Add Moonarch package registry setup with signed packages

Import Gitea Arch registry key dynamically and configure pacman
with SigLevel = Required DatabaseOptional. Key ID is extracted
from the downloaded key file to avoid hardcoding.

ci/act-runner/Dockerfile

@@ -0,0 +1,10 @@
+FROM archlinux:base-devel
+RUN pacman -Sy --noconfirm git curl && pacman -Scc --noconfirm
+RUN useradd -m builder && echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+ADD https://gitea.com/gitea/act_runner/releases/download/v0.3.1/act_runner-0.3.1-linux-amd64 /usr/local/bin/act_runner
+RUN chmod +x /usr/local/bin/act_runner
+COPY --from=gitea/act_runner:latest /usr/local/bin/run.sh /usr/local/bin/run.sh
+RUN mkdir -p /data && chown builder:builder /data
+USER builder
+ENV HOME=/home/builder
+ENTRYPOINT ["/usr/local/bin/run.sh"]

scripts/post-install.sh

@@ -20,6 +20,34 @@ else
     log "paru already installed."
 fi
 
+# --- Set up Moonarch package registry ---
+
+log "Setting up Moonarch package registry..."
+if ! grep -q '\[moonarch\]' /etc/pacman.conf 2>/dev/null; then
+    sudo tee -a /etc/pacman.conf > /dev/null <<'EOCONF'
+
+[moonarch]
+SigLevel = Required DatabaseOptional
+Server = https://gitea.moonarch.de/api/packages/nevaforget/arch/$repo/$arch
+EOCONF
+    log "  + Moonarch repo added to pacman.conf."
+else
+    log "  ~ Moonarch repo already in pacman.conf."
+fi
+
+log "Importing Moonarch registry signing key..."
+KEY_FILE=$(mktemp)
+curl -sf https://gitea.moonarch.de/api/packages/nevaforget/arch/repository.key -o "$KEY_FILE"
+KEY_ID=$(gpg --show-keys --with-colons "$KEY_FILE" 2>/dev/null | awk -F: '/^pub/{print $5}')
+if [[ -n "$KEY_ID" ]] && ! sudo pacman-key --list-keys "$KEY_ID" &>/dev/null; then
+    sudo pacman-key --add "$KEY_FILE"
+    sudo pacman-key --lsign-key "$KEY_ID"
+    log "  + Registry key $KEY_ID imported and locally signed."
+else
+    log "  ~ Registry key already imported."
+fi
+rm -f "$KEY_FILE"
+
 # --- Set up Moonarch custom paru repo ---
 
 log "Setting up Moonarch paru repo..."

scripts/transform.sh

@@ -206,6 +206,33 @@ else
     log "paru already installed."
 fi
 
+# Moonarch package registry
+log "Setting up Moonarch package registry..."
+if ! grep -q '\[moonarch\]' /etc/pacman.conf 2>/dev/null; then
+    sudo tee -a /etc/pacman.conf > /dev/null <<'EOCONF'
+
+[moonarch]
+SigLevel = Required DatabaseOptional
+Server = https://gitea.moonarch.de/api/packages/nevaforget/arch/$repo/$arch
+EOCONF
+    log "  + Moonarch repo added to pacman.conf."
+else
+    log "  ~ Moonarch repo already in pacman.conf."
+fi
+
+log "Importing Moonarch registry signing key..."
+KEY_FILE=$(mktemp)
+curl -sf https://gitea.moonarch.de/api/packages/nevaforget/arch/repository.key -o "$KEY_FILE"
+KEY_ID=$(gpg --show-keys --with-colons "$KEY_FILE" 2>/dev/null | awk -F: '/^pub/{print $5}')
+if [[ -n "$KEY_ID" ]] && ! sudo pacman-key --list-keys "$KEY_ID" &>/dev/null; then
+    sudo pacman-key --add "$KEY_FILE"
+    sudo pacman-key --lsign-key "$KEY_ID"
+    log "  + Registry key $KEY_ID imported and locally signed."
+else
+    log "  ~ Registry key already imported."
+fi
+rm -f "$KEY_FILE"
+
 # Moonarch custom paru repo
 log "Setting up Moonarch paru repo..."
 PARU_CONF="$HOME/.config/paru/paru.conf"