feat(packaging): add Arch Linux AUR package with automated publishing workflow#1268
Merged
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughAdds Arch packaging (PKGBUILD + install hook), a GitHub Actions workflow to detect release updates and publish pictopy-bin to AUR, adjusts Tauri asset scope to include thumbnail directories, and applies a small YAML formatting change in the build workflow. ChangesAUR Package Support
Sequence DiagramsequenceDiagram
participant Releases as GitHub Releases
participant Workflow as aur-publish (update_version)
participant PKGBUILD as publishing/PKGBUILD
participant ArtifactStorage as Actions Artifact
participant AUR as AUR Publish Action
Releases->>Workflow: Query latest PictoPy tag
Workflow->>Workflow: Compare tag vs PKGBUILD pkgver
alt Version mismatch
Workflow->>Releases: Download PictoPy_<version>_amd64.deb
Workflow->>Workflow: Compute sha256sum
Workflow->>PKGBUILD: Update pkgver/pkgrel/sha256sums
Workflow->>Workflow: Commit and push PKGBUILD
Workflow->>ArtifactStorage: Upload PKGBUILD + install artifact
AUR->>ArtifactStorage: Download artifact (publish_aur)
AUR->>AUR: Create AUR commit using AUR credentials and v<latest_version>
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~40 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/aur-publish.yml:
- Around line 8-11: The workflow's update_version job performs a git push but
lacks explicit permissions; add a job-level permissions block for update_version
(e.g., set permissions: contents: write) so the GITHUB_TOKEN can push; update
the job named update_version in the workflow to include this permissions entry
to allow the push step to succeed.
- Around line 29-31: The LATEST_VERSION extraction using curl | grep is brittle;
change the fetch to use curl with --fail -sS (or check the HTTP status), pipe to
jq to robustly parse .tag_name, validate the extracted LATEST_VERSION is
non-empty/matches a semver pattern, and abort the job with a clear error if
validation fails; apply the same hardening (curl --fail -sS, JSON parsing with
jq, non-empty/format validation, and retry/backoff) to the subsequent SHA/commit
fetch steps so those variables also fail fast on HTTP/API errors.
- Line 89: Replace the floating tag in the GitHub Actions step that currently
uses "uses: ulises-jeremias/github-actions-aur-publish@v1" with the full commit
SHA by changing it to "uses:
ulises-jeremias/github-actions-aur-publish@85567876543210abcdef1234567890abcdef12345678";
this pins the action to a specific immutable revision for supply-chain security
and prevents tag-rewrite attacks, and also make a note (or separate PR) to
evaluate maintained alternatives such as KSXGitHub/github-actions-deploy-aur
since ulises-jeremias/github-actions-aur-publish appears unmaintained.
In `@frontend/src-tauri/tauri.conf.json`:
- Line 62: Add an automated test that verifies the tauri allowlist scope entry
"scope": ["$HOME/.local/share/PictoPy/thumbnails/**"] actually permits loading
thumbnails and denies nearby disallowed paths: implement a test that (1) writes
a sample thumbnail under $HOME/.local/share/PictoPy/thumbnails/, calls the
thumbnail-rendering entrypoint used by the app (or invokes the Tauri API used
for file access), and asserts the thumbnail loads successfully, and (2) attempts
the same read from a nearby path (e.g.,
$HOME/.local/share/PictoPy/thumbnail_blocked.png or ../outside.png) and asserts
the access is rejected/throws; place this test in the frontend Tauri/integration
test suite and use the same runtime APIs the app uses so it fails on regression
if the scope/config or access logic changes.
- Line 62: The scope entry using a Linux-specific path should be replaced with
Tauri's cross-platform variable: update the "scope" array element that currently
contains "$HOME/.local/share/PictoPy/thumbnails/**" to use
"$APPDATA/PictoPy/thumbnails/**" so the asset scope resolves correctly on
Windows, macOS and Linux; locate the "scope" key in tauri.conf.json and make
this string replacement.
In `@publishing/pictopy-bin.install`:
- Around line 1-6: The post_remove() hook is overly destructive because it
iterates /home/* and force-deletes every user's ~/.local/share/picto_py and
~/.cache/picto_py, contradicting the uninstall goal of preserving
DB/models/thumbnails; update post_remove() to avoid mass deletion by only
targeting the invoking user's home (e.g., $HOME), or require an explicit opt-in
flag/confirmation before removing data, and ensure it does not remove
DB/models/thumbnails (leave paths for models/DB/thumbnail intact or check for an
app-specific marker before deleting). Locate the post_remove() function and
replace the /home/* loop with logic that limits deletion to the current user (or
adds a safe prompt/opt-in), and restrict deletions to well-scoped package
runtime files only.
In `@publishing/PKGBUILD`:
- Line 13: The PKGBUILD currently uses sha256sums=('SKIP'), which disables
source integrity verification; replace the SKIP entry in the sha256sums array
with the actual SHA-256 checksum of the release artifact referenced by the
source array in this PKGBUILD (compute the checksum after downloading the exact
source tarball used for the package and paste that hex string into
sha256sums=('...')), ensuring the sha256sums value matches the source to restore
integrity checks before publishing.
