feat(packaging): publish workflows for AUR, COPR and the PPA - #33
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
thinkutils | eee1e1e | Jul 20 2026, 03:25 AM |
Completes the packaging story: the manifests existed but nothing published them. All three are workflow_dispatch only and default to dry_run. That is not caution for its own sake -- each writes to somewhere users install from, and one of them cannot be undone. A Launchpad upload can be superseded, never deleted, so publish-ppa prints every .changes file and attaches the source packages as an artifact before it would upload anything. All three verify the git tag is PUSHED before doing work. AUR's source and COPR's Source0 both point at the tag tarball, so a queued build would 404 partway through if the tag were only local -- cheap to check up front, slow to diagnose afterwards. Details that are easy to get wrong and are handled here: AUR's default branch is master. A local main needs HEAD:master or the push lands in a ref nobody installs from. updpkgsums runs before publishing so a SKIP placeholder can never reach the AUR, and the workflow fails if one survives. makepkg refuses to run as root, so the build happens as an unprivileged user. COPR needs --enable-net on because %build fetches crates and mock disables builder networking. That setting belongs to the PROJECT, not the spec, so it does not travel with the repo -- it is set on every publish rather than assumed. COPR chroots are resolved to the newest three rather than hardcoded; a fixed list goes stale every six months when Fedora branches. The Launchpad passphrase goes in gpg.conf, not an argument, because dpkg-buildpackage invokes gpg itself with no passphrase argument. The gpg-agent preset approach does not work: pinentry-mode loopback bypasses the agent, so the preset is never consulted and signing fails headless. A clearsign self-test runs before any build, so a broken key fails in seconds rather than after a full source build. Docs cover the one-time setup for each, including the Launchpad steps that block uploads until done -- signing the Code of Conduct, and decrypting the token Launchpad emails to verify key ownership.
vietanhdev
force-pushed
the
packaging/publish-workflows
branch
from
July 20, 2026 03:23
57f64f0 to
eee1e1e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the packaging story — the manifests existed but nothing published them.
All three are
workflow_dispatchonly and default todry_run: true. Each writes somewhere users install from, and one cannot be undone: a Launchpad upload can be superseded, never deleted. Sopublish-ppaprints every.changesfile and attaches the source packages as an artifact before it would upload.All three verify the git tag is pushed first. AUR's
sourceand COPR'sSource0both point at the tag tarball, so a queued build 404s partway through if the tag is only local — cheap to check up front, slow to diagnose after.Details that are easy to get wrong
mastermainneedsHEAD:master, or the push lands in a ref nobody installs fromupdpkgsumsbefore publishSKIPplaceholder can never reach the AUR — and the workflow fails if one survivesmakepkgrefuses root--enable-net on%buildfetches crates; mock disables networking. That setting belongs to the project, not the spec, so it doesn't travel with the repo — set on every publish rather than assumedThe Launchpad signing detail
The passphrase goes in
gpg.conf, not a command-line argument, becausedpkg-buildpackageinvokesgpgitself with no passphrase argument.The gpg-agent preset approach does not work:
pinentry-mode loopbackbypasses the agent entirely, so the preset is never consulted and signing fails headless with "Operation cancelled".A
gpg --clearsignself-test runs before any build, so a broken key fails in seconds rather than after a full source build.Secrets needed
AUR_SSH_PRIVATE_KEYCOPR_API_TOKENLAUNCHPAD_GPG_PRIVATE_KEY,LAUNCHPAD_GPG_PASSPHRASEDocs cover one-time setup for each, including the Launchpad steps that block uploads until done — signing the Ubuntu Code of Conduct, and decrypting the token Launchpad emails to verify key ownership.
Untested end to end, necessarily: none of these can run without credentials, and the PPA one is irreversible so it shouldn't be tried casually. Every workflow parses as valid YAML and the dry-run paths are the default.