enricobuehler
4f8cce6751
767e67ca's per-channel mechanics were correct; they were aimed at the wrong binary. Each one is restored here pointed at punktfunk-encode-worker, and every host-side removal from #136 stays verbatim. All grants remain best-effort — an uncapped worker still encodes, at default priority, so a failed setcap must never fail an install. * Arch: setcap in post_install AND post_upgrade (a replaced binary is a new inode). * RPM: %caps(cap_sys_nice=ep) in %files, never a %post setcap — %caps applies, restores and verifies, and covers Fedora as well as Bazzite via rpm-ostree layering. * Bazzite + Arch sysext: setcap on the staging tree before mksquashfs, which does record security.capability. The assertion is amended, not removed: host EMPTY is still a hard fail, and the worker must carry exactly cap_sys_nice=ep — missing is fine, anything else is not. * deb: setcap in postinst. * NixOS: security.wrappers for the WORKER plus PUNKTFUNK_ENCODE_WORKER in the unit. A file capability cannot live on a store path, and an ambient grant is right here precisely because nothing ever identifies the worker. The host's ExecStart stays on the store path. * Steam Deck: setcap the worker; the .desktop the script writes stays valid this time. Four things the plan's channel table missed: * packaging/arch/build-sysext.sh had no capability handling at all, and a sysext can never run a pacman scriptlet — the SteamOS image would have shipped the lever permanently inert. * scripts/steamdeck/update.sh had none either. It rebuilds both binaries, so a new inode drops the grant, and it is the documented steady-state path: the lever would have died on the first update. It also never healed a Deck already capped by 0.26.0-1. * A capped worker is AT_SECURE, and glibc drops $ORIGIN-expanded RPATH entries for secure binaries unless they normalise into a trusted system dir. Copying the host's rpath under BUNDLE_FFMPEG=1 would have left the capped worker unable to find libavcodec on exactly the channel that bundles it. Absolute DT_RPATH instead. * Nix crane scopes by -p, so the worker would not have been built at all, and it needs its own addDriverRunpath. scripts/ci/assert-cap-matrix.sh mechanizes the lesson from 0.26.0-1 — verify the PACKAGE, never the board. It unpacks the built Arch package, the deb, the rpm and the mounted sysext raw and asserts one matrix: the host carries NOTHING (hard fail), the worker exactly cap_sys_nice=ep. The sysext reader first proves it can round-trip a capability through mksquashfs/unsquashfs at all, so an unreadable artifact fails rather than issuing a blind PASS, and --self-test red-teams the assertions themselves. Red-teaming the leg found a real bug: setcap originally ran BEFORE the assertion, so "the worker arrived carrying something unexpected" was unreachable and a stray %caps would have been silently overwritten. Both sysext scripts now assert, then grant, then assert again.
464 lines
28 KiB
YAML
464 lines
28 KiB
YAML
# Build the punktfunk-host / punktfunk-client / punktfunk-web / punktfunk-scripting pacman packages from
|
|
# packaging/arch/PKGBUILD and publish them to Gitea's Arch package registry, so Arch boxes
|
|
# get new builds via `pacman -Syu`. Counterpart to deb.yml (apt) and rpm.yml (dnf/rpm-ostree).
|
|
# Arch is rolling, so the packages build against whatever the archlinux:base-devel container
|
|
# resolves today — the same sonames an up-to-date Arch box runs.
|
|
#
|
|
# Registry (public, unom org) — box setup (once), see packaging/arch/README.md. The registry
|
|
# SIGNS the DB + packages, so the box imports the registry key first (pacman-key --add +
|
|
# --lsign-key), then no SigLevel line is needed (pacman's default Required verifies):
|
|
# [punktfunk] # or [punktfunk-canary] for main-push builds
|
|
# Server = https://git.unom.io/api/packages/unom/arch/$repo/$arch
|
|
#
|
|
# REGISTRY_TOKEN: repo Actions secret, a PAT with write:package scope (shared with docker.yml).
|
|
# NOTE: this token + the registry-held private key are the trust root — a token holder can
|
|
# publish a validly-signed package (the signature attests "via the registry", not "built by CI").
|
|
name: arch
|
|
# One pending run per workflow+ref: a newer push supersedes the queued/running one and cancels
|
|
# it (a canary only needs the latest commit; each release tag is its own ref so tag runs never
|
|
# cancel each other). Keeps a busy push cadence from piling ~10 queued runs per commit onto the
|
|
# runner fleet. Gitea honors this for push triggers (PR triggers: see gitea#35933).
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# Scope canary builds to what this artifact is built FROM — a docs-only or
|
|
# web-only push should not light up the whole fleet. Applies to branch pushes;
|
|
# tag runs are matched by `tags:` (proven by flatpak/windows-msix releases).
|
|
paths:
|
|
- 'crates/**'
|
|
- 'clients/linux/**'
|
|
- 'clients/session/**'
|
|
- 'clients/shared/**'
|
|
- 'clients/cli/**'
|
|
- 'web/**'
|
|
- 'sdk/**'
|
|
- 'packaging/arch/**'
|
|
- 'packaging/gamescope/**'
|
|
- 'Cargo.toml'
|
|
- 'Cargo.lock'
|
|
- 'rust-toolchain.toml'
|
|
- 'scripts/ci/**'
|
|
- '.gitea/workflows/arch.yml'
|
|
# Single project version: a `vX.Y.Z` tag is THE release. main publishes to the
|
|
# `punktfunk-canary` pacman repo as X.Y.Z-0.<run#> (sorts below the eventual X.Y.Z-1),
|
|
# tags to `punktfunk` — separate repos, so neither channel can shadow the other.
|
|
tags: ['v*']
|
|
# REBUILDING A PUBLISHED RELEASE, because on a rolling distro the ground moves under one.
|
|
# Arch went FFmpeg 8 -> 9 (every libav soname +1) four minutes before v0.25.0 was tagged, so
|
|
# the release's punktfunk-host was linked in a builder image that still had 8 and shipped
|
|
# `libavcodec.so=62-64`. No up-to-date Arch box can satisfy that — and pacman prepares the
|
|
# whole transaction at once, so it did not merely block our package, it blocked those users'
|
|
# entire `pacman -Syu`. The repair is a rebuild of the SAME upstream version at a HIGHER
|
|
# pkgrel; nothing else reaches a box that already has the broken build recorded in its db.
|
|
# The workflow file at the tag can never carry inputs added after it was tagged, so dispatch
|
|
# this from `main`: it checks the tag's SOURCE out, publishes to the STABLE repo, and
|
|
# replaces the release-page assets. Same lever for any future "the distro moved" rebuild.
|
|
workflow_dispatch:
|
|
inputs:
|
|
release_tag:
|
|
description: 'Rebuild this published release (e.g. v0.25.0) into the stable `punktfunk` repo. Empty = ordinary canary build of the dispatched ref.'
|
|
required: false
|
|
default: ''
|
|
pkgrel:
|
|
description: 'pkgrel for that rebuild — MUST be above the published one (2, 3, …); a same-pkgrel republish is invisible to pacman. Ignored without release_tag.'
|
|
required: false
|
|
default: '2'
|
|
|
|
env:
|
|
REGISTRY: git.unom.io
|
|
OWNER: unom
|
|
# Shared compile cache: sccache -> RustFS S3 (storage.unom.io). NOTE: makepkg runs
|
|
# behind `sudo -u builder env ...`, which strips ambient env — the makepkg step
|
|
# re-exports these explicitly.
|
|
RUSTC_WRAPPER: sccache
|
|
SCCACHE_BUCKET: unom-ci-sccache
|
|
SCCACHE_ENDPOINT: https://storage.unom.io
|
|
SCCACHE_REGION: home-central
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_SECRET_ACCESS_KEY }}
|
|
CARGO_INCREMENTAL: "0"
|
|
|
|
jobs:
|
|
build-publish:
|
|
runs-on: ubuntu-24.04
|
|
container:
|
|
# Everything the two pacman steps below used to download (~1 GB/run) is baked in,
|
|
# plus bun, sccache and node (ci/arch-ci.Dockerfile). The steps stay as --needed
|
|
# no-op guards for the one push where :latest lags an image-content change.
|
|
image: 192.168.1.58:5010/punktfunk-arch-ci:latest
|
|
timeout-minutes: 90
|
|
env:
|
|
CARGO_HOME: /usr/local/cargo
|
|
steps:
