1423 lines
60 KiB
YAML
1423 lines
60 KiB
YAML
name: build and publish packages
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'arch/**'
|
|
- 'debian/**'
|
|
- '.gitea/workflows/**'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
distcc-avahi-aarch64:
|
|
runs-on: arch-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh arch/distcc-avahi)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: bootstrap runner (idempotent)
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo avahi popt python python-setuptools
|
|
|
|
- name: import signing key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
|
|
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
|
|
run: |
|
|
set -e
|
|
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
|
|
rm -rf /root/.gnupg /root/repo_pass
|
|
mkdir -m700 -p /root/.gnupg
|
|
printf '%s' "$PASS" > /root/repo_pass
|
|
chmod 600 /root/repo_pass
|
|
printf '%s\n' "$PRIV" | gpg --batch --import
|
|
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
|
|
|
|
- name: install deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
|
|
chmod 600 /root/.ssh/id_ed25519
|
|
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: makepkg distcc-avahi
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
rm -rf /tmp/build-distcc-avahi
|
|
cp -r arch/distcc-avahi /tmp/build-distcc-avahi
|
|
chown -R builder:builder /tmp/build-distcc-avahi
|
|
cd /tmp/build-distcc-avahi
|
|
sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
|
|
ls -la *.pkg.tar.* | grep -v "\.sig$"
|
|
|
|
- name: sign distcc-avahi
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd /tmp/build-distcc-avahi
|
|
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
|
|
[ -f "$f" ] || continue
|
|
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
|
|
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
|
|
done
|
|
|
|
- name: update aarch64 repo db
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
mkdir -p /tmp/arch-stage
|
|
cd /tmp/arch-stage
|
|
rm -f *
|
|
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
|
|
curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
|
|
done
|
|
for ext in xz zst gz; do
|
|
ls /tmp/build-distcc-avahi/*.pkg.tar.$ext 2>/dev/null && \
|
|
mv /tmp/build-distcc-avahi/*.pkg.tar.$ext /tmp/build-distcc-avahi/*.pkg.tar.$ext.sig .
|
|
done || true
|
|
export GNUPGHOME=/root/.gnupg
|
|
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
|
|
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
|
|
gpg-connect-agent reloadagent /bye
|
|
pkgs=()
|
|
for ext in xz zst gz; do
|
|
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
|
|
done
|
|
# Force-replace db entries: remove the package by name first so the
|
|
# subsequent --new add records this build's CSIZE/SHA256, not the
|
|
# previous build's. (makepkg output isn't byte-stable across runs.)
|
|
if [ -f marfrit.db.tar.gz ]; then
|
|
for f in "${pkgs[@]}"; do
|
|
name=$(echo "$f" | sed -E 's/-[0-9].*//')
|
|
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
marfrit.db.tar.gz "$name" 2>/dev/null || true
|
|
done
|
|
fi
|
|
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
--verify marfrit.db.tar.gz "${pkgs[@]}"
|
|
ln -sf marfrit.db.tar.gz marfrit.db
|
|
ln -sf marfrit.files.tar.gz marfrit.files
|
|
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
|
|
# marfrit.files isn't signed by repo-add (pacman only verifies .db)
|
|
rm -f marfrit.files.sig
|
|
|
|
- name: publish to aarch64
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd /tmp/arch-stage
|
|
retry rsync -avL --copy-unsafe-links \
|
|
-e 'ssh -i /root/.ssh/id_ed25519' \
|
|
./ mfritsche@nc.reauktion.de:arch/aarch64/
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/repo_pass /root/.ssh/id_ed25519 /root/.ssh/id_ed25519_hertz
|
|
|
|
# -------------------------------------------------------------------------
|
|
# lmcp Debian (Architecture: all) — built on the aarch64 runner using
|
|
# dpkg-deb (Arch ships dpkg in extra). The .deb is rsynced to hertz's
|
|
# incoming dir, then we trigger 'publish-deb' on hertz which runs
|
|
# reprepro and mirrors dists/+pool/ to nc.
|
|
# -------------------------------------------------------------------------
|
|
lmcp-debian:
|
|
needs: lmcp-any # serialize after the Arch build to share the runner
|
|
runs-on: arch-aarch64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh debian/lmcp)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: install dpkg
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl
|
|
|
|
- name: install hertz deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
|
|
chmod 600 /root/.ssh/id_ed25519_hertz
|
|
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: build lmcp .deb
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd debian/lmcp
|
|
./build-deb.sh
|
|
ls -la *.deb
|
|
|
|
- name: upload + publish to suites
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd debian/lmcp
|
|
DEB=$(ls lmcp_*.deb | head -1)
|
|
# Push the .deb into hertz's incoming dir via rrsync.
|
|
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
|
|
marfritrepo@hertz.fritz.box:
|
|
# Trigger reprepro for each suite.
|
|
for suite in bookworm trixie; do
|
|
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
|
|
"publish-deb $suite $DEB"
