diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index da67e83..6e5475a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -9,7 +9,6 @@ on: options: - changed - foundry-cli-bin - - meshix-cli-bin - tabex-bin - osyrra-bin default: changed @@ -43,7 +42,7 @@ jobs: if [[ -n "$TARGET_PACKAGE" && "$TARGET_PACKAGE" != changed ]]; then case "$TARGET_PACKAGE" in - foundry-cli-bin|meshix-cli-bin|tabex-bin|osyrra-bin) ;; + foundry-cli-bin|tabex-bin|osyrra-bin) ;; *) echo 'Unknown package' >&2; exit 1 ;; esac [[ -f "$TARGET_PACKAGE/PKGBUILD" ]] @@ -61,6 +60,18 @@ jobs: | sort -u ) + # A removed package directory has no PKGBUILD left. Skip it so the + # AUR repo is left untouched; AUR deletion is a separate manual request. + existing=() + for package in "${packages[@]}"; do + if [[ -f "${package}/PKGBUILD" ]]; then + existing+=("${package}") + else + echo "Skipping removed package: ${package}" + fi + done + packages=("${existing[@]}") + if ((${#packages[@]} == 0)); then echo 'packages=[]' >> "${GITHUB_OUTPUT}" exit 0 diff --git a/.github/workflows/version-bumps.yml b/.github/workflows/version-bumps.yml index 8370610..eb38c5b 100644 --- a/.github/workflows/version-bumps.yml +++ b/.github/workflows/version-bumps.yml @@ -3,9 +3,6 @@ name: version-bumps on: workflow_dispatch: inputs: - meshix_cli_version: - description: Optional Meshix CLI release tag to pin for this run (for example v0.0.2) - required: false foundry_cli_release_tag: description: Optional Foundry CLI release tag to pin for this run (for example v0.0.30) required: false @@ -33,7 +30,6 @@ jobs: env: GH_TOKEN: ${{ github.token }} SHPIT_GH_TOKEN: ${{ secrets.SHPIT_GH_TOKEN }} - MESHIX_CLI_VERSION: ${{ github.event.inputs.meshix_cli_version || '' }} FOUNDRY_CLI_RELEASE_TAG: ${{ github.event.inputs.foundry_cli_release_tag || '' }} UPDATE_BRANCH: automation/version-bumps steps: @@ -69,7 +65,7 @@ jobs: if: ${{ steps.detect.outputs.changed == 'true' }} run: | git checkout -B "${UPDATE_BRANCH}" - git add README.md docs scripts .github/workflows meshix-cli-bin foundry-cli-bin tabex-bin osyrra-bin + git add README.md docs scripts .github/workflows foundry-cli-bin tabex-bin osyrra-bin git commit -m "chore(pkgbuilds): bump package versions" git push --force --set-upstream origin "${UPDATE_BRANCH}" diff --git a/README.md b/README.md index 236bb93..1bd3b32 100644 --- a/README.md +++ b/README.md @@ -7,9 +7,8 @@ Arch Linux package definitions for SHPIT-maintained command-line tools. | Package | Upstream | Notes | |---|---|---| | `foundry-cli-bin` | `shpitdev/foundry-cli` GitHub Releases | Private release assets. Same auth model as the other SHPIT packages. | -| `meshix-cli-bin` | `shpitdev/meshix-observability` GitHub Releases | Private release assets. Same auth model as `osyrra-bin`. | | `tabex-bin` | `shpitdev/pkgbuilds` GitHub Releases | Public binary release assets mirrored from the private Tabex release after digest and archive verification. No GitHub credentials are required to install a mirrored version. | -| `osyrra-bin` | `shpitdev/osyrra` GitHub Releases | Private release assets. Same auth model as `meshix-cli-bin`. | +| `osyrra-bin` | `shpitdev/osyrra` GitHub Releases | Private release assets. Same auth model as the other SHPIT packages. | ## Automation @@ -39,7 +38,7 @@ cd makepkg -si ``` -`gh auth login` must be configured with access to the `shpitdev` org before `makepkg` can download the private `foundry-cli-bin`, `meshix-cli-bin`, or `osyrra-bin` release assets. Tabex versions published through the public binary channel need no GitHub credentials. +`gh auth login` must be configured with access to the `shpitdev` org before `makepkg` can download the private `foundry-cli-bin` or `osyrra-bin` release assets. Tabex versions published through the public binary channel need no GitHub credentials. After installing `tabex-bin`, start with: @@ -53,7 +52,7 @@ The package includes an install hook that prints the same guidance after install - You can use this repo immediately without creating the AUR repositories or AUR secrets. - The scheduled/manual bump workflow uses the repository `GITHUB_TOKEN` for branch and PR operations in this repo. -- Without `SHPIT_GH_TOKEN`, the workflow skips the private package updates (`foundry-cli-bin`, `meshix-cli-bin`, and `osyrra-bin`). Public Tabex package updates remain available. +- Without `SHPIT_GH_TOKEN`, the workflow skips the private package updates (`foundry-cli-bin` and `osyrra-bin`). Public Tabex package updates remain available. - Without AUR secrets, the publish workflow exits successfully without pushing anywhere. ## Secrets diff --git a/docs/setup.md b/docs/setup.md index 799f236..e45a40a 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -16,10 +16,10 @@ Use this first. Result: - branch and PR creation use the repo `GITHUB_TOKEN` -- `meshix-cli-bin` and `osyrra-bin` update only if the repo has access to `SHPIT_GH_TOKEN` +- `osyrra-bin` updates only if the repo has access to `SHPIT_GH_TOKEN` - `tabex-bin` updates anonymously after an exact stable Tabex release has been mirrored publicly - AUR publishing is skipped without failing -- upstream `meshix-observability` and `osyrra` release workflows can trigger the version-bump workflow directly +- the upstream `osyrra` release workflow can trigger the version-bump workflow directly - the Tabex release workflow instead dispatches `publish-tabex-release.yml`; that trusted workflow verifies and publishes the exact public mirror before it triggers the local version bump ## GitHub UI Links @@ -30,7 +30,7 @@ Result: ## SHPIT_GH_TOKEN -Create the secret (org-level or repo-level) with access to read private releases on `shpitdev/meshix-observability`, `shpitdev/tabex`, and `shpitdev/osyrra`. The Tabex publisher uses it only for the private source read; publication and the same-repository bump dispatch use the workflow's repository-scoped token. An org-level secret with `selected` visibility is the cleanest option if you have multiple consuming repos. +Create the secret (org-level or repo-level) with access to read private releases on `shpitdev/tabex` and `shpitdev/osyrra`. The Tabex publisher uses it only for the private source read; publication and the same-repository bump dispatch use the workflow's repository-scoped token. An org-level secret with `selected` visibility is the cleanest option if you have multiple consuming repos. Attach it to this repo with: @@ -52,16 +52,12 @@ Create a fine-grained PAT that can trigger workflow dispatches in: Store that PAT as the GitHub org secret `SHPIT_WORKFLOW_DISPATCH_TOKEN` with `selected` visibility for these producer repos: -- `shpitdev/meshix-observability` - `shpitdev/tabex` - `shpitdev/osyrra` Those producer release workflows run in Depot CI, so GitHub org secrets are not enough on their own. Mirror the same secret into Depot for each producer repo with one of these paths: ```bash -cd /home/anandpant/Development/shpitdev/meshix/meshix-observability -depot ci migrate secrets-and-vars -y - cd /home/anandpant/Development/shpitdev/tabex depot ci migrate secrets-and-vars -y @@ -72,7 +68,6 @@ depot ci migrate secrets-and-vars -y Or add the Depot secrets directly: ```bash -depot ci secrets add SHPIT_WORKFLOW_DISPATCH_TOKEN --repo shpitdev/meshix-observability depot ci secrets add SHPIT_WORKFLOW_DISPATCH_TOKEN --repo shpitdev/tabex depot ci secrets add SHPIT_WORKFLOW_DISPATCH_TOKEN --repo shpitdev/osyrra ``` @@ -100,7 +95,7 @@ That is safe because `v0.0.4` is the first stable release that ships the source- When you are ready to publish to AUR: -1. Create the target AUR package repos (`meshix-cli-bin`, `tabex-bin`, `osyrra-bin`). +1. Create the target AUR package repos (`tabex-bin`, `osyrra-bin`). 2. Generate an SSH key that can push to those AUR repos. 