+ - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0

+ go-version-file: go.mod

+ - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1

+ with:

+ mirror: https://pkg.earth/zig # maintained by mirum author

+ version: 0.16.0 # keep in sync with build.zig.zon

+

+ - name: Install tools

+ run: |

+ echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list

+ sudo apt update && sudo apt install nfpm apt-utils rclone createrepo-c

+ sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin

+ curl -sSL "https://github.com/bufbuild/buf/releases/download/v1.67.0/buf-$(uname -s)-$(uname -m)" -o /usr/local/bin/buf && chmod +x /usr/local/bin/buf

+ task publish:repos \

+ CHANNEL=$CHANNEL \

+ S3_BUCKET=${{ vars.S3_BUCKET }} \

+ S3_PUBLIC_URL=${{ vars.S3_PUBLIC_URL }} \

+ S3_PROVIDER="${{ vars.S3_PROVIDER || 'Other' }}" \

+ S3_REGION=${{ vars.S3_REGION }} \

+ S3_ENDPOINT=${{ vars.S3_ENDPOINT }} \

+ GPG_KEY_ID=${{ vars.GPG_KEY_ID }}

+curl -fsSL https://dl.mirum.dev/public.gpg | sudo gpg --dearmor -o /usr/share/keyrings/mirum.gpg

+echo "deb [signed-by=/usr/share/keyrings/mirum.gpg] https://dl.mirum.dev/apt/ nightly main" | sudo tee /etc/apt/sources.list.d/mirum.list

+sudo dnf config-manager addrepo --from-repofile=https://dl.mirum.dev/rpm/nightly/mirum-nightly.repo

+sudo curl -o /etc/yum.repos.d/mirum-nightly.repo https://dl.mirum.dev/rpm/nightly/mirum-nightly.repo

+sudo rpm --import https://dl.mirum.dev/public.gpg

+sudo zypper addrepo https://dl.mirum.dev/rpm/nightly/ mirum-nightly

+No repository yet — grab the signing key and the signed `.apk` from the nightly

+release:

+

+sudo wget -O /etc/apk/keys/mirum.rsa.pub https://dl.mirum.dev/mirum.rsa.pub

+

+# Download the .apk for your arch from

+# https://github.com/dimidiumlabs/mirum/releases/tag/nightly

+sudo apk add ./mirum_<version>_<arch>.apk

+ if [ "$os" = "windows" ]; then

+ (cd "$staging" && zip -qr "$OLDPWD/{{.DIST_DIR}}/mirum-${target}.zip" .)

+ else

+ tar -czf "{{.DIST_DIR}}/mirum-${target}.tar.gz" -C "$staging" .

+ fi

+ cleanup() { rm -rf "$GNUPGHOME" /tmp/mirum-signing.asc /tmp/mirum-apk.rsa 2>/dev/null; }

+ trap cleanup EXIT

+

+ if [ -n "${GPG_PRIVATE_KEY:-}" ]; then

+ export GNUPGHOME=$(mktemp -d)

+ chmod 700 "$GNUPGHOME"

+ printf '%s' "$GPG_PRIVATE_KEY" > /tmp/mirum-signing.asc

+ chmod 600 /tmp/mirum-signing.asc

+ gpg --batch --yes --passphrase "$GPG_PASSPHRASE" --import /tmp/mirum-signing.asc

+ export GPG_KEY_ID="{{.GPG_KEY_ID}}"

+ export SIGNING_PRIVATE_KEY="/tmp/mirum-signing.asc"

+ export NFPM_PASSPHRASE="$GPG_PASSPHRASE"

+ fi

+

+ if [ -n "${APK_PRIVATE_KEY:-}" ]; then

+ printf '%s' "$APK_PRIVATE_KEY" > /tmp/mirum-apk.rsa

+ chmod 600 /tmp/mirum-apk.rsa

+ export APK_SIGNING_KEY="/tmp/mirum-apk.rsa"

+ openssl rsa -in /tmp/mirum-apk.rsa -pubout -out "{{.DIST_DIR}}/mirum.rsa.pub"

+ fi

+

+ ARCH=$arch nfpm package --packager deb --target {{.DIST_DIR}}/

+ ARCH=$arch nfpm package --packager rpm --target {{.DIST_DIR}}/

+ ARCH=$arch nfpm package --packager apk --target {{.DIST_DIR}}/

+ publish:repos:

+ desc: Publish packages to APT and RPM repositories on S3

+ requires:

+ vars:

+ [

+ CHANNEL,

+ S3_BUCKET,

+ S3_PUBLIC_URL,

+ S3_PROVIDER,

+ S3_REGION,

+ S3_ENDPOINT,

+ GPG_KEY_ID,

+ ]

+ cmds:

+ - |

+ set -e

+ export GNUPGHOME=$(mktemp -d)

+ RCLONE_CONF=$(mktemp)

+ chmod 700 "$GNUPGHOME"

+ cleanup() { rm -rf "$GNUPGHOME" "$RCLONE_CONF"; }

+ trap cleanup EXIT

+

+ cat > "$RCLONE_CONF" << EOF

+ [s3]