|
|
# git + nodejs must exist before actions/checkout — base-devel ships neither, and
|
|
# act_runner runs the action's JS with the CONTAINER's node, it does not inject one.
|
|
- name: Build + runtime-dev deps (no-op guard — baked into arch-ci)
|
|
# No -Syu: the image's snapshot IS the build environment (see the Dockerfile's
|
|
# rolling-release note); with everything installed this resolves locally and
|
|
# does nothing. It only matters on the push that adds a dep before the image
|
|
# rebuild lands — same bootstrap note as ci.yml's GTK4 step.
|
|
run: |
|
|
pacman -S --noconfirm --needed \
|
|
git nodejs rust clang cmake ninja nasm pkgconf python vulkan-headers \
|
|
gtk4 libadwaita sdl3 ffmpeg pipewire wayland libxkbcommon opus libei \
|
|
mesa libglvnd unzip libarchive || echo "::warning::pacman guard failed (stale image db?) — proceeding with baked packages"
|
|
command -v bun >/dev/null || {
|
|
curl -fsSL https://bun.sh/install | bash
|
|
install -m0755 "$HOME/.bun/bin/bun" /usr/local/bin/bun
|
|
}
|
|
bun --version
|
|
|
|
# THE BUILDER'S FFmpeg IS PART OF THE PACKAGE CONTRACT, not merely a build detail.
|
|
# packaging/arch/PKGBUILD binds punktfunk-host to the exact libav sonames it linked
|
|
# (`libavcodec.so=63-64` …), so a builder one FFmpeg major behind Arch emits a package
|
|
# that NOBODY can install — and takes the user's whole `pacman -Syu` down with it, since
|
|
# pacman prepares the transaction as a unit. That is exactly how v0.25.0 shipped: PR #108
|
|
# re-keyed this image for FFmpeg 9, the release tag fired four minutes later, and the job
|
|
# still got the FFmpeg-8 `:latest`. The image is a cache and is allowed to lag — but never
|
|
# on this one axis. So heal it in-job and shout, instead of building a dead package.
|
|
# (Runs BEFORE checkout: a stale image should be repaired before anything depends on it.)
|
|
- name: FFmpeg soname parity with today's Arch (heals a stale builder image)
|
|
run: |
|
|
export LC_ALL=C # `Provides` is a localized field name
|
|
# Piped (never a TTY here) pacman prints each field on ONE line, unwrapped.
|
|
sonames() { sed -n 's/^Provides *: *//p' | tr ' ' '\n' | grep -E '^lib(av|sw)[a-z]*\.so=' | sort | tr '\n' ' '; }
|
|
# A SEPARATE --dbpath: this refreshes only a throwaway view of the repos, so the
|
|
# container's own db never enters the partial-upgrade state a bare `pacman -Sy` leaves.
|
|
mkdir -p /tmp/pf-archsync
|
|
if ! pacman -Sy --dbpath /tmp/pf-archsync --logfile /dev/null >/dev/null 2>&1; then
|
|
echo "::warning::could not refresh the Arch db — skipping the FFmpeg parity check"
|
|
exit 0
|
|
fi
|
|
HAVE="$(pacman -Qi ffmpeg | sonames)"
|
|
WANT="$(pacman -Si --dbpath /tmp/pf-archsync ffmpeg | sonames)"
|
|
echo "builder ffmpeg $(pacman -Q ffmpeg | cut -d' ' -f2): $HAVE"
|
|
echo "arch ffmpeg $(pacman -Si --dbpath /tmp/pf-archsync ffmpeg | sed -n 's/^Version *: *//p'): $WANT"
|
|
if [ "$HAVE" = "$WANT" ]; then
|
|
echo "OK: the builder links the FFmpeg every up-to-date Arch box already has"
|
|
exit 0
|
|
fi
|
|
echo "::warning::arch-ci is stale ACROSS AN FFMPEG SONAME BUMP — upgrading it for this run."
|
|
echo "::warning::Bump the 'refreshed:' date in ci/arch-ci.Dockerfile so the IMAGE carries it."
|
|
pacman -Syu --noconfirm || true
|
|
HAVE="$(pacman -Qi ffmpeg | sonames)"
|
|
if [ "$HAVE" != "$WANT" ]; then
|
|
echo "::error::builder still links $HAVE while Arch ships $WANT."
|
|
echo "::error::Building on would publish a package no Arch box can install."