|
|
done
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/.ssh/id_ed25519_hertz
|
|
|
|
# -------------------------------------------------------------------------
|
|
# lmcp is pure Lua (arch=any). One build on the aarch64 runner produces a
|
|
# package that's valid on every pacman-based target, so we publish the same
|
|
# .pkg.tar.* to both /arch/aarch64/ and /arch/x86_64/ after rebuilding each
|
|
# db with the package registered.
|
|
# -------------------------------------------------------------------------
|
|
lmcp-any:
|
|
needs: distcc-avahi-aarch64 # serialize on shared aarch64 db; expand later
|
|
runs-on: arch-aarch64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh arch/lmcp)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: bootstrap runner (idempotent)
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo lua lua-socket
|
|
|
|
- name: import signing key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
|
|
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
|
|
run: |
|
|
set -e
|
|
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
|
|
rm -rf /root/.gnupg /root/repo_pass
|
|
mkdir -m700 -p /root/.gnupg
|
|
printf '%s' "$PASS" > /root/repo_pass
|
|
chmod 600 /root/repo_pass
|
|
printf '%s\n' "$PRIV" | gpg --batch --import
|
|
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
|
|
|
|
- name: install deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
|
|
chmod 600 /root/.ssh/id_ed25519
|
|
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: makepkg lmcp
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
rm -rf /tmp/build-lmcp
|
|
cp -r arch/lmcp /tmp/build-lmcp
|
|
chown -R builder:builder /tmp/build-lmcp
|
|
cd /tmp/build-lmcp
|
|
sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
|
|
ls -la *.pkg.tar.* | grep -v "\.sig$"
|
|
|
|
- name: sign lmcp
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd /tmp/build-lmcp
|
|
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
|
|
[ -f "$f" ] || continue
|
|
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
|
|
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
|
|
done
|
|
|
|
- name: publish lmcp to both arches
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
export GNUPGHOME=/root/.gnupg
|
|
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
|
|
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
|
|
gpg-connect-agent reloadagent /bye
|
|
|
|
for target in aarch64 x86_64; do
|
|
stage="/tmp/arch-stage-$target"
|
|
rm -rf "$stage"; mkdir -p "$stage"; cd "$stage"
|
|
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
|
|
curl -sSLf "https://packages.reauktion.de/arch/$target/$f" -o "$f" || rm -f "$f"
|
|
done
|
|
cp /tmp/build-lmcp/*.pkg.tar.* .
|
|
pkgs=()
|
|
for ext in xz zst gz; do
|
|
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
|
|
done
|
|
if [ -f marfrit.db.tar.gz ]; then
|
|
for f in "${pkgs[@]}"; do
|
|
name=$(echo "$f" | sed -E 's/-[0-9].*//')
|
|
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
marfrit.db.tar.gz "$name" 2>/dev/null || true
|
|
done
|
|
fi
|
|
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
--verify marfrit.db.tar.gz "${pkgs[@]}"
|
|
ln -sf marfrit.db.tar.gz marfrit.db
|
|
ln -sf marfrit.files.tar.gz marfrit.files
|
|
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
|
|
ln -sf marfrit.files.tar.gz.sig marfrit.files.sig
|
|
retry rsync -avL --copy-unsafe-links \
|
|
-e 'ssh -i /root/.ssh/id_ed25519' \
|
|
./ "mfritsche@nc.reauktion.de:arch/$target/"
|
|
done
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
|
|
|
|
# -------------------------------------------------------------------------
|
|
# claude-his-agent (arch=any) — pure markdown + shell, one pkg valid on all
|
|
# pacman targets. Same dual-arch publish trick as lmcp.
|
|
# -------------------------------------------------------------------------
|
|
claude-his-any:
|
|
needs: lmcp-debian
|
|
runs-on: arch-aarch64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh arch/claude-his-agent)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: bootstrap runner (idempotent)
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
|
|
|
|
- name: import signing key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
|
|
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
|
|
run: |
|
|
set -e
|
|
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
|
|
rm -rf /root/.gnupg /root/repo_pass
|
|
mkdir -m700 -p /root/.gnupg
|
|
printf '%s' "$PASS" > /root/repo_pass
|
|
chmod 600 /root/repo_pass
|
|
printf '%s\n' "$PRIV" | gpg --batch --import
|
|
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
|
|
|
|
- name: install deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
|
|
chmod 600 /root/.ssh/id_ed25519
|
|
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: makepkg claude-his-agent
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
rm -rf /tmp/build-his
|
|
cp -r arch/claude-his-agent /tmp/build-his
|
|
chown -R builder:builder /tmp/build-his
|
|
cd /tmp/build-his
|
|
sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
|
|
ls -la *.pkg.tar.* | grep -v "\.sig$"
|
|
|
|
- name: sign claude-his-agent
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd /tmp/build-his
|
|
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
|
|
[ -f "$f" ] || continue
|
|
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
|
|
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
|
|
done
|
|
|
|
- name: publish claude-his-agent to both arches
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
export GNUPGHOME=/root/.gnupg
|
|
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
|
|
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
|
|
gpg-connect-agent reloadagent /bye
|
|
|
|
for target in aarch64 x86_64; do
|
|
stage="/tmp/arch-stage-his-$target"
|
|
rm -rf "$stage"; mkdir -p "$stage"; cd "$stage"
|
|
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
|
|
curl -sSLf "https://packages.reauktion.de/arch/$target/$f" -o "$f" || rm -f "$f"
|
|
done
|
|
cp /tmp/build-his/*.pkg.tar.* .
