ci: refresh the nightly and sonora-bin on every release

.github/workflows/nightly.yml

@@ -13,8 +13,9 @@ permissions:
   contents: read
 
 jobs:
-  # A scheduled run builds only when main has moved past the commit the current nightly was built
-  # from. A manual run always builds. Either way the build is main, never another branch.
+  # A scheduled run builds only when main has changed beyond flake.nix since the commit the current
+  # nightly was built from. A manual run always builds. Either way the build is main, never another
+  # branch.
   gate:
     if: github.repository == 'sonorahq/sonora' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
@@ -40,6 +41,16 @@ jobs:
             echo "::notice::main is still at ${GITHUB_SHA:0:7}, which the current nightly was built from"
             exit 0
           fi
+          # A release rebuilds the nightly and then points the flake at itself in a commit of its
+          # own. flake.nix does not go into the binary, so that commit alone needs no build.
+          if [ "$EVENT" = schedule ] && [ -n "$built" ]; then
+            changed="$(gh api "repos/$GITHUB_REPOSITORY/compare/$built...$GITHUB_SHA" \
+              --jq '[.files[].filename | select(. != "flake.nix")] | length' || echo unknown)"
+            if [ "$changed" = 0 ]; then
+              echo "::notice::main has changed only flake.nix since ${built:0:7}, which the current nightly was built from"
+              exit 0
+            fi
+          fi
           version="$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -n 1)"
           {
             echo "number=$version-nightly.$(date -u +%Y%m%d)"

.github/workflows/release.yml

@@ -754,3 +754,94 @@ jobs:
     secrets: inherit
     with:
       tag: ${{ github.ref_name }}
+
+  # A release brings dev's work to main, and the nightly built before it predates that work.
+  # Building the nightly again right away keeps nightly users from running behind the release.
+  refresh-nightly:
+    needs: release
+    if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - name: dispatch the nightly
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run nightly.yml --repo "$GITHUB_REPOSITORY" --ref main
+
+  # sonora-bin is rendered from aur/sonora-bin/PKGBUILD on every stable release, so the AUR
+  # repository only ever holds what this job pushed. It needs AUR_SSH_KEY, the key nightly.yml
+  # pushes sonora-nightly-bin with, since one AUR account maintains both.
+  aur:
+    needs: release
+    if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-')
+    runs-on: ubuntu-latest
+    container: archlinux:base-devel
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: system dependencies
+        run: pacman -Syu --noconfirm --needed git openssh
+
+      - uses: actions/checkout@v5
+
+      - name: render and build the PKGBUILD
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          base="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
+          curl -fsSL "$base/releases/download/$TAG/SHA256SUMS" > sums
+          sum() { awk -v file="$1" '$2 == file { print $1 }' sums; }
+          source="$(curl -fsSL "$base/archive/refs/tags/$TAG.tar.gz" | sha256sum | cut -d ' ' -f 1)"
+          x86_64="$(sum "sonora-$TAG-x86_64-unknown-linux-gnu")"
+          aarch64="$(sum "sonora-$TAG-aarch64-unknown-linux-gnu")"
+          test -n "$x86_64"
+          test -n "$aarch64"
+
+          mkdir package
+          sed \
+            -e "s/@PKGVER@/${TAG#v}/" \
+            -e "s/@SHA256_SOURCE@/$source/" \
+            -e "s/@SHA256_X86_64@/$x86_64/" \
+            -e "s/@SHA256_AARCH64@/$aarch64/" \
+            aur/sonora-bin/PKGBUILD > package/PKGBUILD
+          if grep -n '@[A-Z0-9_]*@' package/PKGBUILD; then exit 1; fi
+
+          # A package build downloads every source and checks it against its sum, so a PKGBUILD
+          # that would fail for users never reaches the AUR. makepkg refuses to run as root, and
+          # -d skips installing the runtime dependencies the build itself does not need.
+          useradd -m builder
+          chown -R builder package
+          su builder -c 'cd package && makepkg -f -d --noconfirm && makepkg --printsrcinfo > .SRCINFO'
+          cat package/.SRCINFO
+
+      - name: push to the AUR
+        env:
+          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$AUR_SSH_KEY" > ~/.ssh/aur
+          chmod 600 ~/.ssh/aur
+          # The AUR's published ed25519 host key. ssh reads its known_hosts from the passwd home,
+          # which in a job container is not $HOME, so the file is named explicitly.
+          echo "aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN" \
+            > ~/.ssh/known_hosts
+          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/aur -o IdentitiesOnly=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+
+          git clone -q ssh://aur@aur.archlinux.org/sonora-bin.git aur-repo
+          cp package/PKGBUILD package/.SRCINFO aur-repo/
+          cd aur-repo
+          git add PKGBUILD .SRCINFO
+          if git diff --cached --quiet; then
+            echo "::notice::the AUR package is already at ${TAG#v}"
+            exit 0
+          fi
+          git \
+            -c user.name="github-actions[bot]" \
+            -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
+            commit -q -m "upgpkg: sonora-bin ${TAG#v}-1"
+          git push origin HEAD:master

