Skip to content

ci(release): Arch and Flatpak packages, crates.io publishing - #19

Merged
onyks-os merged 2 commits into
mainfrom
ci/publish-pipeline
Sep 26, 2026
Merged

onyks-os merged 2 commits into
mainfrom
ci/publish-pipeline

Conversation

@onyks-os

Copy link
Copy Markdown
Owner

Summary

  • A v* tag now builds, alongside the .deb, .rpm, binary, and .crate: an Arch .pkg.tar.zst (makepkg in an archlinux container, from the tag's own tree) and a single-file .flatpak bundle (GNOME 50 runtime, fetched from Flathub on install).
  • New crates-io job, after the GitHub Release, in the crates-io environment (tags v* only): Trusted Publishing when vars.CRATES_IO_TRUSTED_PUBLISHING == 'true', otherwise the CARGO_REGISTRY_TOKEN environment secret (required for the first publish).
  • Tags with a suffix (v0.1.0-rc.3) are pre-releases: never "latest", never published to crates.io.
  • tests/ now ships in git archive and in the crate: the library's unit tests include the fixtures, so check() in the PKGBUILD failed.
  • docs/releasing.md: procedure, rehearsal, verification, credentials.

Test plan

  • Arch package built locally with makepkg in archlinux:latest, check() passing
  • Flatpak bundle built locally; usbguard-gui --version and --diagnose run in the sandbox and reach the system bus
  • cargo publish --dry-run passes
  • Rehearsal tag v0.1.0-rc.3 after merge

🤖 Generated with Claude Code

onyks-os and others added 2 commits September 26, 2026 13:39
Pushing a v* tag now also builds a .pkg.tar.zst with makepkg in an Arch
container and a single-file .flatpak bundle, signs them with the other
assets, and publishes the crate to crates.io from the crates-io
environment. Authentication uses Trusted Publishing when the
CRATES_IO_TRUSTED_PUBLISHING variable is set, and the
CARGO_REGISTRY_TOKEN environment secret otherwise, which the first
publish requires. Tags with a suffix are pre-releases: never "latest",
never published to crates.io.

tests/ now ships in source archives and in the crate: the library's
unit tests read its fixtures, so packagers running them failed.

docs/releasing.md describes the procedure and the credentials.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: onyks-os <129986281+onyks-os@users.noreply.github.com>
The bundle names Flathub as its runtime repository, so installing it
fetches the GNOME runtime. makepkg's -debug package stays out of the
release assets. The README lists every asset and cargo install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: onyks-os <129986281+onyks-os@users.noreply.github.com>
@onyks-os
onyks-os merged commit a55f69e into main Sep 26, 2026
14 of 15 checks passed
@onyks-os
onyks-os deleted the ci/publish-pipeline branch September 26, 2026 11:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant