feat(dist): Homebrew notify + AUR publish parity with CNA

.github/workflows/notify-homebrew.yml

@@ -1,18 +1,51 @@
 name: Notify Homebrew tap
+
+# Triggers on release tags for the CLI package. Sends a
+# repository_dispatch event to Create-Python-App/homebrew-tap so its
+# update-formula workflow can bump the formula and push it.
 on:
  push:
  tags:
  - "create-awesome-python-app@*"
  workflow_dispatch:
  inputs:
  version:
- description: "Package version"
+ description: "Package version (e.g. 0.1.0)"
  required: true
+
+permissions:
+ contents: read
+
 jobs:
  notify:
+ name: Dispatch to homebrew-tap
  runs-on: ubuntu-latest
  steps:
- - name: Dispatch to homebrew-tap
+ - name: Resolve version
+ id: version
+ env:
+ TAG_REF: ${{ github.ref_name }}
+ INPUT_VERSION: ${{ github.event.inputs.version }}
  run: |
- echo "Send repository_dispatch to Create-Python-App/homebrew-tap when it exists"
- echo "Secret: HOMEBREW_TAP_TOKEN"
+ if [ -n "$INPUT_VERSION" ]; then
+ VERSION="$INPUT_VERSION"
+ else
+ VERSION="${TAG_REF#create-awesome-python-app@}"
+ fi
+ echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+ - name: Dispatch repository event
+ env:
+ GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+ VERSION: ${{ steps.version.outputs.version }}
+ run: |
+ if [ -z "$GH_TOKEN" ]; then
+ echo "::error::HOMEBREW_TAP_TOKEN secret is not set" >&2
+ exit 1
+ fi
+ gh api \
+ --method POST \
+ -H "Accept: application/vnd.github+json" \
+ /repos/Create-Python-App/homebrew-tap/dispatches \
+ -f "event_type=new-release" \
+ -f "client_payload[version]=$VERSION"

.github/workflows/publish-aur.yml

@@ -1,19 +1,91 @@
 name: Publish to AUR
+
+# Triggers on release tags for the CLI package.
+# Publishes the updated PKGBUILD to aur.archlinux.org and keeps the
+# Create-Python-App/aur-package GitHub mirror in sync.
 on:
  push:
  tags:
  - "create-awesome-python-app@*"
  workflow_dispatch:
  inputs:
  version:
- description: "Package version"
+ description: "Package version (e.g. 0.1.0)"
  required: true
+
+permissions:
+ contents: read
+
 jobs:
  aur:
+ name: Update AUR package
  runs-on: ubuntu-latest
  steps:
- - uses: actions/checkout@v4
- - name: Placeholder
+ - name: Resolve version
+ id: version
+ env:
+ TAG_REF: ${{ github.ref_name }}
+ INPUT_VERSION: ${{ github.event.inputs.version }}
  run: |
- echo "AUR publish requires AUR_SSH_PRIVATE_KEY + optional Create-Python-App/aur-package mirror"
- echo "See docs/DISTRIBUTION_SETUP.md"
+ if [ -n "$INPUT_VERSION" ]; then
+ VERSION="$INPUT_VERSION"
+ else
+ VERSION="${TAG_REF#create-awesome-python-app@}"
+ fi
+ echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+ - name: Checkout aur-package mirror repo
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ repository: Create-Python-App/aur-package
+ token: ${{ secrets.AUR_REPO_TOKEN }}
+ path: aur-package
+
+ - name: Update PKGBUILD (version + sha256 from PyPI)
+ working-directory: aur-package
+ env:
+ NEW_VERSION: ${{ steps.version.outputs.version }}
+ run: |
+ set -euo pipefail
+ # Reset pkgver and pkgrel; source URL already interpolates ${pkgver}.
+ sed -i "s/^pkgver=.*/pkgver=${NEW_VERSION}/" PKGBUILD
+ sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
+
+ META=$(curl -sfL "https://pypi.org/pypi/create-awesome-python-app/${NEW_VERSION}/json")
+ SHA=$(echo "$META" | jq -r '.urls[] | select(.packagetype=="sdist") | .digests.sha256')
+ if [ -z "$SHA" ] || [ "$SHA" = "null" ]; then
+ echo "::error::Failed to resolve PyPI sdist sha256 for v${NEW_VERSION}" >&2
+ exit 1
+ fi
+ sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" PKGBUILD
+
+ echo "----- Updated PKGBUILD -----"
+ cat PKGBUILD
+
+ - name: Publish to AUR
+ # Pushes to aur.archlinux.org via SSH. The action reads the
+ # updated PKGBUILD, regenerates .SRCINFO, and pushes.
+ uses: ulises-jeremias/github-actions-aur-publish@217e4e2abbbee9ecc942bdc0681302e233656d9f # v1
+ with:
+ pkgname: create-awesome-python-app
+ pkgbuild: aur-package/PKGBUILD
+ commit_username: "Create Python App Bot"
+ commit_email: "ulisescf.24@gmail.com"
+ commit_message: "Update to version ${{ steps.version.outputs.version }}"
+ ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+ allow_empty_commits: "false"
+ # dsa is no longer supported in modern OpenSSH; omit it to
+ # avoid "Unknown key type" errors during keyscan.
+ ssh_keyscan_types: "rsa,ecdsa,ed25519"
+
+ - name: Sync updated PKGBUILD to GitHub mirror
+ # Keep the aur-package GitHub mirror in sync with what's live
+ # on AUR. Only PKGBUILD needs to be committed here — .SRCINFO
+ # is regenerated automatically by AUR from PKGBUILD.
+ uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
+ with:
+ repository: aur-package
+ commit_message: "chore: sync PKGBUILD for v${{ steps.version.outputs.version }}"
+ commit_user_name: "Create Python App Bot"
+ commit_user_email: "ulisescf.24@gmail.com"
+ file_pattern: "PKGBUILD"

