nevaforget
d01a358f35
Update PKGBUILD version / update-pkgver (push) Successful in 3s
Three rounds of audit-driven hardening, fully documented in DECISIONS.md: - argv hardening: validate HostName/User/IdentityFile via allowlist regexes, parse Port via strconv.Atoi, surface ssh_config parse errors instead of silently swallowing them. Switch -o kernel_cache to auto_cache for network- FS correctness, pin StrictHostKeyChecking=accept-new. - LOW-severity cleanup: -v verbose flag (default output is just the mount path), run_editor returns errors and main exits 7 on failure, ABOUTME headers, golang.org/x/sys v0.43.0 (go 1.25.0). - Defense-in-depth + UX: rxIdentityFile first-character anchor rejects leading "-"/"."/":"/etc., verify_mount_dir resolves base via EvalSymlinks and refuses pre-existing symlinks at the mount path, flag.Usage shows the positional <Host> argument, run_editor uses cmd.Start() so cold-start Sublime does not block the terminal. - CI: empty-PKGVER guard in update-pkgver workflow. - Tests: verify_mount_dir path-traversal + symlink-reject coverage, rxHostUser/rxIdentityFile boundary cases.
64 lines
2.0 KiB
YAML
64 lines
2.0 KiB
YAML
# ABOUTME: Updates pkgver in moonarch-pkgbuilds after a push to main.
|
|
# ABOUTME: Ensures paru detects new versions of this package.
|
|
|
|
name: Update PKGBUILD version
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
update-pkgver:
|
|
runs-on: moonarch
|
|
steps:
|
|
- name: Checkout source repo
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
git clone --bare http://gitea:3000/nevaforget/sshfs_connect.git source.git
|
|
cd source.git
|
|
PKGVER=$(git describe --long --tags | sed 's/^v//;s/-/.r/;s/-/./')
|
|
echo "New pkgver: $PKGVER"
|
|
echo "$PKGVER" > /tmp/pkgver
|
|
|
|
- name: Update PKGBUILD
|
|
shell: bash
|
|
env:
|
|
PKGBUILD_TOKEN: ${{ secrets.PKGBUILD_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [ -z "${PKGBUILD_TOKEN:-}" ]; then
|
|
echo "ERROR: PKGBUILD_TOKEN secret is empty or unset."
|
|
echo "Set it under Repo Settings -> Actions -> Secrets."
|
|
exit 1
|
|
fi
|
|
|
|
PKGVER=$(cat /tmp/pkgver)
|
|
if [ -z "$PKGVER" ]; then
|
|
echo "ERROR: PKGVER from previous step is empty."
|
|
exit 1
|
|
fi
|
|
git clone http://gitea:3000/nevaforget/moonarch-pkgbuilds.git pkgbuilds
|
|
cd pkgbuilds
|
|
|
|
OLD_VER=$(grep '^pkgver=' sshfsc-git/PKGBUILD | cut -d= -f2)
|
|
if [ "$OLD_VER" = "$PKGVER" ]; then
|
|
echo "pkgver already up to date ($PKGVER)"
|
|
exit 0
|
|
fi
|
|
|
|
sed -i "s/^pkgver=.*/pkgver=$PKGVER/" sshfsc-git/PKGBUILD
|
|
sed -i "s/^\tpkgver = .*/\tpkgver = $PKGVER/" sshfsc-git/.SRCINFO
|
|
echo "Updated pkgver: $OLD_VER -> $PKGVER"
|
|
|
|
git config user.name "pkgver-bot"
|
|
git config user.email "gitea@moonarch.de"
|
|
git add sshfsc-git/PKGBUILD sshfsc-git/.SRCINFO
|
|
git commit -m "chore(sshfsc-git): bump pkgver to $PKGVER"
|
|
|
|
echo "--- pushing ---"
|
|
git -c http.extraHeader="Authorization: token ${PKGBUILD_TOKEN}" push --verbose origin HEAD:main
|
|
echo "--- push done ---"
|