|
|
pkgs=()
|
|
for ext in xz zst gz; do
|
|
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
|
|
done
|
|
if [ -f marfrit.db.tar.gz ]; then
|
|
for f in "${pkgs[@]}"; do
|
|
name=$(echo "$f" | sed -E 's/-[0-9].*//')
|
|
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
marfrit.db.tar.gz "$name" 2>/dev/null || true
|
|
done
|
|
fi
|
|
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
--verify marfrit.db.tar.gz "${pkgs[@]}"
|
|
ln -sf marfrit.db.tar.gz marfrit.db
|
|
ln -sf marfrit.files.tar.gz marfrit.files
|
|
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
|
|
ln -sf marfrit.files.tar.gz.sig marfrit.files.sig
|
|
retry rsync -avL --copy-unsafe-links \
|
|
-e 'ssh -i /root/.ssh/id_ed25519' \
|
|
./ "mfritsche@nc.reauktion.de:arch/$target/"
|
|
done
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
|
|
|
|
# -------------------------------------------------------------------------
|
|
# ffmpeg-v4l2-request-fourier (aarch64 only) — FFmpeg with V4L2 Request API
|
|
# hwaccel for Rockchip / Allwinner stateless decoders. Used by the Fourier
|
|
# umbrella (ohm, fresnel, ampere). Long-running build, so failures don't
|
|
# block downstream debian jobs.
|
|
# -------------------------------------------------------------------------
|
|
ffmpeg-v4l2-request-aarch64:
|
|
needs: claude-his-any
|
|
runs-on: arch-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh arch/ffmpeg-v4l2-request-fourier)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: bootstrap runner (idempotent)
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo nasm
|
|
|
|
- name: import signing key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
|
|
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
|
|
run: |
|
|
set -e
|
|
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
|
|
rm -rf /root/.gnupg /root/repo_pass
|
|
mkdir -m700 -p /root/.gnupg
|
|
printf '%s' "$PASS" > /root/repo_pass
|
|
chmod 600 /root/repo_pass
|
|
printf '%s\n' "$PRIV" | gpg --batch --import
|
|
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
|
|
|
|
- name: install deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
|
|
chmod 600 /root/.ssh/id_ed25519
|
|
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: makepkg ffmpeg-v4l2-request-fourier
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
rm -rf /tmp/build-ffmpeg-v4l2
|
|
cp -r arch/ffmpeg-v4l2-request-fourier /tmp/build-ffmpeg-v4l2
|
|
chown -R builder:builder /tmp/build-ffmpeg-v4l2
|
|
cd /tmp/build-ffmpeg-v4l2
|
|
# Parallelise wide; distcc-avahi distributes compiles across the
|
|
# zeroconf pool (tesla, dcc1, dcc2, boltzmann ≈ 60 logical cores).
|
|
sudo -u builder -H env MAKEFLAGS="-j60" \
|
|
makepkg --nocheck --noconfirm --syncdeps --cleanbuild
|
|
ls -la *.pkg.tar.* | grep -v "\.sig$"
|
|
|
|
- name: sign ffmpeg-v4l2-request-fourier
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd /tmp/build-ffmpeg-v4l2
|
|
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
|
|
[ -f "$f" ] || continue
|
|
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
|
|
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
|
|
done
|
|
|
|
- name: update aarch64 repo db
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
mkdir -p /tmp/arch-stage-ffmpeg
|
|
cd /tmp/arch-stage-ffmpeg
|
|
rm -f *
|
|
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
|
|
curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
|
|
done
|
|
for ext in xz zst gz; do
|
|
ls /tmp/build-ffmpeg-v4l2/*.pkg.tar.$ext 2>/dev/null && \
|
|
mv /tmp/build-ffmpeg-v4l2/*.pkg.tar.$ext /tmp/build-ffmpeg-v4l2/*.pkg.tar.$ext.sig .
|
|
done || true
|
|
export GNUPGHOME=/root/.gnupg
|
|
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
|
|
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
|
|
gpg-connect-agent reloadagent /bye
|
|
pkgs=()
|
|
for ext in xz zst gz; do
|
|
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
|
|
done
|
|
if [ -f marfrit.db.tar.gz ]; then
|
|
for f in "${pkgs[@]}"; do
|
|
name=$(echo "$f" | sed -E 's/-[0-9].*//')
|
|
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
marfrit.db.tar.gz "$name" 2>/dev/null || true
|
|
done
|
|
fi
|
|
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
--verify marfrit.db.tar.gz "${pkgs[@]}"
