CI: add GitHub Actions workflow to automate AUR package updates on release

.github/workflows/update-aur-package.yml

@@ -0,0 +1,108 @@
+name: Update AUR Package
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  aur-sync:
+    name: Sync PKGBUILD with release
+    runs-on: ubuntu-latest
+    container:
+      image: archlinux:latest
+    defaults:
+      run:
+        shell: bash
+    env:
+      AUR_REPO: ssh://aur@aur.archlinux.org/noctalia-shell.git
+      GIT_SSH_COMMAND: ssh -i /root/.ssh/id_aur -o StrictHostKeyChecking=yes -o IdentitiesOnly=yes
+      PKGNAME: noctalia-shell
+      AUR_LINK: https://aur.archlinux.org/packages/noctalia-shell
+
+    steps:
+      - name: Install dependencies
+        run: |
+          set -euo pipefail
+          pacman -Syu --noconfirm git base-devel pacman-contrib openssh
+
+      - name: Create build user
+        run: |
+          set -euo pipefail
+          useradd -m builduser
+          echo 'builduser ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+
+      - name: Configure SSH
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+          mkdir -p /root/.ssh
+          chmod 700 /root/.ssh
+          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > /root/.ssh/id_aur
+          chmod 600 /root/.ssh/id_aur
+          ssh-keyscan aur.archlinux.org >> /root/.ssh/known_hosts
+          chmod 600 /root/.ssh/known_hosts
+
+      - name: Determine version
+        id: vars
+        env:
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          PKGVER="${TAG_NAME#v}"
+          echo "pkgver=$PKGVER" >> "$GITHUB_OUTPUT"
+
+      - name: Clone AUR repository
+        run: |
+          set -euo pipefail
+          git clone "$AUR_REPO" "$GITHUB_WORKSPACE/aur"
+
+      - name: Update PKGBUILD
+        env:
+          PKGVER: ${{ steps.vars.outputs.pkgver }}
+        run: |
+          set -euo pipefail
+          cd "$GITHUB_WORKSPACE/aur"
+          sed -i "s/^pkgver=.*/pkgver=${PKGVER}/" PKGBUILD
+          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
+
+      - name: Refresh checksums and metadata
+        run: |
+          set -euo pipefail
+          AUR_DIR="$GITHUB_WORKSPACE/aur"
+          chown -R builduser:builduser "$AUR_DIR"
+          su - builduser -c "cd $AUR_DIR && updpkgsums"
+          su - builduser -c "cd $AUR_DIR && makepkg --printsrcinfo > .SRCINFO"
+
+      - name: Commit and push changes
+        env:
+          PKGVER: ${{ steps.vars.outputs.pkgver }}
+        run: |
+          set -euo pipefail
+          cd "$GITHUB_WORKSPACE/aur"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          if [[ -n "$(git status --porcelain)" ]]; then
+            git add PKGBUILD .SRCINFO
+            git commit -m "chore(package): release ${PKGVER}"
+            git push origin HEAD
+          else
+            echo "No updates necessary."
+          fi
+
+      - name: Summarize update
+        env:
+          PKGNAME: noctalia-shell
+          PKGVER: ${{ steps.vars.outputs.pkgver }}
+          AUR_LINK: https://aur.archlinux.org/packages/noctalia-shell
+        run: |
+          set -euo pipefail
+          {
+            echo "## AUR Update"
+            echo ""
+            echo "- Package: ${PKGNAME}"
+            echo "- Updated version: ${PKGVER}"
+            echo "- AUR page: ${AUR_LINK}"
+          } >> "$GITHUB_STEP_SUMMARY"