artcraft: kezi update workflow (check + bump + build + publish)

1 files changed, 243 insertions, 0 deletions

diff --git a/.forgejo/workflows/artcraft-update.yml b/.forgejo/workflows/artcraft-update.yml
new file mode 100644
index 0000000..419d627
--- /dev/null
+++ b/.forgejo/workflows/artcraft-update.yml
@@ -0,0 +1,243 @@
+name: ArtCraft update (manual)
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: raveos-repo-publish
+  cancel-in-progress: false
+
+jobs:
+  update:
+    runs-on: iso-builder
+
+    steps:
+      - name: Checkout PKGBUILDs repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.FORGEJO_TOKEN }}
+
+      - name: Install build tools
+        run: |
+          set -euo pipefail
+          sudo pacman -Syu --noconfirm
+          sudo pacman -S --needed --noconfirm base-devel git pacman-contrib rsync curl jq cargo
+
+      - name: Check latest versions and bump PKGBUILDs
+        id: bump
+        env:
+          GH_TOKEN: ${{ secrets.GH_MIRROR_TOKEN }}
+        run: |
+          set -euo pipefail
+          APPS=(designcraft effectcraft filmcraft lightcraft pdfcraft photocraft vectorcraft)
+          CHANGED=0
+          for app in "${APPS[@]}"; do
+            AUTH=()
+            [ -n "${GH_TOKEN:-}" ] && AUTH=(-H "Authorization: Bearer ${GH_TOKEN}")
+            LATEST=$(curl -fsSL --retry 3 "${AUTH[@]}" \
+              "https://api.github.com/repos/storytold/${app}/releases/latest" \
+              | jq -r '.tag_name // empty' 2>/dev/null | sed 's/^v//' || true)
+            CUR=$(grep '^pkgver=' "artcraft-raveos/${app}/PKGBUILD" | cut -d= -f2)
+            if [ -z "$LATEST" ]; then
+              echo "FIGYELEM: ${app}: a legfrissebb verziot nem sikerult lekerdezni -> kihagyva"
+              continue
+            fi
+            if [ "$LATEST" = "$CUR" ]; then
+              echo "${app}: naprakesz (${CUR})"
+              continue
+            fi
+            echo "${app}: ${CUR} -> ${LATEST}"
+            curl -fsSL --retry 3 -o "/tmp/${app}-src.tar.gz" \
+              "https://github.com/storytold/${app}/archive/refs/tags/v${LATEST}/${app}-${LATEST}.tar.gz"
+            SHA=$(sha256sum "/tmp/${app}-src.tar.gz" | cut -d' ' -f1)
+            sed -i "s/^pkgver=.*/pkgver=${LATEST}/" "artcraft-raveos/${app}/PKGBUILD"
+            sed -i "s/^sha256sums=('.*')$/sha256sums=('${SHA}')/" "artcraft-raveos/${app}/PKGBUILD"
+            sed -i "s/^pkgrel=.*/pkgrel=1/" "artcraft-raveos/${app}/PKGBUILD"
+            CHANGED=1
+          done
+          rm -f /tmp/*-src.tar.gz || true
+          echo "CHANGED=${CHANGED}" >> $GITHUB_OUTPUT
+
+      - name: Commit PKGBUILD bumps
+        if: steps.bump.outputs.CHANGED == '1'
+        run: |
+          set -euo pipefail
+          git config user.name "RaveOS Bot"
+          git config user.email "bot@raveos.hu"
+          git add artcraft-raveos
+          git commit -m "artcraft: frissites a legujabb upstream verziokra"
+          git push origin main
+
+      - name: Sync core repo from VPS (rsync pull)
+        run: |
+          set -euo pipefail
+          RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes"
+          rm -rf /tmp/raveos-core-repo
+          mkdir -p /tmp/raveos-core-repo/x86_64
+          rsync -az -e "$RSYNC_SSH" \
+            root@10.66.66.1:/root/docker/repo/repo/x86_64/ /tmp/raveos-core-repo/x86_64/
+          mkdir -p /tmp/builtpkgs
+
+      - name: Import GPG signing key
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          rm -rf "$GNUPGHOME"
