Skip to content

Commit 0665c96

Browse files
matpdevmatpdev
committed
fix: replace goreleaser AUR integration with manual ssh-agent push
1 parent 5f4cda7 commit 0665c96

2 files changed

Lines changed: 129 additions & 96 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 116 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -5,24 +5,21 @@
55
# vX.Y.Z is pushed to the repository (e.g.: via `make release` or scripts/release.sh).
66
#
77
# Full flow:
8-
# git commit → scripts/release.sh → tag vX.Y.Z → this workflow → goreleaser
9-
# ↓
10-
# binários + archives + GitHub Release
11-
# ↓
12-
# (se AUR_KEY configurado) AUR push
8+
# git commit → tag vX.Y.Z → this workflow
9+
# ↓
10+
# goreleaser → binaries + archives + GitHub Release (always)
11+
# ↓
12+
# Publish to AUR (only if AUR_KEY is set)
1313
#
1414
# ── AUR secret setup ──────────────────────────────────────────────────────────
15-
# The AUR_KEY secret MUST be stored as base64 to avoid newline corruption.
16-
# GitHub Actions mangles multi-line secrets; base64 encodes them to a single
17-
# line that is decoded byte-for-byte back to the original key file.
15+
# Store the SSH private key as base64 to avoid newline corruption from GitHub
16+
# Actions secret expansion. Run once on your machine:
1817
#
19-
# One-time setup — encode your AUR SSH private key and store it as AUR_KEY:
18+
# Linux: base64 -w 0 ~/.ssh/aur > /tmp/aur_b64.txt
19+
# macOS: base64 -i ~/.ssh/aur > /tmp/aur_b64.txt
2020
#
21-
# Linux: base64 -w 0 ~/.ssh/aur > aur_key_b64.txt
22-
# macOS: base64 -i ~/.ssh/aur > aur_key_b64.txt
23-
#
24-
# Copy the content of aur_key_b64.txt and paste it as the AUR_KEY secret at:
25-
# Settings → Secrets and variables → Actions → New repository secret
21+
# Then go to: Settings → Secrets and variables → Actions → AUR_KEY → Update
22+
# and paste the single-line base64 output.
2623
# ==============================================================================
2724

2825
name: Release
@@ -33,23 +30,20 @@ on:
3330
- "v[0-9]+.[0-9]+.[0-9]+" # v1.2.3
3431
- "v[0-9]+.[0-9]+.[0-9]+-*" # v1.2.3-beta.1 (pre-release)
3532

36-
# Minimum permissions required for goreleaser to create the release
3733
permissions:
38-
contents: write # create releases and upload assets
39-
packages: write # publish packages (if needed in the future)
34+
contents: write
35+
packages: write
4036

4137
jobs:
42-
# ── Goreleaser ───────────────────────────────────────────────────────────────
43-
goreleaser:
38+
# ── Release ──────────────────────────────────────────────────────────────────
39+
release:
4440
name: Release ${{ github.ref_name }}
4541
runs-on: ubuntu-latest
4642

4743
steps:
48-
- name: Checkout (com histórico completo)
44+
- name: Checkout
4945
uses: actions/checkout@v4
5046
with:
51-
# fetch-depth 0 is required for goreleaser to generate the changelog
52-
# correctly from the full commit and tag history.
5347
fetch-depth: 0
5448

5549
- name: Setup Go
@@ -64,69 +58,128 @@ jobs:
6458
go mod tidy
6559
git diff --exit-code go.mod go.sum
6660

67-
# Runs tests before publishing — failure here aborts the release
6861
- name: Test
6962
run: go test -race ./...
7063

