mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
3746e75301
The fips-git AUR workflow published PKGBUILD-git on every dispatch and every qualifying master push without running namcap on it, and nothing ran it on a pull request, so an error-level finding reached the AUR unseen. A new lint job patches PKGBUILD-git with the same script the publish job uses and runs it through the namcap gate, which fails on error-level findings. The publish job now needs it and is skipped on pull requests. A pull_request trigger, filtered to the package's files, the gate and the workflow itself, runs the lint without publishing. The lint covers the PKGBUILD only. PKGBUILD-git builds from the GitHub repository, so building it here would compile GitHub's master rather than the tree under review; the release package, which declares the same dependencies and package() body, is built and linted on every push and pull request. Because the patch now runs under two different awks, the patch script checks that the computed sums actually landed in the file and fails otherwise, rather than leaving stale sums and exiting 0.
84 lines
3.3 KiB
YAML
84 lines
3.3 KiB
YAML
name: AUR Publish (fips-git)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- master
|
|
paths:
|
|
- 'packaging/aur/PKGBUILD-git'
|
|
- 'packaging/aur/fips.sysusers'
|
|
- 'packaging/aur/fips.tmpfiles'
|
|
- 'packaging/aur/fips.install'
|
|
pull_request:
|
|
paths:
|
|
- 'packaging/aur/PKGBUILD-git'
|
|
- 'packaging/aur/fips.sysusers'
|
|
- 'packaging/aur/fips.tmpfiles'
|
|
- 'packaging/aur/fips.install'
|
|
- 'packaging/aur/namcap-gate.sh'
|
|
- 'packaging/aur/patch-pkgbuild-git.sh'
|
|
- '.github/workflows/aur-publish-git.yml'
|
|
|
|
jobs:
|
|
# ───────────────────────────────────────────────────────────────────────────
|
|
# Lint the PKGBUILD-git this workflow publishes, patched by the same script
|
|
# the publish job uses, and fail on namcap error-level (E:) findings. Runs
|
|
# before every publish and, without publishing, on pull requests that touch
|
|
# the package's files.
|
|
#
|
|
# It lints the PKGBUILD only and does not build fips-git: PKGBUILD-git's
|
|
# source= is the GitHub repository, so a build here would compile GitHub's
|
|
# master rather than the tree under review. The built-package lint is the
|
|
# release package's, in aur-publish.yml, which declares the same depends,
|
|
# optdepends and package() body and is built and linted on every push and
|
|
# pull request.
|
|
# ───────────────────────────────────────────────────────────────────────────
|
|
aur-lint-fips-git:
|
|
name: Lint fips-git AUR PKGBUILD
|
|
runs-on: ubuntu-latest
|
|
container: archlinux:base-devel
|
|
|
|
steps:
|
|
- name: Install lint tooling
|
|
run: |
|
|
set -euo pipefail
|
|
pacman -Sy --noconfirm --needed namcap
|
|
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
|
|
|
|
- name: Patch PKGBUILD-git b2sums for local assets
|
|
run: bash packaging/aur/patch-pkgbuild-git.sh
|
|
|
|
- name: namcap PKGBUILD-git
|
|
run: bash packaging/aur/namcap-gate.sh packaging/aur/PKGBUILD-git
|
|
|
|
# Publish to the AUR on a dispatch or a master push, never on a pull
|
|
# request, and only after the lint above has passed on the same commit.
|
|
aur-publish-fips-git:
|
|
name: Publish fips-git to AUR
|
|
needs: aur-lint-fips-git
|
|
if: github.event_name != 'pull_request'
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
|
|
|
|
- name: Patch PKGBUILD-git b2sums for local assets
|
|
run: bash packaging/aur/patch-pkgbuild-git.sh
|
|
|
|
- name: Publish to AUR
|
|
uses: KSXGitHub/github-actions-deploy-aur@abe8ac26b51011c88be58c8809fd2ac674068ea5 # v4.1.2
|
|
with:
|
|
pkgname: fips-git
|
|
pkgbuild: packaging/aur/PKGBUILD-git
|
|
updpkgsums: false
|
|
assets: |
|
|
packaging/aur/fips.sysusers
|
|
packaging/aur/fips.tmpfiles
|
|
packaging/aur/fips.install
|
|
commit_username: ${{ github.repository_owner }}
|
|
commit_email: ${{ secrets.AUR_EMAIL }}
|
|
ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
|
|
commit_message: "Update PKGBUILD-git (${{ github.sha }})"
|