ci: fix AUR deployment #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| cat .github/workflows/release.yml | ||
| name: Release | ||
| "on": | ||
| push: | ||
| branches: | ||
| - main | ||
| workflow_dispatch: {} | ||
| concurrency: | ||
| group: release-main | ||
| cancel-in-progress: false | ||
| jobs: | ||
| release_please: | ||
| name: Prepare semantic release | ||
| if: github.ref == 'refs/heads/main' | ||
| runs-on: ubuntu-24.04 | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| issues: write | ||
| outputs: | ||
| release_created: ${{ steps.release.outputs.release_created }} | ||
| tag_name: ${{ steps.release.outputs.tag_name }} | ||
| steps: | ||
| - name: Create or update release | ||
| id: release | ||
| uses: googleapis/release-please-action@v5 | ||
| with: | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| config-file: release-please-config.json | ||
| manifest-file: .release-please-manifest.json | ||
| publish: | ||
| name: Build and publish release | ||
| needs: | ||
| - release_please | ||
| if: needs.release_please.outputs.release_created == 'true' | ||
| runs-on: ubuntu-24.04 | ||
| environment: | ||
| name: aur-production | ||
| permissions: | ||
| contents: write | ||
| steps: | ||
| - name: Checkout released tag | ||
| uses: actions/checkout@v7 | ||
| with: | ||
| ref: ${{ needs.release_please.outputs.tag_name }} | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| - name: Set up Go | ||
| uses: actions/setup-go@v7 | ||
| with: | ||
| go-version: "1.26.4" | ||
| check-latest: false | ||
| cache: true | ||
| cache-dependency-path: go.sum | ||
| - name: Verify Go version | ||
| run: go version | ||
| - name: Download and verify modules | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| go mod download | ||
| go mod verify | ||
| - name: Run tests | ||
| run: go test ./... | ||
| - name: Generate man pages | ||
| run: go run . man --dir=man | ||
| - name: Install GoReleaser | ||
| uses: goreleaser/goreleaser-action@v7 | ||
| with: | ||
| distribution: goreleaser | ||
| version: "~> v2" | ||
| install-only: true | ||
| - name: Prepare AUR deployment key | ||
| shell: bash | ||
| env: | ||
| AUR_KEY_B64: ${{ secrets.AUR_KEY_B64 }} | ||
| run: | | ||
| set -euo pipefail | ||
| set +x | ||
| if [[ -z "${AUR_KEY_B64:-}" ]]; then | ||
| echo "::error::AUR_KEY_B64 is not configured in the aur-production environment." | ||
| exit 1 | ||
| fi | ||
| KEY_PATH="${RUNNER_TEMP}/penguinguide-aur-key" | ||
| umask 077 | ||
| printf '%s' "${AUR_KEY_B64}" | | ||
| base64 --decode > "${KEY_PATH}" | ||
| unset AUR_KEY_B64 | ||
| chmod 600 "${KEY_PATH}" | ||
| if ! ssh-keygen \ | ||
| -y \ | ||
| -P "" \ | ||
| -f "${KEY_PATH}" \ | ||
| >/dev/null 2>&1; then | ||
| echo "::error::The decoded AUR key is invalid or password-protected." | ||
| rm -f "${KEY_PATH}" | ||
| exit 1 | ||
| fi | ||
| printf 'AUR_KEY_PATH=%s\n' "${KEY_PATH}" >> "${GITHUB_ENV}" | ||
| - name: Run GoReleaser | ||
| shell: bash | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| PUBLISH_AUR: "true" | ||
| run: | | ||
| set -euo pipefail | ||
| set +x | ||
| goreleaser release \ | ||
| --clean \ | ||
| --config .goreleaser.yml | ||
| - name: Remove temporary AUR key | ||
| if: always() | ||
| shell: bash | ||
| run: | | ||
| set +x | ||
| rm -f "${RUNNER_TEMP}/penguinguide-aur-key" | ||
