fixup! chore: add CI to publish Flatpak to Mixxx repo

Author: acolombier

.github/workflows/flatpak.yml

@@ -32,11 +32,7 @@ jobs:
           ssh-agent -a $SSH_AUTH_SOCK > /dev/null
           ssh-add - <<< "${SSH_PRIVATE_KEY}"
           mkdir -p "${HOME}/.ssh"
-          cat >> "${HOME}/.ssh/known_hosts" <<EOF
-          ${SSH_HOST} ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQtz9VUh6ZindK6DiHQ108KUVI8yQX/PQSUSrMZJ0kWD56yi/mzpZ9Q6hB9E2Gd94CmoDQwnAHQiV6k8461Qv4wGK1ykFwsUG3iOXm/gPOP1Sd1u6GI9SF/ixh/a+WatzzjdC8Y8c0BuuYufV7/Hox6IHvoVsrRWQQwXcK/tpCOzgwgUBzoDxhmS5lFtTfOK6JIOcXbOFmiKWzBVnXCawBKZBEeajkvyTqhLCCu7xbhqXIsBP/UTMeFNsyzIqvJvqHgEm5MPo04PtX1Myvnzv15/cT23PQDGNKANCrMSrUAWtqSFMZdWSehS2R0BbCJ1TJIgsG1Zc+BBDL8vYOesm8TpkXvUdMKWSuptEawYMDORQgjXerTHtsYzvpYNAV4Cm0ajJXngjM926++F1PvlvXs7sLhhOVzVTELgJYwiqFZcIBEdR8jgEkwLQ9Goig0h8lFJpcIket0pmFPTytzrev3gyWnymdZ9ScIo4wEmnwAKNGVMFArZ7O3Ckx/qXAyb8=
-          ${SSH_HOST} ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC/q8hYkss2z4UhT43JRDq+yaUcE3P6VlmfQZWw/49GjwT+VbIuFmej3iLFn1y3YkzPLKYf+BVcXQixZGKNpKrA=
-          ${SSH_HOST} ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJR4dlJQ4NmvJj63YZmxhcUOVkmTITCfCwrCiGRaNe4
-          EOF
+          ssh-keyscan "${SSH_HOST}" >> "${HOME}/.ssh/known_hosts"
           echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "${GITHUB_ENV}"
 
       - name: Check out repository
@@ -58,25 +54,30 @@ jobs:
           if [[ "$REF" =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "commit_summary=Stable build for 2.5" >> $GITHUB_OUTPUT
             echo "channel=stable" >> $GITHUB_OUTPUT
-          elif [[ "$REF" == "refs/heads/2.6" ]]; then
+          elif [ "$REF" = "refs/heads/2.6" ]; then
             echo "commit_summary=Beta build for 2.6" >> $GITHUB_OUTPUT
             echo "channel=beta" >> $GITHUB_OUTPUT
             echo "expiry=30 days" >> $GITHUB_OUTPUT
-          elif [[ "$REF" == "refs/heads/main" ]]; then
+          elif [ "$REF" = "refs/heads/main" ]; then
             echo "commit_summary=Alpha build for 2.7" >> $GITHUB_OUTPUT
             echo "channel=alpha" >> $GITHUB_OUTPUT
             echo "expiry=14 days" >> $GITHUB_OUTPUT
+          else
+            echo "commit_summary=Snapshot build for ${GITHUB_SHA}" >> $GITHUB_OUTPUT
+            echo "channel=snapshot" >> $GITHUB_OUTPUT
+            echo "expiry=7 days" >> $GITHUB_OUTPUT
           fi
 