3. Add these repo secrets: - `AUR_USERNAME` @@ -112,12 +107,12 @@ When you are ready to publish to AUR: ## Token Model - Same-repo automation uses the built-in `GITHUB_TOKEN`. -- Cross-repo private release access for `meshix-cli-bin`, `tabex-bin`, and `osyrra-bin` needs a separate credential in Actions, because the workflow token is scoped to the repository that contains the workflow. +- Cross-repo private release access for `tabex-bin` and `osyrra-bin` needs a separate credential in Actions, because the workflow token is scoped to the repository that contains the workflow. - Local runs can use your normal `gh auth login` session instead of any exported token. ## Recommended Follow-Up Replace the org-level token with a narrower machine credential when practical: -1. Create a dedicated machine user token with only the repo access needed for private release reads on `shpitdev/meshix-observability`, `shpitdev/tabex`, and `shpitdev/osyrra`. +1. Create a dedicated machine user token with only the repo access needed for private release reads on `shpitdev/tabex` and `shpitdev/osyrra`. 2. Or use a GitHub App installation token flow for the cleanest long-term setup. diff --git a/meshix-cli-bin/.SRCINFO b/meshix-cli-bin/.SRCINFO deleted file mode 100644 index c379dc9..0000000 --- a/meshix-cli-bin/.SRCINFO +++ /dev/null @@ -1,14 +0,0 @@ -pkgbase = meshix-cli-bin - pkgdesc = Meshix CLI for run inspection and generation workflows - pkgver = 0.0.27 - pkgrel = 1 - url = https://github.com/shpitdev/meshix-mono - install = meshix-cli-bin.install - arch = x86_64 - license = LicenseRef-proprietary - makedepends = github-cli - depends = nodejs - provides = meshix-cli - conflicts = meshix-cli - -pkgname = meshix-cli-bin diff --git a/meshix-cli-bin/PKGBUILD b/meshix-cli-bin/PKGBUILD deleted file mode 100644 index 639a1a2..0000000 --- a/meshix-cli-bin/PKGBUILD +++ /dev/null @@ -1,34 +0,0 @@ -# Maintainer: Anand Pant - -pkgname=meshix-cli-bin -pkgver=0.0.27 -pkgrel=1 -pkgdesc="Meshix CLI for run inspection and generation workflows" -arch=('x86_64') -url="https://github.com/shpitdev/meshix-mono" -license=('LicenseRef-proprietary') -install="${pkgname}.install" -makedepends=('github-cli') -depends=('nodejs') -provides=('meshix-cli') -conflicts=('meshix-cli') - -# Public PKGBUILD, private release asset. Users need GitHub access to the shpitdev org. -_release_version="${pkgver//_/-}" -_asset="meshix-cli_v${_release_version}_linux_amd64.tar.gz" -_sha256='f881387e2c5a6d8701a1e3a3037546d57911ca7e9ec14e65b3e763489fbac965' - -prepare() { - gh release download "meshix-cli-v${_release_version}" \ - --repo shpitdev/meshix-mono \ - --pattern "${_asset}" \ - --dir . --clobber - - echo "${_sha256} ${_asset}" | sha256sum -c - tar xzf "${_asset}" -} - -package() { - install -Dm755 "meshix-cli_v${_release_version}_linux_amd64/meshix-cli" \ - "${pkgdir}/usr/bin/meshix-cli" -} diff --git a/meshix-cli-bin/meshix-cli-bin.install b/meshix-cli-bin/meshix-cli-bin.install deleted file mode 100644 index 5de5704..0000000 --- a/meshix-cli-bin/meshix-cli-bin.install +++ /dev/null @@ -1,13 +0,0 @@ -post_install() { - cat <<'EOF' -==> meshix-cli-bin: package-manager installs provide the stable meshix-cli command only. -==> Start with: -==> meshix-cli --help -==> -==> For a checkout-linked dev command, install meshix-cli-dev from a local checkout. -EOF -} - -post_upgrade() { - post_install -} diff --git a/scripts/update-meshix-cli-bin.sh b/scripts/update-meshix-cli-bin.sh deleted file mode 100755 index 690b5df..0000000 --- a/scripts/update-meshix-cli-bin.sh +++ /dev/null @@ -1,115 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -optional=false -if (($# > 1)); then - echo "usage: $0 [--optional]" >&2 - exit 1 -fi -if (($# == 1)); then - if [[ "$1" != "--optional" ]]; then - echo "usage: $0 [--optional]" >&2 - exit 1 - fi - optional=true -fi - -repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)" -pkgbuild="${repo_root}/meshix-cli-bin/PKGBUILD" -repo="shpitdev/meshix-mono" -requested_version="${MESHIX_CLI_VERSION:-latest}" - -normalize_release_tag() { - local version="$1" - - if [[ -z "${version}" || "${version}" == "latest" ]]; then - printf 'latest' - return 0 - fi - - version="${version#meshix-cli-}" - version="${version#v}" - printf 'meshix-cli-v%s' "${version}" -} - -resolve_release_json() { - local version="$1" - local endpoint - local release_tag - local output="" - - release_tag="$(normalize_release_tag "${version}")" - - if [[ "${release_tag}" == "latest" ]]; then - endpoint="repos/${repo}/releases/latest" - else - endpoint="repos/${repo}/releases/tags/${release_tag}" - fi - - if [[ -n "${SHPIT_GH_TOKEN:-}" ]]; then - if output="$(GH_TOKEN="${SHPIT_GH_TOKEN}" gh api "${endpoint}" 2>/dev/null)"; then - printf '%s' "${output}" - return 0 - fi - if [[ -n "${GITHUB_ACTIONS:-}" && "${optional}" == "true" ]]; then - echo "Skipping meshix-cli-bin: SHPIT_GH_TOKEN does not currently grant release access to ${repo}." >&2 - printf '__SKIP__' - return 0 - fi - echo "SHPIT_GH_TOKEN could not read the private meshix-cli release in ${repo}." >&2 - return 1 - elif [[ -n "${GITHUB_ACTIONS:-}" ]]; then - if [[ "${optional}" == "true" ]]; then - echo "Skipping meshix-cli-bin: SHPIT_GH_TOKEN is not configured in GitHub Actions." >&2 - printf '__SKIP__' - return 0 - fi - echo "SHPIT_GH_TOKEN is required in GitHub Actions to read the private meshix-cli release." >&2 - return 1 - else - gh api "${endpoint}" - fi -} - -release_json="$(resolve_release_json "${requested_version}")" -if [[ "${release_json}" == "__SKIP__" ]]; then - exit 0 -fi -tag_name="$(jq -r '.tag_name' <<<"${release_json}")" -pkgver="${tag_name#meshix-cli-v}" -pkgver="${pkgver#v}" -# Arch package versions cannot contain hyphens. The PKGBUILD maps underscores -# back to release-tag hyphens when resolving the GitHub asset. -pkgver="${pkgver//-/_}" -asset_json="$(jq -c ' - .assets - | map(select(.name | test("_linux_amd64\\.tar\\.gz$"))) - | first -' <<<"${release_json}")" -release_asset="$(jq -r '.name // empty' <<<"${asset_json}")" -sha256="$(jq -r '.digest // empty' <<<"${asset_json}")" - -if [[ -z "${release_asset}" || "${release_asset}" == "null" ]]; then - if [[ "${optional}" == "true" ]]; then - echo "Skipping meshix-cli-bin: release is missing a linux amd64 archive." >&2 - exit 0 - fi - echo "meshix-cli release is missing a linux amd64 archive" >&2 - exit 1 -fi - -if [[ -z "${sha256}" || "${sha256}" == "null" ]]; then - if [[ "${optional}" == "true" ]]; then - echo "Skipping meshix-cli-bin: release is missing an asset digest." >&2 - exit 0 - fi - echo "meshix-cli release is missing an asset digest" >&2 - exit 1 -fi - -sha256="${sha256#sha256:}" - -perl -0pi -e "s/^pkgver=.*/pkgver=${pkgver}/m" "${pkgbuild}" -perl -0pi -e "s/^_sha256=.*/_sha256='${sha256}'/m" "${pkgbuild}" - -"${repo_root}/scripts/render-srcinfo.sh" "${repo_root}/meshix-cli-bin" diff --git a/scripts/update-packages.sh b/scripts/update-packages.sh index 02ceb89..12a09ed 100755 --- a/scripts/update-packages.sh +++ b/scripts/update-packages.sh @@ -8,13 +8,12 @@ if (($# == 0)); then fi if [[ "$1" == "auto" ]]; then - packages=(meshix-cli-bin tabex-bin) + packages=(tabex-bin) if [[ -n "${SHPIT_GH_TOKEN:-}" || -z "${GITHUB_ACTIONS:-}" ]]; then packages+=(osyrra-bin) fi elif [[ "$1" == "all" ]]; then packages=( - meshix-cli-bin foundry-cli-bin tabex-bin osyrra-bin @@ -25,13 +24,6 @@ fi for package in "${packages[@]}"; do case "${package}" in - meshix-cli-bin) - if [[ "$1" == "auto" ]]; then - "${repo_root}/scripts/update-meshix-cli-bin.sh" --optional - else - "${repo_root}/scripts/update-meshix-cli-bin.sh" - fi - ;; foundry-cli-bin) if [[ "$1" == "auto" ]]; then "${repo_root}/scripts/update-foundry-cli-bin.sh" --optional diff --git a/scripts/validate-packages.sh b/scripts/validate-packages.sh index 33ce3ed..b33035f 100755 --- a/scripts/validate-packages.sh +++ b/scripts/validate-packages.sh @@ -13,15 +13,6 @@ done "${repo_root}/scripts/validate-foundry-cli-archive.test.sh" "${repo_root}/scripts/select-foundry-cli-asset.test.sh" -meshix_pkg="${repo_root}/meshix-cli-bin" -if [[ -f "${meshix_pkg}/PKGBUILD" ]]; then - grep -q "depends=('nodejs')" "${meshix_pkg}/PKGBUILD" - grep -q '_release_version="${pkgver//_/-}"' "${meshix_pkg}/PKGBUILD" - grep -q 'gh release download "meshix-cli-v${_release_version}"' "${meshix_pkg}/PKGBUILD" - grep -q 'install="${pkgname}\.install"' "${meshix_pkg}/PKGBUILD" - grep -q 'meshix-cli-dev' "${meshix_pkg}/meshix-cli-bin.install" -fi - tabex_pkg="${repo_root}/tabex-bin" if [[ -f "${tabex_pkg}/PKGBUILD" ]]; then grep -q 'install="${pkgname}\.install"' "${tabex_pkg}/PKGBUILD"