Updated PPA installer script #71
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release to PPA | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| defaults: | |
| run: | |
| shell: bash | |
| working-directory: ./app | |
| jobs: | |
| build-and-release: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| dist: [jammy, noble, questing] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install packaging tools | |
| run: | | |
| sudo apt update | |
| sudo apt install -y \ | |
| devscripts debhelper dput gnupg2 build-essential lintian fakeroot | |
| - name: Extract version from tag | |
| id: version | |
| run: | | |
| RAW_TAG="${GITHUB_REF#refs/tags/}" | |
| VERSION="${RAW_TAG#v}" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Generate upstream tarball (.orig.tar.gz) | |
| working-directory: . | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| # Archive only the app subtree as upstream, exclude debian/ via worktree attributes | |
| git archive --worktree-attributes \ | |
| --prefix=hudbox-$VERSION/ \ | |
| -o app/../hudbox_${VERSION}.orig.tar.gz HEAD:app | |
| - name: Setup GPG for signing | |
| env: | |
| GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} | |
| GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }} | |
| PPA_GPG_PASSPHRASE: ${{ secrets.PPA_GPG_PASSPHRASE }} | |
| run: | | |
| export GNUPGHOME=$RUNNER_TEMP/gnupg | |
| mkdir -p "$GNUPGHOME" | |
| chmod 700 "$GNUPGHOME" | |
| # Configure gpg-agent for non-interactive loopback pinentry | |
| echo 'allow-loopback-pinentry' > "$GNUPGHOME/gpg-agent.conf" | |
| echo 'pinentry-mode loopback' > "$GNUPGHOME/gpg.conf" | |
| gpgconf --kill gpg-agent || true | |
| # Import ASCII-armored PRIVATE key (must begin with BEGIN PGP PRIVATE KEY BLOCK) | |
| echo "$GPG_PRIVATE_KEY" | gpg --batch --yes --import | |
| echo "Imported keys (secret):" | |
| gpg --list-secret-keys --keyid-format LONG || true | |
| # Fail fast if no secret keys are present (public key only won't work) | |
| if ! gpg --list-secret-keys --keyid-format LONG | grep -q 'sec'; then | |
| echo "ERROR: No secret key was imported. Ensure secrets.GPG_PRIVATE_KEY contains your ASCII-armored PRIVATE key (not just the public key)." >&2 | |
| exit 1 | |
| fi | |
| # Quick signing self-test to validate passphrase + loopback work | |
| echo test > /tmp/gpgtest.txt | |
| gpg --batch --yes \ | |
| --pinentry-mode loopback \ | |
| --passphrase "$PPA_GPG_PASSPHRASE" \ | |
| -u "$GPG_KEY_ID" \ | |
| -a \ | |
| -s \ | |
| -o /tmp/gpgtest.txt.asc \ | |
| /tmp/gpgtest.txt | |
| echo "GNUPGHOME=$GNUPGHOME" >> $GITHUB_ENV | |
| - name: Prepare debian/changelog | |
| env: | |
| DEBEMAIL: ${{ secrets.LAUNCHPAD_EMAIL }} | |
| DEBFULLNAME: ${{ secrets.GPG_FULL_NAME }} | |
| UBUNTU_DIST: ${{ matrix.dist }} | |
| GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} | |
| if: env.GPG_PRIVATE_KEY != '' | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| DEBVER="${VERSION}-0ppa1~${UBUNTU_DIST}" | |
| dch --package hudbox --newversion "$DEBVER" \ | |
| --distribution "$UBUNTU_DIST" \ | |
| --force-distribution \ | |
| "Release $VERSION for PPA ($UBUNTU_DIST)" | |
| - name: Build signed source package | |
| env: | |
| GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }} | |
| PPA_GPG_PASSPHRASE: ${{ secrets.PPA_GPG_PASSPHRASE }} | |
| DEBEMAIL: ${{ secrets.LAUNCHPAD_EMAIL }} | |
| DEBFULLNAME: ${{ secrets.GPG_FULL_NAME }} | |
| UBUNTU_DIST: ${{ matrix.dist }} | |
| GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} | |
| if: env.GPG_PRIVATE_KEY != '' | |
| run: | | |
| export GNUPGHOME="$RUNNER_TEMP/gnupg" | |
| # Build unsigned source package (-us -uc) | |
| debuild -S -sa -d -us -uc | |
| # Inline-sign the .changes (and automatically the .dsc) | |
| debsign -k"$GPG_KEY_ID" \ | |
| -p"gpg --batch --yes --pinentry-mode loopback --passphrase $PPA_GPG_PASSPHRASE" \ | |
| --re-sign ../*.changes | |
| ls -l ../* | |
| - name: Upload to Launchpad PPA | |
| env: | |
| GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} | |
| DPUT_HOST: ppa:swstegall/hudbox | |
| if: env.GPG_PRIVATE_KEY != '' | |
| run: | | |
| CHANGES_FILE=$(ls -1 ../*.changes | head -n1) | |
| echo "Uploading $CHANGES_FILE to $DPUT_HOST" | |
| dput "$DPUT_HOST" "$CHANGES_FILE" |