From 79ad4499710e2bdd407c33a8a87be663a79ad40b Mon Sep 17 00:00:00 2001
From: Tri Vo Khac <git@trivk.dev>
Date: Sat, 14 Nov 2026 02:32:46 +0700
Subject: [PATCH] ci: probe package auth

---
 .gitea/workflows/arch-package.yml | 57 -------------------------------
 .gitea/workflows/ci.yml           | 27 ---------------
 .gitea/workflows/probe.yml        | 23 +++++++++++++
 .gitea/workflows/release.yml      | 42 -----------------------
 4 files changed, 23 insertions(+), 126 deletions(-)
 delete mode 100644 .gitea/workflows/arch-package.yml
 delete mode 100644 .gitea/workflows/ci.yml
 create mode 100644 .gitea/workflows/probe.yml
 delete mode 100644 .gitea/workflows/release.yml

diff --git a/.gitea/workflows/arch-package.yml b/.gitea/workflows/arch-package.yml
deleted file mode 100644
index 359aa5c..0000000
--- a/.gitea/workflows/arch-package.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Arch package
-
-# Builds the qtpotato package from a release tag and publishes it to this Gitea's Arch
-# registry, so users can install it with pacman until it is on the AUR.
-on:
-  push:
-    tags: ['v*']
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: Release tag to package, e.g. v0.1.0
-        required: true
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  package:
-    # Arch Linux only ships x86_64 images, so pick an amd64 runner.
-    runs-on: amd64
-    container: archlinux:latest
-    env:
-      TAG: ${{ inputs.tag || github.ref_name }}
-    steps:
-      - name: Install dependencies
-        run: |
-          pacman -Syu --noconfirm --needed git nodejs base-devel cmake ninja extra-cmake-modules \
-              qt6-base qt6-declarative kirigami ki18n kcoreaddons kcrash kconfig \
-              mpvqt qcoro qtkeychain-qt6 ffmpeg hicolor-icon-theme
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.tag || github.ref }}
-      - name: Build
-        run: |
-          version="${TAG#v}"
-          dir=/tmp/pkg
-          mkdir -p "$dir"
-          git config --global --add safe.directory "$PWD"
-          git archive --format=tar --prefix="qtpotato-$version/" HEAD | gzip -n > "$dir/qtpotato-$version.tar.gz"
-          sum="$(sha256sum "$dir/qtpotato-$version.tar.gz" | cut -d' ' -f1)"
-          sed -e "s/^pkgver=.*/pkgver=$version/" -e "s/^pkgrel=.*/pkgrel=1/" \
-              -e 's/^source=.*/source=("$pkgname-$pkgver.tar.gz")/' \
-              -e "s/^sha256sums=.*/sha256sums=('$sum')/" \
-              packaging/aur/qtpotato/PKGBUILD > "$dir/PKGBUILD"
-          # makepkg refuses to run as root.
-          useradd -m builder
-          chown -R builder "$dir"
-          su builder -c "cd $dir && makepkg --noconfirm"
-      - name: Publish
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          for f in /tmp/pkg/qtpotato-[0-9]*.pkg.tar.zst; do
-              curl -fsS -X PUT -H "Authorization: token $TOKEN" --upload-file "$f" \
-                  "$GITHUB_SERVER_URL/api/packages/${GITHUB_REPOSITORY%%/*}/arch/qtpotato"
-          done
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
deleted file mode 100644
index c62940f..0000000
--- a/.gitea/workflows/ci.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  build:
-    # Arch Linux only ships x86_64 images, so pick an amd64 runner.
-    runs-on: amd64
-    container: archlinux:latest
-    steps:
-      - name: Install dependencies
-        run: |
-          pacman -Syu --noconfirm --needed git nodejs base-devel cmake ninja extra-cmake-modules \
-              qt6-base qt6-declarative kirigami ki18n kcoreaddons kcrash kconfig \
-              mpvqt qcoro qtkeychain-qt6 ffmpeg
-      - uses: actions/checkout@v4
-      - name: Configure
-        run: cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON
-      - name: Build
-        run: cmake --build build
-      - name: Test
-        env:
-          QT_QPA_PLATFORM: offscreen
-        run: ctest --test-dir build --output-on-failure
diff --git a/.gitea/workflows/probe.yml b/.gitea/workflows/probe.yml
new file mode 100644
index 0000000..47c5dc7
--- /dev/null
+++ b/.gitea/workflows/probe.yml
@@ -0,0 +1,23 @@
+name: Probe
+on:
+  push:
+    branches: ['probe/**']
+permissions:
+  contents: read
+  packages: write
+jobs:
+  auth:
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GT: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          echo junk > /tmp/junk.pkg.tar.zst
+          u="$GITHUB_SERVER_URL/api/packages/${GITHUB_REPOSITORY%%/*}/arch/probe"
+          echo "actor=$GITHUB_ACTOR same=$([ "$TOKEN" = "$GT" ] && echo yes || echo no)"
+          echo -n "header token: "; curl -s -o /dev/null -w '%{http_code}\n' -X PUT -H "Authorization: token $TOKEN" --upload-file /tmp/junk.pkg.tar.zst "$u"
+          echo -n "bearer: "; curl -s -o /dev/null -w '%{http_code}\n' -X PUT -H "Authorization: Bearer $TOKEN" --upload-file /tmp/junk.pkg.tar.zst "$u"
+          echo -n "basic actor: "; curl -s -o /dev/null -w '%{http_code}\n' -X PUT --user "$GITHUB_ACTOR:$TOKEN" --upload-file /tmp/junk.pkg.tar.zst "$u"
+          echo -n "basic x: "; curl -s -o /dev/null -w '%{http_code}\n' -X PUT --user "x:$TOKEN" --upload-file /tmp/junk.pkg.tar.zst "$u"
+          echo -n "api v1 user: "; curl -s -o /dev/null -w '%{http_code}\n' -H "Authorization: token $TOKEN" "$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY"
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
deleted file mode 100644
index 5ccd1ac..0000000
--- a/.gitea/workflows/release.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags: ['v*']
-
-permissions:
-  contents: write
-
-jobs:
-  release:
-    # Arch Linux only ships x86_64 images, so pick an amd64 runner.
-    runs-on: amd64
-    container: archlinux:latest
-    steps:
-      - name: Install dependencies
-        run: |
-          pacman -Syu --noconfirm --needed git nodejs curl jq
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Source tarball
-        run: |
-          git config --global --add safe.directory "$PWD"
-          version="${GITHUB_REF_NAME#v}"
-          mkdir -p dist
-          git archive --format=tar --prefix="qtpotato-$version/" "$GITHUB_REF_NAME" \
-              | gzip -n > "dist/qtpotato-$version.tar.gz"
-      - name: Publish release
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          cd dist
-          sha256sum -- * > SHA256SUMS
-          api="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY"
-          id=$(jq -n --arg tag "$GITHUB_REF_NAME" '{tag_name: $tag, name: ("QtPotato " + ($tag | ltrimstr("v")))}' \
-              | curl -fsS -X POST -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' \
-                  --data @- "$api/releases" | jq -r .id)
-          for f in *; do
-              curl -fsS -X POST -H "Authorization: token $TOKEN" \
-                  -F "attachment=@$f" "$api/releases/$id/assets?name=$f" > /dev/null
-          done