71-
# Decodes the base64-encoded AUR_KEY secret into a proper PEM key file.
72-
# goreleaser v2 requires private_key to be a FILE PATH, not inline content.
73-
# Storing the key as base64 avoids the newline corruption that GitHub
74-
# Actions causes when expanding multi-line secrets — which triggers
75-
# "error in libcrypto" from OpenSSH when it tries to parse the key.
76-
- name: Setup AUR key
64+
# ── Goreleaser (GitHub Release only, AUR handled separately below) ──────
65+
- name: Run goreleaser
66+
uses: goreleaser/goreleaser-action@v6
67+
with:
68+
distribution: goreleaser
69+
version: "~> v2"
70+
args: release --clean --skip=aurs
71+
env:
72+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
73+
74+
# ── AUR publish ──────────────────────────────────────────────────────────
75+
# Uses ssh-agent to load the key into memory, bypassing the OpenSSH
76+
# file-loading path that causes "error in libcrypto" with go-git / git.
77+
# The AUR_KEY secret must be base64-encoded (see header comment above).
78+
- name: Decode AUR key
7779
id: aur
7880
env:
7981
AUR_KEY_B64: ${{ secrets.AUR_KEY }}
8082
run: |
81-
if [ -n "$AUR_KEY_B64" ]; then
82-
mkdir -p ~/.ssh
83-
echo "$AUR_KEY_B64" | base64 -d > ~/.ssh/aur_key
84-
chmod 600 ~/.ssh/aur_key
85-
# Validate the decoded key is parseable before proceeding
86-
if ssh-keygen -l -f ~/.ssh/aur_key > /dev/null 2>&1; then
87-
echo "has_key=true" >> "$GITHUB_OUTPUT"
88-
else
89-
echo "::error title=AUR_KEY inválida::A chave decodificada não é um arquivo de chave SSH válido."
90-
echo "::error title=AUR_KEY inválida::Verifique se o secret foi armazenado em base64 (veja o comentário no topo deste arquivo)."
91-
echo "has_key=false" >> "$GITHUB_OUTPUT"
92-
fi
93-
else
83+
if [ -z "$AUR_KEY_B64" ]; then
9484
echo "has_key=false" >> "$GITHUB_OUTPUT"
95-
echo "::warning title=AUR_KEY ausente::Publicação no AUR ignorada. Configure o secret AUR_KEY para habilitar."
85+
echo "::warning title=AUR_KEY ausente::Publicação no AUR ignorada."
86+
exit 0
9687
fi
9788