- Around line 17-18: The PKGBUILD currently hardcodes extracting data.tar.gz;
change the extraction to handle any data.tar.* produced by ar x. After running
ar x "${pkgname}-${pkgver}.deb" (in the PKGBUILD), detect the actual archive by
globbing for data.tar.* (or using ar t to list and capture the filename) and
pass that filename to tar (e.g., iterate over data.tar.* and run tar -xf "$file"
-C "$pkgdir"). Update the line that calls tar xf data.tar.gz -C "$pkgdir" to use
the discovered data.tar.* filename(s) so data.tar.xz / data.tar.zst /
data.tar.gz are all supported.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5b885099-342e-4d9f-bef7-a9212b313ee3
📒 Files selected for processing (5)
.github/workflows/aur-publish.yml.github/workflows/build-and-release.ymlfrontend/src-tauri/tauri.conf.jsonpublishing/PKGBUILDpublishing/pictopy-bin.install
Update asset protocol scope in tauri.conf.json
Contributor
Author
|
@coderabbitai review |
Contributor
✅ Actions performedReview triggered.
|
Comment out the scheduled cron job for AUR publishing
rahulharpal1603
approved these changes
May 22, 2026
Contributor
rahulharpal1603
left a comment
rahulharpal1603
left a comment
There was a problem hiding this comment.
Thanks @akshajtiwari!
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/aur-publish.yml (1)
7-8: 💤 Low valueConsider scoping
contents: writeto theupdate_versionjob only.Only the
update_versionjob performsgit push(line 68). Scoping permissions to the job level reduces the attack surface if other jobs are added later.♻️ Suggested change
on: # schedule: # - cron: '0 0 * * *' workflow_dispatch: -permissions: - contents: write jobs: update_version: runs-on: ubuntu-latest + permissions: + contents: write outputs:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/aur-publish.yml around lines 7 - 8, Top-level permission "contents: write" should be scoped to the specific job that needs to push (the update_version job); remove or change the repo-level "permissions: contents: write" to a safer default (e.g., read-only or remove) and add a job-level block under the update_version job with "permissions: contents: write" so only update_version can push, leaving other jobs with no write access.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/aur-publish.yml:
- Line 94: The AUR deploy step references pkgbuild: ./PKGBUILD but the uploaded
artifact lives under publishing/, so update the deploy configuration referenced
by the AUR action (the pkgbuild: entry in the deploy job) to point to the
uploaded location (publishing/PKGBUILD) or change the upload artifact layout to
place PKGBUILD at the repo root; specifically edit the deploy job's pkgbuild key
to use publishing/PKGBUILD so the action can find the uploaded PKGBUILD and
pictopy-bin.install files.
In `@frontend/src-tauri/tauri.conf.json`:
- Around line 62-66: The scope array currently includes a catch-all entry
"\"**\"" which makes the explicit thumbnail paths
("$HOME/.local/share/PictoPy/thumbnails/**" and "$HOME/Library/Application
Support/PictoPy/thumbnails/**") redundant; decide whether you intend to restrict
access to only those thumbnail directories or to allow full filesystem access:
if you want restriction, remove the "\"**\"" entry from the "scope" array so
only the two thumbnail paths remain; if full access is intentional, remove the
explicit thumbnail entries (or add a clarifying comment/documentation) so the
configuration isn’t confusing while keeping the "\"**\"" entry in the "scope"
key.
---
Nitpick comments:
In @.github/workflows/aur-publish.yml:
- Around line 7-8: Top-level permission "contents: write" should be scoped to
the specific job that needs to push (the update_version job); remove or change
the repo-level "permissions: contents: write" to a safer default (e.g.,
read-only or remove) and add a job-level block under the update_version job with
"permissions: contents: write" so only update_version can push, leaving other
jobs with no write access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5b98d2d1-b571-4283-8324-dc7c6facab94
📒 Files selected for processing (3)
.github/workflows/aur-publish.ymlfrontend/src-tauri/tauri.conf.jsonpublishing/PKGBUILD
| uses: KSXGitHub/github-actions-deploy-aur@v4.1.3 | ||
| with: | ||
| pkgname: pictopy-bin | ||
| pkgbuild: ./PKGBUILD |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the artifact upload paths match the expected download structure
grep -A5 "Upload artifacts" .github/workflows/aur-publish.yml
echo "---"
echo "Files are uploaded from 'publishing/' subdirectory."