aur/sonora-bin/PKGBUILD

@@ -0,0 +1,61 @@
+# Maintainer: Pavel Olizko <contact@nolight.dev>
+
+# Rendered on every stable release from aur/sonora-bin/PKGBUILD in github.com/sonorahq/sonora by
+# its release workflow, which overwrites any change made in the AUR repository.
+
+pkgname=sonora-bin
+_pkgname=sonora
+pkgver=@PKGVER@
+pkgrel=1
+pkgdesc='A native music streaming client, built with Rust and GPUI'
+arch=('x86_64' 'aarch64')
+url='https://github.com/sonorahq/sonora'
+license=('GPL-3.0-or-later')
+depends=('glibc' 'alsa-lib' 'dbus' 'fontconfig' 'hicolor-icon-theme' 'libxcb'
+         'libxkbcommon' 'libxkbcommon-x11' 'sqlite' 'vulkan-icd-loader' 'wayland')
+optdepends=('vulkan-radeon: Vulkan driver for AMD GPUs'
+            'vulkan-intel: Vulkan driver for Intel GPUs'
+            'nvidia-utils: Vulkan driver for NVIDIA GPUs'
+            'pipewire-alsa: audio output through PipeWire'
+            'pulseaudio-alsa: audio output through PulseAudio'
+            'webkit2gtk-4.1: sign in to YouTube Music through a browser window')
+provides=("${_pkgname}=${pkgver}")
+conflicts=("${_pkgname}")
+options=('!strip' '!debug')
+source=("${url}/archive/refs/tags/v${pkgver}/${_pkgname}-${pkgver}.tar.gz")
+source_x86_64=("${_pkgname}-${pkgver}-x86_64::${url}/releases/download/v${pkgver}/sonora-v${pkgver}-x86_64-unknown-linux-gnu")
+source_aarch64=("${_pkgname}-${pkgver}-aarch64::${url}/releases/download/v${pkgver}/sonora-v${pkgver}-aarch64-unknown-linux-gnu")
+sha256sums=('@SHA256_SOURCE@')
+sha256sums_x86_64=('@SHA256_X86_64@')
+sha256sums_aarch64=('@SHA256_AARCH64@')
+
+package() {
+  cd "${_pkgname}-${pkgver}"
+
+  install -Dm755 "${srcdir}/${_pkgname}-${pkgver}-${CARCH}" "${pkgdir}/usr/bin/${_pkgname}"
+  install -Dm644 assets/linux/sonora.desktop \
+    "${pkgdir}/usr/share/applications/sonora.desktop"
+  install -Dm644 assets/linux/sonora.svg \
+    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/sonora.svg"
+
+  for icon in assets/linux/icons/hicolor/*/apps/sonora.png; do
+    local size
+    size=$(basename "$(dirname "$(dirname "${icon}")")")
+    install -Dm644 "${icon}" \
+      "${pkgdir}/usr/share/icons/hicolor/${size}/apps/sonora.png"
+  done
+
+  install -Dm644 COPYING "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
+  install -Dm644 THIRD-PARTY.md "${pkgdir}/usr/share/licenses/${_pkgname}/THIRD-PARTY.md"
+  install -Dm644 assets/fonts/LICENSE.txt \
+    "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE.Inter"
+  install -Dm644 assets/icons/LICENSE \
+    "${pkgdir}/usr/share/licenses/${_pkgname}/icons/LICENSE"
+
+  for licence in assets/icons/*/LICENSE; do
+    local pack
+    pack=$(basename "$(dirname "${licence}")")
+    install -Dm644 "${licence}" \
+      "${pkgdir}/usr/share/licenses/${_pkgname}/icons/LICENSE.${pack}"
+  done
+}