98-
- name: Run goreleaser
99-
uses: goreleaser/goreleaser-action@v6
100-
with:
101-
distribution: goreleaser
102-
version: "~> v2"
103-
args: >-
104-
release --clean
105-
${{ steps.aur.outputs.has_key != 'true' && '--skip=aurs' || '' }}
89+
mkdir -p ~/.ssh
90+
echo "$AUR_KEY_B64" | base64 -d > ~/.ssh/aur_key
91+
chmod 600 ~/.ssh/aur_key
92+
93+
if ! ssh-keygen -l -f ~/.ssh/aur_key > /dev/null 2>&1; then
94+
echo "has_key=false" >> "$GITHUB_OUTPUT"
95+
echo "::error title=AUR_KEY inválida::Chave não reconhecida. Confirme que o secret está em base64."
96+
exit 0
97+
fi
98+
99+
echo "has_key=true" >> "$GITHUB_OUTPUT"
100+
101+
- name: Publish to AUR
102+
if: steps.aur.outputs.has_key == 'true'
106103
env:
107-
# GitHub token to create the release and upload assets.
108-
# GITHUB_TOKEN is automatically injected by Actions — no extra configuration needed.
109-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
110-
# goreleaser v2 expects a FILE PATH for private_key, not inline key content.
111-
# Points to the file written and validated by the "Setup AUR key" step above.
112-
AUR_KEY: /home/runner/.ssh/aur_key
104+
GIT_AUTHOR_NAME: goreleaserbot
105+
GIT_AUTHOR_EMAIL: bot@goreleaser.com
106+
GIT_COMMITTER_NAME: goreleaserbot
107+
GIT_COMMITTER_EMAIL: bot@goreleaser.com
108+
run: |
109+
# ── Load key into agent (avoids all file-based libcrypto issues) ────
110+
eval "$(ssh-agent -s)"
111+
ssh-add ~/.ssh/aur_key
112+
ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
113+
114+
# ── Version and checksums ────────────────────────────────────────────
115+
VERSION="${GITHUB_REF_NAME#v}"
116+
SHA_X86_64=$(grep "linux_amd64.tar.gz" dist/checksums.txt | awk '{print $1}')
117+
SHA_I686=$(grep "linux_386.tar.gz" dist/checksums.txt | awk '{print $1}')
118+
119+
if [ -z "$SHA_X86_64" ] || [ -z "$SHA_I686" ]; then
120+
echo "::error::Checksums não encontrados em dist/checksums.txt"
121+
exit 1
122+
fi
123+
124+
# ── Clone AUR repo ───────────────────────────────────────────────────
125+
git -c init.defaultBranch=master \
126+
clone ssh://aur@aur.archlinux.org/cpp-gen-bin.git /tmp/aur-cpp-gen-bin
127+
128+
# ── Generate PKGBUILD with real version and checksums ────────────────
129+
sed \
130+
-e "s/^pkgver=.*/pkgver=${VERSION}/" \
131+
-e "s/^pkgrel=.*/pkgrel=1/" \
132+
-e "s/sha256sums_x86_64=('SKIP')/sha256sums_x86_64=('${SHA_X86_64}')/" \
133+
-e "s/sha256sums_i686=('SKIP')/sha256sums_i686=('${SHA_I686}')/" \
134+
aur/PKGBUILD > /tmp/aur-cpp-gen-bin/PKGBUILD
135+
136+
# ── Generate .SRCINFO ────────────────────────────────────────────────
137+
cat > /tmp/aur-cpp-gen-bin/.SRCINFO << EOF
138+
pkgbase = cpp-gen-bin
139+
pkgdesc = Modern C++ project generator with CMake, package managers, IDE configurations and development tools
140+
pkgver = ${VERSION}
141+
pkgrel = 1
142+
url = https://github.com/matpdev/cpp-gen
143+
arch = x86_64
144+
arch = i686
145+
license = MIT
146+
provides = cpp-gen
147+
conflicts = cpp-gen
148+
options = !strip
149+
source_x86_64 = cpp-gen-bin-${VERSION}-x86_64.tar.gz::https://github.com/matpdev/cpp-gen/releases/download/v${VERSION}/cpp-gen_${VERSION}_linux_amd64.tar.gz
150+
sha256sums_x86_64 = ${SHA_X86_64}
151+
source_i686 = cpp-gen-bin-${VERSION}-i686.tar.gz::https://github.com/matpdev/cpp-gen/releases/download/v${VERSION}/cpp-gen_${VERSION}_linux_386.tar.gz
152+
sha256sums_i686 = ${SHA_I686}
153+
154+
pkgname = cpp-gen-bin
155+
EOF
156+
157+
# ── Copy LICENSE ─────────────────────────────────────────────────────
158+
cp aur/LICENSE /tmp/aur-cpp-gen-bin/LICENSE
159+
160+
# ── Commit and push (branch must be master for AUR) ──────────────────
161+
cd /tmp/aur-cpp-gen-bin
162+
git add PKGBUILD .SRCINFO LICENSE
163+
git diff --staged --quiet && echo "Nothing to commit, skipping." && exit 0
164+
git commit -m "Update to v${VERSION}"
165+
git push origin master
113166

114-
# ── Completion notification ───────────────────────────────────────────────────
167+
# ── Notify ───────────────────────────────────────────────────────────────────
115168
notify:
116169
name: Notify
117170
runs-on: ubuntu-latest
118-
needs: goreleaser
171+
needs: release
119172
if: always()
120173

121174
steps:
122175
- name: Release succeeded
123-
if: needs.goreleaser.result == 'success'
176+
if: needs.release.result == 'success'
124177
run: |
125-
echo "::notice title=Release publicada::cpp-gen ${{ github.ref_name }} foi publicada com sucesso!"
178+
echo "::notice title=Release publicada::cpp-gen ${{ github.ref_name }} publicada com sucesso!"
126179
echo "URL: https://github.com/${{ github.repository }}/releases/tag/${{ github.ref_name }}"
127180

