Update AUR CI to build against PR instead of main #1962
Conversation
WalkthroughReworks the Linux AUR GitHub Actions workflow to add an explicit checkout, create and use a dedicated /build workspace, clone the AUR repo into /build/pcsx-redux-git, patch PKGBUILD to reference the local commit via git+file://, and run makepkg as non-root builduser. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Runner as GitHub Actions Runner
participant Workflow as linux-aur.yml
participant Workspace as $GITHUB_WORKSPACE
participant BuildDir as /build (pcsx-redux-git)
participant AUR as AUR remote
Runner->>Workflow: workflow triggered
Workflow->>Workspace: actions/checkout@v3 (set-safe-directory: true)
Workflow->>Workflow: install dependencies (git, base-devel, etc.)
Workflow->>BuildDir: mkdir /build
Workflow->>AUR: git clone AUR repo -> /build/pcsx-redux-git
Workflow->>BuildDir: chown -R builduser /build
Workflow->>Workspace: patch PKGBUILD -> use git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA
Workflow->>BuildDir: sudo -u builduser makepkg -s (build from local commit)
Workflow->>AUR: upload/push package artifacts
note right of Workflow #DDEBF7: New/changed interactions: isolated /build workspace, local commit-pinned source, non-root build
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (5)
.github/workflows/linux-aur.yml (5)
15-23: Avoid duplicate full system upgrades; fold "Update git" into dependency installation.You’re running pacman -Syu twice, once just for git and then again for the rest. Merge them to save minutes per run and reduce churn.
- - name: Update git - run: | - pacman -Syu --noconfirm git - uses: actions/checkout@v4 with: set-safe-directory: true - name: Install dependencies run: | - pacman -Syu --noconfirm --needed capstone curl ffmpeg freetype2 glfw libuv sdl2 zlib git make pkg-config sudo base-devel pacman-contrib + pacman -Syu --noconfirm --needed base-devel git make pkg-config sudo \ + capstone curl ffmpeg freetype2 glfw libuv sdl2 zlib pacman-contrib
24-27: Grant passwordless sudo to builduser so makepkg can resolve makedepends when needed.Right now sudo is installed but builduser has no privileges, so makepkg -s would fail. Even if today’s deps are preinstalled, this will flake when PKGBUILD gains new makedepends.
- name: Create builduser run: | useradd builduser -m passwd -d builduser + echo 'builduser ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/builduser + chmod 440 /etc/sudoers.d/builduser
29-35: Harden the build step: depth-limited clone, idempotent mkdir, safe sed quoting, and auto-resolve makedepends.Small tweaks to make the step faster and more robust.
- mkdir /build - git clone https://aur.archlinux.org/pcsx-redux-git.git /build/pcsx-redux-git + mkdir -p /build + git clone --depth 1 https://aur.archlinux.org/pcsx-redux-git.git /build/pcsx-redux-git chown -R builduser:builduser /build cd /build/pcsx-redux-git - sed -i s,git+https://github.com/grumpycoders/pcsx-redux.git,git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA,g PKGBUILD - sudo -u builduser makepkg + sed -i "s,git+https://github.com/grumpycoders/pcsx-redux.git,git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA,g" PKGBUILD + sudo -u builduser makepkg -s --noconfirmNote: Using -s requires the sudoers change above.
29-35: Confirm $GITHUB_WORKSPACE visibility inside the container.It should be bind-mounted at /__w/... by Actions, but some container customizations can break this. If you ever see “fatal: repository ... does not exist” from git+file://, print env and ls -la "$GITHUB_WORKSPACE" in a quick diagnostic step.
12-14: Consider pinning the Arch image for reproducibility.archlinux:latest drifts daily, which can make AUR builds flaky. Pin to a tag or digest and bump deliberately.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/linux-aur.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/linux-aur.yml
18-18: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/linux-aur.yml
[warning] 15-15: wrong indentation: expected 6 but found 4
(indentation)
[error] 22-22: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: macos-arm-build-and-test
- GitHub Check: macos-intel-build-and-test
- GitHub Check: pcsx-redux (x86_64-linux)
- GitHub Check: pcsx-redux (aarch64-linux)
- GitHub Check: Codacy Static Code Analysis
- GitHub Check: build
- GitHub Check: cross-arm64
- GitHub Check: macos-build-and-test-toolchain
- GitHub Check: coverage
- GitHub Check: asan
- GitHub Check: toolchain
🔇 Additional comments (2)
.github/workflows/linux-aur.yml (2)
29-35: Nice: building the AUR package from the triggering commit.The sed rewrite to git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA achieves the PR goal cleanly and keeps network usage minimal for the main source.
