Skip to content

fix(release): upload .SRCINFO so the AUR step can find it - #69

Merged
ralyodio merged 1 commit into
mainfrom
worktree-aur-srcinfo
Sep 23, 2026
Merged

ralyodio merged 1 commit into
mainfrom
worktree-aur-srcinfo

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

With a working AUR key, the Submit job got past cloning the AUR repo for the first time, then failed with:

cp: cannot stat 'dist/packaging/aur/.SRCINFO': No such file or directory

actions/upload-artifact skips hidden files by default. The generator does write .SRCINFO, but the artifact silently dropped it: the downloaded v0.2.0 artifact's aur/ folder held only PKGBUILD. This was always broken. Every earlier run failed on the AUR key first, so the job never got as far as this line.

The fix is include-hidden-files: true on the manifests upload.

🤖 Generated with Claude Code

With a working AUR key the Submit job got past the clone for the first time,
and then died on:

  cp: cannot stat 'dist/packaging/aur/.SRCINFO': No such file or directory

upload-artifact skips hidden files by default. The generator writes
.SRCINFO, and the artifact silently dropped it (the downloaded v0.2.0
artifact's aur/ held only PKGBUILD). The AUR key failure on every earlier
run stopped the job before it reached this line.

`include-hidden-files: true` on the manifests upload.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

9 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 5

Severity Rule Location
HIGH manifest-typosquat apps/game/package.json:17
HIGH sh-remote-script-execution apps/site/public/install.sh:210
HIGH sh-remote-script-execution apps/site/public/install.sh:213
HIGH sh-remote-script-execution apps/site/public/install.sh:216
MEDIUM sh-remote-script-execution apps/site/public/install.sh:219
MEDIUM sh-remote-script-execution apps/site/public/install.sh:432
MEDIUM sh-remote-script-execution apps/site/public/install.sh:433
MEDIUM js-path-traversal tools/art/tactical-sample/validate.mjs:6
MEDIUM js-path-traversal tools/art/tactical-sample/validate.mjs:10

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 4f1ba3e into main Sep 23, 2026
7 checks passed
@ralyodio
ralyodio deleted the worktree-aur-srcinfo branch September 23, 2026 16:40
@ralyodio ralyodio mentioned this pull request Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant