shadow-test
3c8296843f
Publishing to the AUR needs a maintainer AUR account and its SSH key registered as a secret here, neither of which exists yet. Rather than leave the workflow permanently failing at that last step, it now stops short of AUR and instead uploads the built .pkg.tar.zst to the same GitHub release it built from, as a plain downloadable asset (`pacman -U` to install). The AUR-push step is still in this file's git history if that setup happens later. Renamed publish-aur-package.yml -> publish-arch-package.yml to match. The render/validate steps are unchanged; new here is capturing the exact built package filename from inside the build container (makepkg is the only thing that actually knows it) and an upload step that follows the same create-or-reuse-release, strip-upload_url, POST-octet-stream pattern build-app.yml and backfill-releases.yml already use for GitHub assets, plus a delete-existing-asset-first step so a re-dispatch for an already-packaged version replaces rather than 422s. Verified with a real Docker run end to end: rendered a real PKGBUILD, built a real (synthetic) .deb through makepkg + namcap in an archlinux container, confirmed the container exits 0, and confirmed the exact package filename it captures (triple-c-bin-<version>-1-x86_64.pkg.tar.zst) round-trips out via docker cp intact.
87 lines
4.9 KiB
Bash
87 lines
4.9 KiB
Bash
# Maintainer: Triple-C Contributors
|
|
#
|
|
# This file is regenerated by .gitea/workflows/publish-arch-package.yml on every
|
|
# publish — pkgver, the source URL and sha256sums are rewritten from the real,
|
|
# already-uploaded release asset, never guessed. Editing pkgver/source/
|
|
# sha256sums by hand here only matters until the next automated run overwrites
|
|
# them; everything else (depends, pkgdesc, package()) is meant to be hand-
|
|
# maintained normally.
|
|
#
|
|
# "-bin" rather than building from source: this repackages the same .deb
|
|
# build-app.yml already produces and publishes, so a user gets exactly the
|
|
# binary the project ships and tests, and `makepkg` never needs a Rust
|
|
# toolchain, Node, or the dozen -dev packages CLAUDE.md lists for building
|
|
# Triple-C itself. The trade-off is the one every "-bin" package makes: it
|
|
# assumes the glibc the CI runner (Ubuntu 24.04) linked against is compatible
|
|
# with the installing system's — true for essentially every currently
|
|
# supported Arch install, since Arch tracks glibc newer than Ubuntu 24.04
|
|
# ships, and forward compatibility is the direction that holds.
|
|
pkgname=triple-c-bin
|
|
pkgver=0.4.0
|
|
pkgrel=1
|
|
pkgdesc="Sandbox Claude Code inside Docker containers"
|
|
arch=('x86_64')
|
|
url="https://github.com/shadowdao/triple-c"
|
|
license=('MIT')
|
|
# Verified against a real release asset (v0.4.14), not Tauri's generic docs:
|
|
# downloaded Triple-C_0.4.14_amd64.deb, installed each of these into a real
|
|
# Arch container, and re-ran `ldd` on the actual binary until nothing came
|
|
# back "not found". `pango` and `libayatana-appindicator` were both in an
|
|
# earlier draft — pango isn't directly linked (gtk3 already pulls it in
|
|
# transitively, and namcap correctly flags declaring it as redundant), and
|
|
# libayatana-appindicator is in Tauri's own linux dependency list but this
|
|
# binary never links it at all: there is no tray icon or menu in this app
|
|
# (see CLAUDE.md's note that `core:menu`/`core:tray` are dropped for the
|
|
# same reason), so it was never a real dependency to begin with.
|
|
depends=('cairo' 'desktop-file-utils' 'gdk-pixbuf2' 'glib2' 'gtk3'
|
|
'hicolor-icon-theme' 'libsoup3' 'webkit2gtk-4.1')
|
|
optdepends=('docker: to actually run the sandboxed containers'
|
|
'xdg-utils: opening links from the app in your default browser')
|
|
provides=('triple-c')
|
|
conflicts=('triple-c')
|
|
# !strip: the upstream .deb's binary is already the release build Tauri
|
|
# produced and tested; re-stripping a prebuilt binary is unnecessary risk for
|
|
# no benefit. It's also what actually suppresses makepkg's debug-package
|
|
# machinery here (debug-package extraction requires strip; verified in a
|
|
# real build — with !strip alone, no debug package is produced at all).
|
|
# !debug is kept anyway, explicit about intent rather than relying on that
|
|
# side effect. Without either, makepkg built a usr/src/debug/triple-c-bin
|
|
# tree containing a dangling .build-id symlink, which is a real namcap
|
|
# error (not just the empty-directory warning it looks like) — there is no
|
|
# debug info in this release binary for the machinery to have extracted in
|
|
# the first place.
|
|
options=('!strip' '!debug')
|
|
# Tauri names the asset after `productName` verbatim ("Triple-C"), not the
|
|
# lowercase Cargo binary name — verified against the real release, not
|
|
# assumed; a lowercase guess here would 404. The LICENSE fetch is separate
|
|
# because the .deb itself carries no license file — namcap flags an MIT
|
|
# package with nothing under /usr/share/licenses/ as an error, correctly.
|
|
source=("Triple-C_${pkgver}_amd64.deb::https://github.com/shadowdao/triple-c/releases/download/v${pkgver}/Triple-C_${pkgver}_amd64.deb"
|
|
"LICENSE::https://raw.githubusercontent.com/shadowdao/triple-c/v${pkgver}/LICENSE")
|
|
sha256sums=('SKIP'
|
|
'SKIP')
|
|
|
|
package() {
|
|
cd "$srcdir"
|
|
# A .deb is an ar archive of debian-binary, control.tar.*, data.tar.* — `ar`
|
|
# (part of base-devel's binutils) pulls just the payload out. Extracting
|
|
# that tar directly into $pkgdir works here with no path rewriting at all:
|
|
# verified against the real archive, whose entire payload is
|
|
# usr/bin/triple-c, usr/share/applications/Triple-C.desktop and
|
|
# usr/share/icons/hicolor/*/apps/triple-c.png — Tauri's Linux bundle for
|
|
# this app carries no separate resource directory under usr/lib/, so there
|
|
# is nothing that could disagree between Debian's and Arch's package trees
|
|
# for it to land in the wrong place.
|
|
#
|
|
# Globbed rather than named literally: the publish workflow discovers the
|
|
# real asset name from the release itself specifically so a Tauri bundler
|
|
# naming change can't silently break this — naming the file again here
|
|
# would throw that away and fail this one line with an opaque "No such
|
|
# file or directory" instead. `source=()` above guarantees exactly one
|
|
# `*_amd64.deb` entry, so the glob can only ever match that one file.
|
|
ar x ./*_amd64.deb
|
|
tar xf data.tar.* -C "$pkgdir"
|
|
|
|
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
|
}
|