chore(release): update package version to 0.0.4 and fix build paths

* Adjust pkgver in PKGBUILD to 0.0.4
* Update build paths in PKGBUILD for consistency
* Enhance AUR package versioning logic in release workflow

.gitea/workflows/release.yml

@@ -92,61 +92,108 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  pkg-arch:
+  pkg-aur:
     needs: release
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
-      - name: Build Arch package
+      - name: Publish to AUR
+        env:
+          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
         run: |
+          set -euo pipefail
+
           VERSION="${{ github.event.inputs.tag || github.ref_name }}"
           PKGVER="${VERSION#v}"
+          AUR_KEY_PATH="$HOME/.ssh/aur"
+          AUR_KNOWN_HOSTS="$HOME/.ssh/known_hosts"
 
-          # Source tarball — prefix=unitdore/ matches `cd "$pkgname"` in PKGBUILD
-          git archive --format=tar.gz --prefix=unitdore/ HEAD \
-            > pkg/arch/unitdore-${PKGVER}.tar.gz
-          SHA=$(sha256sum pkg/arch/unitdore-${PKGVER}.tar.gz | cut -d' ' -f1)
+          # Setup SSH for AUR
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
 
-          # Patch PKGBUILD for local build
-          sed -i \
-            -e "s/^pkgver=.*/pkgver=${PKGVER}/" \
-            -e "s/^sha256sums=.*/sha256sums=('${SHA}')/" \
-            -e "s|source=.*|source=(\"unitdore-\${pkgver}.tar.gz\")|" \
-            pkg/arch/PKGBUILD
+          if [ -z "${AUR_SSH_KEY:-}" ]; then
+            echo "AUR_SSH_KEY is empty"
+            exit 1
+          fi
 
-          mkdir -p pkg/arch/out
-          docker run --rm \
-            -v "$PWD/pkg/arch:/build" \
-            -v "$PWD/pkg/arch/out:/out" \
-            -w /build \
-            archlinux:latest \
-            bash -c "
-              pacman -Syu --noconfirm base-devel go &&
-              useradd -m builder &&
-              chown -R builder:builder /build &&
-              runuser -u builder -- makepkg --noconfirm --noprogressbar &&
-              cp /build/*.pkg.tar.zst /out/
-            "
+          # Support raw multiline keys, escaped \\n secrets, or base64-encoded keys.
+          CLEAN_AUR_SSH_KEY="$(printf '%s' "$AUR_SSH_KEY" | tr -d '\r')"
+          if printf '%s' "$CLEAN_AUR_SSH_KEY" | grep -q "^-----BEGIN .*PRIVATE KEY-----$"; then
+            printf '%s\n' "$CLEAN_AUR_SSH_KEY" > "$AUR_KEY_PATH"
+          elif printf '%s' "$CLEAN_AUR_SSH_KEY" | grep -q '\\n'; then
+            printf '%b\n' "$CLEAN_AUR_SSH_KEY" > "$AUR_KEY_PATH"
+          else
+            if printf '%s' "$CLEAN_AUR_SSH_KEY" | tr -d '[:space:]' | base64 --decode > "$AUR_KEY_PATH" 2>/dev/null; then
+              :
+            else
+              printf '%s\n' "$CLEAN_AUR_SSH_KEY" > "$AUR_KEY_PATH"
+            fi
+          fi
+          chmod 600 "$AUR_KEY_PATH"
 