|
|
ln -sf marfrit.db.tar.gz marfrit.db
|
|
ln -sf marfrit.files.tar.gz marfrit.files
|
|
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
|
|
rm -f marfrit.files.sig
|
|
|
|
- name: publish to aarch64
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd /tmp/arch-stage-ffmpeg
|
|
retry rsync -avL --copy-unsafe-links \
|
|
-e 'ssh -i /root/.ssh/id_ed25519' \
|
|
./ mfritsche@nc.reauktion.de:arch/aarch64/
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
|
|
|
|
# -------------------------------------------------------------------------
|
|
# libva-v4l2-request-fourier (aarch64 only) — VA-API V4L2-stateless backend,
|
|
# multiplanar fork. Successor to libva-v4l2-request-ohm-gl-fix (never
|
|
# published). Tracks the campaign fork's git tip directly; pinned commit
|
|
# is the libva-multiplanar iter8 close.
|
|
# -------------------------------------------------------------------------
|
|
libva-v4l2-request-fourier-aarch64:
|
|
needs: ffmpeg-v4l2-request-aarch64
|
|
runs-on: arch-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh arch/libva-v4l2-request-fourier)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: bootstrap runner (idempotent)
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
|
|
|
|
- name: import signing key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
|
|
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
|
|
run: |
|
|
set -e
|
|
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
|
|
rm -rf /root/.gnupg /root/repo_pass
|
|
mkdir -m700 -p /root/.gnupg
|
|
printf '%s' "$PASS" > /root/repo_pass
|
|
chmod 600 /root/repo_pass
|
|
printf '%s\n' "$PRIV" | gpg --batch --import
|
|
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
|
|
|
|
- name: install deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
|
|
chmod 600 /root/.ssh/id_ed25519
|
|
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: makepkg libva-v4l2-request-fourier
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
rm -rf /tmp/build-libva-v4l2
|
|
cp -r arch/libva-v4l2-request-fourier /tmp/build-libva-v4l2
|
|
chown -R builder:builder /tmp/build-libva-v4l2
|
|
cd /tmp/build-libva-v4l2
|
|
sudo -u builder -H env MAKEFLAGS="-j60" \
|
|
makepkg --nocheck --noconfirm --syncdeps --cleanbuild
|
|
ls -la *.pkg.tar.* | grep -v "\.sig$"
|
|
|
|
- name: sign libva-v4l2-request-fourier
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd /tmp/build-libva-v4l2
|
|
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
|
|
[ -f "$f" ] || continue
|
|
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
|
|
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
|
|
done
|
|
|
|
- name: update aarch64 repo db
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
mkdir -p /tmp/arch-stage-libva
|
|
cd /tmp/arch-stage-libva
|
|
rm -f *
|
|
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
|
|
curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
|
|
done
|
|
for ext in xz zst gz; do
|
|
ls /tmp/build-libva-v4l2/*.pkg.tar.$ext 2>/dev/null && \
|
|
mv /tmp/build-libva-v4l2/*.pkg.tar.$ext /tmp/build-libva-v4l2/*.pkg.tar.$ext.sig .
|
|
done || true
|
|
export GNUPGHOME=/root/.gnupg
|
|
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
|
|
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
|
|
gpg-connect-agent reloadagent /bye
|
|
pkgs=()
|
|
for ext in xz zst gz; do
|
|
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
|
|
done
|
|
if [ -f marfrit.db.tar.gz ]; then
|
|
for f in "${pkgs[@]}"; do
|
|
name=$(echo "$f" | sed -E 's/-[0-9].*//')
|
|
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
marfrit.db.tar.gz "$name" 2>/dev/null || true
|
|
done
|
|
fi
|
|
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
--verify marfrit.db.tar.gz "${pkgs[@]}"
|
|
ln -sf marfrit.db.tar.gz marfrit.db
|
|
ln -sf marfrit.files.tar.gz marfrit.files
|
|
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
|
|
rm -f marfrit.files.sig
|
|
|
|
- name: publish to aarch64
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd /tmp/arch-stage-libva
|
|
retry rsync -avL --copy-unsafe-links \
|
|
-e 'ssh -i /root/.ssh/id_ed25519' \
|
|
./ mfritsche@nc.reauktion.de:arch/aarch64/
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
|
|
|
|
# -------------------------------------------------------------------------
|
|
# mpv-fourier (aarch64 only) — mpv with fourier-umbrella patches.
|
|
# Patch slot exists for the vo_dmabuf_wayland plane-semantics fix per
|
|
# marfrit/dmabuf-modifier-triage#1. Initial scaffold builds vanilla
|
|
# mpv 0.41.0 — bump pkgrel and add patch to source=() when iter1 lands.
|
|
# -------------------------------------------------------------------------
|
|
mpv-fourier-aarch64:
|
|
needs: libva-v4l2-request-fourier-aarch64
|
|
runs-on: arch-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh arch/mpv-fourier)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: bootstrap runner (idempotent)
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
|
|
|
|
- name: import signing key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
|
|
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
|
|
run: |
|
|
set -e
|
|
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
|
|
rm -rf /root/.gnupg /root/repo_pass
|
|
mkdir -m700 -p /root/.gnupg
|
|
printf '%s' "$PASS" > /root/repo_pass
|
|
chmod 600 /root/repo_pass
|
|
printf '%s\n' "$PRIV" | gpg --batch --import
|
|
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
|
|
|
|
- name: install deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
|
|
chmod 600 /root/.ssh/id_ed25519
|
|
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: configure [marfrit] repo + pre-install ffmpeg-v4l2-request-fourier
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
# mpv-fourier links libavcodec at build time. If the build host pulls
|
|
# stock arch's ffmpeg, the resulting binary's libavcodec ABI version
|
|
# drifts from the marfrit ffmpeg-v4l2-request-fourier that consumer
|
|
# hosts (ohm) install. Force build-time consistency by configuring
|
|
# [marfrit] on fermi and pre-installing our ffmpeg before makepkg.
|
|
curl -sLo /tmp/marfrit.gpg https://packages.reauktion.de/marfrit.gpg
|
|
pacman-key --add /tmp/marfrit.gpg
|
|
pacman-key --lsign-key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C
|
|
rm -f /tmp/marfrit.gpg
|
|
if ! grep -q '^\[marfrit\]' /etc/pacman.conf; then
|
|
printf '\n[marfrit]\nServer = https://packages.reauktion.de/arch/$arch\nSigLevel = Required\n' >> /etc/pacman.conf