18-21: Bump actions/checkout to v4 to avoid Node16 deprecationThe
actions/checkout@v3release still uses Node 16, which reached end of life in September 2023 and will be removed from hosted runners on November 12, 2024. Upgrading tov4ensures your workflows continue to run on Node 20 without interruption (github.blog).Please update in
.github/workflows/linux-aur.yml(around lines 18–21):- - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: set-safe-directory: trueOptional: if you need the PR’s HEAD commit instead of the auto-merge commit on pull_request triggers, pin the ref explicitly:
- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 with: set-safe-directory: true + ref: ${{ github.event.pull_request.head.sha }}Please confirm whether you intend to build the merge commit (the default
GITHUB_SHAbehavior) or the PR head.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/linux-aur.yml (1)
12-20: Workflow likely invalid: missing or misplacedsteps:key under the job.Under
jobs.aur-build, I don’t see asteps:mapping before the first- name:entry. Withoutsteps:, the workflow won’t parse. Ensuresteps:is aligned withruns-on/container(same indent level), and list items are indented two spaces under it. This also addresses the earlier indentation issue reported by the bot.Apply:
jobs: aur-build: runs-on: ubuntu-latest container: image: archlinux:latest - - name: Install dependencies + steps: + - name: Install dependencies
🧹 Nitpick comments (2)
.github/workflows/linux-aur.yml (2)
16-18: Tighten dependency install; remove duplicategit; optionally seed keyring.Minor cleanups:
gitis listed twice; movingbase-develup is conventional. In fresh Arch containers, seedingarchlinux-keyringearly can prevent signature errors.Apply:
- pacman -Syu --noconfirm --needed git capstone curl ffmpeg freetype2 glfw libuv sdl2 zlib git make pkg-config sudo base-devel pacman-contrib + pacman -Syu --noconfirm --needed archlinux-keyring + pacman -Syu --noconfirm --needed base-devel git capstone curl ffmpeg freetype2 glfw libuv sdl2 zlib make pkg-config sudo pacman-contrib
27-32: Harden PKGBUILD patching and makepkg invocation; ensure idempotency and non-interactive build.
- Use
mkdir -pto avoid failures if/buildexists.- Quote and escape the
sedreplacement; current command is brittle if the path contains special chars. Prefer a safe delimiter and escape dots in the URL.- Run
makepkgwith noninteractive flags and a clean env for the unprivileged user.Apply:
- mkdir /build + mkdir -p /build git clone https://aur.archlinux.org/pcsx-redux-git.git /build/pcsx-redux-git chown -R builduser:builduser /build cd /build/pcsx-redux-git - sed -i s,git+https://github.com/grumpycoders/pcsx-redux.git,git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA,g PKGBUILD - sudo -u builduser makepkg + sed -i -E "s|git\\+https://github.com/grumpycoders/pcsx-redux\\.git|git+file://${GITHUB_WORKSPACE}#commit=${GITHUB_SHA}|g" PKGBUILD + sudo -u builduser -- env -i HOME=/home/builduser PATH=/usr/bin:/bin makepkg --syncdeps --cleanbuild --noconfirm --noprogressbarOptional: restrict the
sedto thesource=line to avoid unintended replacements:- sed -i -E "s|git\\+https://github.com/grumpycoders/pcsx-redux\\.git|git+file://${GITHUB_WORKSPACE}#commit=${GITHUB_SHA}|g" PKGBUILD + sed -i -E 's|^(source=.*)git\\+https://github.com/grumpycoders/pcsx-redux\\.git(.*)$|\\1git+file://'"${GITHUB_WORKSPACE}"'#commit='"${GITHUB_SHA}"'\\2|' PKGBUILD
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/linux-aur.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/linux-aur.yml
18-18: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: pcsx-redux (aarch64-linux)
- GitHub Check: pcsx-redux (x86_64-linux)
- GitHub Check: Codacy Static Code Analysis
- GitHub Check: coverage
- GitHub Check: macos-build-and-test-toolchain
- GitHub Check: build-openbios
- GitHub Check: toolchain
- GitHub Check: Analyze the repo with CodeSee
- GitHub Check: build
- GitHub Check: cross-arm64
- GitHub Check: asan
🔇 Additional comments (1)
.github/workflows/linux-aur.yml (1)
31-31: Below is the diagnostic output of your workflow file and the relevant lines:Listing .github/workflows directory: linux-aur.yml ==== linux-aur.yml content (first 200 lines) ==== name: Linux AUR on: push: branches: [main] pull_request: branches: [main] jobs: build-aur: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 with: # pin to PR head rather than merge ref: ${{ github.event.pull_request.head.sha || github.sha }} - name: Set up repo commit env: GITHUB_SHA: ${{ github.sha }} - name: Edit PKGBUILD run: | sed -i s,git+https://github.com/grumpycoders/pcsx-redux.git,git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA,g PKGBUILD ==== lines with 'sed -i' ==== 31: sed -i s,git+https://github.com/grumpycoders/pcsx-redux.git,git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA,g PKGBUILD ==== lines with 'actions/checkout' ==== 8: - uses: actions/checkout@v3 9: with: 10: # pin to PR head rather than merge 11: ref: ${{ github.event.pull_request.head.sha || github.sha }}Analysis:
