From 8c0943e700142ef90f0412105d4e9529c91a78f9 Mon Sep 17 00:00:00 2001
From: Fabio Manganiello <fabio@manganiello.tech>
Date: Tue, 16 Jul 2024 22:03:32 +0200
Subject: [PATCH] [CI/CD] Moved generation of Arch stable package to tag
 events.

Separating the generation of the Arch git package (on each commit to
master) from the generation of the Arch stable package (only on a new
tag) ensures that:

1. The checksum of the package isn't calculated on an older version of
   the archive.

2. The stable version of the package is always exactly aligned with the
   commit associated to the tag.
---
 .drone.yml                                    | 29 ++++++++++++--
 .drone/update-arch-git-package.sh             | 38 +++++++++++++++++++
 ...kages.sh => update-arch-stable-package.sh} | 23 +----------
 3 files changed, 64 insertions(+), 26 deletions(-)
 create mode 100755 .drone/update-arch-git-package.sh
 rename .drone/{update-arch-packages.sh => update-arch-stable-package.sh} (63%)

diff --git a/.drone.yml b/.drone.yml
index 4b2ec3be85..b868bc8c87 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -114,10 +114,10 @@ steps:
     - . .drone/update-components-cache.sh
 
 ###
-### Update the Arch packages
+### Update the Arch git package
 ###
 
-- name: update-arch-packages
+- name: update-arch-git-package
   image: python:3.11-alpine
   environment:
     WORKDIR: /tmp/workdir
@@ -136,7 +136,27 @@ steps:
     - update-components-cache
 
   commands:
-    - . .drone/update-arch-packages.sh
+    - . .drone/update-arch-git-package.sh
+
+###
+### Update the Arch stable package
+###
+
+- name: update-arch-stable-package
+  image: python:3.11-alpine
+  environment:
+    WORKDIR: /tmp/workdir
+    SSH_PUBKEY:
+      from_secret: ssh_pubkey
+    SSH_PRIVKEY:
+      from_secret: ssh_privkey
+
+  when:
+    event:
+      - tag
+
+  commands:
+    - . .drone/update-arch-stable-package.sh
 
 ###
 ### Update the Debian (stable) packages
@@ -325,7 +345,7 @@ steps:
       - push
 
   depends_on:
-    - update-arch-packages
+    - update-arch-git-package
     - update-rpm-repo
     - update-apt-repo
 
@@ -348,6 +368,7 @@ steps:
 
   depends_on:
     - update-pip-package
+    - update-arch-stable-package
 
   commands:
     - apk add --update --no-cache curl
diff --git a/.drone/update-arch-git-package.sh b/.drone/update-arch-git-package.sh
new file mode 100755
index 0000000000..3a39f15043
--- /dev/null
+++ b/.drone/update-arch-git-package.sh
@@ -0,0 +1,38 @@
+#!/bin/sh
+
+[ -f .skipci ] && exit 0
+
+apk add --update --no-cache curl pacman sudo
+
+. .drone/macros/configure-ssh.sh
+. .drone/macros/configure-git.sh
+
+git pull --rebase origin master --tags
+
+export VERSION=$(python setup.py --version)
+export HEAD=$(git log --pretty=format:%h HEAD...HEAD~1 | head -1)
+export GIT_VERSION="$VERSION.r$(git log --pretty=oneline HEAD...v$VERSION | wc -l).g${HEAD}"
+
+ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
+adduser -u 1000 -D build
+mkdir -p "$WORKDIR"
+
+echo "--- Updating Arch git version"
+export PKGDIR=$WORKDIR/git
+git clone ssh://aur@aur.archlinux.org/platypush-git.git "$PKGDIR"
+git config --global --add safe.directory "$PKGDIR"
+chown -R build "$PKGDIR"
+cd "$PKGDIR"
+
+sed -i 'PKGBUILD' -r \
+  -e "s/^pkgver=.*/pkgver=$GIT_VERSION/" \
+  -e "s/^pkgrel=.*/pkgrel=1/" \
+
+sudo -u build makepkg --printsrcinfo > .SRCINFO
+export FILES_CHANGED=$(git status --porcelain --untracked-files=no | wc -l)
+
+if [ $FILES_CHANGED -gt 0 ]; then
+  echo "--- Pushing git package version $GIT_VERSION"
+  git commit -a -m '[Automatic] Package update'
+  git push origin master
+fi
diff --git a/.drone/update-arch-packages.sh b/.drone/update-arch-stable-package.sh
similarity index 63%
rename from .drone/update-arch-packages.sh
rename to .drone/update-arch-stable-package.sh
index 695cdf5801..7def064545 100755
--- a/.drone/update-arch-packages.sh
+++ b/.drone/update-arch-stable-package.sh
@@ -10,34 +10,12 @@ apk add --update --no-cache curl pacman sudo
 git pull --rebase origin master --tags
 
 export VERSION=$(python setup.py --version)
-export HEAD=$(git log --pretty=format:%h HEAD...HEAD~1 | head -1)
-export GIT_VERSION="$VERSION.r$(git log --pretty=oneline HEAD...v$VERSION | wc -l).g${HEAD}"
 export TAG_URL="https://git.platypush.tech/platypush/platypush/archive/v$VERSION.tar.gz"
 
 ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
 adduser -u 1000 -D build
 mkdir -p "$WORKDIR"
 
-echo "--- Updating Arch git version"
-export PKGDIR=$WORKDIR/git
-git clone ssh://aur@aur.archlinux.org/platypush-git.git "$PKGDIR"
-git config --global --add safe.directory "$PKGDIR"
-chown -R build "$PKGDIR"
-cd "$PKGDIR"
-
-sed -i 'PKGBUILD' -r \
-  -e "s/^pkgver=.*/pkgver=$GIT_VERSION/" \
-  -e "s/^pkgrel=.*/pkgrel=1/" \
-
-sudo -u build makepkg --printsrcinfo > .SRCINFO
-export FILES_CHANGED=$(git status --porcelain --untracked-files=no | wc -l)
-
-if [ $FILES_CHANGED -gt 0 ]; then
-  echo "--- Pushing git package version $GIT_VERSION"
-  git commit -a -m '[Automatic] Package update'
-  git push origin master
-fi
-
 echo "--- Updating Arch stable version"
 export PKGDIR="$WORKDIR/stable"
 git clone ssh://aur@aur.archlinux.org/platypush.git "$PKGDIR"
@@ -47,6 +25,7 @@ cd "$PKGDIR"
 export RELEASED_VERSION=$(grep -e '^pkgver=' PKGBUILD | sed -r -e 's/^pkgver=(.*)\s*/\1/')
 
 if [ "$RELEASED_VERSION" == "$VERSION" ]; then
+  echo "--- No changes in the stable package version"
   exit 0
 fi