|
|
exit 1
|
|
fi
|
|
echo "healed: builder now links $HAVE"
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# A dispatched release rebuild takes its WORKFLOW from the ref you dispatch (the only
|
|
# way it can carry inputs the tag predates) and its SOURCE from the tag. Empty string
|
|
# = checkout's own default, i.e. the triggering ref, for every other trigger.
|
|
ref: ${{ github.event.inputs.release_tag }}
|
|
|
|
# Cache cargo's git dir too, not just the registry: the workspace includes
|
|
# clients/windows, whose windows-reactor/windows deps are git-pinned — cargo must CLONE
|
|
# them (windows-rs is huge) merely to resolve the workspace, even though nothing Windows
|
|
# is ever compiled here. Cached, that cost is paid once per runner.
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
/usr/local/cargo/registry
|
|
/usr/local/cargo/git
|
|
key: cargo-home-arch-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-home-arch-
|
|
|
|
- name: Version + channel
|
|
# vX.Y.Z tag -> X.Y.Z-1 in the `punktfunk` repo; main push -> <next-minor>-0.<run#> in
|
|
# `punktfunk-canary` (pkgrel accepts only digits+dots — the run number carries the
|
|
# monotonic ordering; the commit sha is stamped into the binary via the workflow log).
|
|
#
|
|
# The run number is ZERO-PADDED to a fixed width, and that padding is load-bearing.
|
|
# pacman's own vercmp compares numeric segments numerically and gets this right either
|
|
# way, but Gitea's Arch registry picks the version it advertises in `punktfunk-canary.db`
|
|
# by STRING order. Unpadded, the run counter crossing a power of ten inverts that order
|
|
# ("0.9907" > "0.10095" because '9' > '1'), so the db pins itself to the last build
|
|
# before the rollover and every later canary becomes invisible to `pacman -Syu` — the
|
|
# packages publish fine, the index just never names them. That is exactly what happened
|
|
# on 2026-07-29 when run #10000 landed; it cost an evening and needed a manual purge of
|
|
# every 4-digit `0.22.0-0.9xxx` version to unstick. Padding keeps string order and
|
|
# numeric order in agreement, so the two can never disagree again.
|
|
#
|
|
# Keep the leading `0.` — it is what sorts a canary BELOW the eventual `X.Y.Z-1` stable
|
|
# release. (A pkgrel is digits+dots only, so `0.` is the only prefix available; raising
|
|
# it to `1.` would sort canaries ABOVE the release and is not an option.)
|
|
env:
|
|
RELEASE_TAG: ${{ github.event.inputs.release_tag }}
|
|
REBUILD_PKGREL: ${{ github.event.inputs.pkgrel }}
|
|
run: |
|
|
eval "$(bash scripts/ci/pf-version.sh)" # -> PF_BASE (one minor ahead of latest stable)
|
|
if [ -n "${RELEASE_TAG:-}" ]; then
|
|
# Dispatched rebuild of a published release (see the workflow_dispatch note at the
|
|
# top): same upstream version, higher pkgrel, straight into the stable repo.
|
|
# ⚠ Keep that pkgrel SINGLE-DIGIT. Gitea's Arch registry picks the version its .db
|
|
# advertises by STRING order (the same trap the canary zero-padding below exists for),
|
|
# so "0.25.0-10" sorts BELOW "0.25.0-2" and the rebuild would never be advertised.
|
|
V="${RELEASE_TAG#v}"
|
|
R="${REBUILD_PKGREL:-2}"
|
|
REPO=punktfunk
|
|
case "$R" in
|
|
''|*[!0-9.]*) echo "::error::pkgrel '$R' is not digits+dots"; exit 1 ;;
|
|
1) echo "::error::pkgrel 1 is the published build — a rebuild MUST go up (2, 3, …)"; exit 1 ;;
|
|
esac
|
|
else
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) V="${GITHUB_REF_NAME#v}"; R="1"; REPO=punktfunk ;;
|
|
*) V="$PF_BASE"; R="0.$(printf '%08d' "$GITHUB_RUN_NUMBER")"; REPO=punktfunk-canary ;;
|
|
esac
|
|
fi
|
|
echo "PF_PKGVER=$V" >> "$GITHUB_ENV"
|
|
echo "PF_PKGREL=$R" >> "$GITHUB_ENV"
|
|
echo "REPO=$REPO" >> "$GITHUB_ENV"
|
|
echo "pacman $V-$R -> repo '$REPO'"
|
|
|
|
- name: Build packages (makepkg)
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
# libcuda link stub — same trick as packaging/rpm/build-rpm.sh: the zerocopy FFI
|
|
# links -lcuda but the builder has no GPU; synthesize every cu* symbol the source
|
|
# references so a newly-added call can't silently break the link.
|
|
CU_SYMS="$(grep -rhoE '\bcu[A-Z][A-Za-z0-9_]*' crates/punktfunk-host/src/ | sort -u || true)"
|
|
if [ -n "$CU_SYMS" ] && [ ! -e /usr/lib/libcuda.so ]; then
|
|
STUB_C="$(mktemp --suffix=.c)"
|
|
for s in $CU_SYMS; do printf 'int %s(void){return 0;}\n' "$s" >> "$STUB_C"; done
|
|
gcc -shared -fPIC -Wl,-soname,libcuda.so.1 -o /usr/lib/libcuda.so.1 "$STUB_C"
|
|
ln -sf libcuda.so.1 /usr/lib/libcuda.so
|
|
rm -f "$STUB_C"; ldconfig
|
|
echo "== libcuda stub: $(printf '%s\n' "$CU_SYMS" | wc -l) symbols =="
|
|
fi
|
|
# makepkg refuses to run as root; deps are already installed above (-d skips the
|
|
# RPM-level check that can't see the script-installed bun anyway).
|
|
useradd -m builder
|
|
mkdir -p "$CARGO_HOME" # actions/cache doesn't create it on a cache miss
|
|
chown -R builder: "$PWD" "$CARGO_HOME"
|
|
sudo -u builder git config --global --add safe.directory "$PWD"
|
|
mkdir -p dist && chown builder: dist
|
|
cd packaging/arch
|
|
# sudo env_reset strips the ambient env, so the sccache wiring must cross the
|
|
# boundary explicitly (same values as the workflow env block).
|
|
sudo -u builder env PF_SRCDIR="$GITHUB_WORKSPACE" PF_WITH_WEB=1 PF_WITH_SCRIPTING=1 \
|
|
PF_PKGVER="$PF_PKGVER" PF_PKGREL="$PF_PKGREL" \
|
|
CARGO_HOME="$CARGO_HOME" PKGDEST="$GITHUB_WORKSPACE/dist" \
|
|
RUSTC_WRAPPER="$RUSTC_WRAPPER" CARGO_INCREMENTAL="$CARGO_INCREMENTAL" \
|
|
SCCACHE_BUCKET="$SCCACHE_BUCKET" SCCACHE_ENDPOINT="$SCCACHE_ENDPOINT" \
|
|
SCCACHE_REGION="$SCCACHE_REGION" \
|
|
AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" \
|
|
makepkg -f -d --holdver
|
|
ls -lh "$GITHUB_WORKSPACE/dist"
|
|
|
|
# The host must ship a VERSIONED libav soname dep, and nothing else in this pipeline proves
|
|
# it. packaging/arch/PKGBUILD lists bare `libavcodec.so` etc. and relies on makepkg rewriting
|
|
# each into `libavcodec.so=<soname>-<arch>` from the built binary's DT_NEEDED; if that
|
|
# rewrite ever stops happening — Arch dropping the soname `provides`, someone "tidying" the
|
|
# entries out of `depends`, a makepkg change — the dep silently degrades to an unversioned
|
|
# name that ANY ffmpeg satisfies. That is precisely the 2026-08-08 state in which `pacman
|
|
# -Syu` walked every Arch/CachyOS install across the FFmpeg 8 -> 9 soname bump and left the
|
|
# host unable to start (exit 127 before main(), restart loop). The failure is invisible in a
|
|
# green build and only shows up as a bricked box weeks later, so assert it here.
|
|
- name: Assert the host pins the FFmpeg soname
|
|
run: |
|
|
PKG="$(ls "$GITHUB_WORKSPACE"/dist/punktfunk-host-*.pkg.tar.zst | head -1)"
|
|
DEPS="$(bsdtar -xOf "$PKG" .PKGINFO | sed -n 's/^depend = //p')"
|
|
echo "$DEPS" | sed 's/^/ depend = /'
|
|
for lib in libavcodec libavutil; do
|
|
echo "$DEPS" | grep -qE "^$lib\.so=[0-9]+-[0-9]+$" || {
|
|
echo "::error::punktfunk-host declares no VERSIONED $lib.so dependency."