       - name: "Download bundles"
         env:
           GH_TOKEN: ${{ github.token }}
           RUN_ID: ${{ inputs.run_id }}
+        shell: bash
         run: |
           gh --repo mixxxdj/mixxx run download $RUN_ID --pattern 'Flatpak *' -D bundles
           find bundles/ -name *.flatpak -exec mv {} bundles/ \;
           find bundles/ -mindepth 1 -type d -delete
-          if [ ! `find bundles/ -name '*x86_64.flatpak | wc -l` -eq 1 ]; then
+          if [ ! `find bundles/ -name '*x86_64.flatpak' | wc -l` -eq 1 ]; then
             echo "At least a x86_64 build is expected. Current bundles:"
             find bundles/ -type f
             exit 1
@@ -106,17 +107,21 @@ jobs:
 
             flatpak build-import-bundle -v --gpg-sign=$GPG_KEY_ID repo.tmp "$file"
             checksum=$(ostree --repo=repo.tmp rev-parse "${type}/${id}/${arch}/master")
+            ostree --repo=repo.tmp show --raw --print-metadata-key=xa.metadata "${type}/${id}/${arch}/master"
+            ostree --repo=repo.tmp show --print-metadata-key=xa.metadata "${type}/${id}/${arch}/master"
+            metadata=`ostree --repo=repo.tmp show --print-metadata-key=xa.metadata "${type}/${id}/${arch}/master"`
             ostree --repo=repo pull --depth=-1 --mirror "upstream:${type}/${id}/${arch}/${CHANNEL}" || true
             ostree --repo=repo pull-local repo.tmp "${checksum}"
-            ostree --repo=repo commit -b "${type}/${id}/${arch}/${CHANNEL}" -s "$COMMIT_SUMMARY" "--add-metadata-string=version=$VERSION" "--tree=ref=${checksum}"
+            ostree --repo=repo commit --gpg-sign=$GPG_KEY_ID -b "${type}/${id}/${arch}/${CHANNEL}" -s "$COMMIT_SUMMARY" "--add-metadata-string=version=$VERSION" "--add-metadata-string=xa.metadata=$metadata" "--tree=ref=${checksum}"
+            ostree --repo=repo show --print-metadata-key=xa.metadata "${type}/${id}/${arch}/${CHANNEL}"
           }
 
           # Prepare local repos
           ostree --repo=repo.tmp init --mode=archive-z2
           ostree --repo=repo init --mode=archive-z2
 
           # Hook publish repo to the remote
-          ostree --repo=repo remote add --no-gpg-verify upstream https://downloads.mixxx.org/flatpak/
+          ostree --repo=repo remote add upstream https://downloads.mixxx.org/flatpak/
 
           for arch in "x86_64" "aarch64"; do
             import_to_repo "bundles/Mixxx-${VERSION}-${arch}.flatpak" org.mixxx.Mixxx ${arch} app
@@ -127,20 +132,13 @@ jobs:
             fi
           done
 
-      - name: "Update the repo manifest"
-        if: ${{ inputs.update_repo }}
-        shell: bash
-        run: |
-          cp packaging/flatpak/repo.flatpakrepo repo/repo.flatpakrepo
-
       - name: "Cleanup old builds"
         if: ${{ steps.prepare.outputs.expiry != null }}
         shell: bash
         env:
           EXPIRY: ${{ steps.prepare.outputs.expiry }}
         run: |
           ostree --repo=repo prune --refs-only --keep-younger-than="$EXPIRY ago"
-
       - name: "Push the updated repo"
         env:
           SSH_HOST: downloads-hostgator.mixxx.org
@@ -151,4 +149,13 @@ jobs:
           flatpak build-update-repo repo
           ./rsync-repos --src "repo/" --dest "${SSH_USER}@${SSH_HOST}:public_html/downloads/flatpak" --rsync-opts "--verbose --recursive --checksum --times --delay-updates"
 
+      - name: "Update the repo manifest"
+        if: ${{ inputs.update_repo }}
+        env:
+          SSH_HOST: downloads-hostgator.mixxx.org
+          SSH_USER: mixxx
+        shell: bash
+        run: |
+          rsync --verbose "packaging/flatpak/repo.flatpakrepo" "${SSH_USER}@${SSH_HOST}:public_html/downloads/flatpak/repo.flatpakrepo"
+
       # TODO we could also publish a .flatpakref file to allow one-click install a version and publish this as a comment to the PR.

