fixHEADmain

1 files changed, 61 insertions, 78 deletions

diff --git a/.forgejo/workflows/artcraft-update.yml b/.forgejo/workflows/artcraft-update.yml
index 419d627..5934ffd 100644
--- a/.forgejo/workflows/artcraft-update.yml
+++ b/.forgejo/workflows/artcraft-update.yml
@@ -32,24 +32,39 @@ jobs:
           set -euo pipefail
           APPS=(designcraft effectcraft filmcraft lightcraft pdfcraft photocraft vectorcraft)
           CHANGED=0
+          HDRFILE=$(mktemp)
+          chmod 600 "$HDRFILE"
+          trap 'rm -f "$HDRFILE"' EXIT
+          AUTH=()
+          if [ -n "${GH_TOKEN:-}" ]; then
+            printf 'Authorization: Bearer %s\n' "$GH_TOKEN" > "$HDRFILE"
+            AUTH=(-H "@${HDRFILE}")
+          fi
           for app in "${APPS[@]}"; do
-            AUTH=()
-            [ -n "${GH_TOKEN:-}" ] && AUTH=(-H "Authorization: Bearer ${GH_TOKEN}")
-            LATEST=$(curl -fsSL --retry 3 "${AUTH[@]}" \
+            TAG=$(curl -fsSL --retry 3 "${AUTH[@]}" \
               "https://api.github.com/repos/storytold/${app}/releases/latest" \
-              | jq -r '.tag_name // empty' 2>/dev/null | sed 's/^v//' || true)
-            CUR=$(grep '^pkgver=' "artcraft-raveos/${app}/PKGBUILD" | cut -d= -f2)
-            if [ -z "$LATEST" ]; then
+              | jq -r '.tag_name // empty' 2>/dev/null || true)
+            if [ -z "$TAG" ]; then
               echo "FIGYELEM: ${app}: a legfrissebb verziot nem sikerult lekerdezni -> kihagyva"
               continue
             fi
-            if [ "$LATEST" = "$CUR" ]; then
+            if [ "${TAG#v}" = "$TAG" ]; then
+              echo "FIGYELEM: ${app}: nem v-elotagos tag (${TAG}) -> kihagyva"
+              continue
+            fi
+            LATEST="${TAG#v}"
+            CUR=$(grep '^pkgver=' "artcraft-raveos/${app}/PKGBUILD" | cut -d= -f2)
+            if [ "$(vercmp "$LATEST" "$CUR")" -le 0 ]; then
               echo "${app}: naprakesz (${CUR})"
               continue
             fi
             echo "${app}: ${CUR} -> ${LATEST}"
-            curl -fsSL --retry 3 -o "/tmp/${app}-src.tar.gz" \
-              "https://github.com/storytold/${app}/archive/refs/tags/v${LATEST}/${app}-${LATEST}.tar.gz"
+            if ! curl -fsSL --retry 3 -o "/tmp/${app}-src.tar.gz" \
+              "https://github.com/storytold/${app}/archive/refs/tags/${TAG}/${app}-${LATEST}.tar.gz"; then
+              echo "FIGYELEM: ${app}: a forras letoltese sikertelen -> kihagyva"
+              rm -f "/tmp/${app}-src.tar.gz"
+              continue
+            fi
             SHA=$(sha256sum "/tmp/${app}-src.tar.gz" | cut -d' ' -f1)
             sed -i "s/^pkgver=.*/pkgver=${LATEST}/" "artcraft-raveos/${app}/PKGBUILD"
             sed -i "s/^sha256sums=('.*')$/sha256sums=('${SHA}')/" "artcraft-raveos/${app}/PKGBUILD"
@@ -57,7 +72,7 @@ jobs:
             CHANGED=1
           done
           rm -f /tmp/*-src.tar.gz || true
-          echo "CHANGED=${CHANGED}" >> $GITHUB_OUTPUT
+          echo "CHANGED=${CHANGED}" >> "$GITHUB_OUTPUT"
 
