Cloud RunとR2で自分用のPacmanリポジトリを構築する

export PROJECT_ID="your-gcp-project-id"
gcloud auth login
gcloud auth application-default login
gcloud config set project "${PROJECT_ID}"

gh repo create OWNER/pacman-repo --public --clone
cd pacman-repo
 
terraform_source="$(mktemp -d)"
git clone https://github.com/FascodeNet/alterlinux-terraform.git "${terraform_source}"
git -C "${terraform_source}" checkout 3329bf0163e6abcaf913e7fc1e0c9df3c3ccfddf
cp -R "${terraform_source}/bootstrap" "${terraform_source}/terraform" .
rm -rf -- "${terraform_source:?}"

.terraform/
*.tfstate
*.tfstate.*
*.tfvars
*.tfvars.json
backend.hcl
gha-creds-*.json
out/*
!out/.gitkeep

{
  "builder": {
    "backend": "chroot",
    "devtools": {
      "archbuild": "extra-x86_64-build"
    }
  },
  "repos": [
    {
      "dir": "./personal",
      "destdir": "./out"
    }
  ]
}

{
  "name": "personal",
  "maintainer": "Your Name <you@example.com>",
  "url": "https://repo.example.com/repo/personal",
  "build": {
    "repos": [
      {
        "name": "personal",
        "server": "https://repo.example.com/repo/$repo/$arch"
      }
    ],
    "arches": {
      "x86_64": {}
    },
    "image": "ghcr.io/hayao0819/archlinux:$arch",
    "makepkg": {
      "packager": "Your Name <you@example.com>"
    }
  }
}

mkdir -p personal/example-package out
touch out/.gitkeep
cp /path/to/PKGBUILD personal/example-package/PKGBUILD
cd personal/example-package
makepkg --printsrcinfo >.SRCINFO
cd ../..

./bootstrap/bootstrap.sh "${PROJECT_ID}" asia-northeast1

bucket = "your-gcp-project-id-tfstate"
prefix = "ayato"

gh api repos/OWNER/pacman-repo --jq '.id'

project_id           = "your-gcp-project-id"
region               = "asia-northeast1"
github_repository_id = "123456789"

locals {
  services = [
    "cloudresourcemanager.googleapis.com",
    "serviceusage.googleapis.com",
    "iam.googleapis.com",
    "iamcredentials.googleapis.com",
    "sts.googleapis.com",
    "storage.googleapis.com",
  ]
}

resource "google_service_account" "terraform_deploy" {
  account_id   = "terraform-deploy"
  display_name = "Terraform deploy from GitHub Actions"
 
  depends_on = [google_project_service.this]
}
 
locals {
  terraform_deploy_roles = toset([
    "roles/iam.serviceAccountAdmin",
    "roles/iam.serviceAccountUser",
    "roles/run.admin",
    "roles/secretmanager.admin",
    "roles/serviceusage.serviceUsageAdmin",
  ])
}
 
resource "google_project_iam_member" "terraform_deploy" {
  for_each = local.terraform_deploy_roles
 
  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.terraform_deploy.email}"
}
 
resource "google_storage_bucket_iam_member" "terraform_state" {
  bucket = "${var.project_id}-tfstate"
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:${google_service_account.terraform_deploy.email}"
}
 
resource "google_iam_workload_identity_pool" "github" {
  workload_identity_pool_id = "github"
  display_name              = "GitHub Actions"
 
  depends_on = [google_project_service.this]
}
 
resource "google_iam_workload_identity_pool_provider" "pacman_repo" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = "pacman-repo"
  display_name                       = "pacman-repo"
 
  attribute_mapping = {
    "google.subject"          = "assertion.sub"
    "attribute.repository_id" = "assertion.repository_id"
    "attribute.ref"           = "assertion.ref"
  }
  attribute_condition = "assertion.repository_id == '${var.github_repository_id}' && assertion.ref == 'refs/heads/main'"
 