|
|
fi
|
|
pacman -Sy --noconfirm
|
|
# Drop any cached ffmpeg-v4l2-request-fourier that may be corrupt
|
|
# from a prior interrupted build (the ccache misadventure left
|
|
# one such file behind).
|
|
rm -f /var/cache/pacman/pkg/ffmpeg-v4l2-request-fourier-*-aarch64.pkg.tar.*
|
|
# Stock arch ffmpeg may already be installed from a prior fermi job;
|
|
# pacman -S --noconfirm defaults the [y/N] conflict prompt to N.
|
|
# Use printf (finite stream, exits 0 cleanly) — `yes y | ...` would
|
|
# work but fails under bash pipefail when yes catches SIGPIPE.
|
|
# Three y's covers: "Remove conflict?", "Proceed?", any keyring prompt.
|
|
printf 'y\ny\ny\n' | pacman -S marfrit/ffmpeg-v4l2-request-fourier
|
|
|
|
- name: makepkg mpv-fourier
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
rm -rf /tmp/build-mpv
|
|
cp -r arch/mpv-fourier /tmp/build-mpv
|
|
chown -R builder:builder /tmp/build-mpv
|
|
cd /tmp/build-mpv
|
|
sudo -u builder -H env MAKEFLAGS="-j60" \
|
|
makepkg --nocheck --noconfirm --syncdeps --cleanbuild
|
|
ls -la *.pkg.tar.* | grep -v "\.sig$"
|
|
|
|
- name: sign mpv-fourier
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd /tmp/build-mpv
|
|
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
|
|
[ -f "$f" ] || continue
|
|
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
|
|
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
|
|
done
|
|
|
|
- name: update aarch64 repo db
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
mkdir -p /tmp/arch-stage-mpv
|
|
cd /tmp/arch-stage-mpv
|
|
rm -f *
|
|
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
|
|
curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
|
|
done
|
|
for ext in xz zst gz; do
|
|
ls /tmp/build-mpv/*.pkg.tar.$ext 2>/dev/null && \
|
|
mv /tmp/build-mpv/*.pkg.tar.$ext /tmp/build-mpv/*.pkg.tar.$ext.sig .
|
|
done || true
|
|
export GNUPGHOME=/root/.gnupg
|
|
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
|
|
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
|
|
gpg-connect-agent reloadagent /bye
|
|
pkgs=()
|
|
for ext in xz zst gz; do
|
|
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
|
|
done
|
|
if [ -f marfrit.db.tar.gz ]; then
|
|
for f in "${pkgs[@]}"; do
|
|
name=$(echo "$f" | sed -E 's/-[0-9].*//')
|
|
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
marfrit.db.tar.gz "$name" 2>/dev/null || true
|
|
done
|
|
fi
|
|
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
--verify marfrit.db.tar.gz "${pkgs[@]}"
|
|
ln -sf marfrit.db.tar.gz marfrit.db
|
|
ln -sf marfrit.files.tar.gz marfrit.files
|
|
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
|
|
rm -f marfrit.files.sig
|
|
|
|
- name: publish to aarch64
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd /tmp/arch-stage-mpv
|
|
retry rsync -avL --copy-unsafe-links \
|
|
-e 'ssh -i /root/.ssh/id_ed25519' \
|
|
./ mfritsche@nc.reauktion.de:arch/aarch64/
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
|
|
|
|
# -------------------------------------------------------------------------
|
|
# claude-his-agent Debian (Architecture: all) — same dpkg-deb pattern as
|
|
# lmcp-debian; publishes to bookworm + trixie via hertz reprepro.
|
|
# -------------------------------------------------------------------------
|
|
claude-his-debian:
|
|
needs: claude-his-any
|
|
runs-on: arch-aarch64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh debian/claude-his-agent)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: install dpkg
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl
|
|
|
|
- name: install hertz deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
|
|
chmod 600 /root/.ssh/id_ed25519_hertz
|
|
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: build claude-his-agent .deb
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd debian/claude-his-agent
|
|
./build-deb.sh
|
|
ls -la *.deb
|
|
|
|
- name: upload + publish to suites
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd debian/claude-his-agent
|
|
DEB=$(ls claude-his-agent_*.deb | head -1)
|
|
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
|
|
marfritrepo@hertz.fritz.box:
|
|
for suite in bookworm trixie; do
|
|
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
|
|
"publish-deb $suite $DEB"
|
|
done
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/.ssh/id_ed25519_hertz
|
|
|
|
# -------------------------------------------------------------------------
|
|
# ffmpeg-v4l2-request-fourier Debian (aarch64) — debian/<pkg>/build-deb.sh
|
|
# builds the Kwiboo FFmpeg fork natively on the arch-aarch64 runner using
|
|
# the arch toolchain + system libs, then dpkg-deb's the result. Resulting
|
|
# .deb is rsynced to hertz; reprepro publishes into bookworm + trixie.
|
|
# -------------------------------------------------------------------------
|
|
ffmpeg-v4l2-request-debian:
|
|
needs: ffmpeg-v4l2-request-aarch64
|
|
runs-on: debian-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh debian/ffmpeg-v4l2-request-fourier)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: install build-deps (Arch pkg names; build-deb.sh links natively)
