From 37b9b855ecad55241805858a753b530cbbb99195 Mon Sep 17 00:00:00 2001 From: Dexoron Date: Thu, 28 May 2026 18:08:06 +0800 Subject: [PATCH] feat: streamline artifact download process and enhance repository indexing with signing --- .github/workflows/dexoron-packages-index.yml | 94 +++++++------------- 1 file changed, 30 insertions(+), 64 deletions(-) diff --git a/.github/workflows/dexoron-packages-index.yml b/.github/workflows/dexoron-packages-index.yml index e646288..130509c 100644 --- a/.github/workflows/dexoron-packages-index.yml +++ b/.github/workflows/dexoron-packages-index.yml @@ -28,112 +28,78 @@ jobs: token: ${{ secrets.PACKAGES_REPO_TOKEN }} path: 'central-packages' - # --- ВАРИАНТ A: АВТОМАШЕСТВО ИЗ РЕЛИЗА (WORKFLOW RUN) --- + - name: Import GPG Key + uses: crazy-max/ghaction-import-gpg@v6 + with: + gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} - - name: Download Arch package artifact + # --- Загрузка артефактов (сохранена прежняя логика) --- + - name: Download Artifacts if: ${{ github.event_name == 'workflow_run' }} uses: actions/download-artifact@v4 with: - name: arch-package - path: central-packages/archlinux/x86_64/ + path: central-packages/ github-token: ${{ secrets.GITHUB_TOKEN }} run-id: ${{ github.event.workflow_run.id }} - - name: Download Debian package artifact - if: ${{ github.event_name == 'workflow_run' }} - uses: actions/download-artifact@v4 - with: - name: debian-package - path: central-packages/debian/ - github-token: ${{ secrets.GITHUB_TOKEN }} - run-id: ${{ github.event.workflow_run.id }} - - - name: Download RPM package artifact - if: ${{ github.event_name == 'workflow_run' }} - uses: actions/download-artifact@v4 - with: - name: rpm-package - path: central-packages/fedora/x86_64/ - github-token: ${{ secrets.GITHUB_TOKEN }} - run-id: ${{ github.event.workflow_run.id }} - - # --- ВАРИАНТ B: РУЧНОЙ ЗАПУСК ПО ТЕГУ (MANUAL DISPATCH) --- - - name: Download Packages from Release Assets if: ${{ github.event_name == 'workflow_dispatch' }} env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} TAG: ${{ inputs.tag }} run: | - echo "Запрошен ручной импорт пакетов из релиза $TAG репозитория dexoron/dcr..." gh release download "$TAG" --repo dexoron/dcr --pattern "*.pkg.tar.zst" --dir central-packages/archlinux/x86_64/ --clobber gh release download "$TAG" --repo dexoron/dcr --pattern "*.deb" --dir central-packages/debian/ --clobber gh release download "$TAG" --repo dexoron/dcr --pattern "*.rpm" --dir central-packages/fedora/x86_64/ --clobber - # --- ИНДЕКСАЦИЯ REPO --- + # --- ИНДЕКСАЦИЯ И ПОДПИСЬ --- - - name: Update Pacman Database (Inside Arch Container) + - name: Update Pacman Database run: | docker run --rm \ -v ${{ github.workspace }}/central-packages:/packages \ + -v ~/.gnupg:/root/.gnupg \ archlinux:latest \ bash -c ' cd /packages/archlinux/x86_64 && \ - rm -f dexoron.db dexoron.files && \ - shopt -s nullglob - packages=(*.pkg.tar.zst) - if [ ${#packages[@]} -gt 0 ]; then - echo "Found ${#packages[@]} Arch packages. Updating database..." - repo-add dexoron.db.tar.gz "${packages[@]}" && \ - ln -sf dexoron.db.tar.gz dexoron.db && \ - ln -sf dexoron.files.tar.gz dexoron.files - else - echo "No .pkg.tar.zst files found. Skipping." - fi + packages=(*.pkg.tar.zst) && \ + repo-add --sign dexoron.db.tar.gz "${packages[@]}" && \ + ln -sf dexoron.db.tar.gz dexoron.db && \ + ln -sf dexoron.files.tar.gz dexoron.files ' - name: Update Debian APT Repository Index run: | sudo apt-get update && sudo apt-get install -y dpkg-dev cd central-packages/debian + dpkg-scanpackages . /dev/null | gzip -9c > Packages.gz - shopt -s nullglob - deb_packages=(*.deb) + # Генерация и подпись Release + echo "Origin: Dexoron" > Release + echo "Suite: stable" >> Release + echo "Architectures: amd64" >> Release + echo "Components: main" >> Release + echo "Date: $(date -uR)" >> Release + echo "SHA256:" >> Release + echo " $(sha256sum Packages.gz | awk '{print $1" "$2}')" >> Release - if [ ${#deb_packages[@]} -gt 0 ]; then - echo "Found ${#deb_packages[@]} Debian packages. Generating Packages.gz..." - dpkg-scanpackages . /dev/null | gzip -9c > Packages.gz - else - echo "No .deb files found. Skipping Debian index update." - fi + gpg --batch --yes --detach-sign --armor --output Release.gpg Release + gpg --batch --yes --clearsign --output InRelease Release - name: Update Fedora DNF Repository Index run: | sudo apt-get update && sudo apt-get install -y createrepo-c cd central-packages/fedora/x86_64 - - shopt -s nullglob - rpm_packages=(*.rpm) - - if [ ${#rpm_packages[@]} -gt 0 ]; then - echo "Found ${#rpm_packages[@]} RPM packages. Generating repodata..." - createrepo_c . - else - echo "No .rpm files found. Skipping Fedora index update." - fi - - # --- ПУШ ИЗМЕНЕНИЙ --- + createrepo_c . + gpg --batch --yes --detach-sign --armor --output repodata/repomd.xml.asc repodata/repomd.xml - name: Push to dexoron/packages run: | cd central-packages git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - if [ -n "$(git status --porcelain)" ]; then - git add archlinux/ debian/ fedora/ - git commit -m "chore: update repositories index (arch, debian, fedora)" + git add . + if ! git diff --cached --quiet; then + git commit -m "chore: update and sign repositories" git push - else - echo "No changes detected in repository databases." fi \ No newline at end of file