-
Notifications
You must be signed in to change notification settings - Fork 1
Add Registries and its metadata creation part #18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
5612381
7601ca6
96a1e93
b168041
029d274
0a5ea32
b95ed4d
dcb5e69
b2878e6
17bfaa9
2a80484
f7d8973
1aaba90
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,90 @@ | ||||||||||||||||||||||||||||||||
| name: Build package registry artifacts | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||
| workflow_dispatch: | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| env: | ||||||||||||||||||||||||||||||||
| CARGO_TERM_COLOR: always | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||
| build_apt: | ||||||||||||||||||||||||||||||||
| name: Build APT package | ||||||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||
| - name: Checkout | ||||||||||||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Install Rust toolchain | ||||||||||||||||||||||||||||||||
| uses: actions-rs/toolchain@v1 | ||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||
| toolchain: stable | ||||||||||||||||||||||||||||||||
| profile: minimal | ||||||||||||||||||||||||||||||||
| override: true | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Install Debian packaging tools | ||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||
| sudo apt-get update | ||||||||||||||||||||||||||||||||
| sudo apt-get install -y --no-install-recommends \ | ||||||||||||||||||||||||||||||||
| debhelper \ | ||||||||||||||||||||||||||||||||
| devscripts \ | ||||||||||||||||||||||||||||||||
| pkg-config | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Build Debian package | ||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||
| cd registries/apt | ||||||||||||||||||||||||||||||||
| dpkg-buildpackage -us -uc -b | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Collect Debian artifacts | ||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||
| mkdir -p artifacts/apt | ||||||||||||||||||||||||||||||||
| find registries -maxdepth 1 -type f -name "*.deb" -exec cp {} artifacts/apt/ \; | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Upload Debian artifacts | ||||||||||||||||||||||||||||||||
| uses: actions/upload-artifact@v4 | ||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||
| name: apt-package | ||||||||||||||||||||||||||||||||
| path: artifacts/apt/*.deb | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| build_flatpak: | ||||||||||||||||||||||||||||||||
| name: Build Flatpak bundle | ||||||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||
| - name: Checkout | ||||||||||||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Install Flatpak tools | ||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||
| sudo apt-get update | ||||||||||||||||||||||||||||||||
| sudo apt-get install -y --no-install-recommends \ | ||||||||||||||||||||||||||||||||
| flatpak \ | ||||||||||||||||||||||||||||||||
| flatpak-builder \ | ||||||||||||||||||||||||||||||||
| curl | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Install Flatpak runtimes | ||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||
| flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo | ||||||||||||||||||||||||||||||||
| flatpak install -y flathub org.freedesktop.Platform//24.08 org.freedesktop.Sdk//24.08 | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Resolve source SHA when placeholder is present | ||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||
| manifest="registries/flatpak/io.github.ghimiresdp.furl.yml" | ||||||||||||||||||||||||||||||||
| if grep -q "REPLACE_WITH_ACTUAL_SHA256" "$manifest"; then | ||||||||||||||||||||||||||||||||
| url=$(grep -E "^[[:space:]]*url:" "$manifest" | head -n 1 | sed -E "s/^[[:space:]]*url:[[:space:]]*//") | ||||||||||||||||||||||||||||||||
| curl -L "$url" -o /tmp/furl-source.tar.gz | ||||||||||||||||||||||||||||||||
| sha=$(sha256sum /tmp/furl-source.tar.gz | awk '{print $1}') | ||||||||||||||||||||||||||||||||
| sed -i "s/REPLACE_WITH_ACTUAL_SHA256/$sha/" "$manifest" | ||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Build Flatpak repo and bundle | ||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||
| mkdir -p artifacts/flatpak | ||||||||||||||||||||||||||||||||
| flatpak-builder --force-clean --repo=flatpak-repo flatpak-build registries/flatpak/io.github.ghimiresdp.furl.yml | ||||||||||||||||||||||||||||||||
| flatpak build-bundle flatpak-repo artifacts/flatpak/io.github.ghimiresdp.furl.flatpak io.github.ghimiresdp.furl | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Upload Flatpak artifacts | ||||||||||||||||||||||||||||||||
| uses: actions/upload-artifact@v4 | ||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||
| name: flatpak-bundle | ||||||||||||||||||||||||||||||||
| path: artifacts/flatpak/*.flatpak | ||||||||||||||||||||||||||||||||
|
Comment on lines
+50
to
+90
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
Copilot AutofixAI 2 months ago In general, fix this by explicitly setting a restricted The best minimal fix without changing functionality is to add a root-level
Suggested changeset
1
.github/workflows/package-registries.yml
Copilot is powered by AI and may make mistakes. Always verify output.
