1 files changed, 103 insertions, 0 deletions
diff --git a/.forgejo/workflows/publish-prebuilt-kernel.yml b/.forgejo/workflows/publish-prebuilt-kernel.yml
new file mode 100644
index 0000000..09ce379
--- /dev/null
+++ b/.forgejo/workflows/publish-prebuilt-kernel.yml
@@ -0,0 +1,103 @@
+name: Publish prebuilt linux-raveos kernel
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: raveos-repo-publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: iso-builder
+
+    steps:
+      - name: Check prebuilt packages
+        run: |
+          set -euo pipefail
+          SRC="$HOME/kernel-kesz"
+          ls "$SRC"/linux-*.pkg.tar.zst
+          for pkg in "$SRC"/linux-*.pkg.tar.zst; do
+            bsdtar -xOf "$pkg" .PKGINFO | grep -E '^(pkgname|pkgver) ='
+          done
+          ( cd "$SRC" && sha256sum -c SHA256SUMS )
+
+      - name: Fetch core repo via rsync
+        run: |
+          set -euo pipefail
+          RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes"
+          rm -rf /tmp/raveos-core-repo /tmp/builtpkgs
+          mkdir -p /tmp/raveos-core-repo/x86_64 /tmp/builtpkgs
+          rsync -az -e "$RSYNC_SSH" \
+            root@10.66.66.1:/root/docker/repo/repo/x86_64/ /tmp/raveos-core-repo/x86_64/
+          test -f /tmp/raveos-core-repo/x86_64/raveos-core-repo.db.tar.xz
+          cp -v "$HOME"/kernel-kesz/linux-*.pkg.tar.zst /tmp/builtpkgs/
+
+      - name: Import GPG signing key
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          rm -rf "$GNUPGHOME"
+          mkdir -m 700 "$GNUPGHOME"
+          printf '%s' "$GPG_PRIVATE_KEY" | base64 -d | gpg --batch --import
+
+      - name: Sign packages
+        env:
+          GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          PASSFILE=$(mktemp)
+          chmod 600 "$PASSFILE"
+          trap 'rm -f "$PASSFILE"' EXIT
+          printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE"
+          for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do
+            gpg --batch --yes --pinentry-mode loopback \
+                --passphrase-file "$PASSFILE" \
+                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+                --detach-sign --no-armor "$pkg"
+          done
+
+      - name: Update repo database and sync to VPS
+        env:
+          GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}
+        run: |
+          set -euo pipefail
+          CORE="/tmp/raveos-core-repo/x86_64"
+          for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do
+            PKGNAME=$(bsdtar -xOf "$pkg" .PKGINFO | awk -F' = ' '/^pkgname =/{print $2; exit}')
+            rm -f "$CORE/${PKGNAME}-"[0-9]*.pkg.tar.zst* 2>/dev/null || true
+            cp -v "$pkg" "$pkg.sig" "$CORE/"
+          done
+
+          export GNUPGHOME=/tmp/raveos-gnupg
+          cd "$CORE"
+          repo-add raveos-core-repo.db.tar.xz *.pkg.tar.zst
+
+          PASSFILE=$(mktemp)
+          chmod 600 "$PASSFILE"
+          trap 'rm -f "$PASSFILE"' EXIT
+          printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE"
+          for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do
+            gpg --batch --yes --pinentry-mode loopback \
+                --passphrase-file "$PASSFILE" \
+                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+                --detach-sign --no-armor -o "$f.sig" "$f"
+          done
+          ln -sf raveos-core-repo.db.tar.xz.sig raveos-core-repo.db.sig
+          ln -sf raveos-core-repo.files.tar.xz.sig raveos-core-repo.files.sig
+
+          RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes"
+          rsync -az --delete -e "$RSYNC_SSH" \
+            "$CORE/" root@10.66.66.1:/root/docker/repo/repo/x86_64/
+
+          rm -rf "$HOME/kernel-kesz"
+          echo "::notice title=Kernel published::prebuilt linux-raveos published"
+
+      - name: Cleanup
+        if: always()
+        run: |
+          gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true
+          rm -rf /tmp/raveos-gnupg /tmp/builtpkgs /tmp/raveos-core-repo || true