diff options
Diffstat (limited to '.forgejo/workflows/build-theme-send-core-repo.yml')
| -rw-r--r-- | .forgejo/workflows/build-theme-send-core-repo.yml | 86 |
1 files changed, 18 insertions, 68 deletions
diff --git a/.forgejo/workflows/build-theme-send-core-repo.yml b/.forgejo/workflows/build-theme-send-core-repo.yml index 59ee204..c3973e3 100644 --- a/.forgejo/workflows/build-theme-send-core-repo.yml +++ b/.forgejo/workflows/build-theme-send-core-repo.yml @@ -23,7 +23,7 @@ jobs: run: | set -euo pipefail sudo pacman -Rdd --noconfirm hyprutils hyprwayland-scanner hyprlang hyprgraphics hyprcursor aquamarine hyprwire hyprland-guiutils hyprland xdg-desktop-portal-hyprland hyprpolkitagent hyprland-qt-support dms-shell || true - sudo pacman -Syu --noconfirm + sudo pacman -Syu --noconfirm || { sleep 15; sudo pacman -Syu --noconfirm; } || { sleep 15; sudo pacman -Syu --noconfirm; } sudo pacman -S --needed --noconfirm \ base-devel git pacman-contrib cmake qt6-tools go cargo gtk4-layer-shell @@ -38,15 +38,15 @@ jobs: mkdir -p /tmp/builtpkgs - name: Import GPG signing key + env: + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} run: | set -euo pipefail export GNUPGHOME=/tmp/raveos-gnupg rm -rf "$GNUPGHOME" mkdir -m 700 "$GNUPGHOME" gpgconf --launch gpg-agent >/dev/null 2>&1 || true - echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d > /tmp/raveos-signing-key.asc - gpg --batch --yes --import /tmp/raveos-signing-key.asc || true - rm -f /tmp/raveos-signing-key.asc + printf '%s' "$GPG_PRIVATE_KEY" | base64 -d | gpg --batch --yes --import || true gpg --list-secret-keys --with-colons | grep -q '^sec:' || { echo "HIBA: a RaveOS titkos kulcs nem importalodott" exit 1 @@ -328,6 +328,8 @@ jobs: cp -v opentubex-*.pkg.tar.zst /tmp/builtpkgs/ - name: Sign built packages + env: + GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }} run: | set -euo pipefail export GNUPGHOME=/tmp/raveos-gnupg @@ -337,15 +339,21 @@ jobs: echo "Nincs csomag alairashoz -> kihagyva" exit 0 fi + PASSFILE=$(mktemp) + chmod 600 "$PASSFILE" + trap 'rm -f "$PASSFILE"' EXIT + printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE" for pkg in $BUILT; do gpg --batch --yes --pinentry-mode loopback \ - --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \ + --passphrase-file "$PASSFILE" \ --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \ --detach-sign "$pkg" echo "Alairva: $(basename "$pkg")" done - name: Publish packages (repo-add + rsync push, only if changed) + env: + GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }} run: | set -euo pipefail @@ -375,7 +383,8 @@ jobs: PASSFILE=$(mktemp) chmod 600 "$PASSFILE" - printf '%s' "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" > "$PASSFILE" + trap 'rm -f "$PASSFILE"' EXIT + printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE" for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do gpg --batch --yes --pinentry-mode loopback \ --passphrase-file "$PASSFILE" \ @@ -395,70 +404,11 @@ jobs: echo "::notice title=Published packages::rsync-alapu publikalas kesz" - name: Mirror raveos-core-repo to GitHub Releases - if: always() + env: + GH_MIRROR_TOKEN: ${{ secrets.GH_MIRROR_TOKEN }} run: | set -euo pipefail - REPO="/tmp/raveos-core-repo" - [ -d "$REPO/x86_64" ] || { echo "Nincs mit tükrözni -> kihagyva"; exit 0; } - - TOKEN="${{ secrets.GH_MIRROR_TOKEN }}" - if [ -z "${TOKEN:-}" ]; then - echo "FIGYELMEZTETES: GH_MIRROR_TOKEN nincs beallitva -> GitHub tukrozes kihagyva" - exit 0 - fi - - OWNER="rave-os" - GH_REPO="RaveOS-core-repo-mirror" - TAG="core-repo-x86_64" - API="https://api.github.com/repos/${OWNER}/${GH_REPO}" - - release_json=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \ - "${API}/releases/tags/${TAG}" || true) - if [ -z "$release_json" ] || ! echo "$release_json" | jq -e .id &>/dev/null; then - echo "FIGYELMEZTETES: GitHub release nem erheto el (${TAG}) -> kihagyva" - exit 0 - fi - release_id=$(echo "$release_json" | jq -r .id) - existing_assets=$(echo "$release_json" | jq -r '.assets[]? | "\(.id)\t\(.name)"' 2>/dev/null || true) - - cd "$REPO/x86_64" - - for f in *.pkg.tar.zst; do - [ -f "$f" ] || continue - pkgname=$(echo "$f" | sed -E 's/-[0-9][^-]*-[^-]*-[^-]*\.pkg\.tar\.zst$//') - [ -n "$pkgname" ] || continue - while IFS=$'\t' read -r aid aname; do - [ -n "$aid" ] || continue - case "$aname" in - "${pkgname}-"*.pkg.tar.zst | "${pkgname}-"*.pkg.tar.zst.sig) - if [ "$aname" != "$f" ] && [ "$aname" != "${f}.sig" ]; then - curl -sf -X DELETE -H "Authorization: Bearer ${TOKEN}" \ - "${API}/releases/assets/${aid}" || true - echo "torolve (regi verzio): $aname" - fi - ;; - esac - done <<< "$existing_assets" - done - - existing_assets=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \ - "${API}/releases/${release_id}" | jq -r '.assets[] | "\(.id)\t\(.name)"') - - for f in *; do - [ -f "$f" ] || continue - asset_id=$(echo "$existing_assets" | awk -F'\t' -v n="$f" '$2==n {print $1}') - if [ -n "$asset_id" ]; then - curl -sf -X DELETE -H "Authorization: Bearer ${TOKEN}" \ - "${API}/releases/assets/${asset_id}" || true - fi - curl -sf -X POST \ - -H "Authorization: Bearer ${TOKEN}" \ - -H "Content-Type: application/octet-stream" \ - --data-binary "@${f}" \ - "https://uploads.github.com/repos/${OWNER}/${GH_REPO}/releases/${release_id}/assets?name=${f}" \ - || echo "HIBA: ${f} feltoltese sikertelen" - done - echo "::notice title=GitHub mirror::Kesz" + bash .forgejo/scripts/mirror-core-repo.sh /tmp/raveos-core-repo - name: Cleanup (SAFE) if: always() |