From 6df86f0516a86478ec6890d4eb604de56d283c4f Mon Sep 17 00:00:00 2001 From: Jeremy Huntwork Date: Fri, 7 Aug 2026 08:56:45 -0400 Subject: [PATCH 1/2] Use CI v0.18.6 for recipe workflows --- .forgejo/workflows/build.yaml | 134 ------------------------------- .forgejo/workflows/validate.yaml | 47 ----------- .github/workflows/build.yaml | 28 ++----- .github/workflows/validate.yaml | 15 +--- 4 files changed, 12 insertions(+), 212 deletions(-) delete mode 100644 .forgejo/workflows/build.yaml delete mode 100644 .forgejo/workflows/validate.yaml diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml deleted file mode 100644 index 750602f0..00000000 --- a/.forgejo/workflows/build.yaml +++ /dev/null @@ -1,134 +0,0 @@ -on: - push: - branches: - - main - paths: - - 'recipes/**/recipe.kdl' - -jobs: - detect: - runs-on: docker-aarch64 - container: - image: mere/ci:v0.18.1 - outputs: - matrix: ${{ steps.detect.outputs.matrix }} - has_recipes: ${{ steps.detect.outputs.has_recipes }} - steps: - - name: Git checkout - run: | - set -eu - git init "$GITHUB_WORKSPACE" - cd "$GITHUB_WORKSPACE" - git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git" - git -c http.extraHeader="Authorization: Bearer $GITHUB_TOKEN" \ - fetch --depth=2 origin "$GITHUB_SHA" - git checkout --detach FETCH_HEAD - - - name: Detect changed recipes - id: detect - run: | - set -eu - cd "$GITHUB_WORKSPACE" - - # For merge commits, diff against first parent. - if git cat-file -t HEAD^2 >/dev/null 2>&1; then - changed=$( - git diff --name-only HEAD^1 HEAD \ - | grep '^recipes/[^/]*/[^/]*/recipe\.kdl$' || true - ) - else - changed=$( - git diff --name-only HEAD~1 HEAD \ - | grep '^recipes/[^/]*/[^/]*/recipe\.kdl$' || true - ) - fi - - if [ -z "$changed" ]; then - printf 'No recipe changes detected.\n' - printf 'has_recipes=false\n' >> "$GITHUB_OUTPUT" - printf 'matrix={\"include\":[]}\n' >> "$GITHUB_OUTPUT" - exit 0 - fi - - # Build matrix includes by reading archs from each recipe - includes="[]" - for recipe in $changed; do - # Extract the archs line: archs "x86_64" or archs "aarch64" "x86_64" or archs "any" - archs=$(sed -n 's/.*archs[[:space:]]*//p' "$recipe" | tr -d '"' | tr -s ' ') - - case "$archs" in - *any*) - # Arch-independent: build once on aarch64 - includes=$(printf '%s' "$includes" | jq -c ". + [{\"recipe\": \"$recipe\", \"arch\": \"aarch64\"}]") - ;; - *) - # Build for each listed arch - for arch in $archs; do - includes=$(printf '%s' "$includes" | jq -c ". + [{\"recipe\": \"$recipe\", \"arch\": \"$arch\"}]") - done - ;; - esac - done - - printf 'has_recipes=true\n' >> "$GITHUB_OUTPUT" - printf 'matrix=%s\n' "{\"include\":$includes}" >> "$GITHUB_OUTPUT" - printf 'Building: %s\n' "$changed" - printf 'Matrix: %s\n' "{\"include\":$includes}" - - build: - needs: detect - if: needs.detect.outputs.has_recipes == 'true' - runs-on: ${{ matrix.arch == 'aarch64' && 'docker-aarch64' || 'docker' }} - container: - image: mere/ci:v0.18.1 - options: --privileged --cpus=8 --memory=12g - strategy: - matrix: ${{ fromJSON(needs.detect.outputs.matrix) }} - fail-fast: false - env: - MERE_NO_HARDEN: "1" - MERE_SIGNING_KEY: ${{ secrets.MERE_SIGNING_KEY }} - PKGD_PUBLISH_TOKEN: ${{ secrets.PKGD_PUBLISH_TOKEN }} - steps: - - name: Git checkout - run: | - set -eu - git init "$GITHUB_WORKSPACE" - cd "$GITHUB_WORKSPACE" - git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git" - git -c http.extraHeader="Authorization: Bearer $GITHUB_TOKEN" \ - fetch --depth=1 origin "$GITHUB_SHA" - git checkout --detach FETCH_HEAD - - - name: Setup signing key - run: | - set -eu - grep -q '^root:' /etc/passwd 2>/dev/null || printf 'root:x:0:0:root:/root:/bin/sh\n' >> /etc/passwd - install -d -m 700 /root - install -d -m 700 /root/.mere/keys - printf '%s' "$MERE_SIGNING_KEY" | base64 -d > /root/.mere/keys/mere.key - chmod 600 /root/.mere/keys/mere.key - - - name: Build - run: | - set -eu - cd "$GITHUB_WORKSPACE" - mere dev build "${{ matrix.recipe }}" - - - name: Publish to pkgd - run: | - set -eu - archives=$(find /mere/dev/outputs -name '*.pkg.tar.zst' -type f) - if [ -z "$archives" ]; then - printf '::error::Build produced no archives\n' - exit 1 - fi - - curl_args="-sS --fail-with-body" - curl_args="$curl_args -H 'Authorization: Bearer $PKGD_PUBLISH_TOKEN'" - for archive in $archives; do - curl_args="$curl_args -F package=@$archive" - done - - printf 'Publishing %d archive(s) to pkgd\n' $(printf '%s\n' "$archives" | wc -l) - eval curl $curl_args https://pkgs.merelinux.org/publish diff --git a/.forgejo/workflows/validate.yaml b/.forgejo/workflows/validate.yaml deleted file mode 100644 index 9ce672dd..00000000 --- a/.forgejo/workflows/validate.yaml +++ /dev/null @@ -1,47 +0,0 @@ -on: - pull_request: - -jobs: - validate: - runs-on: docker-aarch64 - container: - image: mere/ci:v0.18.1 - steps: - - name: Git checkout - run: | - set -eu - git init "$GITHUB_WORKSPACE" - cd "$GITHUB_WORKSPACE" - git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git" - git -c http.extraHeader="Authorization: Bearer $GITHUB_TOKEN" \ - fetch --depth=1 origin "$GITHUB_SHA" - git checkout --detach FETCH_HEAD - - - name: Validate changed recipes - run: | - set -eu - cd "$GITHUB_WORKSPACE" - - if [ -z "${GITHUB_BASE_REF:-}" ]; then - printf '%s\n' "GITHUB_BASE_REF is not set for this pull request." >&2 - exit 1 - fi - - git -c http.extraHeader="Authorization: Bearer $GITHUB_TOKEN" \ - fetch --depth=50 origin "$GITHUB_BASE_REF" - - changed_recipes=$( - git diff --name-only "origin/$GITHUB_BASE_REF...$GITHUB_SHA" \ - | grep '^recipes/[^/][^/]*/[^/][^/]*/recipe\.kdl$' || true - ) - - if [ -z "$changed_recipes" ]; then - printf '%s\n' "No recipe.kdl changes to validate." - exit 0 - fi - - printf '%s\n' "$changed_recipes" | while IFS= read -r recipe; do - [ -n "$recipe" ] || continue - printf 'Validating %s\n' "$recipe" - mere dev validate "$recipe" - done diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index b3cde7fc..56e37bbb 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -20,23 +20,17 @@ jobs: detect: runs-on: ubuntu-24.04-arm container: - image: mere/ci:v0.18.5 + image: mere/ci:v0.18.6 env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} MANUAL_RECIPES: ${{ inputs.recipes }} outputs: matrix: ${{ steps.detect.outputs.matrix }} has_recipes: ${{ steps.detect.outputs.has_recipes }} steps: - name: Git checkout - run: | - set -eu - git init "$GITHUB_WORKSPACE" - git config --global --add safe.directory "$GITHUB_WORKSPACE" - cd "$GITHUB_WORKSPACE" - git remote add origin "https://x-access-token:${GH_TOKEN}@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" - git fetch --depth=2 origin "$GITHUB_SHA" - git checkout --detach FETCH_HEAD + uses: actions/checkout@v4 + with: + fetch-depth: 2 - name: Detect changed recipes id: detect @@ -120,7 +114,7 @@ jobs: if: needs.detect.outputs.has_recipes == 'true' runs-on: ${{ matrix.runner }} container: - image: mere/ci:v0.18.5 + image: mere/ci:v0.18.6 options: --privileged --cpus=4 --memory=12g strategy: matrix: ${{ fromJSON(needs.detect.outputs.matrix) }} @@ -129,17 +123,11 @@ jobs: MERE_NO_HARDEN: "1" MERE_SIGNING_KEY: ${{ secrets.MERE_SIGNING_KEY }} PKGD_PUBLISH_TOKEN: ${{ secrets.PKGD_PUBLISH_TOKEN }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - name: Git checkout - run: | - set -eu - git init "$GITHUB_WORKSPACE" - git config --global --add safe.directory "$GITHUB_WORKSPACE" - cd "$GITHUB_WORKSPACE" - git remote add origin "https://x-access-token:${GH_TOKEN}@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" - git fetch --depth=1 origin "$GITHUB_SHA" - git checkout --detach FETCH_HEAD + uses: actions/checkout@v4 + with: + fetch-depth: 1 - name: Setup signing key run: | diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml index 06b97f59..1b6e725e 100644 --- a/.github/workflows/validate.yaml +++ b/.github/workflows/validate.yaml @@ -10,19 +10,12 @@ jobs: validate: runs-on: ubuntu-24.04 container: - image: mere/ci:v0.18.5 - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + image: mere/ci:v0.18.6 steps: - name: Git checkout - run: | - set -eu - git init "$GITHUB_WORKSPACE" - git config --global --add safe.directory "$GITHUB_WORKSPACE" - cd "$GITHUB_WORKSPACE" - git remote add origin "https://x-access-token:${GH_TOKEN}@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" - git fetch --depth=1 origin "$GITHUB_SHA" - git checkout --detach FETCH_HEAD + uses: actions/checkout@v4 + with: + fetch-depth: 1 - name: Validate changed recipes run: | From 4e228fbdb1224c8193833ffdfb2f73acbbe4fc99 Mon Sep 17 00:00:00 2001 From: Jeremy Huntwork Date: Fri, 7 Aug 2026 09:00:03 -0400 Subject: [PATCH 2/2] Keep container-compatible checkout --- .github/workflows/build.yaml | 24 ++++++++++++++++++------ .github/workflows/validate.yaml | 13 ++++++++++--- 2 files changed, 28 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 56e37bbb..c68358fa 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -22,15 +22,21 @@ jobs: container: image: mere/ci:v0.18.6 env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} MANUAL_RECIPES: ${{ inputs.recipes }} outputs: matrix: ${{ steps.detect.outputs.matrix }} has_recipes: ${{ steps.detect.outputs.has_recipes }} steps: - name: Git checkout - uses: actions/checkout@v4 - with: - fetch-depth: 2 + run: | + set -eu + git init "$GITHUB_WORKSPACE" + git config --global --add safe.directory "$GITHUB_WORKSPACE" + cd "$GITHUB_WORKSPACE" + git remote add origin "https://x-access-token:${GH_TOKEN}@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" + git fetch --depth=2 origin "$GITHUB_SHA" + git checkout --detach FETCH_HEAD - name: Detect changed recipes id: detect @@ -122,12 +128,18 @@ jobs: env: MERE_NO_HARDEN: "1" MERE_SIGNING_KEY: ${{ secrets.MERE_SIGNING_KEY }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PKGD_PUBLISH_TOKEN: ${{ secrets.PKGD_PUBLISH_TOKEN }} steps: - name: Git checkout - uses: actions/checkout@v4 - with: - fetch-depth: 1 + run: | + set -eu + git init "$GITHUB_WORKSPACE" + git config --global --add safe.directory "$GITHUB_WORKSPACE" + cd "$GITHUB_WORKSPACE" + git remote add origin "https://x-access-token:${GH_TOKEN}@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" + git fetch --depth=1 origin "$GITHUB_SHA" + git checkout --detach FETCH_HEAD - name: Setup signing key run: | diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml index 1b6e725e..c53bb0da 100644 --- a/.github/workflows/validate.yaml +++ b/.github/workflows/validate.yaml @@ -11,11 +11,18 @@ jobs: runs-on: ubuntu-24.04 container: image: mere/ci:v0.18.6 + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - name: Git checkout - uses: actions/checkout@v4 - with: - fetch-depth: 1 + run: | + set -eu + git init "$GITHUB_WORKSPACE" + git config --global --add safe.directory "$GITHUB_WORKSPACE" + cd "$GITHUB_WORKSPACE" + git remote add origin "https://x-access-token:${GH_TOKEN}@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" + git fetch --depth=1 origin "$GITHUB_SHA" + git checkout --detach FETCH_HEAD - name: Validate changed recipes run: |