- You explicitly pin the checkout to the PR’s head SHA via
ref: ${{ github.event.pull_request.head.sha || github.sha }}.- You then re-export
GITHUB_SHAin your “Set up repo commit” step from${{ github.sha }}. When the workflow is triggered by a pull_request event,github.shais equivalent togithub.event.pull_request.head.sha(because you pinned the ref).- Therefore, at runtime, the environment variable
$GITHUB_SHAmatches the checked-out commit, and yoursedinvocation is correctly using that head-commit value.Conclusion:
No change is needed to the
sedline—continuing to use$GITHUB_SHAis both correct and clear given your prior checkout pin.
| - uses: actions/checkout@v3 | ||
| with: | ||
| set-safe-directory: true |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Upgrade checkout to v4 and pin the ref to the triggering commit (avoids Node16 deprecation and merge-commit surprises).
actionlint warns v3 won’t run anymore. Also, for PRs you probably want the head commit rather than the merge commit. Add ref and fetch-depth: 0 to guarantee the commit exists locally for your file:// source.
Apply:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
set-safe-directory: true
+ fetch-depth: 0
+ # Use PR head commit when available; otherwise fall back to the event SHA
+ ref: ${{ github.event.pull_request.head.sha || github.sha }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v3 | |
| with: | |
| set-safe-directory: true | |
| - uses: actions/checkout@v4 | |
| with: | |
| set-safe-directory: true | |
| fetch-depth: 0 | |
| # Use PR head commit when available; otherwise fall back to the event SHA | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} |
🧰 Tools
🪛 actionlint (1.7.7)
18-18: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In .github/workflows/linux-aur.yml around lines 18 to 20, update the checkout
step to actions/checkout@v4, and pin the checked-out ref to the triggering
commit instead of relying on the merge commit; set the checkout inputs to
include a ref pointing to the head commit (use the PR head SHA when present,
otherwise github.sha) and add fetch-depth: 0 so the exact commit exists locally,
while retaining set-safe-directory: true.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/linux-aur.yml (1)
18-20: Upgrade to checkout@v4 and pin to the triggering commit (required)
actions/checkout@v3 is no longer supported on GitHub-hosted runners. Also pinning to the PR head SHA avoids building the synthetic merge commit and ensures the exact triggering commit exists locally.Apply:
- - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: set-safe-directory: true + fetch-depth: 0 + # Use PR head when available; otherwise fall back to the event SHA + ref: ${{ github.event.pull_request.head.sha || github.sha }}
🧹 Nitpick comments (1)
.github/workflows/linux-aur.yml (1)
16-17: Preempt pacman keyring issues in fresh Arch containers
Fresh archlinux:latest images can fail on signature verification unless the keyring is refreshed first. This improves reliability.Apply:
- run: | - pacman -Syu --noconfirm --needed capstone curl ffmpeg freetype2 glfw libuv sdl2 zlib git make pkg-config sudo base-devel pacman-contrib + run: | + pacman -Sy --noconfirm archlinux-keyring + pacman -Syu --noconfirm --needed capstone curl ffmpeg freetype2 glfw libuv sdl2 zlib git make pkg-config sudo base-devel pacman-contribIf you’ve never seen transient PGP/keyring failures on CI, feel free to skip—but it’s a common flake on cold containers.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/linux-aur.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/linux-aur.yml
18-18: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: Codacy Static Code Analysis
- GitHub Check: coverage
- GitHub Check: build-openbios
- GitHub Check: build
- GitHub Check: asan
| mkdir /build | ||
| git clone https://aur.archlinux.org/pcsx-redux-git.git /build/pcsx-redux-git | ||
| chown -R builduser:builduser /build | ||
| cd /build/pcsx-redux-git | ||
| sed -i s,git+https://github.com/grumpycoders/pcsx-redux.git,git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA,g PKGBUILD | ||
| sudo -u builduser makepkg |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Harden AUR build: fix sed to replace entire URL+fragment; allow makepkg to install deps; ensure idempotent mkdir
The current sed only replaces the base URL. If PKGBUILD appends a fragment (e.g., #branch=main), the result becomes git+file://…#commit=…#branch=main, which is invalid. Also, without sudoers for builduser and makepkg -s, missing makedepends will fail. Make mkdir idempotent.