  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}
 
resource "google_service_account_iam_member" "github_actions" {
  service_account_id = google_service_account.terraform_deploy.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository_id/${var.github_repository_id}"
}

variable "github_repository_id" {
  description = "Numeric GitHub repository ID allowed to run Terraform."
  type        = string
}

output "workload_identity_provider" {
  value = google_iam_workload_identity_pool_provider.pacman_repo.name
}
 
output "terraform_deploy_service_account" {
  value = google_service_account.terraform_deploy.email
}

terraform -chdir=terraform/gcp init -backend-config=backend.hcl
terraform -chdir=terraform/gcp plan
terraform -chdir=terraform/gcp apply

gh variable set GCP_PROJECT_ID --repo OWNER/pacman-repo --body "${PROJECT_ID}"
gh variable set TF_STATE_BUCKET --repo OWNER/pacman-repo --body "${PROJECT_ID}-tfstate"
terraform -chdir=terraform/gcp output -raw workload_identity_provider \
  | gh variable set GCP_WORKLOAD_IDENTITY_PROVIDER --repo OWNER/pacman-repo
terraform -chdir=terraform/gcp output -raw terraform_deploy_service_account \
  | gh variable set GCP_SERVICE_ACCOUNT --repo OWNER/pacman-repo

project_id         = "your-gcp-project-id"
region             = "asia-northeast1"
ayato_image_repo   = "docker.io/hayao0819/kamisato"
ayato_image_tag    = "sha-b0f4d89743f68070e72802533a916e56e1e921bc"
ayato_domains      = ["repo.example.com"]
auth_public_origin = "https://packages.example.com"
 
ayato_repos = [
  { name = "personal", arches = ["x86_64"] },
]
 
cloudflare_account_id = "your-cloudflare-account-id"
r2_bucket_name        = "personal-pacman-packages"
r2_access_key_id      = "your-r2-access-key-id"
r2_secret_access_key  = "your-r2-secret-access-key"
cfkv_namespace_id     = "your-workers-kv-namespace-id"
cfkv_token            = "your-workers-kv-api-token"

locals {
  ci_api_keys_json = jsonencode([{
    name          = "pacman-repo"
    key           = random_password.ci_api_key.result
    publish_repos = [for r in var.ayato_repos : r.name]
  }])
}

terraform -chdir=terraform/ayato init -backend-config=backend.hcl
terraform -chdir=terraform/ayato plan
terraform -chdir=terraform/ayato apply

terraform -chdir=terraform/ayato output -json domain_mapping_dns
terraform -chdir=terraform/ayato output -raw ci_api_key \
  | gh secret set AYATO_TOKEN --repo OWNER/pacman-repo
gh variable set AYATO_URL --repo OWNER/pacman-repo --body "https://repo.example.com"

cloudflare_account_id = "your-cloudflare-account-id"
cloudflare_zone_id    = "your-zone-id"
cloudflare_api_token  = "your-pages-and-dns-api-token"
pages_project_name    = "personal-packages"
lumine_domain         = "packages.example.com"

terraform -chdir=terraform/lumine init -backend-config=backend.hcl
terraform -chdir=terraform/lumine plan
terraform -chdir=terraform/lumine apply

name: Deploy
 
on:
  workflow_dispatch:
    inputs:
      ref:
        description: "配置するKamisatoのref"
        default: b0f4d89743f68070e72802533a916e56e1e921bc
 
concurrency:
  group: deploy
  cancel-in-progress: false
 
permissions:
  contents: read
  id-token: write
 
env:
  KAMISATO_REPO: Hayao0819/Kamisato
  PAGES_PROJECT: personal-packages
  AYATO_URL: https://repo.example.com
 
jobs:
  resolve:
    runs-on: ubuntu-latest
    outputs:
      sha: ${{ steps.resolve.outputs.sha }}
    steps:
      - id: resolve
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sha=$(gh api "repos/${KAMISATO_REPO}/commits/${{ inputs.ref }}" --jq .sha)
          echo "sha=${sha}" >>"${GITHUB_OUTPUT}"
 