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
retry apt-get update -qq
|
|
# Debian build-deps for the FFmpeg fourier-fork build. These
|
|
# map 1:1 to the previous Arch list; libav*-dev intentionally
|
|
# absent (we are FFmpeg itself, providing those libs).
|
|
retry apt-get install -y --no-install-recommends \
|
|
build-essential cmake ninja-build git pkg-config nasm yasm \
|
|
linux-libc-dev libgl1-mesa-dev libasound2-dev libbz2-dev \
|
|
libfontconfig-dev libfribidi-dev libgmp-dev libgnutls28-dev \
|
|
libmp3lame-dev libass-dev libdav1d-dev libdrm-dev \
|
|
libfreetype-dev libpulse-dev libva-dev libvorbis-dev libvpx-dev \
|
|
libwebp-dev libx264-dev libx265-dev libxml2-dev libopus-dev \
|
|
libvulkan-dev glslang-tools \
|
|
v4l-utils liblzma-dev zlib1g-dev \
|
|
curl ca-certificates openssh-client rsync dpkg-dev
|
|
|
|
- name: install hertz deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
|
|
chmod 600 /root/.ssh/id_ed25519_hertz
|
|
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: build ffmpeg-v4l2-request-fourier .deb
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd debian/ffmpeg-v4l2-request-fourier
|
|
./build-deb.sh
|
|
ls -la *.deb
|
|
|
|
- name: upload + publish to suites
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd debian/ffmpeg-v4l2-request-fourier
|
|
DEB=$(ls ffmpeg-v4l2-request-fourier_*.deb | head -1)
|
|
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
|
|
marfritrepo@hertz.fritz.box:
|
|
for suite in bookworm trixie; do
|
|
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
|
|
"publish-deb $suite $DEB"
|
|
done
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/.ssh/id_ed25519_hertz
|
|
|
|
# -------------------------------------------------------------------------
|
|
# libva-v4l2-request-fourier Debian (aarch64) — meson build + dpkg-deb wrap.
|
|
# -------------------------------------------------------------------------
|
|
libva-v4l2-request-fourier-debian:
|
|
needs: libva-v4l2-request-fourier-aarch64
|
|
# Native Debian trixie runner — the driver bakes __vaDriverInit_1_<MINOR>
|
|
# at compile time from <va/va.h>. Building on Arch (libva 2.23) produced
|
|
# __vaDriverInit_1_23, which trixie's libva 2.22 runtime cannot bind: the
|
|
# .deb installed but vaInitialize() returned -1 on every host. A native
|
|
# trixie runner avoids the cross-distro ABI skew entirely.
|
|
runs-on: debian-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh debian/libva-v4l2-request-fourier)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: install build-deps
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
retry apt-get update -qq
|
|
retry apt-get install -y --no-install-recommends \
|
|
build-essential meson ninja-build pkg-config \
|
|
libva-dev libdrm-dev \
|
|
curl openssh-client rsync ca-certificates git dpkg-dev
|
|
|
|
- name: install hertz deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
|
|
chmod 600 /root/.ssh/id_ed25519_hertz
|
|
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: build libva-v4l2-request-fourier .deb
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd debian/libva-v4l2-request-fourier
|
|
./build-deb.sh
|
|
ls -la *.deb
|
|
|
|
- name: upload + publish to suites
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd debian/libva-v4l2-request-fourier
|
|
DEB=$(ls libva-v4l2-request-fourier_*.deb | head -1)
|
|
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
|
|
marfritrepo@hertz.fritz.box:
|
|
for suite in bookworm trixie; do
|
|
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
|
|
"publish-deb $suite $DEB"
|
|
done
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/.ssh/id_ed25519_hertz
|
|
|
|
# -------------------------------------------------------------------------
|
|
# mpv-fourier Debian (aarch64) — meson build links against
|
|
# ffmpeg-v4l2-request-fourier's libavcodec to keep ABI symmetry between
|
|
# the .deb's runtime dep declaration and the binary's actual linkage.
|
|
# We pre-install the Arch sibling package from [marfrit] for that.
|
|
# -------------------------------------------------------------------------
|
|
mpv-fourier-debian:
|
|
needs: mpv-fourier-aarch64
|
|
runs-on: debian-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh debian/mpv-fourier)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: install build-deps
