From 6dcdeb89cb6a34f76818a5243f9ceb79bb565b94 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Thu, 27 Aug 2026 14:29:27 -0700 Subject: [PATCH] Fix PKGBUILD render silently no-op'ing on every AUR publish run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "Render PKGBUILD" step's Python heredoc built its old_source match string via an f-string, escaping literal braces as `${{pkgver}}` — which put that exact four-character sequence directly in this workflow file's own YAML text. Gitea Actions scans a run: block for `${{ ... }}` and tries to evaluate whatever's inside as one of its own expressions before the shell ever sees the script; "pkgver" isn't a valid expression context, so every run has been failing that interpolation and emptying the step instead of raising anything visible there. The next step's `makepkg` then failed with "PKGBUILD does not exist" — the actual point of failure was one step earlier and unrelated to AUR credentials. Rebuilt the same match string with a "$" variable and plain concatenation so the file's own text never contains the trigger sequence. Verified by extracting the exact heredoc and running it standalone against the real PKGBUILD template — renders identically to the intended output. --- .gitea/workflows/publish-aur-package.yml | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/publish-aur-package.yml b/.gitea/workflows/publish-aur-package.yml index 0ac5951..6583407 100644 --- a/.gitea/workflows/publish-aur-package.yml +++ b/.gitea/workflows/publish-aur-package.yml @@ -160,10 +160,23 @@ jobs: text, n = re.subn(r"(?m)^pkgrel=.*$", "pkgrel=1", text, count=1) assert n == 1, "pkgrel=... line not found" + # Built with a "$" variable and plain "+" concatenation rather than + # an f-string's double-brace escape for a literal brace: writing + # this as an f-string put a dollar sign directly against two open + # braces, right here in this workflow's own YAML text — and this + # runner's own expression templating scans a run: block for that + # exact two-character opening sequence and tries to evaluate + # whatever sits inside as one of ITS OWN expressions (a step + # output, a secret, ...) before the shell ever sees this script. + # "pkgver" isn't one of those, so that lookup failed and silently + # emptied this whole step rather than raising anything here. + # Spelling the dollar sign out of a variable instead means this + # file's own text never contains that trigger sequence. + DOLLAR = "$" old_source = ( - f'source=("Triple-C_${{pkgver}}_amd64.deb::' - f'https://github.com/{github_repo}/releases/download/v${{pkgver}}/' - f'Triple-C_${{pkgver}}_amd64.deb"' + "source=(\"Triple-C_" + DOLLAR + "{pkgver}_amd64.deb::" + + "https://github.com/" + github_repo + "/releases/download/v" + DOLLAR + "{pkgver}/" + + "Triple-C_" + DOLLAR + "{pkgver}_amd64.deb\"" ) new_source = ( f'source=("{deb_name}::' -- 2.52.0