       - name: Commit PKGBUILD bumps
         if: steps.bump.outputs.CHANGED == '1'
@@ -80,20 +95,24 @@ jobs:
           mkdir -p /tmp/builtpkgs
 
       - name: Import GPG signing key
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
         run: |
           set -euo pipefail
           export GNUPGHOME=/tmp/raveos-gnupg
           rm -rf "$GNUPGHOME"
           mkdir -m 700 "$GNUPGHOME"
-          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import
+          printf '%s' "$GPG_PRIVATE_KEY" | base64 -d | gpg --batch --import
 
       - name: Build ArtCraft packages
+        id: build
         run: |
           set -euo pipefail
           CORE="/tmp/raveos-core-repo/x86_64"
           APPS=(designcraft effectcraft filmcraft lightcraft pdfcraft photocraft vectorcraft)
+          FAILED=()
           for app in "${APPS[@]}"; do
-            cd "artcraft-raveos/${app}"
+            cd "artcraft-raveos/${app}" || { FAILED+=("$app"); continue; }
             PKGVER=$(grep '^pkgver=' PKGBUILD | cut -d= -f2)
             PKGREL=$(grep '^pkgrel=' PKGBUILD | cut -d= -f2)
             if ls "$CORE/${app}-${PKGVER}-${PKGREL}-"*.pkg.tar.zst 2>/dev/null | grep -q .; then
@@ -103,12 +122,23 @@ jobs:
             fi
             echo "=== Building ${app} ${PKGVER}-${PKGREL} ==="
             rm -rf src pkg *.pkg.tar.zst || true
-            makepkg -s --noconfirm -f
-            cp -v "${app}"-*.pkg.tar.zst /tmp/builtpkgs/
+            if ! makepkg -s --noconfirm -f; then
+              echo "HIBA: ${app} build sikertelen"
+              FAILED+=("$app")
+              cd - >/dev/null
+              continue
+            fi
+            if ! cp -v "${app}"-[0-9]*.pkg.tar.zst /tmp/builtpkgs/; then
+              echo "HIBA: ${app} csomag masolasa sikertelen"
+              FAILED+=("$app")
+            fi
             cd - >/dev/null
           done
+          echo "failed=${FAILED[*]:-}" >> "$GITHUB_OUTPUT"
 
       - name: Sign built packages
+        env:
+          GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}
         run: |
           set -euo pipefail
           export GNUPGHOME=/tmp/raveos-gnupg
@@ -118,15 +148,21 @@ jobs:
             echo "Nincs csomag alairashoz -> kihagyva"
             exit 0
           fi
+          PASSFILE=$(mktemp)
+          chmod 600 "$PASSFILE"
+          trap 'rm -f "$PASSFILE"' EXIT
+          printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE"
           for pkg in $BUILT; do
             gpg --batch --yes --pinentry-mode loopback \
-                --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
+                --passphrase-file "$PASSFILE" \
                 --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
                 --detach-sign "$pkg"
             echo "Alairva: $(basename "$pkg")"
           done
 
       - name: Publish packages (repo-add + rsync push, only if changed)
+        env:
+          GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}
         run: |
           set -euo pipefail
           CORE="/tmp/raveos-core-repo/x86_64"
@@ -151,14 +187,14 @@ jobs:
           repo-add raveos-core-repo.db.tar.xz $ALLPKGS
           PASSFILE=$(mktemp)
           chmod 600 "$PASSFILE"
-          printf '%s' "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" > "$PASSFILE"
+          trap 'rm -f "$PASSFILE"' EXIT
+          printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE"
           for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do
             gpg --batch --yes --pinentry-mode loopback \
                 --passphrase-file "$PASSFILE" \
                 --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
                 --detach-sign --no-armor -o "$f.sig" "$f"
           done
-          rm -f "$PASSFILE"
           ln -sf raveos-core-repo.db.tar.xz.sig raveos-core-repo.db.sig
           ln -sf raveos-core-repo.files.tar.xz.sig raveos-core-repo.files.sig
           rm -f raveos-core-repo.db.tar.gz* raveos-core-repo.files.tar.gz* 2>/dev/null || true
@@ -168,70 +204,17 @@ jobs:
           echo "::notice title=Published packages::ArtCraft csomagok publikálva"
 
