From e92d0010124bef8e222b8f9b691b2453aa81fc34 Mon Sep 17 00:00:00 2001 From: MotherSphere Date: Sat, 1 Aug 2026 12:45:29 +0200 Subject: [PATCH] fix(ci): stop leaving stale versions behind in the AUR .SRCINFO The AUR bump mirrors PKGBUILD metadata into .SRCINFO field by field, with one sed per line that embeds $pkgver. That only holds while every new source gets a sed of its own, and the icon source never did: it is matched by neither `colony-[0-9.]*::https` (the filename is `colony-icon-...`, no digit follows the dash) nor `download/v[0-9.]*/colony-linux`. So colony-bin has been published since 0.9.0 announcing `pkgver = 0.9.1` while the icon source still pointed at the v0.8.0 tag. Nothing failed. Builds come from the PKGBUILD, so the package was fine; only the metadata the AUR serves disagreed with the file next to it. Rewriting every occurrence of the outgoing version instead of naming the lines it may appear on fixes today's case, but the durable part is the check after it: if any mention of the old version survives, the release now fails and says which line. The next field somebody forgets stops being invisible. Verified by replaying the 0.8.0 -> 0.9.1 bump that produced the defect: the result is byte-identical to `makepkg --printsrcinfo` on the 0.9.1 PKGBUILD, apart from the binary checksum, which the workflow takes from the downloaded artifact rather than from the previous .SRCINFO. Generating .SRCINFO with makepkg would remove the whole class of bug, but the runner is Ubuntu and it would mean a container in the release path: an unverifiable step whose failure costs every future version bump, traded against metadata that is merely cosmetically stale. Not worth it here. --- .github/workflows/aur-publish.yml | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml index 5e8e344..c1e7666 100644 --- a/.github/workflows/aur-publish.yml +++ b/.github/workflows/aur-publish.yml @@ -87,6 +87,9 @@ jobs: echo "pkgver already at ${PKGVER} — nothing to do." else echo "changed=true" >> "$GITHUB_OUTPUT" + # Carried to the next step so it can rewrite every occurrence of + # the OUTGOING version, not just the fields someone listed. + echo "oldver=${CURRENT}" >> "$GITHUB_OUTPUT" fi - name: Update PKGBUILD + .SRCINFO @@ -94,6 +97,7 @@ jobs: env: PKGVER: ${{ steps.tag.outputs.pkgver }} SHA256: ${{ steps.sha.outputs.sha256 }} + OLDVER: ${{ steps.check.outputs.oldver }} run: | cd aur-repo # Reset pkgrel to 1 because pkgver changed — standard AUR convention. @@ -103,18 +107,30 @@ jobs: # _iconsha is stable across releases and must not be touched). sed -i "s/^_binsha=.*/_binsha='${SHA256}'/" PKGBUILD - # .SRCINFO mirrors the PKGBUILD metadata. We sed the three fields - # that track pkgver (pkgver itself, noextract filename, source URL) - # plus the single sha256sums line. Everything else is static. + # .SRCINFO mirrors the PKGBUILD metadata, field by field. The + # mirroring is the weakness: it only holds while someone adds a sed + # for every new line that embeds $pkgver, and nobody did when the + # icon source was added. The published .SRCINFO announced pkgver + # 0.9.1 while still pointing the icon at the v0.8.0 tag, and nothing + # complained - the AUR simply served metadata disagreeing with the + # PKGBUILD beside it. + # + # So: rewrite EVERY occurrence of the outgoing version rather than + # naming the lines it may appear on, and then refuse to continue if + # any survived. The check is the part that matters - it turns the + # next forgotten field from silent staleness into a failed release. sed -i "s/^\tpkgver = .*/\tpkgver = ${PKGVER}/" .SRCINFO sed -i "s/^\tpkgrel = .*/\tpkgrel = 1/" .SRCINFO - sed -i "s|noextract = colony-[^[:space:]]*|noextract = colony-${PKGVER}|" .SRCINFO - sed -i "s|colony-[0-9.]*::https|colony-${PKGVER}::https|" .SRCINFO - sed -i "s|download/v[0-9.]*/colony-linux|download/v${PKGVER}/colony-linux|" .SRCINFO + sed -i "s|${OLDVER//./\\.}|${PKGVER}|g" .SRCINFO # Only the FIRST sha256sums line is the binary's; the second is the # stable icon hash. sed -i "0,/^\tsha256sums = .*/s//\tsha256sums = ${SHA256}/" .SRCINFO + if grep -n "${OLDVER//./\\.}" .SRCINFO; then + echo "::error::.SRCINFO still mentions ${OLDVER} after the bump to ${PKGVER} (lines above)" + exit 1 + fi + echo "--- PKGBUILD diff ---" git --no-pager diff PKGBUILD || true echo "--- .SRCINFO diff ---"