.github/workflows/tmp_flatpak.yml

@@ -0,0 +1,40 @@
+name: Flatpak
+on:
+  push:
+    branches:
+      - chore/prepare-flatpak-ci
+
+jobs:
+  reset-flatpak:
+    name: Reset Flatpak
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Set up SSH Agent"
+        shell: bash
+        env:
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+          SSH_PRIVATE_KEY: ${{ secrets.DOWNLOADS_HOSTGATOR_DOT_MIXXX_DOT_ORG_KEY }}
+          SSH_HOST: downloads-hostgator.mixxx.org
+        run: |
+          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+          ssh-add - <<< "${SSH_PRIVATE_KEY}"
+          mkdir -p "${HOME}/.ssh"
+          ssh-keyscan "${SSH_HOST}" >> "${HOME}/.ssh/known_hosts"
+          echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "${GITHUB_ENV}"
+
+      - name: "Push the updated repo"
+        env:
+          SSH_HOST: downloads-hostgator.mixxx.org
+          SSH_USER: mixxx
+        shell: bash
+        run: |
+          ssh "${SSH_USER}@${SSH_HOST}" rm -rfv public_html/downloads/flatpak
+  publish-flatpak:
+    uses: ./.github/workflows/flatpak.yml
+    with:
+      update_repo: true
+      ref: ${{ github.ref }}
+      run_id: "22817007952"
+    secrets:
+      DOWNLOADS_HOSTGATOR_DOT_MIXXX_DOT_ORG_KEY: ${{ secrets.DOWNLOADS_HOSTGATOR_DOT_MIXXX_DOT_ORG_KEY }}
+      RRYAN_AT_MIXXX_DOT_ORG_GPG_PRIVATE_KEY: ${{ secrets.RRYAN_AT_MIXXX_DOT_ORG_GPG_PRIVATE_KEY }}