128181
- name: Release failed
129-
if: needs.goreleaser.result == 'failure'
182+
if: needs.release.result == 'failure'
130183
run: |
131-
echo "::error title=Falha na release::O goreleaser falhou para a tag ${{ github.ref_name }}."
184+
echo "::error title=Falha na release::goreleaser falhou para ${{ github.ref_name }}."
132185
exit 1

‎.goreleaser.yaml‎

Lines changed: 13 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -77,41 +77,21 @@ checksum:
7777
algorithm: sha256
7878

7979
# ── AUR ───────────────────────────────────────────────────────────────────────
80-
# Publishes the PKGBUILD automatically to the Arch User Repository after release.
80+
# AUR publishing is handled manually in .github/workflows/release.yml via
81+
# ssh-agent + system git, bypassing goreleaser's built-in AUR integration.
8182
#
82-
# Prerequisites:
83-
# 1. Create an account at https://aur.archlinux.org
84-
# 2. Generate an SSH key pair: ssh-keygen -t ed25519 -f ~/.ssh/aur
85-
# 3. Add the public key to your AUR account: https://aur.archlinux.org/account/
86-
# 4. Register the package with an initial push (branch MUST be master):
87-
# git -c init.defaultBranch=master clone ssh://aur@aur.archlinux.org/cpp-gen-bin.git
88-
# cp aur/PKGBUILD aur/.SRCINFO aur/LICENSE <cloned-dir>/
89-
# cd <cloned-dir> && git add PKGBUILD .SRCINFO LICENSE && git commit -m "Initial release" && git push
90-
# 5. Add the private key as a GitHub repository secret named AUR_KEY
83+
# The manual approach avoids "error in libcrypto" caused by goreleaser passing
84+
# the private key file path to go-git/system SSH in a way that OpenSSH on the
85+
# GitHub Actions runner cannot parse.
9186
#
92-
# Note: The AUR only accepts pushes to the `master` branch.
93-
# See: https://goreleaser.com/customization/aur/
94-
95-
aurs:
96-
- name: cpp-gen-bin
97-
homepage: "https://github.com/matpdev/cpp-gen"
98-
description: "Modern C++ project generator with CMake, package managers, IDE configurations and development tools."
99-
maintainers:
100-
- "matpdev <matheus2ep at gmail dot com>"
101-
license: MIT
102-
private_key: "{{ .Env.AUR_KEY }}"
103-
git_url: "ssh://aur@aur.archlinux.org/cpp-gen-bin.git"
104-
provides:
105-
- cpp-gen
106-
conflicts:
107-
- cpp-gen
108-
package: |-
109-
install -Dm755 "./cpp-gen" "${pkgdir}/usr/bin/cpp-gen"
110-
install -Dm644 "./LICENSE" "${pkgdir}/usr/share/licenses/cpp-gen-bin/LICENSE"
111-
install -Dm644 "./README.md" "${pkgdir}/usr/share/doc/cpp-gen-bin/README.md"
112-
commit_author:
113-
name: goreleaserbot
114-
email: bot@goreleaser.com
87+
# The release.yml workflow:
88+
# 1. Decodes the base64-encoded AUR_KEY secret to ~/.ssh/aur_key
89+
# 2. Loads it into ssh-agent (key stays in memory, no file reading by SSH)
90+
# 3. Clones ssh://aur@aur.archlinux.org/cpp-gen-bin.git
91+
# 4. Generates PKGBUILD (from aur/PKGBUILD template) with real checksums
92+
# 5. Generates .SRCINFO inline
93+
# 6. Commits and pushes to branch master
94+
11595

11696
# ── Changelog ─────────────────────────────────────────────────────────────────
11797
# Generated from commit messages following the Conventional Commits convention.

0 commit comments

Comments
 (0)