  terraform:
    needs: resolve
    runs-on: ubuntu-latest
    env:
      TF_VAR_ayato_image_tag: sha-${{ needs.resolve.outputs.sha }}
      TF_VAR_project_id: ${{ vars.GCP_PROJECT_ID }}
      TF_VAR_cloudflare_account_id: ${{ vars.CF_ACCOUNT_ID }}
      TF_VAR_cloudflare_zone_id: ${{ vars.CLOUDFLARE_ZONE_ID }}
      TF_VAR_cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      TF_VAR_r2_access_key_id: ${{ secrets.R2_ACCESS_KEY_ID }}
      TF_VAR_r2_secret_access_key: ${{ secrets.R2_SECRET_ACCESS_KEY }}
      TF_VAR_cfkv_namespace_id: ${{ vars.CFKV_NAMESPACE_ID }}
      TF_VAR_cfkv_token: ${{ secrets.CFKV_TOKEN }}
      TF_VAR_r2_bucket_name: personal-pacman-packages
      TF_VAR_ayato_domains: '["repo.example.com"]'
      TF_VAR_auth_public_origin: https://packages.example.com
      TF_VAR_ayato_repos: '[{"name":"personal","arches":["x86_64"]}]'
      TF_VAR_pages_project_name: personal-packages
      TF_VAR_lumine_domain: packages.example.com
    steps:
      - uses: actions/checkout@v7
      - uses: google-github-actions/auth@v3
        with:
          project_id: ${{ vars.GCP_PROJECT_ID }}
          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_wrapper: false
      - name: Apply ayato
        working-directory: terraform/ayato
        run: |
          terraform init -input=false \
            -backend-config="bucket=${{ vars.TF_STATE_BUCKET }}" \
            -backend-config="prefix=ayato"
          terraform apply -input=false -auto-approve
      - name: Apply lumine
        working-directory: terraform/lumine
        run: |
          terraform init -input=false \
            -backend-config="bucket=${{ vars.TF_STATE_BUCKET }}" \
            -backend-config="prefix=lumine"
          terraform apply -input=false -auto-approve
 
  lumine:
    needs: [resolve, terraform]
    runs-on: ubuntu-latest
    steps:
      - id: build
        uses: Hayao0819/Kamisato/actions/build-lumine@b0f4d89743f68070e72802533a916e56e1e921bc
        with:
          ayato_url: ${{ env.AYATO_URL }}
          auth_mode: bearer
          ref: ${{ needs.resolve.outputs.sha }}
      - uses: cloudflare/wrangler-action@v4
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ vars.CF_ACCOUNT_ID }}
          command: >-
            pages deploy ${{ steps.build.outputs.dir }}
            --project-name=${{ env.PAGES_PROJECT }}
            --branch=main

gh variable set CF_ACCOUNT_ID --repo OWNER/pacman-repo --body "your-cloudflare-account-id"
gh variable set CLOUDFLARE_ZONE_ID --repo OWNER/pacman-repo --body "your-zone-id"
gh variable set CFKV_NAMESPACE_ID --repo OWNER/pacman-repo --body "your-workers-kv-namespace-id"
 
gh secret set CLOUDFLARE_API_TOKEN --repo OWNER/pacman-repo
gh secret set R2_ACCESS_KEY_ID --repo OWNER/pacman-repo
gh secret set R2_SECRET_ACCESS_KEY --repo OWNER/pacman-repo
gh secret set CFKV_TOKEN --repo OWNER/pacman-repo

name: Build and publish
 
on:
  push:
    branches: [main]
    paths: ["personal/**"]
  workflow_dispatch:
    inputs:
      packages:
        description: "再ビルドするpkgbaseを空白区切りで指定"
        required: false
        default: ""
      all:
        description: "すべてのパッケージを再ビルド"
        type: boolean
        required: false
        default: false
 
permissions:
  contents: write
 
concurrency:
  group: build-${{ github.ref }}
 
jobs:
  plan:
    runs-on: ubuntu-latest
    outputs:
      build_matrix: ${{ steps.plan.outputs.build_matrix }}
      prune_matrix: ${{ steps.plan.outputs.prune_matrix }}
      bumps: ${{ steps.plan.outputs.bumps }}
      any_build: ${{ steps.plan.outputs.any_build }}
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive
          fetch-depth: 0
      - uses: actions/setup-go@v7
        with:
          go-version: "1.x"
          cache: false
      - uses: Hayao0819/Kamisato/actions/install@b0f4d89743f68070e72802533a916e56e1e921bc
        with:
          ayaka: "true"
          version: b0f4d89743f68070e72802533a916e56e1e921bc
      - id: plan
        uses: Hayao0819/Kamisato/actions/plan@b0f4d89743f68070e72802533a916e56e1e921bc
        with:
          server: ${{ vars.AYATO_URL }}
          packages: ${{ github.event.inputs.packages }}
          all: ${{ github.event.inputs.all }}
          workers: 4
 