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
retry apt-get update -qq
|
|
# Debian libav*-dev is ABI-compatible with the fourier ffmpeg
|
|
# fork at the header level; mpv link-binds against system
|
|
# libav at build time, runtime dlopen picks up the fourier
|
|
# libs if installed. The previous [marfrit] pre-install of
|
|
# ffmpeg-v4l2-request-fourier under pacman is unnecessary
|
|
# under apt: stock Debian libav*-dev provides the trixie
|
|
# ABI mpv-fourier's binary will encounter.
|
|
retry apt-get install -y --no-install-recommends \
|
|
build-essential git meson ninja-build pkg-config python3-docutils \
|
|
ladspa-sdk wayland-protocols libvulkan-dev libwayland-dev \
|
|
libasound2-dev desktop-file-utils libc6-dev hicolor-icon-theme \
|
|
libjack-jackd2-dev liblcms2-dev libarchive-dev libass-dev \
|
|
libbluray-dev libcdio-dev libcdio-paranoia-dev libdisplay-info-dev \
|
|
libdrm-dev libdvdnav-dev libdvdread-dev libegl-dev libgl-dev \
|
|
libglvnd-dev libjpeg-dev libplacebo-dev libpulse-dev libsixel-dev \
|
|
libva-dev libvdpau-dev libx11-dev libxext-dev libxkbcommon-dev \
|
|
libxpresent-dev libxrandr-dev libxss-dev libxv-dev libluajit-5.1-dev \
|
|
libmujs-dev libpipewire-0.3-dev librubberband-dev libsdl2-dev \
|
|
libopenal-dev libuchardet-dev libvapoursynth-dev liblzma-dev \
|
|
libavcodec-dev libavformat-dev libavutil-dev libswscale-dev libswresample-dev \
|
|
zlib1g-dev \
|
|
curl ca-certificates openssh-client rsync dpkg-dev
|
|
|
|
- name: install hertz deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
|
|
chmod 600 /root/.ssh/id_ed25519_hertz
|
|
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: build mpv-fourier .deb
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd debian/mpv-fourier
|
|
./build-deb.sh
|
|
ls -la *.deb
|
|
|
|
- name: upload + publish to suites
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd debian/mpv-fourier
|
|
DEB=$(ls mpv-fourier_*.deb | head -1)
|
|
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
|
|
marfritrepo@hertz.fritz.box:
|
|
for suite in bookworm trixie; do
|
|
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
|
|
"publish-deb $suite $DEB"
|
|
done
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/.ssh/id_ed25519_hertz
|
|
|
|
# -------------------------------------------------------------------------
|
|
# daedalus-v4l2 Debian (aarch64) — CMake + Make build, dpkg-deb wrap.
|
|
# Userspace daemon + test tools for the daedalus_v4l2 V4L2-stateless shim.
|
|
# -------------------------------------------------------------------------
|
|
daedalus-v4l2-debian:
|
|
needs: claude-his-debian
|
|
runs-on: debian-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh debian/daedalus-v4l2)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: install build-deps
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
retry apt-get update -qq
|
|
# FFmpeg headers + sonames the daemon dlopens. As of
|
|
# daedalus-v4l2 PR #16 (commit 514da29), the daemon targets
|
|
# the Kwiboo fork's libavcodec.so.62 / libavformat.so.62 /
|
|
# libavutil.so.60 at /opt/fourier — so the build needs
|
|
# /opt/fourier/include and /opt/fourier/lib/pkgconfig.
|
|
# ffmpeg-v4l2-request-fourier provides both (plus the
|
|
# runtime libs the .deb will dlopen on the target host;
|
|
# we install it as a build-dep here and the dpkg-shlibdeps
|
|
# step pulls it into the daemon .deb's Depends automatically).
|
|
# Debian-stock libav*-dev removed — would conflict on
|
|
# /usr/include/libavcodec/avcodec.h vs /opt/fourier's copy.
|
|
#
|
|
# libvulkan-dev + glslang-tools: needed by the in-build
|
|
# daedalus-fourier fetch (build-deb.sh fetches the sibling
|
|
# library, cmake-builds it into a temp prefix, then the
|
|
# daedalus daemon static-links against it via pkg-config).
|
|
# Without these, daedalus-fourier's find_package(Vulkan)
|
|
# and glslangValidator find_program both fail at configure
|
|
# time. See marfrit/daedalus-fourier PR #1 +
|
|
# reauktion/daedalus-v4l2 PR #13.
|
|
retry apt-get install -y --no-install-recommends \
|
|
build-essential cmake ninja-build pkg-config git \
|
|
ffmpeg-v4l2-request-fourier libdrm-dev \
|
|
libvulkan-dev glslang-tools \
|
|
linux-libc-dev \
|
|
curl ca-certificates openssh-client rsync dpkg-dev
|
|
|
|
- name: install hertz deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
|
|
chmod 600 /root/.ssh/id_ed25519_hertz
|
|
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: build daedalus-v4l2 .deb
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd debian/daedalus-v4l2
|
|
./build-deb.sh
|
|
ls -la *.deb
|
|
|
|
- name: upload + publish to suites
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd debian/daedalus-v4l2
|
|
DEB=$(ls daedalus-v4l2_*.deb | head -1)
|
|
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
|
|
marfritrepo@hertz.fritz.box:
|
|
for suite in bookworm trixie; do
|
|
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
|
|
"publish-deb $suite $DEB"
|
|
done
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/.ssh/id_ed25519_hertz
|
|
|
|
# -------------------------------------------------------------------------
|
|
# daedalus-v4l2-dkms Debian (Architecture: all) — packages the kernel
|
|
# source tree + dkms.conf. No compilation; just file copy + dpkg-deb.
|
|
# -------------------------------------------------------------------------
|
|
daedalus-v4l2-dkms-debian:
|
|
needs: daedalus-v4l2-debian
|
|
runs-on: debian-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh debian/daedalus-v4l2-dkms)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: install tooling
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
retry apt-get update -qq
|
|
retry apt-get install -y --no-install-recommends \
|
|
dpkg-dev openssh-client rsync curl ca-certificates tar gzip
|
|
|
|
- name: install hertz deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
|
|
chmod 600 /root/.ssh/id_ed25519_hertz
|
|
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: build daedalus-v4l2-dkms .deb
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd debian/daedalus-v4l2-dkms
|
|
./build-deb.sh
|
|
ls -la *.deb
|
|
|
|
- name: upload + publish to suites
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd debian/daedalus-v4l2-dkms
|
|
DEB=$(ls daedalus-v4l2-dkms_*.deb | head -1)
|
|
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
|
|
marfritrepo@hertz.fritz.box:
|
|
for suite in bookworm trixie; do
|
|
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
|
|
"publish-deb $suite $DEB"