+ type = s3

+ provider = {{.S3_PROVIDER}}

+ access_key_id = ${S3_ACCESS_KEY_ID}

+ secret_access_key = ${S3_SECRET_ACCESS_KEY}

+ region = {{.S3_REGION}}

+ endpoint = {{.S3_ENDPOINT}}

+ EOF

+ export RCLONE_CONFIG="$RCLONE_CONF"

+

+ printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --import

+ echo "allow-loopback-pinentry" >> "$GNUPGHOME/gpg-agent.conf"

+ gpgconf --kill gpg-agent

+

+ # Upload static files

+ gpg --export --armor "{{.GPG_KEY_ID}}" > "$GNUPGHOME/public.gpg"

+ rclone copyto "$GNUPGHOME/public.gpg" "s3:{{.S3_BUCKET}}/public.gpg"

+ rclone copy packaging/dl/ "s3:{{.S3_BUCKET}}/"

+

+ if [ -f "{{.DIST_DIR}}/mirum.rsa.pub" ]; then

+ rclone copyto "{{.DIST_DIR}}/mirum.rsa.pub" "s3:{{.S3_BUCKET}}/mirum.rsa.pub"

+ fi

+

+ # APT repository

+ CHANNEL={{.CHANNEL}}

+ mkdir -p /tmp/apt-cache apt-repo

+ rclone copy "s3:{{.S3_BUCKET}}/apt/" apt-repo/

+

+ for ch in stable nightly; do

+ mkdir -p apt-repo/pool/$ch

+ for arch in {{.LINUX_PKG_TARGETS}}; do

+ mkdir -p apt-repo/dists/$ch/main/binary-$arch

+ done

+ done

+ cp {{.DIST_DIR}}/*.deb apt-repo/pool/$CHANNEL/

+

+ cd apt-repo

+ apt-ftparchive generate "$(pwd)/../packaging/apt-ftparchive.conf"

+ apt-ftparchive \

+ -o APT::FTPArchive::Release::Codename=$CHANNEL \

+ -o APT::FTPArchive::Release::Components=main \

+ -o APT::FTPArchive::Release::Architectures="{{.LINUX_PKG_TARGETS}}" \

+ release dists/$CHANNEL/ > dists/$CHANNEL/Release

+ gpg --default-key="{{.GPG_KEY_ID}}" --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" -abs -o dists/$CHANNEL/Release.gpg dists/$CHANNEL/Release

+ gpg --default-key="{{.GPG_KEY_ID}}" --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --clearsign -o dists/$CHANNEL/InRelease dists/$CHANNEL/Release

+ cd ..

+ rclone copy apt-repo/ "s3:{{.S3_BUCKET}}/apt/" --progress

+

+ # RPM repository

+ mkdir -p rpm-repo

+ rclone copy "s3:{{.S3_BUCKET}}/rpm/$CHANNEL/" rpm-repo/

+

+ cp {{.DIST_DIR}}/*.rpm rpm-repo/

+

+ createrepo_c --update rpm-repo/

+ gpg --default-key="{{.GPG_KEY_ID}}" --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --detach-sign --armor rpm-repo/repodata/repomd.xml

+

+ cat > rpm-repo/mirum-${CHANNEL}.repo << REPOEOF

+ [mirum-${CHANNEL}]

+ name=Mirum ${CHANNEL}

+ gpgkey={{.S3_PUBLIC_URL}}/public.gpg

+ baseurl={{.S3_PUBLIC_URL}}/rpm/${CHANNEL}/

+ enabled=1

+ gpgcheck=1

+ REPOEOF

+

+ rclone copy rpm-repo/ "s3:{{.S3_BUCKET}}/rpm/$CHANNEL/" --progress

+

+ gh release create "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.rsa.pub {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS \

+ || gh release upload "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.rsa.pub {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS --clobber

+ "git::https://github.com/dimidiumlabs/infra.git//tasks?ref=1934f5fb264ab046031d5d1b61227de2e1f8dde9",

+ # nfpm appends ".rsa.pub" to this value when embedding the signature;

+ # clients must install the public key as /etc/apk/keys/mirum.rsa.pub.

+ key_name: mirum

+// SPDX-FileCopyrightText: 2026 Nikolay Govorov

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+Dir {

+ ArchiveDir ".";

+ CacheDir "/tmp/apt-cache";

+};

+

+Default {

+ Packages::Compress ". gzip";

+ Packages::Extensions ".deb";

+};

+

+TreeDefault {

+ Packages "$(DIST)/$(SECTION)/binary-$(ARCH)/Packages";

+ BinCacheDB "packages-$(DIST)-$(ARCH).db";

+};

+

+Tree "dists/stable" {

+ Sections "main";

+ Architectures "amd64 arm64 riscv64 ppc64le";

+ Directory "pool/stable";

+};

+

+Tree "dists/nightly" {

+ Sections "main";

+ Architectures "amd64 arm64 riscv64 ppc64le";

+ Directory "pool/nightly";

+};