.github/workflows/publish-docker.yml

@@ -1,27 +1,96 @@
 name: Publish Docker image
+
+# Triggers on release tags for the CLI package. Version comes directly
+# from the tag ref (create-awesome-python-app@X.Y.Z).
 on:
  push:
  tags:
  - "create-awesome-python-app@*"
+ # Manual trigger to rebuild an image for an existing version.
  workflow_dispatch:
  inputs:
  version:
- description: "Package version"
+ description: "Package version (e.g. 0.1.0)"
  required: true
+
+permissions:
+ contents: read
+
 jobs:
  docker:
+ name: Build and push Docker image
  runs-on: ubuntu-latest
  steps:
- - uses: actions/checkout@v4
- - name: Login to Docker Hub
- uses: docker/login-action@v3
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ persist-credentials: false
+
+ - name: Resolve version
+ id: version
+ env:
+ TAG_REF: ${{ github.ref_name }}
+ INPUT_VERSION: ${{ github.event.inputs.version }}
+ run: |
+ if [ -n "$INPUT_VERSION" ]; then
+ VERSION="$INPUT_VERSION"
+ else
+ # Tag format: create-awesome-python-app@X.Y.Z
+ VERSION="${TAG_REF#create-awesome-python-app@}"
+ fi
+ MAJOR=$(echo "$VERSION" | cut -d. -f1)
+ MINOR=$(echo "$VERSION" | cut -d. -f2)
+ {
+ echo "version=$VERSION"
+ echo "major=$MAJOR"
+ echo "minor=$MINOR"
+ } >> "$GITHUB_OUTPUT"
+
+ - name: Set up QEMU
+ # Required so buildx can cross-build linux/arm64 on the x86_64
+ # ubuntu-latest runner.
+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+ with:
+ platforms: linux/arm64
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+ - name: Log in to Docker Hub
+ uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
  with:
  username: ${{ secrets.DOCKERHUB_USERNAME }}
  password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+ - name: Extract Docker metadata
+ id: meta
+ uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+ with:
+ images: ulisesjeremias/create-awesome-python-app
+ # `latest` is pushed on tag pushes AND on explicit workflow_dispatch
+ # runs (which always execute against main, so they represent the
+ # current release).
+ tags: |
+ type=raw,value=latest
+ type=raw,value=${{ steps.version.outputs.version }}
+ type=raw,value=${{ steps.version.outputs.major }}.${{ steps.version.outputs.minor }}
+ type=raw,value=v${{ steps.version.outputs.major }}
+ labels: |
+ org.opencontainers.image.title=create-awesome-python-app
+ org.opencontainers.image.description=Composable scaffolding CLI for production-ready Python apps
+ org.opencontainers.image.url=https://github.com/Create-Python-App/create-python-app
+ org.opencontainers.image.source=https://github.com/Create-Python-App/create-python-app
+ org.opencontainers.image.licenses=MIT
+ org.opencontainers.image.version=${{ steps.version.outputs.version }}
+
  - name: Build and push
- uses: docker/build-push-action@v6
+ uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
  with:
  context: .
  push: true
- tags: |
- ${{ secrets.DOCKERHUB_USERNAME }}/create-awesome-python-app:latest
+ platforms: linux/amd64,linux/arm64
+ tags: ${{ steps.meta.outputs.tags }}
+ labels: ${{ steps.meta.outputs.labels }}
+ build-args: |
+ VERSION=${{ steps.version.outputs.version }}
+ cache-from: type=gha
+ cache-to: type=gha,mode=max