docs(release): AUR pkgver is now derived from __version__ by CI

Author: peternaame-boop

CLAUDE.md

@@ -129,7 +129,7 @@ Three GitHub Actions workflows live in `.github/workflows/`:
 
 ## Releases
 
-The flow is **tag-driven**. Pushing a `vX.Y.Z` tag triggers `publish.yml`, which handles PyPI + the GitHub Release end-to-end. AUR is still updated by hand afterward.
+The flow is **tag-driven**. Pushing a `vX.Y.Z` tag triggers `publish.yml`, which handles PyPI + the GitHub Release end-to-end; `aur-publish.yml` then pushes to AUR automatically, deriving `pkgver` from `__version__` (never hand-bump `pkgver=` in `aur/PKGBUILD` — CI overwrites it).
 
 ### One-time setup (already done)
 
@@ -156,20 +156,11 @@ GitHub Environments `pypi` and `testpypi` exist in repo settings. No API tokens
 
 Trigger `Publish` manually from the Actions tab → `Run workflow` → target `testpypi`. Builds + uploads to https://test.pypi.org/project/ytm-player/ without touching production. Useful when changing build config or pyproject metadata.
 
-### After PyPI publishes — update AUR
+### AUR (automated)
 
-AUR (`ytm-player-git`) PKGBUILD lives in `aur/PKGBUILD`. After every release:
+`aur-publish.yml` runs after `Publish` succeeds: it checks out the release commit, derives the version from `__version__`, rewrites `pkgver=` in the copied `aur/PKGBUILD` (the committed value is only a placeholder), regenerates `.SRCINFO`, and pushes to AUR. No manual version step.
 
-1. If dependencies changed: update `depends`/`optdepends`/`makedepends` in `aur/PKGBUILD`.
-2. Push the AUR update:
-
-```bash
-git clone ssh://aur@aur.archlinux.org/ytm-player-git.git /tmp/ytm-player-aur
-cp aur/PKGBUILD /tmp/ytm-player-aur/
-cd /tmp/ytm-player-aur && makepkg --printsrcinfo > .SRCINFO
-git add PKGBUILD .SRCINFO && git commit -m "Update to vX.Y.Z" && git push
-rm -rf /tmp/ytm-player-aur
-```
+Still manual: if dependencies changed, update `depends`/`optdepends`/`makedepends` in `aur/PKGBUILD` before tagging. Manual push fallback (if the workflow fails) is documented in `RELEASING.md`.
 
 AUR package URL: https://aur.archlinux.org/packages/ytm-player-git
 

RELEASING.md

@@ -4,23 +4,24 @@ The release flow is **tag-driven**. Pushing a `vX.Y.Z` tag triggers PyPI publish
 
 ## Quick checklist
 
-1. **Bump version** — `src/ytm_player/__init__.py` → `__version__ = "X.Y.Z"`
-2. **Update PKGBUILD** — `aur/PKGBUILD` → `pkgver=X.Y.Z`
-3. **Fold CHANGELOG** — collapse all `### Unreleased` blocks into one `### vX.Y.Z (YYYY-MM-DD)` entry
-4. **Lint + test**:
+1. **Bump version** — `src/ytm_player/__init__.py` → `__version__ = "X.Y.Z"` (this is the
+   single source of truth: the tag guard checks it and the AUR workflow derives `pkgver`
+   from it — do NOT hand-edit `pkgver=` in `aur/PKGBUILD`, CI overwrites it)
+2. **Fold CHANGELOG** — collapse all `### Unreleased` blocks into one `### vX.Y.Z (YYYY-MM-DD)` entry
+3. **Lint + test**:
    ```bash
    .venv/bin/ruff format src/ tests/
    .venv/bin/ruff check src/ tests/
    .venv/bin/pytest -x -q
    ```
-5. **Commit + tag + push**:
+4. **Commit + tag + push**:
    ```bash
    git add -A
    git commit -m "chore(release): vX.Y.Z"
    git tag vX.Y.Z
    git push origin master --tags
    ```
-6. **Watch the workflows**:
+5. **Watch the workflows**:
    ```bash
    gh run watch --exit-status
    ```
@@ -35,7 +36,7 @@ No API tokens — auth is via OIDC trusted-publisher entries at PyPI and TestPyP
 
 ### `Publish AUR` workflow (`.github/workflows/aur-publish.yml`)
 
-Triggered after `Publish` succeeds. Reads `pkgver` from `aur/PKGBUILD`, clones `ssh://aur@aur.archlinux.org/ytm-player-git.git` via SSH key, copies `PKGBUILD`, regenerates `.SRCINFO` via `scripts/regenerate_srcinfo.py` (pure Python — no Arch dependency on Ubuntu CI runners), commits and pushes.
+Triggered after `Publish` succeeds. Checks out the exact commit the `Publish` run built (the one the tag guard verified), reads the version from `__version__` in `src/ytm_player/__init__.py`, clones `ssh://aur@aur.archlinux.org/ytm-player-git.git` via SSH key, copies `PKGBUILD`, rewrites its `pkgver=` line to the real version (the committed `pkgver=` is only a placeholder), regenerates `.SRCINFO` via `scripts/regenerate_srcinfo.py` (pure Python — no Arch dependency on Ubuntu CI runners), commits and pushes.
 
 The `regenerate_srcinfo.py` script handles shell variable expansion (`${url}`, `$pkgname`) so PKGBUILD constructs like `source=("git+${url}.git")` resolve correctly in the emitted `.SRCINFO`.
 
@@ -44,6 +45,8 @@ The `regenerate_srcinfo.py` script handles shell variable expansion (`${url}`, `
 ```bash
 git clone ssh://aur@aur.archlinux.org/ytm-player-git.git /tmp/ytm-player-aur
 cp aur/PKGBUILD /tmp/ytm-player-aur/
+# The committed pkgver= is a placeholder — set the real version, like CI does:
+sed -i "s/^pkgver=.*/pkgver=X.Y.Z/" /tmp/ytm-player-aur/PKGBUILD
 python3 scripts/regenerate_srcinfo.py /tmp/ytm-player-aur/PKGBUILD /tmp/ytm-player-aur/.SRCINFO
 cd /tmp/ytm-player-aur
 git add PKGBUILD .SRCINFO