aur.yml

name: AUR PKGBUILD validation

on:
  push:
    paths:
      - 'packaging/aur/**'
      - '.github/workflows/aur.yml'
      - 'Cargo.toml'
  pull_request:
    paths:
      - 'packaging/aur/**'
      - '.github/workflows/aur.yml'
      - 'Cargo.toml'

permissions:
  contents: read

# Cancel superseded runs. push + pull_request both fire on a PR branch; without
# this, two full source compiles run concurrently on one runner and OOM each
# other (exit 137). Key on the head branch (not github.ref, which differs between
# push `refs/heads/...` and PR `refs/pull/.../merge`) so both event types for the
# same branch share one group and only one survives.
concurrency:
  group: aur-${{ github.workflow }}-${{ github.event.pull_request.head.ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  validate:
    name: ${{ matrix.pkg }} — namcap + .SRCINFO + makepkg
    runs-on: ubuntu-latest
    container:
      image: archlinux:base-devel
    strategy:
      fail-fast: false
      matrix:
        # honkhonk: source build. honkhonk-bin: .deb re-extract.
        # honkhonk-git: VCS build from main. PR validation rewrites it to the
        # candidate head commit below so dependency removals are tested against
        # the code that will become main.
        pkg: [honkhonk, honkhonk-bin, honkhonk-git]
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install validation tooling
        run: |
          pacman -Syu --noconfirm --needed namcap pacman-contrib git

      - name: Create non-root build user
        run: |
          useradd -m builder
          echo 'builder ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
          chown -R builder "packaging/aur/${{ matrix.pkg }}"

      - name: namcap lint
        working-directory: packaging/aur/${{ matrix.pkg }}
        run: sudo -u builder namcap PKGBUILD

      - name: .SRCINFO freshness check
        working-directory: packaging/aur/${{ matrix.pkg }}
        run: |
          sudo -u builder makepkg --printsrcinfo > /tmp/.SRCINFO.fresh
          diff -u .SRCINFO /tmp/.SRCINFO.fresh

      - name: Point VCS package at PR head
        if: github.event_name == 'pull_request' && matrix.pkg == 'honkhonk-git'
        working-directory: packaging/aur/${{ matrix.pkg }}
        env:
          PR_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          PR_HEAD: ${{ github.event.pull_request.head.sha }}
        run: |
          sed -i \
            "s|^source=.*|source=(\"git+https://github.com/${PR_REPO}.git#commit=${PR_HEAD}\")|" \
            PKGBUILD

      - name: Wait for release artifacts (tag push only)
        if: startsWith(github.ref, 'refs/tags/') && matrix.pkg != 'honkhonk-git'
        working-directory: packaging/aur/${{ matrix.pkg }}
        # A tag push fires this workflow alongside the release builds that
        # produce the very artifacts the PKGBUILDs download (deb.yml uploads
        # the -bin .deb minutes after the tag lands; the source tarball
        # appears when GitHub processes the tag). Poll each remote source URL
        # until it exists so validation runs AFTER its dependencies instead
        # of racing them to a 404. PR/branch runs skip this gate and fail
        # fast — there, a PKGBUILD pointing at a not-yet-published release is
        # a legitimate failure.
        run: |
          # `|| true` keeps a no-match grep from killing the step under
          # `bash -e` before the explicit fail-closed check below can print
          # a usable error.
          urls=$(sudo -u builder makepkg --printsrcinfo \
            | grep -oP 'source = (?:[^:]+::)?\Khttps://\S+' || true)
          if [ -z "$urls" ]; then
            echo "ERROR: no remote source URLs extracted from the PKGBUILD;" \
                 "refusing to silently bypass the artifact gate"
            exit 1
          fi
          for url in $urls; do
            echo "Waiting for: $url"
            for i in $(seq 1 40); do
              if curl -sfLI -o /dev/null "$url"; then
                echo "OK: $url"
                continue 2
              fi
              echo "  not there yet (attempt $i/40), sleeping 30s"
              sleep 30
            done
            echo "ERROR: $url still missing after 20 minutes"
            exit 1
          done

      - name: Build + install
        working-directory: packaging/aur/${{ matrix.pkg }}
        # Disable LTO and cap codegen parallelism for the CI compile only — the
        # release profile's `lto = true` peaks too high in memory and OOM-kills the
        # 7 GB runner (exit 137). This validates the PKGBUILD builds; it does not
        # ship the binary, so a non-LTO CI build is fine. `-bin` ignores these
        # (it re-extracts a .deb, no compile).
        #
        # NOTE: pass the vars via `env` (NOT `sudo -E`). `sudo -E` would also keep
        # HOME=/github/home (root's home), which `builder` can't write — cargo's
        # registry cache then fails with EACCES. Plain `sudo -u builder` resets
        # HOME to /home/builder; `env` injects only the two CARGO_* overrides.
        run: |
          sudo -u builder env \
            CARGO_PROFILE_RELEASE_LTO=false \
            CARGO_BUILD_JOBS=2 \
            makepkg --noconfirm --syncdeps --install

      - name: Installed file manifest
        run: |
          pacman -Ql ${{ matrix.pkg }}
          pacman -Ql ${{ matrix.pkg }} | grep -q '/usr/bin/honkhonk$'
          pacman -Ql ${{ matrix.pkg }} | grep -q '/usr/share/applications/honkhonk.desktop$'
          pacman -Ql ${{ matrix.pkg }} | grep -q '/usr/share/icons/hicolor/256x256/apps/honkhonk.png$'

      - name: Persistent-source conf.d packaged
        if: matrix.pkg == 'honkhonk-bin' || matrix.pkg == 'honkhonk-git'
        # The source `honkhonk` package builds the released tag, which predates
        # the #49 conf.d drop-in, so only `-bin` and the VCS package ship it today.
        # Once `_pkgtag` bumps past a release containing #49, extend this to the
        # `honkhonk` leg too.
        run: |
          pacman -Ql ${{ matrix.pkg }} | grep -q '/usr/share/pipewire/pipewire.conf.d/50-honkhonk.conf$'

      - name: Vendored conf.d matches canonical drop-in
        if: matrix.pkg == 'honkhonk-bin'
        run: |
          cmp packaging/aur/honkhonk-bin/50-honkhonk.conf packaging/pipewire/50-honkhonk.conf