Packaged for the [uhhm] Arch registry, like every other uhhm binary

PKGBUILD from the tagged checkout (tag must equal pkgver), built per
architecture by the release workflow: x86_64 on ergo's bare runner,
aarch64 on klokka's, uploaded to project.uhhm.no/api/packages/bl/arch/
uhhm with the REGISTRY_TOKEN repo secret. The package ships /usr/bin/
gdo, gdo.service and an /etc/gdo/env template; the installer script is
gone. !lto: makepkg's -flto hid ring's C symbols from the Rust linker.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

.gitea/workflows/publish.yml

@@ -1,46 +1,94 @@
 name: Publish release
 
-# A `v*` tag builds the binary and attaches it to the Gitea release as
-# `gdo`, with the tag's CHANGELOG.md section as the notes. Hosts
-# install it with deploy/install.sh.
+# A `v*` tag builds the package on each architecture's own runner
+# (x86_64 on ergo's bare runner, aarch64 on klokka's) and uploads it
+# to the [uhhm] Arch registry, like uhhm/corp and cnats. Hosts then
+# `pacman -S gdo`. The tag has to agree with PKGBUILD's pkgver, and
+# CHANGELOG.md has to have the section; a release with the tag's notes
+# is created from the x86_64 job for the record, with no asset.
 
 on:
   push:
     tags: ["v*"]
 
 jobs:
-  publish:
-    runs-on: bare
+  package:
+    strategy:
+      matrix:
+        include:
+          - arch: x86_64
+            runs-on: bare
+            # The bare runner's shared toolchain and caches, with the
+            # writable cargo home uhhm/iris uses.
+            cargo_home: /var/local/cargo-target/iris-cargo-home
+            rustc_wrapper: /usr/bin/sccache
+            rustup_home: /var/local/rustup
+            target_dir: /var/local/cargo-target
+          - arch: aarch64
+            runs-on: aarch64
+            # klokka's host runner: the system cargo, defaults everywhere.
+            cargo_home: ""
+            rustc_wrapper: ""
+            rustup_home: ""
+            target_dir: ""
+    runs-on: ${{ matrix.runs-on }}
     env:
-      CARGO_HOME: /var/local/cargo-target/iris-cargo-home
-      RUSTC_WRAPPER: /usr/bin/sccache
-      RUSTUP_HOME: /var/local/rustup
+      CARGO_HOME: ${{ matrix.cargo_home }}
+      RUSTC_WRAPPER: ${{ matrix.rustc_wrapper }}
+      RUSTUP_HOME: ${{ matrix.rustup_home }}
+      CARGO_TARGET_DIR: ${{ matrix.target_dir }}
       PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
       SCCACHE_DIR: /var/local/sccache
       SCCACHE_SERVER_PORT: "4228"
-      CARGO_TARGET_DIR: /var/local/cargo-target
     steps:
-      - uses: actions/checkout@v4
+      # Plain git: the aarch64 host runner has no Node.js for
+      # actions/checkout (same as uhhm/corp).
+      - name: Checkout
+        run: |
+          git init -q .
+          git fetch -q --depth 1 "https://ci:${{ gitea.token }}@${GITEA_SERVER#https://}/${{ gitea.repository }}.git" "${{ gitea.sha }}"
+          git checkout -q FETCH_HEAD
+        env:
+          GITEA_SERVER: ${{ gitea.server_url }}
 
-      - name: Build
-        run: cargo build --release && cargo test --release
+      - name: Check tag matches pkgver
+        run: |
+          want="${GITHUB_REF_NAME#v}"
+          have=$(sed -n 's/^pkgver=//p' PKGBUILD)
+          [ "$want" = "$have" ] || { echo "tag $GITHUB_REF_NAME != pkgver $have" >&2; exit 1; }
+          notes=$(awk -v v="$want" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
+          [ -n "$(printf "%s" "$notes" | tr -d "[:space:]")" ] || { echo "CHANGELOG.md has no section for $GITHUB_REF_NAME" >&2; exit 1; }
 
-      - name: Publish release
+      # -d: cargo is the shared toolchain, not a pacman package the
+      # runner could verify. Builds and tests from the checkout. Empty
+      # env values above are unset here so cargo's defaults apply.
+      - name: Build package
+        run: |
+          for v in CARGO_HOME RUSTC_WRAPPER RUSTUP_HOME CARGO_TARGET_DIR; do
+            eval "[ -n \"\$$v\" ]" || unset "$v"
+          done
+          makepkg -f -d --noconfirm
+
+      # REGISTRY_TOKEN is a write:package token for bl, a secret on this
+      # repo (org repos do not inherit bl's). The registry namespace is
+      # always bl: pacman.conf's [uhhm] points at /api/packages/bl/arch/uhhm.
+      - name: Publish to the Arch package registry
+        run: |
+          for pkg in $(makepkg --packagelist); do
+            echo "==> $pkg"
+            curl --fail-with-body --user "bl:${{ secrets.REGISTRY_TOKEN }}" \
+              --upload-file "$pkg" \
+              "${{ gitea.server_url }}/api/packages/bl/arch/uhhm"
+          done
+
+      - name: Release notes
+        if: matrix.arch == 'x86_64'
         run: |
           set -euo pipefail
           tag="${{ github.ref_name }}"
           api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
           auth="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
           notes=$(awk -v v="${tag#v}" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
-          [ -n "$(printf "%s" "$notes" | tr -d "[:space:]")" ] || { echo "CHANGELOG.md has no section for $tag"; exit 1; }
           body=$(jq -n --arg tag "$tag" --arg notes "$notes" '{tag_name: $tag, name: $tag, body: $notes}')
-          id=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
-            -d "$body" "$api/releases" | jq .id) \
-            || id=$(curl -sf -H "$auth" "$api/releases/tags/$tag" | jq .id)
-          for aid in $(curl -sf -H "$auth" "$api/releases/$id/assets" | jq '.[].id'); do
-            curl -sf -X DELETE -H "$auth" "$api/releases/$id/assets/$aid"
-          done
-          curl -sf -X POST -H "$auth" \
-            -F "attachment=@/var/local/cargo-target/release/gdo" \
-            "$api/releases/$id/assets?name=gdo" > /dev/null
-          echo "published $tag"
+          curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' -d "$body" "$api/releases" > /dev/null \
+            || echo "release $tag exists"