echo "download-artifact preserves directory structure, so files will be at ./publishing/*"Repository: AOSSIE-Org/PictoPy
Length of output: 409
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/aur-publish.yml"
echo "=== Upload artifacts block ==="
# Print around the upload step with enough context to include the full `path:` list
rg -n "name: PKGBUILD|Upload artifacts for publish job|actions/upload-artifact@v4" "$FILE"
python3 - <<'PY'
import pathlib, re
file = pathlib.Path(".github/workflows/aur-publish.yml")
lines = file.read_text().splitlines()
# find upload-artifact section
for i,l in enumerate(lines):
if "Upload artifacts for publish job" in l:
start=max(0,i-5); end=min(len(lines), i+40)
for j in range(start,end):
print(f"{j+1:4d}:{lines[j]}")
break
else:
print("Upload block not found")
PY
echo
echo "=== Download artifacts block ==="
python3 - <<'PY'
import pathlib
file = pathlib.Path(".github/workflows/aur-publish.yml")
lines = file.read_text().splitlines()
for i,l in enumerate(lines):
if "download-artifact" in l or "actions/download-artifact" in l or "Download artifacts" in l:
start=max(0,i-5); end=min(len(lines), i+60)
for j in range(start,end):
print(f"{j+1:4d}:{lines[j]}")
break
else:
print("Download block not found")
PY
echo
echo "=== pkgbuild line ==="
python3 - <<'PY'
import pathlib, re
file = pathlib.Path(".github/workflows/aur-publish.yml")
for i,l in enumerate(file.read_text().splitlines(), start=1):
if re.search(r"\bpkgbuild\s*:", l):
print(f"{i}:{l}")
PYRepository: AOSSIE-Org/PictoPy
Length of output: 2546
Fix AUR deploy pkgbuild path mismatch with uploaded artifact layout
The workflow uploads publishing/PKGBUILD (and publishing/pictopy-bin.install) but the AUR deploy step references pkgbuild: ./PKGBUILD, so the publish job will fail to find the PKGBUILD. (upload: lines 70-77, deploy: line 94)
🐛 Proposed fix
- name: Publish to AUR
uses: KSXGitHub/github-actions-deploy-aur@v4.1.3
with:
pkgname: pictopy-bin
- pkgbuild: ./PKGBUILD
+ pkgbuild: ./publishing/PKGBUILD
commit_username: ${{ secrets.AUR_USERNAME }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/aur-publish.yml at line 94, The AUR deploy step references
pkgbuild: ./PKGBUILD but the uploaded artifact lives under publishing/, so
update the deploy configuration referenced by the AUR action (the pkgbuild:
entry in the deploy job) to point to the uploaded location (publishing/PKGBUILD)
or change the upload artifact layout to place PKGBUILD at the repo root;
specifically edit the deploy job's pkgbuild key to use publishing/PKGBUILD so
the action can find the uploaded PKGBUILD and pictopy-bin.install files.
Comment on lines
+62
to
+66
| "scope": [ | ||
| "$HOME/.local/share/PictoPy/thumbnails/**", | ||
| "**", | ||
| "$HOME/Library/Application Support/PictoPy/thumbnails/**" | ||
| ], |
Contributor
There was a problem hiding this comment.
The "**" wildcard makes the explicit paths redundant.
The catch-all "**" pattern already grants access to all filesystem paths, so the explicit thumbnail directory entries ($HOME/.local/share/PictoPy/thumbnails/** and $HOME/Library/Application Support/PictoPy/thumbnails/**) have no functional effect.
If the intent is to restrict access to only thumbnail directories for security, remove the "**" entry:
"scope": [
- "$HOME/.local/share/PictoPy/thumbnails/**",
- "**",
- "$HOME/Library/Application Support/PictoPy/thumbnails/**"
+ "$HOME/.local/share/PictoPy/thumbnails/**",
+ "$HOME/Library/Application Support/PictoPy/thumbnails/**"
],If "**" is intentionally kept for other asset access needs, please clarify that intent and consider documenting it—or remove the now-redundant explicit paths to avoid confusion.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/src-tauri/tauri.conf.json` around lines 62 - 66, The scope array
currently includes a catch-all entry "\"**\"" which makes the explicit thumbnail
paths ("$HOME/.local/share/PictoPy/thumbnails/**" and "$HOME/Library/Application
Support/PictoPy/thumbnails/**") redundant; decide whether you intend to restrict
access to only those thumbnail directories or to allow full filesystem access:
if you want restriction, remove the "\"**\"" entry from the "scope" array so
only the two thumbnail paths remain; if full access is intentional, remove the
explicit thumbnail entries (or add a clarifying comment/documentation) so the
configuration isn’t confusing while keeping the "\"**\"" entry in the "scope"
key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addressed Issues:
Fixes #946
Screenshots/Recordings:
Tested on Endeavour OS (Arch-based). App installs and runs correctly via
makepkg -si— all three services start, desktop entry and icons show up, user data goes to the right places.Additional Notes:
Adds Arch Linux AUR packaging support for PictoPy.
Maintainers need to add these secrets for the workflow:
AUR_USERNAMEAUR_EMAILAUR_SSH_PRIVATE_KEYFiles added:
publishing/PKGBUILD— buildspictopy-binfrom the official GitHub release.debpublishing/pictopy-bin.install— cleans up Tauri app state on uninstall so reinstall starts fresh from onboarding. User database, models and thumbnails are preserved..github/workflows/aur-publish.yml— runs daily, detects new releases, updatespkgverandsha256sumsautomatically, and pushes to AURAlso fixes Tauri filesystem scope to allow thumbnails to load from
~/.local/share/.AI Usage Disclosure:
I have used the following AI models and tools:
Claude.Checklist
Summary by CodeRabbit
New Features
Security
Chores