gnome fos fix

1 files changed, 167 insertions, 0 deletions

diff --git a/.forgejo/workflows/build-gnome.yml b/.forgejo/workflows/build-gnome.yml
new file mode 100644
index 0000000..8dd397e
--- /dev/null
+++ b/.forgejo/workflows/build-gnome.yml
@@ -0,0 +1,167 @@
+name: Build gnome-raveos 50 pin
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'gnome-raveos/**'
+  workflow_dispatch:
+
+concurrency:
+  group: raveos-gnome50-build
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: iso-builder
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install build dependencies
+        run: |
+          set -euo pipefail
+          sudo pacman -S --needed --noconfirm base-devel zstd rsync pacman-contrib
+
+      - name: Fetch core repo via rsync
+        run: |
+          set -euo pipefail
+          RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=no"
+          rm -rf /tmp/raveos-core-repo
+          mkdir -p /tmp/raveos-core-repo/x86_64
+          rsync -az -e "$RSYNC_SSH" \
+            root@10.66.66.1:/root/docker/repo/repo/x86_64/ /tmp/raveos-core-repo/x86_64/ || true
+          mkdir -p /tmp/builtpkgs
+
+      - name: Import GPG signing key
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          rm -rf "$GNUPGHOME"
+          mkdir -m 700 "$GNUPGHOME"
+          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import
+
+      - name: Build gnome-raveos 50 pin stack
+        run: |
+          set -euo pipefail
+          ORDER=(
+            gnome-desktop
+            gnome-desktop-common
+            gnome-desktop-4
+            gsettings-desktop-schemas
+            gsettings-system-schemas
+            gnome-keybindings
+            gnome-keyring
+            mutter
+            gnome-shell
+            gnome-session
+            gdm
+            gnome-settings-daemon
+            gnome-control-center
+            nautilus
+            gnome-console
+            gnome-disk-utility
+            gnome-system-monitor
+            eog
+            gedit
+            gnome-calculator
+            baobab
+            gnome-shell-extensions
+            gvfs
+            gvfs-mtp
+            gvfs-nfs
+            gvfs-smb
+            xdg-desktop-portal-gnome
+          )
+
+          mkdir -p /tmp/builtpkgs
+          CORE="/tmp/raveos-core-repo/x86_64"
+
+          for pkg in "${ORDER[@]}"; do
+            dir="gnome-raveos/$pkg"
+            [ -d "$dir" ] || continue
+
+            PKGVER=$(grep '^pkgver=' "$dir/PKGBUILD" | head -1 | cut -d= -f2 | tr -d "'\"")
+            PKGREL=$(grep '^pkgrel=' "$dir/PKGBUILD" | head -1 | cut -d= -f2 | tr -d "'\"")
+
+            echo "=== Checking $pkg (${PKGVER}-${PKGREL}) ==="
+            if ls "$CORE"/${pkg}-${PKGVER}-${PKGREL}-*.pkg.tar.zst 2>/dev/null | grep -q .; then
+              echo "$pkg already built -> skipping"
+              continue
+            fi
+
+            echo "=== Building $pkg ==="
+            cd "$dir"
+            rm -f *.pkg.tar.zst || true
+            makepkg -s --noconfirm -f
+
+            for built in *.pkg.tar.zst; do
+              [ -f "$built" ] || continue
+              cp -v "$built" /tmp/builtpkgs/
+              sudo pacman -U --noconfirm "$built" || true
+            done
+            cd - >/dev/null
+          done
+
+      - name: Sign built packages
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do
+            [ -f "$pkg" ] || continue
+            gpg --batch --yes --pinentry-mode loopback \
+                --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
+                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+                --detach-sign --no-armor "$pkg"
+          done
+
+      - name: Update repo database and sync to VPS
+        run: |
+          set -euo pipefail
+          BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true)
+          if [ -z "$BUILT" ]; then
+            echo "Nincs új csomag -> kihagyva"
+            exit 0
+          fi
+
+          CORE="/tmp/raveos-core-repo/x86_64"
+          for pkg in $BUILT; do
+            PKGFILE=$(basename "$pkg")
+            PKGNAME=$(echo "$PKGFILE" | sed 's/-[0-9][^-]*-[^-]*-[^-]*\.pkg\.tar\.zst$//')
+            rm -f "$CORE/${PKGNAME}-"*.pkg.tar.zst* 2>/dev/null || true
+            cp -v "$pkg" "$CORE/"
+            [ -f "$pkg.sig" ] && cp -v "$pkg.sig" "$CORE/"
+          done
+
+          export GNUPGHOME=/tmp/raveos-gnupg
+          cd "$CORE"
+          ALLPKGS=$(ls *.pkg.tar.zst)
+          repo-add raveos-core-repo.db.tar.xz $ALLPKGS
+
+          for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do
+            gpg --batch --yes --pinentry-mode loopback \
+                --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
+                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+                --detach-sign --no-armor -o "$f.sig" "$f"
+          done
+          ln -sf raveos-core-repo.db.tar.xz.sig raveos-core-repo.db.sig
+          ln -sf raveos-core-repo.files.tar.xz.sig raveos-core-repo.files.sig
+
+          RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=no"
+          rsync -az --delete -e "$RSYNC_SSH" \
+            "$CORE/" root@10.66.66.1:/root/docker/repo/repo/x86_64/
+
+          echo "::notice title=GNOME 50 pin published::All packages updated in repo"
+
+      - name: Cleanup
+        if: always()
+        run: |
+          gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true
+          sudo rm -rf /tmp/raveos-gnupg || true
+          sudo rm -rf /tmp/builtpkgs || true
+          sudo rm -rf /tmp/raveos-core-repo || true
+          df -h