  bump:
    needs: plan
    if: needs.plan.outputs.bumps != '{}'
    runs-on: ubuntu-latest
    container: archlinux:latest
    outputs:
      sha: ${{ steps.bump.outputs.sha }}
    steps:
      - name: Install tooling
        run: pacman -Syu --noconfirm base-devel git go sudo jq
      - uses: actions/checkout@v7
        with:
          submodules: recursive
          fetch-depth: 0
      - uses: Hayao0819/Kamisato/actions/install@b0f4d89743f68070e72802533a916e56e1e921bc
        with:
          ayaka: "true"
          version: b0f4d89743f68070e72802533a916e56e1e921bc
      - id: bump
        uses: Hayao0819/Kamisato/actions/bump@b0f4d89743f68070e72802533a916e56e1e921bc
        with:
          bumps: ${{ needs.plan.outputs.bumps }}
          ref: main
 
  build:
    needs: [plan, bump]
    if: >-
      always() &&
      needs.plan.result == 'success' &&
      needs.plan.outputs.any_build == 'true' &&
      (needs.bump.result == 'success' || needs.bump.result == 'skipped')
    runs-on: ubuntu-latest
    timeout-minutes: 355
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.plan.outputs.build_matrix) }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.bump.outputs.sha || github.sha }}
          submodules: recursive
          fetch-depth: 0
      - uses: actions/setup-go@v7
        with:
          go-version: "1.x"
          cache: false
      - uses: Hayao0819/Kamisato/actions/install@b0f4d89743f68070e72802533a916e56e1e921bc
        with:
          ayaka: "true"
          version: b0f4d89743f68070e72802533a916e56e1e921bc
      - name: Build and publish packages
        uses: Hayao0819/Kamisato/actions/build@b0f4d89743f68070e72802533a916e56e1e921bc
        with:
          server: ${{ vars.AYATO_URL }}
          repo: ${{ matrix.repo }}
          arch: ${{ matrix.arch }}
          pkgs: ${{ matrix.pkgs }}
          api_key: ${{ secrets.AYATO_TOKEN }}
 
  prune:
    needs: [plan, bump, build]
    if: >-
      always() &&
      needs.plan.result == 'success' &&
      needs.build.result != 'failure' &&
      needs.build.result != 'cancelled'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.plan.outputs.prune_matrix) }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.bump.outputs.sha || github.sha }}
          submodules: recursive
          fetch-depth: 0
      - uses: actions/setup-go@v7
        with:
          go-version: "1.x"
          cache: false
      - uses: Hayao0819/Kamisato/actions/install@b0f4d89743f68070e72802533a916e56e1e921bc
        with:
          ayaka: "true"
          version: b0f4d89743f68070e72802533a916e56e1e921bc
      - name: Prune removed packages
        uses: Hayao0819/Kamisato/actions/prune@b0f4d89743f68070e72802533a916e56e1e921bc
        with:
          server: ${{ vars.AYATO_URL }}
          repo: ${{ matrix.repo }}
          arch: ${{ matrix.arch }}
          api_key: ${{ secrets.AYATO_TOKEN }}

name: Check .SRCINFO
 
on:
  pull_request:
    paths: ["personal/**"]
  push:
    branches: [main]
    paths: ["personal/**"]
 
permissions:
  contents: read
 
jobs:
  srcinfo:
    uses: Hayao0819/Kamisato/.github/workflows/srcinfo-check.yml@b0f4d89743f68070e72802533a916e56e1e921bc
    with:
      repos: personal
      version: b0f4d89743f68070e72802533a916e56e1e921bc

name: Update upstream versions
 
on:
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch: {}
 
permissions:
  contents: write
  actions: write
 
concurrency:
  group: build-refs/heads/main
 
jobs:
  update:
    uses: Hayao0819/Kamisato/.github/workflows/upstream-update.yml@b0f4d89743f68070e72802533a916e56e1e921bc
    with:
      version: b0f4d89743f68070e72802533a916e56e1e921bc
      ref: main

git add .
git commit -m "feat: Add initial repository configuration"
git branch -M main
git push -u origin main

curl --fail --show-error https://repo.example.com/health

curl --fail --location --output /dev/null \
  --write-out '%{http_code}\n' \
  https://repo.example.com/repo/personal/x86_64/personal.db

[personal]
SigLevel = Optional TrustAll
Server = https://repo.example.com/repo/$repo/$arch

sudo pacman -Syu
pacman -Sl personal