build_updated_packages.yml

name: Build updated packages
on:
  push:
    paths-ignore:
      - '.github/workflows/**'
      - 'keyring.asc'
permissions:
  id-token: write
  contents: read
  attestations: write

jobs:
  evaluate:
    name: Evaluate changed packages
    runs-on: ubuntu-22.04
    outputs:
      packages: ${{ steps.get-packages.outputs.packages }}
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name: Figure out which packages have changed since the last push
      id: get-packages
      run: |
        echo "packages=["$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -v '^\(\.git\|keyring.asc\)' | sed 's/\/.*$//g' | sort -u | xargs -I{} bash -c "test -d \"{}\" && echo \"\\\"{}\\\"\"" | head -c -1 | sed -z 's/\n/,/g')"]" >> $GITHUB_OUTPUT
  build:
    name: Build
    needs: evaluate
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        pkgname: ${{ fromJSON(needs.evaluate.outputs.packages) }}
      fail-fast: false
    if: ${{ needs.evaluate.outputs.packages != '[]' }}
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        path: buildsrc
    - name: Prepare build environment
      run: |
        sudo chown -R 1000 buildsrc
        sudo chown -R $(id -u) buildsrc/.git
        sudo install -d -o 1000 -g users repo
    - name: Use geschenkerbauer to build packages
      uses: mutantmonkey/geschenkerbauer/action@674d9e8baedd18f55be653207a805d97112469a1
      env:
        GNUPG_PUBKEYRING: ${{ github.workspace }}/buildsrc/keyring.asc
        PACKAGER: geschenkerbauer on github <archpkgs+github@mutantmonkey.mx>
      with:
        packages: ${{ matrix.pkgname }}
    - name: Replace forbidden colon character in package filenames
      run: |
        for f in $(find . -iname '*:*'); do
          sudo mv "$f" "${f/:/__3A__}"
        done || exit 0
      working-directory: ./repo
    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: build-output-${{ matrix.pkgname }}
        path: repo
    - name: Generate artifact attestation
      uses: actions/attest-build-provenance@v1
      with:
        subject-path: 'repo/*'