packaging/flatpak/repo.flatpakrepo

@@ -5,3 +5,4 @@ Homepage=https://mixxx.org/
 Comment=Flatpak repo for Mixxx releases and snapshots
 Description=Flatpak repo for Mixxx releases and snapshots
 Icon=https://mixxx.org/theme/images/mixxx-logo.svg
+GPGKey=LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCkNvbW1lbnQ6IEhvc3RuYW1lOiAKVmVyc2lvbjogSG9ja2V5cHVjayAyLjIKCnhzRk5CRTFjeENzQkVBQzJaNE5wbnhJb0ZiYzV1NzJMV01WMEdtV1VJNm5PekZXUHdGUWNSalIzRTVIb2F2dmYKVSs3dS9QSkRrdnN5OWV3VEI0OEVFNXB4T0dFRHN4WWVKRnFmTWJoazJESFNlbkp4OGtvaUsrK0JJYk5PMEpLTQpHOVlEME9QTmZQZnA1UzJnY09Dc2k1cElrTkdQZjE5bWMyKytKVTN1emxMM1JjOE5sMG9JdklMSmxWVDhhT2RzCkJ1RC9OaHVrNlFGQ1UzbGYwdUpBaFA3QU1mSnRHeS9QYTJ4QlQ5bDBKdGJDZGhSWW4rSHNKclAwbkNqSUNYMDkKQ1A0cTVFMHBaNDVrSkFOa3ZEVEh3SCtqZDBWaXhxcTcyWVhRZ0MvOWlMMXpUNnhvUkx6aG9SSTNXQ1M3djhVRwppZk01TTVacGFQL3ozQjdDYWlqNHB1ZGlqVFRHeEkzamhFUm1BR3hNQzNxdG1Bd1Exc201SXM0aHZVT0RSOWtkCnMwL2RaZGVHUG0zSy8xazRNcVluVndtTHV1M0x4SGd2OXliUXpnemp5Um9GaytqMWZnbzU1N08zUWdsRDczWEwKQ043cUVpWFFtNEJKTzJ1Y0MxbEVva1NtY2ZtOURTdk9xZzlPZDdJek5CQ3VDU0VLRjBjTXdWMC80QnE2Z3NMWgpwekl5cGRtc05oT2txQ1B4d0RQRXIyMFBFQU5CQThUMVd2MDY0OGNrdGZtaFd2aDduYkRURndVUmZFRlU2Z2lIClZmL1lNUVdLOUxReDdSVE1YNHFxSVB2VktkNEZ2UmREZ2x4QzloTnVxTWFucFQwb2RCTEI4WktnOHNDU05yTUQKQnhOU0ZvaGtSZmJBUkYyYldoRk5EcTExSzhGOTJHY1IrNFNlUU9NR2NJZHYzanZvbkRHYVRFRm13d0FSQVFBQgp6UmxTU2lCU2VXRnVJRHh5Y25saGJrQnRhWGg0ZUM1dmNtYyt3c0Y0QkJNQkFnQWlCUUpOWE1RckFoc0RCZ3NKCkNBY0RBZ1lWQ0FJSkNnc0VGZ0lEQVFJZUFRSVhnQUFLQ1JCdmNKR1UyU3hKUjYrTUVBQ09vcUxlWnhNQ0xTY3UKcFdmTGRyczVibDg2QzlRODlXeDFzeWMwcEFVc2tlU1o2SzFmZHJtQWE0Um9EeGsxYWx0L1hReFFQNE5IZ0ZXTApCTWVOQS82Uk44bHczTXZudVNPR2ozcHFkNEtoamswYTczRUt3REpXYWU1cGdKNnIxL0g1clVlOUlFVDRpTWpxCmh0V253c0dqWTdTOEhtKzRsaGtlbXhicmM3M1ZQb2E3S2x4cFVzdHVPSDFzSHh0aDkxZDlrazN6c2dHVEd2a2kKRTl2M1llWkYvcWRSNURhcDFwTElrWVg2VGpjMkIwekxMbXRoMTd4Tk1lUVhGL3pYNXZadnhGM3ZGODJFMEIvYQowNWFZUHUzc1hqSmpYcVd5UmxteFozRnZZdzB5TVZ3SEVRSkNyL3JkakZGL2liQW9XTGVJb1h6ZG1YRDR6OFpaCkw5eDdiVDhrdmFYWFFNbFVYWEdIQXRYVHRCTkNqSkNjR0xjc0c1RjVtUnVPb2toTHJkQ2l0K2VwdGJja2FZWHIKdmdzUlZDSXcwdnJUME9BMFlUTEVCZk9BbXBZWDI5ZDZjSHhLWVRWcW9WRVhaMzVMaE92STFGYk1sRXpiUVdyMQpIVGRMaUt3L1JPYWhGRmJTclNSS0tRUWFWV0EvSTJmQjIwdmhycys5WWFJVjFVVysrNTYyRC9IeElyZVFjeWdKCk9DVktZcTJjTndkVExPK2lWTXJxUk9TWDRuTE9TSkRpWkd1UmtDNUI3OVoxcjVGWXNoL2RJTlhrZ29PaldGdzIKZU8zcmNwZjBwWFMvUlFpajRsL1dMa01NTGFmcjUxZS9HSW53dGIvZm5oNHMxaVBZeUpXalpSSVRSYk1jRnZaSApMc3BiREw3SVVyaVQyVVhvRy9PYjVxd2lCNlZBZnM3QlRRUk5YTVFyQVJBQTdKTGhhV2VmR25SZVJJQlBGell0ClNod0kxS1l2MFFvRkhkRVpIZ2Z0aWxVNENkbmdHZ0xwcVVoeW03eWpYU3NRMmFaVXZrTExkcy9JeHZ2QWxsbnUKSWE5Q0Nzc242NjRtL0lXaGFRZVZrQ1BqaXBvTk8xWlRrQURLUkVzVHpOZ3c0TDdMVmQ4ZFNYc2h2TzdKc25zVgpIWkxrN3J4STdoSnRoK2xoRTVZUGVDVHBWNENPUzRMdG5Tc09MM28wekpmZGQ1Z0grY2J1VkxBSzFPalpFVExrCmIyMk1wOWRPQ1lzMFNNcUFMU2hXYkt1M085Mk1SeXczaFM5enBsa2poK0p2RU9pN1RLOGFOdVNYWFRsWHJxeEMKUUw3YXFiWE91S0xoZHBsMTVDdjdVUDRJSzY5UGpJWnArbzMraHpyajh1blJtaVduSnl5bkxFbUZQcWpHL3FrRQpZSGo3bEEvaTlUTzd1U0NUanFnb3NZM2dsM0JZSXQ4b0F6WGhGZjNSOWx5cEFQV29SeDA4YWF6WU9mS1lDNTNUCmpZSXhMT2orbTVrNnVsOUhNaHpjb2lWbWlHbDZlYW9OWGhaZlAvUFgvQlFncXRHL3RDTE9mVC9KWERNN0oxZFcKUFlXYktmeU9aRjlPcTNRU2ZpQkRRWXpLLzBYK0dYdTJodTg2TUxNanFReERueU55SDZHRWwwRmVsdHVWVFdHRAp2VnRsVkZjQ3YxOTIxdlNQUGhFc25jMFB1N0tObkJwNk1rVlpmMFZzdEVrSUwrV3lNeTRUQVdkUDJaeUVRdWh5CmN2RGE1RUtQaGNVWVM1SlBVbnR5b2U5THBkMmFVNDNyYjNneW95U1I2WlRxUUt5WnRtb0pTLzY5VXI5SWdZRCsKYm1pakNoZm5FTWlNdHBrd1lodlVqTjBBRVFFQUFjTEJYd1FZQVFJQUNRVUNUVnpFS3dJYkRBQUtDUkJ2Y0pHVQoyU3hKUjZQdEQvNHNKTzcydWszVjE3WDlscHo1THppeVlIcHVpTG1KZlFIZEE5aDYvYjI1dWg2cGFxV1EzSmdOCnY1N0RZR2RSdVR4NnREUUtVZFc4UlJOSGpqR2dGSFo5bHpOMVl0Q0lzb240RDF3QzkwSEJ3WVpJeTNHL2M2c08KTkdoUkhhb2Q3cjVNMGllOWZ4L3VTZkVaNGlESnBPUExsbE5KR3g2UlhZdFNSVFZMTlNiY0FvZVV0TW1aL1U0Wgp1ZDdnamlKWkpIOHdtWDZKUGkxbk5SdnlPcm54Q0hudTcvQ2l1SW8rT1M3ZXF6cHNvTDg4eU5rYlA5d3kxN1JsCkYyeW9pVmtPK0N4Mi9EZXdWWXdGQWpQY2RlRlp1REliZ2JWNzFLSDN4OWw3ejVESnpkMjhWdUkxK1VqNFJMekQKcGN1N0l0NGJNMnBoNzhSUlJEdjFrNFJMa1pjb2liMytLamIwbFhQMC9MSjgwRHluamxCaE5raS9qSExDWnFaMQpSRWhrcDB2Rzdlc25ZQWJtK0JHNjFvcm9XUUZ3QkZMVmpqSFNja1dtVk9OS2VuTWlSbXdZOGN5VDhyZjRhMlVXCktkVnJteWxQQVV6MEd3TFZrOGsxWkZxK0ZpUjRmd0F3T3ZweGpCY1VETVE5bG5CWjBRL2R6VU96RktaSStuK2wKNGFPYStZb1hBQlVPTGprVGNvMmQrUjlFb2tPV1kzQk0xTUZXU2l2WDlSRXJFZGFXNXN1ak5yS1JIMksyOHR2aQp3T1d3Z2N5RWFucGcyUzBWMU1SNHlTRFp3RHcxaG1Ib1F3OE5Jd1BJcWtHUmJaSlIwQ3J0Y3ZBekpMa2VQcW4vCk1zQ1YzN0RDUCtrVlNtY0RWcU5vcGYwclFNcFpLK3MvblhKS2RIVGJGdVFqd29DWUl1NENsZz09Cj1IaHY0Ci0tLS0tRU5EIFBHUCBQVUJMSUMgS0VZIEJMT0NLLS0tLS0K