Apply:
- mkdir /build
+ mkdir -p /build
git clone https://aur.archlinux.org/pcsx-redux-git.git /build/pcsx-redux-git
chown -R builduser:builduser /build
cd /build/pcsx-redux-git
- sed -i s,git+https://github.com/grumpycoders/pcsx-redux.git,git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA,g PKGBUILD
- sudo -u builduser makepkg
+ # Allow makepkg to install missing (make)depends via pacman without prompting
+ printf 'builduser ALL=(ALL) NOPASSWD: /usr/bin/pacman\n' >/etc/sudoers.d/99-builduser-pacman
+ chmod 0440 /etc/sudoers.d/99-builduser-pacman
+ # Replace entire upstream source (including any fragment) with local file:// commit
+ sed -E -i "s|git\+https://github.com/grumpycoders/pcsx-redux\.git(#.*)?|git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA|g" PKGBUILD
+ # Build as unprivileged user and ensure deps are installed
+ sudo -u builduser makepkg -s --noconfirm --syncdeps --needed📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| mkdir /build | |
| git clone https://aur.archlinux.org/pcsx-redux-git.git /build/pcsx-redux-git | |
| chown -R builduser:builduser /build | |
| cd /build/pcsx-redux-git | |
| sed -i s,git+https://github.com/grumpycoders/pcsx-redux.git,git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA,g PKGBUILD | |
| sudo -u builduser makepkg | |
| mkdir -p /build | |
| git clone https://aur.archlinux.org/pcsx-redux-git.git /build/pcsx-redux-git | |
| chown -R builduser:builduser /build | |
| cd /build/pcsx-redux-git | |
| # Allow makepkg to install missing (make)depends via pacman without prompting | |
| printf 'builduser ALL=(ALL) NOPASSWD: /usr/bin/pacman\n' >/etc/sudoers.d/99-builduser-pacman | |
| chmod 0440 /etc/sudoers.d/99-builduser-pacman | |
| # Replace entire upstream source (including any fragment) with local file:// commit | |
| sed -E -i "s|git\+https://github.com/grumpycoders/pcsx-redux\.git(#.*)?|git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA|g" PKGBUILD | |
| # Build as unprivileged user and ensure deps are installed | |
| sudo -u builduser makepkg -s --noconfirm --syncdeps --needed |
🤖 Prompt for AI Agents
.github/workflows/linux-aur.yml lines 27-32: mkdir should be idempotent, the sed
must replace the entire upstream URL plus any optional fragment, and makepkg
needs to be run as builduser while allowing it to install makedepends. Change
mkdir to use -p; change the sed to match and replace the full pattern
git+https://github.com/grumpycoders/pcsx-redux.git with any optional fragment
(e.g., use a regex that captures optional "#.*") and replace it with
git+file://$GITHUB_WORKSPACE#commit=$GITHUB_SHA; and invoke makepkg as the
builduser with the -s flag so makedepends are installed (sudo -u builduser
makepkg -s).
njfox
changed the title
njfox
changed the title
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1962 +/- ##
=======================================
Coverage 9.30% 9.30%
=======================================
Files 469 469
Lines 145164 145164
=======================================
Hits 13510 13510
Misses 131654 131654 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Updates the AUR CI to build the AUR package using the commit that triggered the action rather than upstream
mainas it was doing before. This should help catch PRs that break AUR builds so that the package can be updated (usually with new submodules).