Refresh and try again.
|
||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,6 +4,7 @@ on: | |
| push: | ||
| tags: | ||
| - "v*" | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| build: | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| furl-cli (0.6.2-1) unstable; urgency=medium | ||
|
|
||
| * Initial Debian packaging template for the project registry. | ||
|
|
||
| -- Sudip Ghimire <ghimiresdp@users.noreply.github.com> Sat, 15 Mar 2026 00:00:00 +0000 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| Source: furl-cli | ||
| Section: utils | ||
| Priority: optional | ||
| Maintainer: Sudip Ghimire <ghimiresdp@users.noreply.github.com> | ||
| Build-Depends: debhelper-compat (= 13), cargo, rustc, pkg-config | ||
| Standards-Version: 4.7.0 | ||
| Homepage: https://github.com/ghimiresdp/furl-cli | ||
| Rules-Requires-Root: no | ||
|
|
||
| Package: furl-cli | ||
| Architecture: any | ||
| Depends: ${shlibs:Depends}, ${misc:Depends} | ||
| Description: Fast, multithreaded CLI downloader built in Rust | ||
| furl is a high-performance command-line downloader that can split | ||
| downloads into chunks and fetch them concurrently. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| ../../target/release/furl usr/bin |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| #!/usr/bin/make -f | ||
|
|
||
| %: | ||
| dh $@ | ||
|
|
||
| override_dh_auto_build: | ||
| cargo build --manifest-path ../../Cargo.toml --release --locked |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| 3.0 (native) |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| app-id: io.github.ghimiresdp.furl | ||
| runtime: org.freedesktop.Platform | ||
| runtime-version: "24.08" | ||
| sdk: org.freedesktop.Sdk | ||
| command: furl | ||
| finish-args: | ||
| - --share=network | ||
| modules: | ||
| - name: furl | ||
| buildsystem: simple | ||
| build-commands: | ||
| - install -Dm755 furl /app/bin/furl | ||
| sources: | ||
| - type: archive | ||
| url: https://github.com/ghimiresdp/furl-cli/releases/download/v0.6.2/furl-v0.6.2-linux-x86_64.tar.gz | ||
| sha256: REPLACE_WITH_ACTUAL_SHA256 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| # Created using wingetcreate 1.12.8.0 | ||
| # yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json | ||
|
|
||
| PackageIdentifier: ghimiresdp.furl | ||
| PackageVersion: 0.6.2 | ||
| InstallerType: zip | ||
| NestedInstallerType: portable | ||
| NestedInstallerFiles: | ||
| - RelativeFilePath: furl.exe | ||
| PortableCommandAlias: furl | ||
| Installers: | ||
| - Architecture: x64 | ||
| InstallerUrl: https://github.com/ghimiresdp/furl-cli/releases/download/v0.6.2/furl-v0.6.2-windows-x86_64.zip | ||
| InstallerSha256: A2AE2C1216CFCFBD4484AEF6E60C7451804ADC2CC81142ABB98434442CDFDD87 | ||
| ManifestType: installer | ||
| ManifestVersion: 1.12.0 | ||
| ReleaseDate: 2026-03-15 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| # Created using wingetcreate 1.12.8.0 | ||
| # yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json | ||
|
|
||
| PackageIdentifier: ghimiresdp.furl | ||
| PackageVersion: 0.6.2 | ||
| PackageLocale: en-US | ||
| Publisher: Sudip Ghimire | ||
| PublisherUrl: https://github.com/ghimiresdp | ||
| PublisherSupportUrl: https://github.com/ghimiresdp/furl-cli/issues | ||
| PackageName: furl-cli | ||
| PackageUrl: https://github.com/ghimiresdp/furl-cli | ||
| License: Apache-2.0 | ||
| ShortDescription: A fast, multithreaded CLI downloader built in Rust. | ||
| Tags: | ||
| - download-manager | ||
| - downloader | ||
| - file-downloader | ||
| - network-util | ||
| ReleaseNotesUrl: https://github.com/ghimiresdp/furl-cli/releases/tag/v0.6.2 | ||
| Documentations: | ||
| - DocumentLabel: Wiki | ||
| DocumentUrl: https://github.com/ghimiresdp/furl-cli/wiki | ||
| ManifestType: defaultLocale | ||
| ManifestVersion: 1.12.0 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| # Created using wingetcreate 1.12.8.0 | ||
| # yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json | ||
|
|
||
| PackageIdentifier: ghimiresdp.furl | ||
| PackageVersion: 0.6.2 | ||
| DefaultLocale: en-US | ||
| ManifestType: version | ||
| ManifestVersion: 1.12.0 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| # Created using wingetcreate 1.12.8.0 | ||
| # yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json | ||
|
|
||
| PackageIdentifier: ghimiresdp.furl | ||
| PackageVersion: 0.7.0 | ||
