ci: publish aarch64 pacman package artifacts

.gitea/workflows/ci.yml

@@ -109,6 +109,36 @@ jobs:
           cp "$BIN" souveraine-aarch64
           sha256sum souveraine-aarch64 > souveraine-aarch64.sha256
 
+      - name: Package aarch64 pacman artifact
+        run: |
+          set -euo pipefail
+          cd "$GITHUB_WORKSPACE/src/Souveraine"
+          PKGVER="0.1.r$(git rev-list --count HEAD).g${GITHUB_SHA:0:12}"
+          WORK="$GITHUB_WORKSPACE/pacman-package"
+          REPO="$GITHUB_WORKSPACE/pacman-repo"
+          rm -rf "$WORK" "$REPO"
+          mkdir -p "$WORK" "$REPO"
+          cp souveraine-aarch64 packaging/souveraine.service LICENSE "$WORK/"
+          cp packaging/arch/PKGBUILD.prebuilt "$WORK/PKGBUILD"
+          (
+            cd "$WORK"
+            export SOUVERAINE_PKGVER="$PKGVER"
+            # The payload was cross-compiled above; tell makepkg to label the
+            # archive for that payload, not for this x86_64 runner host.
+            CARCH=aarch64 makepkg --nodeps --noconfirm --cleanbuild
+          )
+          PKG=$(find "$WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
+          test -n "$PKG"
+          bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
+          cp "$PKG" "$REPO/"
+          repo-add "$REPO/souveraine.db.tar.zst" "$REPO/$(basename "$PKG")"
+          # Pacman requests <repo>.db; release assets cannot preserve the
+          # symlink repo-add normally creates, so replace it with a real copy.
+          rm -f "$REPO/souveraine.db"
+          cp "$REPO/souveraine.db.tar.zst" "$REPO/souveraine.db"
+          sha256sum "$REPO/$(basename "$PKG")" "$REPO/souveraine.db" \
+            > "$REPO/souveraine-repo.sha256"
+
       - name: Publish rolling edge prerelease
         run: |
           set -euo pipefail
@@ -131,12 +161,13 @@ jobs:
             -d "{\"tag_name\":\"edge\",\"target_commitish\":\"${GITHUB_SHA}\",\"name\":\"edge (${DESC})\",\"body\":\"Rolling aarch64 build of public HEAD (${GITHUB_SHA}). Built on the archdev node, published only when CI is green.\",\"prerelease\":true}" \
             | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
 
-          for f in souveraine-aarch64 souveraine-aarch64.sha256; do
+          for f in souveraine-aarch64 souveraine-aarch64.sha256 \
+            "$GITHUB_WORKSPACE"/pacman-repo/*; do
             curl -sf -X POST -H "$AUTH" \
-              "$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=${f}" \
+              "$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=$(basename "$f")" \
               -F "attachment=@${f}" -o /dev/null
           done
-          echo "published edge (${DESC})"
+          echo "published edge (${DESC}) with aarch64 package + pacman database"
 
   # Mirror the published branch only. primary (dev) never reaches Codeberg.
   sync-codeberg:

packaging/arch/PKGBUILD.prebuilt

@@ -0,0 +1,23 @@
+# CI package recipe for a prebuilt Souveraine aarch64 binary.
+#
+# The runner cross-compiles first, then makepkg assembles this package.  This
+# deliberately avoids compiling on the phone and keeps its agent data outside
+# pacman's ownership.
+pkgname=souveraine
+pkgver="${SOUVERAINE_PKGVER:?CI must set SOUVERAINE_PKGVER}"
+pkgrel=1
+pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
+arch=('aarch64')
+url="https://gitea.wiuf.net/Fimeg/souveraine"
+license=('MIT')
+depends=('gcc-libs')
+options=('!strip')
+source=('souveraine-aarch64' 'souveraine.service' 'LICENSE')
+sha256sums=('SKIP' 'SKIP' 'SKIP')
+
+package() {
+    install -Dm755 "$srcdir/souveraine-aarch64" "$pkgdir/usr/bin/souveraine"
+    sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
+        | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
+    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}