt $attempt/$attempts failed: $*; retrying in ${delay}s" >&2
sleep "$delay"
done
}
test -n "$AUR_SSH_PRIVATE_KEY" || {
echo "::error::AUR_SSH_PRIVATE_KEY is empty or unavailable in the pypi environment"
exit 1
}
retry 5 15 curl -fsSL "$AUR_RPC_URL" >/tmp/aur-rpc.json
python3 - <<'PY'
import json
from pathlib import Path
data = json.loads(Path("/tmp/aur-rpc.json").read_text())
print(f"AUR RPC resultcount={data.get('resultcount')}")
PY
mkdir -p ~/.ssh
retry 5 10 ssh-keyscan -T 30 -t rsa,ecdsa,ed25519 aur.archlinux.org >> ~/.ssh/known_hosts
retry 5 15 git ls-remote "https://aur.archlinux.org/${AUR_PACKAGE}.git" >/dev/null
- name: Publish to AUR
uses: ulises-jeremias/github-actions-aur-publish@217e4e2abbbee9ecc942bdc0681302e233656d9f # v1
with:
pkgname: create-awesome-python-app
pkgbuild: aur-package/PKGBUILD
commit_username: "Create Python App Bot"
commit_email: "ulisescf.24@gmail.com"
commit_message: "Update to version ${{ steps.version.outputs.version }}"
ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
allow_empty_commits: "false"
ssh_keyscan_types: "rsa,ecdsa,ed25519"
- name: Verify AUR RPC after publish
env:
EXPECTED_VERSION: ${{ steps.version.outputs.version }}
run: |
set -euo pipefail
retry() {
local attempts="$1"
local delay="$2"
shift 2
for attempt in $(seq 1 "$attempts"); do
if "$@"; then
return 0
fi
if [ "$attempt" = "$attempts" ]; then
return 1
fi
echo "::warning::Attempt $attempt/$attempts failed: $*; retrying in ${delay}s" >&2
sleep "$delay"
done
}
retry 6 20 curl -fsSL "$AUR_RPC_URL" >/tmp/aur-rpc.json
AUR_VERSION=$(
python3 - <<'PY'
import json
from pathlib import Path
data = json.loads(Path("/tmp/aur-rpc.json").read_text())
results = data.get("results") or []
print(results[0]["Version"].split("-", 1)[0] if results else "")
PY
)
echo "AUR version: $AUR_VERSION"
echo "Expected version: $EXPECTED_VERSION"
if [ "$AUR_VERSION" != "$EXPECTED_VERSION" ]; then
echo "::warning::AUR RPC has not reflected ${EXPECTED_VERSION} yet (current: ${AUR_VERSION:-missing})"
fi
{
echo "## AUR publish verification"
echo
echo "- Expected version: \`$EXPECTED_VERSION\`"
echo "- AUR RPC version: \`${AUR_VERSION:-missing}\`"
} >> "$GITHUB_STEP_SUMMARY"
- name: Sync updated PKGBUILD to GitHub mirror
uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
with:
repository: aur-package
commit_message: "chore: sync PKGBUILD for v${{ steps.version.outputs.version }}"
commit_user_name: "Create Python App Bot"
commit_user_email: "ulisescf.24@gmail.com"
file_pattern: "PKGBUILD"