+          mkdir -m 700 "$GNUPGHOME"
+          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import
+
+      - name: Build ArtCraft packages
+        run: |
+          set -euo pipefail
+          CORE="/tmp/raveos-core-repo/x86_64"
+          APPS=(designcraft effectcraft filmcraft lightcraft pdfcraft photocraft vectorcraft)
+          for app in "${APPS[@]}"; do
+            cd "artcraft-raveos/${app}"
+            PKGVER=$(grep '^pkgver=' PKGBUILD | cut -d= -f2)
+            PKGREL=$(grep '^pkgrel=' PKGBUILD | cut -d= -f2)
+            if ls "$CORE/${app}-${PKGVER}-${PKGREL}-"*.pkg.tar.zst 2>/dev/null | grep -q .; then
+              echo "${app} ${PKGVER}-${PKGREL} unchanged -> skip"
+              cd - >/dev/null
+              continue
+            fi
+            echo "=== Building ${app} ${PKGVER}-${PKGREL} ==="
+            rm -rf src pkg *.pkg.tar.zst || true
+            makepkg -s --noconfirm -f
+            cp -v "${app}"-*.pkg.tar.zst /tmp/builtpkgs/
+            cd - >/dev/null
+          done
+
+      - name: Sign built packages
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          gpgconf --launch gpg-agent >/dev/null 2>&1 || true
+          BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true)
+          if [ -z "$BUILT" ]; then
+            echo "Nincs csomag alairashoz -> kihagyva"
+            exit 0
+          fi
+          for pkg in $BUILT; do
+            gpg --batch --yes --pinentry-mode loopback \
+                --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
+                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+                --detach-sign "$pkg"
+            echo "Alairva: $(basename "$pkg")"
+          done
+
+      - name: Publish packages (repo-add + rsync push, only if changed)
+        run: |
+          set -euo pipefail
+          CORE="/tmp/raveos-core-repo/x86_64"
+          BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true)
+          if [ -z "$BUILT" ]; then
+            echo "Nincs uj csomag -> kihagyva"
+            exit 0
+          fi
+          for pkg in $BUILT; do
+            PKGNAME=$(bsdtar -xOf "$pkg" .PKGINFO | awk -F' = ' '/^pkgname =/{print $2; exit}')
+            if [[ ! "$PKGNAME" =~ ^[a-zA-Z0-9_+-]+$ ]]; then
+              echo "HIBA: Ervenytelen csomagnev: $PKGNAME -> skip"
+              continue
+            fi
+            rm -f "$CORE/${PKGNAME}-"[0-9]*.pkg.tar.zst* 2>/dev/null || true
+            cp -v "$pkg" "$CORE/"
+            [ -f "$pkg.sig" ] && cp -v "$pkg.sig" "$CORE/"
+          done
+          export GNUPGHOME=/tmp/raveos-gnupg
+          cd "$CORE"
+          ALLPKGS=$(ls *.pkg.tar.zst)
+          repo-add raveos-core-repo.db.tar.xz $ALLPKGS
+          PASSFILE=$(mktemp)
+          chmod 600 "$PASSFILE"
+          printf '%s' "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" > "$PASSFILE"
+          for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do
+            gpg --batch --yes --pinentry-mode loopback \
+                --passphrase-file "$PASSFILE" \
+                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+                --detach-sign --no-armor -o "$f.sig" "$f"
+          done
+          rm -f "$PASSFILE"
+          ln -sf raveos-core-repo.db.tar.xz.sig raveos-core-repo.db.sig
+          ln -sf raveos-core-repo.files.tar.xz.sig raveos-core-repo.files.sig
+          rm -f raveos-core-repo.db.tar.gz* raveos-core-repo.files.tar.gz* 2>/dev/null || true
