BUILDER

scripts/build.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+version="${1:?usage: build.sh VERSION TAG}"
+tag="${2:?usage: build.sh VERSION TAG}"
+[[ "$tag" == "v$version" ]] || { echo "Tag/version mismatch: $tag vs $version" >&2; exit 1; }
+
+sed -i -E "s/^pkgver=.*/pkgver=${version}/; s/^pkgrel=.*/pkgrel=1/" PKGBUILD
+
+# makepkg must not run as root. In Gitea's Arch container the job normally runs
+# as root, so build as an unprivileged account and keep the workspace writable.
+if [[ "$(id -u)" -eq 0 ]]; then
+  id builder >/dev/null 2>&1 || useradd --create-home --shell /bin/bash builder
+  chown -R builder:builder "$PWD"
+  runuser -u builder -- makepkg --syncdeps --cleanbuild --clean --noconfirm
+  # Restore ownership so later workflow steps can commit .current-version as the runner user.
+  chown -R "$(stat -c %u:%g .git 2>/dev/null || echo 0:0)" "$PWD" 2>/dev/null || chown -R root:root "$PWD"
+else
+  makepkg --syncdeps --cleanbuild --clean --noconfirm
+fi
+
+pkg="$(find . -maxdepth 1 -type f -name 'ratune-*.pkg.tar.zst' -print -quit)"
+[[ -n "$pkg" ]] || { echo "No package was produced" >&2; exit 1; }
+printf '%s\n' "$pkg" > .package-path
+echo "Built package: $pkg"

scripts/check-release.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+api="https://api.github.com/repos/acmagn/ratune/releases/latest"
+json="$(curl --fail --silent --show-error --retry 3 "$api")"
+tag="$(jq -er '.tag_name | select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+"))' <<<"$json")"
+version="${tag#v}"
+current="$(tr -d '[:space:]' < .current-version 2>/dev/null || true)"
+
+echo "Latest Ratune release: $tag"
+echo "Previously published: ${current:-none}"
+
+if [[ "$tag" == "$current" ]]; then
+  echo "Release already published; skipping."
+  {
+    echo "tag=$tag"
+    echo "version=$version"
+    echo "skip=true"
+  } >> "${GITHUB_OUTPUT:-/dev/null}"
+  exit 0
+fi
+
+{
+  echo "tag=$tag"
+  echo "version=$version"
+  echo "skip=false"
+} >> "${GITHUB_OUTPUT:-/dev/null}"

scripts/publish.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${NEXSPENCE_URL:?Set Gitea secret NEXSPENCE_URL}"
+: "${NEXSPENCE_TOKEN:?Set Gitea secret NEXSPENCE_TOKEN}"
+: "${NEXSPENCE_REPOSITORY:=noko-arch}"
+
+pkg="$(cat .package-path)"
+[[ -f "$pkg" ]] || { echo "Package not found: $pkg" >&2; exit 1; }
+
+repo_name="$NEXSPENCE_REPOSITORY"
+base="${NEXSPENCE_URL%/}/repository/${repo_name}/x86_64"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+cp "$pkg" "$tmp/"
+pkg_file="$(basename "$pkg")"
+
+# Raw hosted storage does not preserve repo-add symlinks, so upload both
+# compressed and uncompressed database files as real objects.
+repo-add --remove "$tmp/${repo_name}.db.tar.zst" "$tmp/$pkg_file"
+repo-add --remove "$tmp/${repo_name}.files.tar.zst" "$tmp/$pkg_file"
+zstd -q -d -c "$tmp/${repo_name}.db.tar.zst" > "$tmp/${repo_name}.db"
+zstd -q -d -c "$tmp/${repo_name}.files.tar.zst" > "$tmp/${repo_name}.files"
+
+upload() {
+  local file="$1"
+  local remote="$base/$(basename "$file")"
+  echo "==> PUT $(basename "$file")"
+  curl --fail-with-body --retry 5 --retry-all-errors \
+    --connect-timeout 20 --max-time 900 \
+    -X PUT -H "Authorization: Bearer ${NEXSPENCE_TOKEN}" \
+    --upload-file "$file" "$remote"
+}
+
+upload "$tmp/$pkg_file"
+upload "$tmp/${repo_name}.db"
+upload "$tmp/${repo_name}.db.tar.zst"
+upload "$tmp/${repo_name}.files"
+upload "$tmp/${repo_name}.files.tar.zst"
+
+echo "Published package and repository database to $base/"

scripts/test.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+pkg="$(cat .package-path)"
+[[ -f "$pkg" ]] || { echo "Package not found: $pkg" >&2; exit 1; }
+
+echo "==> Package metadata"
+pacman -Qip "$pkg"
+namcap "$pkg" || {
+  echo "namcap reported warnings; review them above."
+}
+
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+bsdtar -xf "$pkg" -C "$tmp"
+bin="$tmp/usr/bin/ratune"
+[[ -x "$bin" ]] || { echo "ratune binary missing or not executable" >&2; exit 1; }
+file "$bin"
+ldd "$bin" | tee "$tmp/ldd.txt"
+if grep -q 'not found' "$tmp/ldd.txt"; then
+  echo "Unresolved shared library dependency detected" >&2
+  exit 1
+fi
+"$bin" --version
+echo "Package smoke test passed."