       - name: Mirror raveos-core-repo to GitHub Releases
-        if: always()
+        env:
+          GH_MIRROR_TOKEN: ${{ secrets.GH_MIRROR_TOKEN }}
         run: |
           set -euo pipefail
-          REPO="/tmp/raveos-core-repo"
-          [ -d "$REPO/x86_64" ] || { echo "Nincs mit tukrozni -> kihagyva"; exit 0; }
-
-          TOKEN="${{ secrets.GH_MIRROR_TOKEN }}"
-          if [ -z "${TOKEN:-}" ]; then
-            echo "FIGYELMEZTETES: GH_MIRROR_TOKEN nincs beallitva -> GitHub tukrozes kihagyva"
-            exit 0
-          fi
-
-          OWNER="rave-os"
-          GH_REPO="RaveOS-core-repo-mirror"
-          TAG="core-repo-x86_64"
-          API="https://api.github.com/repos/${OWNER}/${GH_REPO}"
-
-          release_json=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
-            "${API}/releases/tags/${TAG}" || true)
-          if [ -z "$release_json" ] || ! echo "$release_json" | jq -e .id &>/dev/null; then
-            echo "FIGYELMEZTETES: GitHub release nem erheto el (${TAG}) -> kihagyva"
-            exit 0
-          fi
-          release_id=$(echo "$release_json" | jq -r .id)
-          existing_assets=$(echo "$release_json" | jq -r '.assets[]? | "\(.id)\t\(.name)"' 2>/dev/null || true)
-
-          cd "$REPO/x86_64"
-
-          for f in *.pkg.tar.zst; do
-            [ -f "$f" ] || continue
-            pkgname=$(echo "$f" | sed -E 's/-[0-9][^-]*-[^-]*-[^-]*\.pkg\.tar\.zst$//')
-            [ -n "$pkgname" ] || continue
-            while IFS=$'\t' read -r aid aname; do
-              [ -n "$aid" ] || continue
-              case "$aname" in
-                "${pkgname}-"*.pkg.tar.zst | "${pkgname}-"*.pkg.tar.zst.sig)
-                  if [ "$aname" != "$f" ] && [ "$aname" != "${f}.sig" ]; then
-                    curl -sf -X DELETE -H "Authorization: Bearer ${TOKEN}" \
-                      "${API}/releases/assets/${aid}" || true
-                    echo "torolve (regi verzio): $aname"
-                  fi
-                  ;;
-              esac
-            done <<< "$existing_assets"
-          done
+          bash .forgejo/scripts/mirror-core-repo.sh /tmp/raveos-core-repo
 
-          existing_assets=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
-            "${API}/releases/${release_id}" | jq -r '.assets[] | "\(.id)\t\(.name)"')
-
-          for f in *; do
-            [ -f "$f" ] || continue
-            asset_id=$(echo "$existing_assets" | awk -F'\t' -v n="$f" '$2==n {print $1}')
-            if [ -n "$asset_id" ]; then
-              curl -sf -X DELETE -H "Authorization: Bearer ${TOKEN}" \
-                "${API}/releases/assets/${asset_id}" || true
-            fi
-            curl -sf -X POST \
-              -H "Authorization: Bearer ${TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              --data-binary "@${f}" \
-              "https://uploads.github.com/repos/${OWNER}/${GH_REPO}/releases/${release_id}/assets?name=${f}" \
-              || echo "HIBA: ${f} feltoltese sikertelen"
-          done
-          echo "::notice title=GitHub mirror::Kesz"
+      - name: Report failed builds
+        if: steps.build.outputs.failed != ''
+        run: |
+          echo "Sikertelen buildek: ${{ steps.build.outputs.failed }}"
+          exit 1
 
       - name: Cleanup
         if: always()