|
|
done
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/.ssh/id_ed25519_hertz
|
|
|
|
# -------------------------------------------------------------------------
|
|
# mesa-panvk-bifrost (aarch64 only) — patched Mesa libvulkan_panfrost.so
|
|
# for Bifrost-gen Mali (panvk-bifrost campaign iter9). Co-installs at
|
|
# /usr/lib/panvk-bifrost/ so stock mesa stays intact; opt-in via the
|
|
# brave-vulkan launcher this package also ships.
|
|
#
|
|
# Build is slow (~30-60min on actrunner-aarch64): full Mesa-from-source.
|
|
# Standalone job — no `needs:` since it doesn't depend on the fourier
|
|
# codec stack. continue-on-error so a build hiccup doesn't block other
|
|
# jobs in the same workflow run.
|
|
# -------------------------------------------------------------------------
|
|
mesa-panvk-bifrost-aarch64:
|
|
runs-on: arch-aarch64
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: skip if already published
|
|
id: skip-check
|
|
run: |
|
|
set -e
|
|
result=$(./.gitea/scripts/check-already-published.sh arch/mesa-panvk-bifrost)
|
|
echo "$result" >> "$GITHUB_OUTPUT"
|
|
echo "decision: $result"
|
|
|
|
- name: bootstrap runner (idempotent)
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
|
|
|
|
- name: import signing key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
|
|
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
|
|
run: |
|
|
set -e
|
|
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
|
|
rm -rf /root/.gnupg /root/repo_pass
|
|
mkdir -m700 -p /root/.gnupg
|
|
printf '%s' "$PASS" > /root/repo_pass
|
|
chmod 600 /root/repo_pass
|
|
printf '%s\n' "$PRIV" | gpg --batch --import
|
|
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
|
|
|
|
- name: install deploy ssh key
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
env:
|
|
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
|
|
run: |
|
|
mkdir -m700 -p /root/.ssh
|
|
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
|
|
chmod 600 /root/.ssh/id_ed25519
|
|
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: makepkg mesa-panvk-bifrost
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
rm -rf /tmp/build-mesa-panvk-bifrost
|
|
cp -r arch/mesa-panvk-bifrost /tmp/build-mesa-panvk-bifrost
|
|
chown -R builder:builder /tmp/build-mesa-panvk-bifrost
|
|
cd /tmp/build-mesa-panvk-bifrost
|
|
# MAKEFLAGS for parallel build; runner is multi-core.
|
|
# --skipinteg because sha256sums=SKIP in PKGBUILD (matches the
|
|
# fourier-fork PKGBUILD convention).
|
|
sudo -u builder -H env MAKEFLAGS="-j60" \
|
|
makepkg --nocheck --noconfirm --syncdeps --cleanbuild --skipinteg
|
|
ls -la *.pkg.tar.* | grep -v "\.sig$"
|
|
|
|
- name: sign mesa-panvk-bifrost
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
cd /tmp/build-mesa-panvk-bifrost
|
|
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
|
|
[ -f "$f" ] || continue
|
|
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
|
|
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
|
|
done
|
|
|
|
- name: update aarch64 repo db
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
mkdir -p /tmp/arch-stage-mesa-panvk
|
|
cd /tmp/arch-stage-mesa-panvk
|
|
rm -f *
|
|
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
|
|
curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
|
|
done
|
|
for ext in xz zst gz; do
|
|
ls /tmp/build-mesa-panvk-bifrost/*.pkg.tar.$ext 2>/dev/null && \
|
|
mv /tmp/build-mesa-panvk-bifrost/*.pkg.tar.$ext /tmp/build-mesa-panvk-bifrost/*.pkg.tar.$ext.sig .
|
|
done || true
|
|
export GNUPGHOME=/root/.gnupg
|
|
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
|
|
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
|
|
gpg-connect-agent reloadagent /bye
|
|
pkgs=()
|
|
for ext in xz zst gz; do
|
|
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
|
|
done
|
|
if [ -f marfrit.db.tar.gz ]; then
|
|
for f in "${pkgs[@]}"; do
|
|
name=$(echo "$f" | sed -E 's/-[0-9].*//')
|
|
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
marfrit.db.tar.gz "$name" 2>/dev/null || true
|
|
done
|
|
fi
|
|
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
|
|
--verify marfrit.db.tar.gz "${pkgs[@]}"
|
|
ln -sf marfrit.db.tar.gz marfrit.db
|
|
ln -sf marfrit.files.tar.gz marfrit.files
|
|
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
|
|
rm -f marfrit.files.sig
|
|
|
|
- name: publish to aarch64
|
|
if: steps.skip-check.outputs.skip != '1'
|
|
run: |
|
|
set -e
|
|
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
|
|
cd /tmp/arch-stage-mesa-panvk
|
|
retry rsync -avL --copy-unsafe-links \
|
|
-e 'ssh -i /root/.ssh/id_ed25519' \
|
|
./ mfritsche@nc.reauktion.de:arch/aarch64/
|
|
|
|
- name: wipe secrets
|
|
if: always()
|
|
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
|