-      - name: Upload to release
-        run: |
-          TAG="${{ github.event.inputs.tag || github.ref_name }}"
-          RELEASE=$(curl -s "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \
-            -H "Authorization: token ${GITHUB_TOKEN}")
-          UPLOAD_URL=$(echo "$RELEASE" | grep -o '"upload_url":"[^"]*"' | cut -d'"' -f4)
-          for f in pkg/arch/out/*.pkg.tar.zst; do
-            FNAME=$(basename "$f")
-            echo "Uploading $FNAME..."
-            curl -s -X POST "${UPLOAD_URL}?name=${FNAME}" \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              --data-binary "@${f}" > /dev/null
-          done
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          if ! ssh-keygen -y -f "$AUR_KEY_PATH" >/dev/null 2>&1; then
+            echo "AUR_SSH_KEY is not a valid private key."
+            echo "Store it as a raw private key, an escaped private key with \\n, or a base64-encoded private key."
+            exit 1
+          fi
+
+          ssh-keyscan -t rsa,ed25519 aur.archlinux.org >> "$AUR_KNOWN_HOSTS"
+          chmod 644 "$AUR_KNOWN_HOSTS"
+
+          # Clone AUR repo
+          GIT_SSH_COMMAND="ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$AUR_KNOWN_HOSTS -i $AUR_KEY_PATH" \
+            git clone ssh://aur@aur.archlinux.org/unitdore.git aur-repo
+
+          CURRENT_PKGVER=$(awk -F= '/^pkgver=/ {print $2; exit}' aur-repo/PKGBUILD | tr -d "[:space:]")
+          CURRENT_PKGREL=$(awk -F= '/^pkgrel=/ {print $2; exit}' aur-repo/PKGBUILD | tr -d "[:space:]")
+
+          if [ "$CURRENT_PKGVER" = "$PKGVER" ]; then
+            case "$CURRENT_PKGREL" in
+              ''|*[!0-9]*)
+                echo "Unsupported pkgrel in AUR repo: ${CURRENT_PKGREL}"
+                exit 1
+                ;;
+              *)
+                PKGREL=$((CURRENT_PKGREL + 1))
+                ;;
+            esac
+          else
+            PKGREL=1
+          fi
+
+          echo "Publishing AUR package version ${PKGVER}-${PKGREL}"
+
+          # Compute SHA256 of the source archive from the same URL the PKGBUILD will download.
+          SHA=$(curl -fsSL "https://git.warky.dev/wdevs/unitdore/archive/v${PKGVER}.zip" | sha256sum | cut -d' ' -f1)
+
+          # Update PKGBUILD — keep remote source URL, bump version/checksum, and increment pkgrel for same-version rebuilds.
+          sed -e "s/^pkgver=.*/pkgver=${PKGVER}/" \
+              -e "s/^pkgrel=.*/pkgrel=${PKGREL}/" \
+              -e "s/^sha256sums=.*/sha256sums=('${SHA}')/" \
+              pkg/arch/PKGBUILD > aur-repo/PKGBUILD
+
+          # Generate .SRCINFO inside an Arch container (docker cp avoids DinD volume mount issues)
+          CID=$(docker run -d archlinux:latest sleep infinity)
+          docker cp aur-repo/PKGBUILD $CID:/build/PKGBUILD || (docker exec $CID mkdir -p /build && docker cp aur-repo/PKGBUILD $CID:/build/PKGBUILD)
+          docker exec $CID bash -c "
+            pacman -Sy --noconfirm base-devel &&
+            useradd -m builder &&
+            chown -R builder:builder /build &&
+            runuser -u builder -- bash -c 'cd /build && makepkg --printsrcinfo > .SRCINFO'
+          "
+          docker cp $CID:/build/.SRCINFO aur-repo/.SRCINFO
+          docker rm -f $CID
+
+          # Commit and push to AUR master
+          cd aur-repo
+          git config user.email "hein@warky.dev"
+          git config user.name "Hein"
+          git add PKGBUILD .SRCINFO
+          git commit -m "Update to v${PKGVER}-${PKGREL}"
+          GIT_SSH_COMMAND="ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$AUR_KNOWN_HOSTS -i $AUR_KEY_PATH" \
+            git push origin HEAD:master
 
   pkg-deb:
     needs: release
@@ -215,8 +262,16 @@ jobs:
 
       - name: Build RPM
         run: |
+          set -euo pipefail
+
           VERSION="${{ github.event.inputs.tag || github.ref_name }}"
           PKGVER="${VERSION#v}"
+          GO_VER="$(awk '/^go / { print $2; exit }' go.mod)"
+
+          if [ -z "${GO_VER}" ]; then
+            echo "Failed to determine Go version from go.mod"
+            exit 1
+          fi
 
           # Source tarball — prefix=unitdore-VERSION/ matches RPM %autosetup convention
           git archive --format=tar.gz --prefix=unitdore-${PKGVER}/ HEAD \
@@ -226,19 +281,37 @@ jobs:
           sed -i "s/^Version:.*/Version:        ${PKGVER}/" pkg/centos/unitdore.spec
 
           mkdir -p pkg/centos/out
-          docker run --rm \
-            -v "$PWD:/workspace" \
-            -v "$PWD/pkg/centos/out:/out" \
-            -w /workspace \
+          CID=$(docker create \
+            -e GO_VER="${GO_VER}" \
+            -e PKGVER="${PKGVER}" \
+            -w /build \
             rockylinux:9 \
-            bash -c "
-              dnf install -y rpm-build golang git &&
+            bash -lc "
+              set -euo pipefail
+              # Rocky 9 images already ship curl-minimal, which is enough for the Go tarball download.
+              dnf install -y rpm-build git &&
+              curl -fsSL https://go.dev/dl/go\${GO_VER}.linux-amd64.tar.gz | tar -C /usr/local -xz &&
+              export PATH=\$PATH:/usr/local/go/bin &&
               mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS} &&
               cp unitdore-${PKGVER}.tar.gz ~/rpmbuild/SOURCES/ &&
               cp pkg/centos/unitdore.spec ~/rpmbuild/SPECS/ &&
-              rpmbuild -ba ~/rpmbuild/SPECS/unitdore.spec &&
-              find ~/rpmbuild/RPMS -name '*.rpm' -exec cp {} /out/ \;
-            "
+              rpmbuild --nodeps -ba ~/rpmbuild/SPECS/unitdore.spec
+            ")
+
+          cleanup() {
+            docker rm -f "$CID" >/dev/null 2>&1 || true
+          }
+          trap cleanup EXIT
+
+          # Avoid bind mounts here because DinD runners may not expose the checkout path to the Docker daemon.
+          docker cp unitdore-${PKGVER}.tar.gz "$CID:/build/unitdore-${PKGVER}.tar.gz"
+          docker cp pkg "$CID:/build/pkg"
+
+          docker start -a "$CID"
+          docker cp "$CID:/root/rpmbuild/RPMS/." pkg/centos/out/
+
+          trap - EXIT
+          cleanup
 
       - name: Upload to release
         run: |

.gitignore

@@ -1,2 +1,3 @@
 unitdore
 *.exe
+.codex

go.mod

@@ -1,6 +1,6 @@
 module github.com/warkanum/unitdore
 
-go 1.26.1
+go 1.23.0
 
 require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect

pkg/arch/PKGBUILD

@@ -1,10 +1,10 @@
 # Maintainer: Hein (Warky Devs) <hein@warky.dev>
 pkgname=unitdore
-pkgver=0.1.0
+pkgver=0.0.4
 pkgrel=1
 pkgdesc="A door you open and close for container units — manage containers via systemd"
 arch=('x86_64' 'aarch64')
-url="https://warky.dev"
+url="https://git.warky.dev/wdevs/unitdore"
 license=('MIT')
 depends=('systemd')
 optdepends=(
@@ -12,8 +12,7 @@ optdepends=(
     'docker: Docker container runtime support'
 )
 makedepends=('go')
-backup=('etc/unitdore/units.yaml')
-source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
+source=("$pkgname-$pkgver.zip::$url/archive/v$pkgver.zip")
 sha256sums=('SKIP')
 
 build() {

pkg/centos/unitdore.spec

@@ -4,10 +4,10 @@ Release:        1%{?dist}
 Summary:        Manage container units via systemd
 
 License:        MIT
-URL:            https://warky.dev
+URL:            https://git.warky.dev/wdevs/unitdore
 Source0:        %{name}-%{version}.tar.gz
 
-BuildRequires:  golang >= 1.21
+BuildRequires:  golang >= 1.23
 Requires:       systemd
 
 %description