| InstallerType: zip | ||
| NestedInstallerType: portable | ||
| NestedInstallerFiles: | ||
| - RelativeFilePath: furl.exe | ||
| PortableCommandAlias: furl | ||
| Installers: | ||
| - Architecture: x64 | ||
| InstallerUrl: https://github.com/ghimiresdp/furl-cli/releases/download/v0.7.0/furl-v0.7.0-windows-x86_64.zip | ||
| InstallerSha256: 1C08229C611F344ACC91089418ADD3665070DDC1143E27B2383A553C4D5F2336 | ||
| ManifestType: installer | ||
| ManifestVersion: 1.12.0 | ||
| ReleaseDate: 2026-03-28 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| # Created using wingetcreate 1.12.8.0 | ||
| # yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json | ||
|
|
||
| PackageIdentifier: ghimiresdp.furl | ||
| PackageVersion: 0.7.0 | ||
| PackageLocale: en-US | ||
| Publisher: Sudip Ghimire | ||
| PublisherUrl: https://github.com/ghimiresdp | ||
| PublisherSupportUrl: https://github.com/ghimiresdp/furl-cli/issues | ||
| PackageName: furl-cli | ||
| PackageUrl: https://github.com/ghimiresdp/furl-cli | ||
| License: Apache-2.0 | ||
| ShortDescription: A fast, multithreaded CLI downloader built in Rust. | ||
| Tags: | ||
| - download-manager | ||
| - downloader | ||
| - file-downloader | ||
| - network-util | ||
| ReleaseNotesUrl: https://github.com/ghimiresdp/furl-cli/releases/tag/v0.7.0 | ||
| Documentations: | ||
| - DocumentLabel: Wiki | ||
| DocumentUrl: https://github.com/ghimiresdp/furl-cli/wiki | ||
| ManifestType: defaultLocale | ||
| ManifestVersion: 1.12.0 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| # Created using wingetcreate 1.12.8.0 | ||
| # yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json | ||
|
|
||
| PackageIdentifier: ghimiresdp.furl | ||
| PackageVersion: 0.7.0 | ||
| DefaultLocale: en-US | ||
| ManifestType: version | ||
| ManifestVersion: 1.12.0 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
|
|
||
| repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" | ||
|
|
||
| version="${1:-}" | ||
| if [[ -z "$version" ]]; then | ||
| version="$(sed -nE 's/^version = "([^"]+)"/\1/p' "$repo_root/Cargo.toml" | head -n 1)" | ||
| fi | ||
|
|
||
| if [[ -z "$version" ]]; then | ||
| echo "Could not determine version from Cargo.toml" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| tag="v${version}" | ||
|
|
||
| winget_file="$repo_root/registries/winget/ghimiresdp.furl.yml" | ||
| flatpak_file="$repo_root/registries/flatpak/io.github.ghimiresdp.furl.yml" | ||
| apt_changelog="$repo_root/registries/apt/debian/changelog" | ||
|
|
||
| if [[ -f "$winget_file" ]]; then | ||
| sed -Ei "s|^(PackageVersion: ).*$|\\1${version}|" "$winget_file" | ||
| sed -Ei "s|(InstallerUrl: .*?/download/)v[^/]+(/furl-)v[^-]+(-windows-x86_64\\.zip)|\\1${tag}\\2${tag}\\3|" "$winget_file" | ||
| fi | ||
|
|
||
| if [[ -f "$flatpak_file" ]]; then | ||
| sed -Ei "s|(url: .*?/download/)v[^/]+(/furl-)v[^-]+(-linux-x86_64\\.tar\\.gz)|\\1${tag}\\2${tag}\\3|" "$flatpak_file" | ||
| fi | ||
|
|
||
| if [[ -f "$apt_changelog" ]]; then | ||
| sed -Ei "1 s/^furl-cli \([^)-]+-([0-9]+)\) /furl-cli (${version}-\\1) /" "$apt_changelog" | ||
| fi | ||
|
|
||
| echo "Synchronized registry metadata to version ${version}." |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 2 months ago
In general, the fix is to define an explicit
permissions:block that grants only the minimal required scopes for the GITHUB_TOKEN, either at the workflow root (applies to all jobs) or per job. Since neither job needs to modify repository contents, a restrictive root‑level block such aspermissions: { contents: read }is appropriate; the jobs useactions/checkoutandactions/upload-artifact, both of which work withcontents: readand do not require write access.The best fix here without changing existing functionality is to add a single
permissions:block at the top level of.github/workflows/package-registries.yml, betweenon:andenv:(or directly undername:/on:), settingcontents: read. No job appears to need any additional scopes (packages,pull-requests, etc.), and there are no GitHub API calls that would require broader access. This single block will satisfy CodeQL, document the required permissions, and ensure that if the repo/org defaults change, this workflow continues to run with only read access to repository contents.Concretely, edit
.github/workflows/package-registries.ymlto insert:just after the
on:block (line 5), leaving the rest of the workflow unchanged.