fix(packaging): validate aur packages against correct sources

Author: thewrz

.github/workflows/aur.yml

@@ -34,7 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         # honkhonk: source build. honkhonk-bin: .deb re-extract.
-        # honkhonk-git: VCS build from main.
+        # honkhonk-git: VCS build from main. PR validation rewrites it to the
+        # candidate head commit below so dependency removals are tested against
+        # the code that will become main.
         pkg: [honkhonk, honkhonk-bin, honkhonk-git]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -59,6 +61,16 @@ jobs:
           sudo -u builder makepkg --printsrcinfo > /tmp/.SRCINFO.fresh
           diff -u .SRCINFO /tmp/.SRCINFO.fresh
 
+      - name: Point VCS package at PR head
+        if: github.event_name == 'pull_request' && matrix.pkg == 'honkhonk-git'
+        working-directory: packaging/aur/${{ matrix.pkg }}
+        run: |
+          pr_repo='${{ github.event.pull_request.head.repo.full_name }}'
+          pr_head='${{ github.event.pull_request.head.sha }}'
+          sed -i \
+            "s|^source=.*|source=(\"git+https://github.com/${pr_repo}.git#commit=${pr_head}\")|" \
+            PKGBUILD
+
       - name: Wait for release artifacts (tag push only)
         if: startsWith(github.ref, 'refs/tags/') && matrix.pkg != 'honkhonk-git'
         working-directory: packaging/aur/${{ matrix.pkg }}

packaging/aur/honkhonk/.SRCINFO

@@ -10,6 +10,8 @@ pkgbase = honkhonk
 	makedepends = pkgconf
 	makedepends = clang
 	depends = pipewire
+	depends = gtk3
+	depends = libayatana-appindicator
 	depends = wayland
 	depends = libxkbcommon
 	depends = xdg-desktop-portal

packaging/aur/honkhonk/PKGBUILD

@@ -12,10 +12,13 @@ license=('MIT')
 # Runtime deps — each is dynamically linked or dlopened by the binary.
 # See README.md in this directory for the full per-dependency justification.
 #
-# The tray backend is pure Rust SNI over D-Bus, so there are no GTK,
-# appindicator, or xdotool runtime dependencies.
+# This stable package still builds the 0.1.0 tag, whose tray backend uses GTK3
+# and libayatana-appindicator. Drop these when _pkgtag points at a release that
+# includes the pure-Rust ksni tray backend.
 depends=(
     'pipewire'                # libpipewire-0.3.so — audio engine (pipewire-sys)
+    'gtk3'                    # libgtk-3.so / libgdk-3.so — tray menu (muda gtk feature)
+    'libayatana-appindicator' # libayatana-appindicator3.so — SNI tray (dlopened)
     'wayland'                 # libwayland-client.so — Iced/winit Wayland backend (dlopened)
     'libxkbcommon'            # libxkbcommon.so — keyboard mapping (winit, dlopened)
     'xdg-desktop-portal'      # D-Bus portal: file chooser + global shortcuts (ashpd)
@@ -27,7 +30,7 @@ makedepends=(
     'clang'   # libclang.so — pipewire-sys runs bindgen at build time
     # NOTE: pipewire headers are needed at build time but pipewire is already a
     # runtime dep (depends=), so it is present during makepkg — listing it here
-    # too would be redundant (namcap warns). Same for wayland/libxkbcommon:
+    # too would be redundant (namcap warns). Same for gtk3/wayland/libxkbcommon:
     # on Arch the runtime packages ship their own headers + .pc files.
 )
 provides=('honkhonk')

packaging/aur/honkhonk/README.md

@@ -28,19 +28,24 @@ offline against that freshly-pinned lockfile.
 
 ## Per-dependency justification
 
-Every entry in `depends=()` is dynamically linked or dlopened by the binary. The
-set was audited against issue #98 — anything not actually linked was dropped.
+Every entry in `depends=()` is dynamically linked or dlopened by the tagged
+binary this package builds. The current `pkgver=0.1.0` tag still uses the old
+GTK3 tray backend; drop the GTK/appindicator entries when `_pkgtag` points at a
+release that contains the pure-Rust `ksni` tray backend.
 
 | Dependency                  | Why it is required (binary links / dlopens it)                          | Arch | Fedora | Ubuntu/Debian |
 |-----------------------------|-------------------------------------------------------------------------|------|--------|---------------|
 | `pipewire`                  | `libpipewire-0.3.so` — audio engine (via the `pipewire` crate / -sys)   | extra | Everything | main |
+| `gtk3`                      | `libgtk-3.so` / `libgdk-3.so` — tray menu in the 0.1.0 tag              | extra | Everything | main |
+| `libayatana-appindicator`   | `libayatana-appindicator3.so` — SNI tray in the 0.1.0 tag               | extra | Everything | main |
 | `wayland`                   | `libwayland-client.so` — Iced/winit Wayland backend (dlopened)         | extra | Everything | main |
 | `libxkbcommon`              | `libxkbcommon.so` — keyboard mapping (winit, dlopened)                 | extra | Everything | main |
 | `xdg-desktop-portal`        | D-Bus service for file chooser + global shortcuts (`ashpd`, no link)    | extra | Everything | main |
 
-The tray backend uses `ksni` (StatusNotifierItem over zbus). It does not link
-GTK, libayatana-appindicator, or xdotool/libxdo. Re-verify package bumps with
-`namcap` and `cargo tree`.
+The current development branch uses `ksni` (StatusNotifierItem over zbus), so
+future release bumps should re-audit this table with `namcap` and `cargo tree`
+and remove the GTK/appindicator entries once the package no longer builds the
+0.1.0 tag.
 
 ## Per-release bump runbook