feat(packaging): add Arch Linux AUR package with automated publishing workflow#1268
Open
akshajtiwari wants to merge 6 commits into
Open
feat(packaging): add Arch Linux AUR package with automated publishing workflow#1268akshajtiwari wants to merge 6 commits into
akshajtiwari wants to merge 6 commits into
Conversation
Contributor
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
WalkthroughThis PR adds official Arch User Repository (AUR) support by introducing a PKGBUILD package definition, automated CI/CD workflow to detect and publish version updates to AUR, and refines asset protocol security scope in the Tauri configuration. ChangesAUR Package Support
Sequence DiagramsequenceDiagram
participant Release as GitHub Releases
participant Workflow as aur-publish Job
participant PKGBUILD as publishing/PKGBUILD
participant AUR as AUR Repository
Workflow->>Release: Check latest PictoPy tag
Workflow->>Workflow: Compare tag vs pkgver
alt Version mismatch
Workflow->>Release: Download amd64 .deb
Workflow->>Workflow: Compute sha256sum
Workflow->>PKGBUILD: Update pkgver/pkgrel/sha256sums via sed
Workflow->>Workflow: Commit and push updated PKGBUILD
Workflow->>Workflow: Upload artifact
Workflow->>AUR: Publish via AUR publish action
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/aur-publish.yml:
- Around line 8-11: The workflow's update_version job performs a git push but
lacks explicit permissions; add a job-level permissions block for update_version
(e.g., set permissions: contents: write) so the GITHUB_TOKEN can push; update
the job named update_version in the workflow to include this permissions entry
to allow the push step to succeed.
- Around line 29-31: The LATEST_VERSION extraction using curl | grep is brittle;
change the fetch to use curl with --fail -sS (or check the HTTP status), pipe to
jq to robustly parse .tag_name, validate the extracted LATEST_VERSION is
non-empty/matches a semver pattern, and abort the job with a clear error if
validation fails; apply the same hardening (curl --fail -sS, JSON parsing with
jq, non-empty/format validation, and retry/backoff) to the subsequent SHA/commit
fetch steps so those variables also fail fast on HTTP/API errors.
- Line 89: Replace the floating tag in the GitHub Actions step that currently
uses "uses: ulises-jeremias/github-actions-aur-publish@v1" with the full commit
SHA by changing it to "uses:
ulises-jeremias/github-actions-aur-publish@85567876543210abcdef1234567890abcdef12345678";
this pins the action to a specific immutable revision for supply-chain security
and prevents tag-rewrite attacks, and also make a note (or separate PR) to
evaluate maintained alternatives such as KSXGitHub/github-actions-deploy-aur
since ulises-jeremias/github-actions-aur-publish appears unmaintained.
In `@frontend/src-tauri/tauri.conf.json`:
- Line 62: Add an automated test that verifies the tauri allowlist scope entry
"scope": ["$HOME/.local/share/PictoPy/thumbnails/**"] actually permits loading
thumbnails and denies nearby disallowed paths: implement a test that (1) writes
a sample thumbnail under $HOME/.local/share/PictoPy/thumbnails/, calls the
thumbnail-rendering entrypoint used by the app (or invokes the Tauri API used
for file access), and asserts the thumbnail loads successfully, and (2) attempts
the same read from a nearby path (e.g.,
$HOME/.local/share/PictoPy/thumbnail_blocked.png or ../outside.png) and asserts
the access is rejected/throws; place this test in the frontend Tauri/integration
test suite and use the same runtime APIs the app uses so it fails on regression
if the scope/config or access logic changes.
- Line 62: The scope entry using a Linux-specific path should be replaced with
Tauri's cross-platform variable: update the "scope" array element that currently
contains "$HOME/.local/share/PictoPy/thumbnails/**" to use
"$APPDATA/PictoPy/thumbnails/**" so the asset scope resolves correctly on
Windows, macOS and Linux; locate the "scope" key in tauri.conf.json and make
this string replacement.
In `@publishing/pictopy-bin.install`:
- Around line 1-6: The post_remove() hook is overly destructive because it
iterates /home/* and force-deletes every user's ~/.local/share/picto_py and
~/.cache/picto_py, contradicting the uninstall goal of preserving
DB/models/thumbnails; update post_remove() to avoid mass deletion by only
targeting the invoking user's home (e.g., $HOME), or require an explicit opt-in
flag/confirmation before removing data, and ensure it does not remove
DB/models/thumbnails (leave paths for models/DB/thumbnail intact or check for an
app-specific marker before deleting). Locate the post_remove() function and
replace the /home/* loop with logic that limits deletion to the current user (or
adds a safe prompt/opt-in), and restrict deletions to well-scoped package
runtime files only.
In `@publishing/PKGBUILD`:
- Line 13: The PKGBUILD currently uses sha256sums=('SKIP'), which disables
source integrity verification; replace the SKIP entry in the sha256sums array
with the actual SHA-256 checksum of the release artifact referenced by the
source array in this PKGBUILD (compute the checksum after downloading the exact
source tarball used for the package and paste that hex string into
sha256sums=('...')), ensuring the sha256sums value matches the source to restore
integrity checks before publishing.
- Around line 17-18: The PKGBUILD currently hardcodes extracting data.tar.gz;
change the extraction to handle any data.tar.* produced by ar x. After running
ar x "${pkgname}-${pkgver}.deb" (in the PKGBUILD), detect the actual archive by
globbing for data.tar.* (or using ar t to list and capture the filename) and
pass that filename to tar (e.g., iterate over data.tar.* and run tar -xf "$file"
-C "$pkgdir"). Update the line that calls tar xf data.tar.gz -C "$pkgdir" to use
the discovered data.tar.* filename(s) so data.tar.xz / data.tar.zst /
data.tar.gz are all supported.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5b885099-342e-4d9f-bef7-a9212b313ee3
📒 Files selected for processing (5)
.github/workflows/aur-publish.yml.github/workflows/build-and-release.ymlfrontend/src-tauri/tauri.conf.jsonpublishing/PKGBUILDpublishing/pictopy-bin.install
Update asset protocol scope in tauri.conf.json
Author
|
@coderabbitai review |
Contributor
✅ Actions performedReview triggered.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addressed Issues:
Fixes #946
Screenshots/Recordings:
Tested on Endeavour OS (Arch-based). App installs and runs correctly via
makepkg -si— all three services start, desktop entry and icons show up, user data goes to the right places.Additional Notes:
Adds Arch Linux AUR packaging support for PictoPy.
Maintainers need to add these secrets for the workflow:
AUR_USERNAMEAUR_EMAILAUR_SSH_PRIVATE_KEYFiles added:
publishing/PKGBUILD— buildspictopy-binfrom the official GitHub release.debpublishing/pictopy-bin.install— cleans up Tauri app state on uninstall so reinstall starts fresh from onboarding. User database, models and thumbnails are preserved..github/workflows/aur-publish.yml— runs daily, detects new releases, updatespkgverandsha256sumsautomatically, and pushes to AURAlso fixes Tauri filesystem scope to allow thumbnails to load from
~/.local/share/.AI Usage Disclosure:
I have used the following AI models and tools:
Claude.Checklist
Summary by CodeRabbit
New Features
Security
Chores