|
|
echo "::error::makepkg did not expand the bare soname from DT_NEEDED, so pacman can"
|
|
echo "::error::upgrade FFmpeg across a soname break and brick the install."
|
|
echo "::error::See the depends comment in packaging/arch/PKGBUILD."
|
|
exit 1
|
|
}
|
|
done
|
|
echo "OK: $(echo "$DEPS" | grep -E '^libav|^libsw' | tr '\n' ' ')"
|
|
|
|
# 0.26.0-1 setcap'd `cap_sys_nice=ep` on the host from this package's .INSTALL scriptlet and
|
|
# killed desktop streaming on every KDE box — with a green board, because nothing here ever
|
|
# looked at what the built package would DO. The lesson recorded then was "verify the
|
|
# PACKAGE, never the board"; this is that, and pacman is the channel where it matters most,
|
|
# since capabilities live in the scriptlet rather than in package metadata.
|
|
#
|
|
# Host must carry NOTHING, the worker exactly cap_sys_nice=ep. `--self-test` runs first so a
|
|
# guard that has quietly lost the ability to fail takes the job down rather than approving a
|
|
# release. (Only the host package is checked: the client/web/scripting packages ship neither
|
|
# binary and the script skips them by itself.)
|
|
- name: Assert the capability matrix (Arch package)
|
|
run: |
|
|
bash scripts/ci/assert-cap-matrix.sh --self-test
|
|
bash scripts/ci/assert-cap-matrix.sh "$GITHUB_WORKSPACE"/dist/punktfunk-host-*.pkg.tar.zst
|
|
|
|
# The optional HDR gamescope companion (packaging/gamescope) — a separate pkgbase with a
|
|
# completely different dependency set, published into the same repo so `pacman -S
|
|
# punktfunk-gamescope` is all an Arch/SteamOS box needs for 10-bit BT.2020 PQ.
|
|
#
|
|
# CACHED on `packaging/gamescope/**`: it depends on nothing else in this repo, so a normal
|
|
# push restores the built package instead of spending ~10 minutes on someone else's C++ tree.
|
|
# Arch is rolling, so the cache is invalidated by our own patch changes only — a stale binary
|
|
# against newer system libs is the same risk the distro's own package carries between rebuilds.
|
|
- uses: actions/cache@v4
|
|
id: gamescope
|
|
with:
|
|
path: dist-gamescope
|
|
key: punktfunk-gamescope-arch-${{ hashFiles('packaging/gamescope/**') }}
|
|
|
|
- name: Build punktfunk-gamescope (makepkg)
|
|
if: steps.gamescope.outputs.cache-hit != 'true'
|
|
# Best-effort: punktfunk-host works without it (SDR on the gamescope backend), and a
|
|
# failure building gamescope must not cost the packages this workflow exists to publish.
|
|
run: |
|
|
set -x
|
|
# Baked into arch-ci — a no-op guard, like the dep step above.
|
|
pacman -S --noconfirm --needed \
|
|
glslang libcap libdrm libinput libx11 libxcomposite libxdamage libxext \
|
|
libxkbcommon libxmu libxrender libxres libxtst libxxf86vm libavif libdecor \
|
|
hwdata luajit pipewire seatd sdl2-compat vulkan-icd-loader wayland \
|
|
xcb-util-errors xcb-util-wm xorg-xwayland \
|
|
meson cmake glm wayland-protocols benchmark libxcursor || true
|
|
mkdir -p dist-gamescope && chown builder: dist-gamescope
|
|
chown -R builder: packaging/gamescope
|
|
if sudo -u builder env PKGDEST="$GITHUB_WORKSPACE/dist-gamescope" \
|
|
bash -c 'cd packaging/gamescope && makepkg -f -d --holdver'; then
|
|
ls -lh dist-gamescope
|
|
else
|
|
echo "::warning::punktfunk-gamescope failed to build — Arch boxes stay SDR on the gamescope backend this run"
|
|
rm -rf dist-gamescope # never cache a failed build (an empty path is not saved)
|
|
fi
|
|
|
|
# THE GATE THIS PIPELINE WAS MISSING. The soname assert above proves the libav dep is
|
|
# VERSIONED; it cannot prove the version is one that EXISTS. v0.25.0 passed it and still
|
|
# shipped `libavcodec.so=62-64` to a world that had moved to 63 — every affected user got
|
|
# "unable to satisfy dependency … required by punktfunk-host", and because pacman prepares
|
|
# one transaction, their whole system upgrade stopped there. So ask the only question that
|
|
# matters before publishing: would a real, up-to-date Arch box install this?
|
|
#
|
|
# An empty --dbpath is what makes the answer honest. It means "nothing is installed", so
|
|
# pacman must satisfy every dependency FROM THE REPOS exactly as a user's box does. Checking
|
|
# against the builder's own installed set instead would let a stale ffmpeg satisfy the stale
|
|
# bound and hide the break completely — the very illusion that shipped v0.25.0. `--print`
|
|
# resolves and prints; it downloads nothing and installs nothing. Verified against the real
|
|
# broken artifact on an ffmpeg-9 box: it reproduces the user-visible failure verbatim.
|
|
- name: Assert every package installs on an up-to-date Arch box
|
|
run: |
|
|
export LC_ALL=C
|
|
mkdir -p /tmp/pf-instcheck
|
|
if ! pacman -Sy --dbpath /tmp/pf-instcheck --logfile /dev/null >/dev/null 2>&1; then
|
|
echo "::error::could not sync the Arch db — cannot prove these packages install"
|
|
exit 1
|
|
fi
|
|
check() { # check FILE -> 0 installable, 1 not (reason on stdout)
|
|
pacman -U --print --noconfirm --dbpath /tmp/pf-instcheck --logfile /dev/null "$1" 2>&1
|
|
}
|
|
ls dist/*.pkg.tar.zst >/dev/null 2>&1 || { echo "::error::nothing in dist/ to check"; exit 1; }
|
|
rc=0
|
|
for pkg in dist/*.pkg.tar.zst; do
|
|
if out="$(check "$pkg")"; then
|
|
echo "OK $(basename "$pkg") ($(echo "$out" | wc -l) targets resolve)"
|
|
else
|
|
rc=1
|
|
echo "::error::$(basename "$pkg") CANNOT be installed on an up-to-date Arch box:"
|
|
echo "$out" | sed 's/^/ /'
|
|
fi
|
|
done
|
|
# gamescope stays best-effort, exactly as its build step is: a companion that cannot
|
|
# install is dropped from the upload with a warning, never a reason to withhold the
|
|
# packages this workflow exists to publish. (It is also the one package that can be
|
|
# restored from a cache older than the current Arch snapshot.)
|
|
for pkg in dist-gamescope/*.pkg.tar.zst; do
|
|
[ -e "$pkg" ] || continue
|
|
if out="$(check "$pkg")"; then
|
|
echo "OK $(basename "$pkg") ($(echo "$out" | wc -l) targets resolve)"
|
|
else
|
|
echo "::warning::$(basename "$pkg") is not installable on current Arch — NOT publishing it"
|
|
echo "$out" | sed 's/^/ /'
|
|
rm -f "$pkg"
|
|
fi
|
|
done
|
|
if [ "$rc" != 0 ]; then
|
|
echo "::error::refusing to publish: pacman would reject this on a current box, and a"
|
|
echo "::error::rejected dependency blocks the user's ENTIRE upgrade, not just punktfunk."
|
|
echo "::error::Usual cause: the arch-ci builder image lags Arch across a soname bump —"
|
|
echo "::error::bump 'refreshed:' in ci/arch-ci.Dockerfile, let docker.yml republish it, re-run."
