diff options
Diffstat (limited to '.forgejo/workflows/artcraft-update.yml')
| -rw-r--r-- | .forgejo/workflows/artcraft-update.yml | 243 |
1 files changed, 243 insertions, 0 deletions
diff --git a/.forgejo/workflows/artcraft-update.yml b/.forgejo/workflows/artcraft-update.yml new file mode 100644 index 0000000..419d627 --- /dev/null +++ b/.forgejo/workflows/artcraft-update.yml @@ -0,0 +1,243 @@ +name: ArtCraft update (manual) + +on: + workflow_dispatch: + +concurrency: + group: raveos-repo-publish + cancel-in-progress: false + +jobs: + update: + runs-on: iso-builder + + steps: + - name: Checkout PKGBUILDs repo + uses: actions/checkout@v4 + with: + fetch-depth: 0 + token: ${{ secrets.FORGEJO_TOKEN }} + + - name: Install build tools + run: | + set -euo pipefail + sudo pacman -Syu --noconfirm + sudo pacman -S --needed --noconfirm base-devel git pacman-contrib rsync curl jq cargo + + - name: Check latest versions and bump PKGBUILDs + id: bump + env: + GH_TOKEN: ${{ secrets.GH_MIRROR_TOKEN }} + run: | + set -euo pipefail + APPS=(designcraft effectcraft filmcraft lightcraft pdfcraft photocraft vectorcraft) + CHANGED=0 + for app in "${APPS[@]}"; do + AUTH=() + [ -n "${GH_TOKEN:-}" ] && AUTH=(-H "Authorization: Bearer ${GH_TOKEN}") + LATEST=$(curl -fsSL --retry 3 "${AUTH[@]}" \ + "https://api.github.com/repos/storytold/${app}/releases/latest" \ + | jq -r '.tag_name // empty' 2>/dev/null | sed 's/^v//' || true) + CUR=$(grep '^pkgver=' "artcraft-raveos/${app}/PKGBUILD" | cut -d= -f2) + if [ -z "$LATEST" ]; then + echo "FIGYELEM: ${app}: a legfrissebb verziot nem sikerult lekerdezni -> kihagyva" + continue + fi + if [ "$LATEST" = "$CUR" ]; then + echo "${app}: naprakesz (${CUR})" + continue + fi + echo "${app}: ${CUR} -> ${LATEST}" + curl -fsSL --retry 3 -o "/tmp/${app}-src.tar.gz" \ + "https://github.com/storytold/${app}/archive/refs/tags/v${LATEST}/${app}-${LATEST}.tar.gz" + SHA=$(sha256sum "/tmp/${app}-src.tar.gz" | cut -d' ' -f1) + sed -i "s/^pkgver=.*/pkgver=${LATEST}/" "artcraft-raveos/${app}/PKGBUILD" + sed -i "s/^sha256sums=('.*')$/sha256sums=('${SHA}')/" "artcraft-raveos/${app}/PKGBUILD" + sed -i "s/^pkgrel=.*/pkgrel=1/" "artcraft-raveos/${app}/PKGBUILD" + CHANGED=1 + done + rm -f /tmp/*-src.tar.gz || true + echo "CHANGED=${CHANGED}" >> $GITHUB_OUTPUT + + - name: Commit PKGBUILD bumps + if: steps.bump.outputs.CHANGED == '1' + run: | + set -euo pipefail + git config user.name "RaveOS Bot" + git config user.email "bot@raveos.hu" + git add artcraft-raveos + git commit -m "artcraft: frissites a legujabb upstream verziokra" + git push origin main + + - name: Sync core repo from VPS (rsync pull) + run: | + set -euo pipefail + RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes" + rm -rf /tmp/raveos-core-repo + mkdir -p /tmp/raveos-core-repo/x86_64 + rsync -az -e "$RSYNC_SSH" \ + root@10.66.66.1:/root/docker/repo/repo/x86_64/ /tmp/raveos-core-repo/x86_64/ + mkdir -p /tmp/builtpkgs + + - name: Import GPG signing key + run: | + set -euo pipefail + export GNUPGHOME=/tmp/raveos-gnupg + rm -rf "$GNUPGHOME" + mkdir -m 700 "$GNUPGHOME" + echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import + + - name: Build ArtCraft packages + run: | + set -euo pipefail + CORE="/tmp/raveos-core-repo/x86_64" + APPS=(designcraft effectcraft filmcraft lightcraft pdfcraft photocraft vectorcraft) + for app in "${APPS[@]}"; do + cd "artcraft-raveos/${app}" + PKGVER=$(grep '^pkgver=' PKGBUILD | cut -d= -f2) + PKGREL=$(grep '^pkgrel=' PKGBUILD | cut -d= -f2) + if ls "$CORE/${app}-${PKGVER}-${PKGREL}-"*.pkg.tar.zst 2>/dev/null | grep -q .; then + echo "${app} ${PKGVER}-${PKGREL} unchanged -> skip" + cd - >/dev/null + continue + fi + echo "=== Building ${app} ${PKGVER}-${PKGREL} ===" + rm -rf src pkg *.pkg.tar.zst || true + makepkg -s --noconfirm -f + cp -v "${app}"-*.pkg.tar.zst /tmp/builtpkgs/ + cd - >/dev/null + done + + - name: Sign built packages + run: | + set -euo pipefail + export GNUPGHOME=/tmp/raveos-gnupg + gpgconf --launch gpg-agent >/dev/null 2>&1 || true + BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true) + if [ -z "$BUILT" ]; then + echo "Nincs csomag alairashoz -> kihagyva" + exit 0 + fi + for pkg in $BUILT; do + gpg --batch --yes --pinentry-mode loopback \ + --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \ + --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \ + --detach-sign "$pkg" + echo "Alairva: $(basename "$pkg")" + done + + - name: Publish packages (repo-add + rsync push, only if changed) + run: | + set -euo pipefail + CORE="/tmp/raveos-core-repo/x86_64" + BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true) + if [ -z "$BUILT" ]; then + echo "Nincs uj csomag -> kihagyva" + exit 0 + fi + for pkg in $BUILT; do + PKGNAME=$(bsdtar -xOf "$pkg" .PKGINFO | awk -F' = ' '/^pkgname =/{print $2; exit}') + if [[ ! "$PKGNAME" =~ ^[a-zA-Z0-9_+-]+$ ]]; then + echo "HIBA: Ervenytelen csomagnev: $PKGNAME -> skip" + continue + fi + rm -f "$CORE/${PKGNAME}-"[0-9]*.pkg.tar.zst* 2>/dev/null || true + cp -v "$pkg" "$CORE/" + [ -f "$pkg.sig" ] && cp -v "$pkg.sig" "$CORE/" + done + export GNUPGHOME=/tmp/raveos-gnupg + cd "$CORE" + ALLPKGS=$(ls *.pkg.tar.zst) + repo-add raveos-core-repo.db.tar.xz $ALLPKGS + PASSFILE=$(mktemp) + chmod 600 "$PASSFILE" + printf '%s' "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" > "$PASSFILE" + for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do + gpg --batch --yes --pinentry-mode loopback \ + --passphrase-file "$PASSFILE" \ + --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \ + --detach-sign --no-armor -o "$f.sig" "$f" + done + rm -f "$PASSFILE" + ln -sf raveos-core-repo.db.tar.xz.sig raveos-core-repo.db.sig + ln -sf raveos-core-repo.files.tar.xz.sig raveos-core-repo.files.sig + rm -f raveos-core-repo.db.tar.gz* raveos-core-repo.files.tar.gz* 2>/dev/null || true + RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes" + rsync -az --delete -e "$RSYNC_SSH" \ + "$CORE/" root@10.66.66.1:/root/docker/repo/repo/x86_64/ + echo "::notice title=Published packages::ArtCraft csomagok publikálva" + + - name: Mirror raveos-core-repo to GitHub Releases + if: always() + run: | + set -euo pipefail + REPO="/tmp/raveos-core-repo" + [ -d "$REPO/x86_64" ] || { echo "Nincs mit tukrozni -> kihagyva"; exit 0; } + + TOKEN="${{ secrets.GH_MIRROR_TOKEN }}" + if [ -z "${TOKEN:-}" ]; then + echo "FIGYELMEZTETES: GH_MIRROR_TOKEN nincs beallitva -> GitHub tukrozes kihagyva" + exit 0 + fi + + OWNER="rave-os" + GH_REPO="RaveOS-core-repo-mirror" + TAG="core-repo-x86_64" + API="https://api.github.com/repos/${OWNER}/${GH_REPO}" + + release_json=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \ + "${API}/releases/tags/${TAG}" || true) + if [ -z "$release_json" ] || ! echo "$release_json" | jq -e .id &>/dev/null; then + echo "FIGYELMEZTETES: GitHub release nem erheto el (${TAG}) -> kihagyva" + exit 0 + fi + release_id=$(echo "$release_json" | jq -r .id) + existing_assets=$(echo "$release_json" | jq -r '.assets[]? | "\(.id)\t\(.name)"' 2>/dev/null || true) + + cd "$REPO/x86_64" + + for f in *.pkg.tar.zst; do + [ -f "$f" ] || continue + pkgname=$(echo "$f" | sed -E 's/-[0-9][^-]*-[^-]*-[^-]*\.pkg\.tar\.zst$//') + [ -n "$pkgname" ] || continue + while IFS=$'\t' read -r aid aname; do + [ -n "$aid" ] || continue + case "$aname" in + "${pkgname}-"*.pkg.tar.zst | "${pkgname}-"*.pkg.tar.zst.sig) + if [ "$aname" != "$f" ] && [ "$aname" != "${f}.sig" ]; then + curl -sf -X DELETE -H "Authorization: Bearer ${TOKEN}" \ + "${API}/releases/assets/${aid}" || true + echo "torolve (regi verzio): $aname" + fi + ;; + esac + done <<< "$existing_assets" + done + + existing_assets=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \ + "${API}/releases/${release_id}" | jq -r '.assets[] | "\(.id)\t\(.name)"') + + for f in *; do + [ -f "$f" ] || continue + asset_id=$(echo "$existing_assets" | awk -F'\t' -v n="$f" '$2==n {print $1}') + if [ -n "$asset_id" ]; then + curl -sf -X DELETE -H "Authorization: Bearer ${TOKEN}" \ + "${API}/releases/assets/${asset_id}" || true + fi + curl -sf -X POST \ + -H "Authorization: Bearer ${TOKEN}" \ + -H "Content-Type: application/octet-stream" \ + --data-binary "@${f}" \ + "https://uploads.github.com/repos/${OWNER}/${GH_REPO}/releases/${release_id}/assets?name=${f}" \ + || echo "HIBA: ${f} feltoltese sikertelen" + done + echo "::notice title=GitHub mirror::Kesz" + + - name: Cleanup + if: always() + run: | + gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true + sudo rm -rf /tmp/raveos-gnupg || true + sudo rm -rf /tmp/builtpkgs || true + sudo rm -rf /tmp/raveos-core-repo || true + df -h |