+          RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes"
+          rsync -az --delete -e "$RSYNC_SSH" \
+            "$CORE/" root@10.66.66.1:/root/docker/repo/repo/x86_64/
+          echo "::notice title=Published packages::ArtCraft csomagok publikálva"
+
+      - name: Mirror raveos-core-repo to GitHub Releases
+        if: always()
+        run: |
+          set -euo pipefail
+          REPO="/tmp/raveos-core-repo"
+          [ -d "$REPO/x86_64" ] || { echo "Nincs mit tukrozni -> kihagyva"; exit 0; }
+
+          TOKEN="${{ secrets.GH_MIRROR_TOKEN }}"
+          if [ -z "${TOKEN:-}" ]; then
+            echo "FIGYELMEZTETES: GH_MIRROR_TOKEN nincs beallitva -> GitHub tukrozes kihagyva"
+            exit 0
+          fi
+
+          OWNER="rave-os"
+          GH_REPO="RaveOS-core-repo-mirror"
+          TAG="core-repo-x86_64"
+          API="https://api.github.com/repos/${OWNER}/${GH_REPO}"
+
+          release_json=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
+            "${API}/releases/tags/${TAG}" || true)
+          if [ -z "$release_json" ] || ! echo "$release_json" | jq -e .id &>/dev/null; then
+            echo "FIGYELMEZTETES: GitHub release nem erheto el (${TAG}) -> kihagyva"
+            exit 0
+          fi
+          release_id=$(echo "$release_json" | jq -r .id)
+          existing_assets=$(echo "$release_json" | jq -r '.assets[]? | "\(.id)\t\(.name)"' 2>/dev/null || true)
+
+          cd "$REPO/x86_64"
+
+          for f in *.pkg.tar.zst; do
+            [ -f "$f" ] || continue
+            pkgname=$(echo "$f" | sed -E 's/-[0-9][^-]*-[^-]*-[^-]*\.pkg\.tar\.zst$//')
+            [ -n "$pkgname" ] || continue
+            while IFS=$'\t' read -r aid aname; do
+              [ -n "$aid" ] || continue
+              case "$aname" in
+                "${pkgname}-"*.pkg.tar.zst | "${pkgname}-"*.pkg.tar.zst.sig)
+                  if [ "$aname" != "$f" ] && [ "$aname" != "${f}.sig" ]; then
+                    curl -sf -X DELETE -H "Authorization: Bearer ${TOKEN}" \
+                      "${API}/releases/assets/${aid}" || true
+                    echo "torolve (regi verzio): $aname"
+                  fi
+                  ;;
+              esac
+            done <<< "$existing_assets"
+          done
+
+          existing_assets=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
+            "${API}/releases/${release_id}" | jq -r '.assets[] | "\(.id)\t\(.name)"')
+
+          for f in *; do
+            [ -f "$f" ] || continue
+            asset_id=$(echo "$existing_assets" | awk -F'\t' -v n="$f" '$2==n {print $1}')
+            if [ -n "$asset_id" ]; then
+              curl -sf -X DELETE -H "Authorization: Bearer ${TOKEN}" \
+                "${API}/releases/assets/${asset_id}" || true
+            fi
+            curl -sf -X POST \
+              -H "Authorization: Bearer ${TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@${f}" \
+              "https://uploads.github.com/repos/${OWNER}/${GH_REPO}/releases/${release_id}/assets?name=${f}" \
+              || echo "HIBA: ${f} feltoltese sikertelen"
+          done
+          echo "::notice title=GitHub mirror::Kesz"
+
+      - name: Cleanup
+        if: always()
+        run: |
+          gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true
+          sudo rm -rf /tmp/raveos-gnupg || true
+          sudo rm -rf /tmp/builtpkgs || true
+          sudo rm -rf /tmp/raveos-core-repo || true
+          df -h