|
|
exit 1
|
|
fi
|
|
|
|
# NOTE deliberately NO sysext image is built or published here: a prebuilt HOST binary on
|
|
# SteamOS breaks on the next A/B soname bump (and /var — where sysexts live — is
|
|
# per-partition-set), which is the standing packaging verdict behind the on-device
|
|
# distrobox build (scripts/steamdeck/, see scripts/steamdeck/README.md). That flow builds
|
|
# its own HDR gamescope too. packaging/arch/build-sysext.sh remains a by-hand tool for the
|
|
# Deck CLIENT image and for operators who accept the prebuilt-host trade-off.
|
|
|
|
- name: Publish to the Gitea Arch registry
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
# The gamescope companion rides the same loop (same repo, same channel).
|
|
cp -f dist-gamescope/*.pkg.tar.zst dist/ 2>/dev/null || true
|
|
for pkg in dist/*.pkg.tar.zst; do
|
|
echo "uploading $pkg"
|
|
NAME=$(bsdtar -xOf "$pkg" .PKGINFO | sed -n 's/^pkgname = //p')
|
|
VER=$(bsdtar -xOf "$pkg" .PKGINFO | sed -n 's/^pkgver = //p')
|
|
ARCH=$(bsdtar -xOf "$pkg" .PKGINFO | sed -n 's/^arch = //p')
|
|
# A re-tagged release re-fires this workflow and the registry 409s on duplicate
|
|
# package versions — delete any prior copy first (404 on the first publish is fine).
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"https://$REGISTRY/api/packages/$OWNER/arch/$REPO/$NAME/$VER/$ARCH" || true
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$pkg" \
|
|
"https://$REGISTRY/api/packages/$OWNER/arch/$REPO"
|
|
done
|
|
echo "published to $OWNER/arch/$REPO"
|
|
|
|
# On a real release, also attach the packages to the unified Gitea Release. A dispatched
|
|
# rebuild attaches to that SAME release object: the release page is a distribution surface
|
|
# too, and leaving the superseded .pkg.tar.zst sitting on it is one click away from handing
|
|
# someone the exact break the rebuild exists to fix.
|
|
- name: Attach packages to the Gitea release (stable tags + release rebuilds)
|
|
if: startsWith(gitea.ref, 'refs/tags/v') || github.event.inputs.release_tag != ''
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
RELEASE_TAG: ${{ github.event.inputs.release_tag }}
|
|
run: |
|
|
. scripts/ci/gitea-release.sh
|
|
TAG="${RELEASE_TAG:-$GITHUB_REF_NAME}"
|
|
RID=$(ensure_release "$TAG" "$TAG" auto)
|
|
for pkg in dist/*.pkg.tar.zst; do
|
|
upsert_asset "$RID" "$pkg"
|
|
done
|
|
# A rebuild bumps pkgrel, so its FILENAMES differ from the ones already attached, and
|
|
# upsert_asset only replaces by name — the superseded set would survive untouched.
|
|
# Drop every pacman asset (and .sha256 sidecar) this upload did not just write.
|
|
#
|
|
# ⚠⚠ THIS MUST LIVE IN THE WORKFLOW, NOT IN scripts/ci/gitea-release.sh. The sourced
|
|
# script comes from the CHECKED-OUT TREE, which on a release rebuild is the OLD TAG —
|
|
# so it can only ever offer the helpers that existed when that tag was cut. A helper
|
|
# added for this feature is therefore guaranteed ABSENT in the one code path that
|
|
# calls it: the first attempt failed with `prune_release_assets: command not found`
|
|
# after publishing perfectly. Only the workflow file itself is taken from the ref you
|
|
# dispatch. Same reason a packaging fix made after a tag does NOT reach a rebuild of
|
|
# that tag — the PKGBUILD is the tag's too.
|
|
if [ -n "${RELEASE_TAG:-}" ]; then
|
|
KEEP="$(cd dist && printf '%s ' *.pkg.tar.zst)"
|
|
# An UNMATCHED glob would come through literally and match nothing in the keep set —
|
|
# i.e. "delete every pacman asset on the release". Skip entirely instead.
|
|
case "$KEEP" in *'*'*) KEEP="" ;; esac
|
|
API="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY"
|
|
if [ -n "$KEEP" ]; then
|
|
curl -fsS "$API/releases/$RID/assets" -H "Authorization: token $GITEA_TOKEN" \
|
|
| python3 -c "import json,sys;k=set(sys.argv[1].split());k|={n+'.sha256' for n in k};print('\n'.join('%s %s'%(a['id'],a['name']) for a in json.load(sys.stdin) if a.get('name','').endswith(('.pkg.tar.zst','.pkg.tar.zst.sha256')) and a['name'] not in k))" "$KEEP" \
|
|
| while read -r id name; do
|
|
[ -n "$id" ] || continue
|
|
echo "dropping superseded release asset: $name"
|
|
curl -fsS -o /dev/null -X DELETE "$API/releases/$RID/assets/$id" \
|
|
-H "Authorization: token $GITEA_TOKEN" || true
|
|
done
|
|
fi
|
|
fi
|