feat(ci): add no_upload_srpms label (#5758) (#5785)

* feat(ci): add no_upload_srpms label

This also fixes manual builds to support subrepos properly.

* to make sure it actually works

* manually set permissions

(cherry picked from commit bc5a6c144c)

Signed-off-by: GildedRoach <GildedRoach@users.noreply.github.com>
Co-authored-by: madomado <madonuko@outlook.com>

.github/workflows/autobuild.yml

@@ -1,6 +1,8 @@
 # for each folder in anda/
 # generate a new workflow for each folder in anda/
 name: Automatically build packages
+permissions:
+  contents: read
 on:
   push:
     paths:
@@ -96,7 +98,7 @@ jobs:
             terra${{ matrix.version }}${{ matrix.pkg.labels['subrepo'] && '-$subrepo' || '' }} anda-build/rpm/rpms/*
 
       - name: Upload source packages to subatomic
-        if: github.event_name == 'push'
+        if: github.event_name == 'push' && matrix.pkg.labels['no_upload_srpms'] != '1'
         run: |
           subrepo="${{ matrix.pkg.labels.subrepo }}"
           subatomic-cli upload --prune \

.github/workflows/bootstrap.yml

@@ -1,5 +1,6 @@
 name: Bootstrap Andaman and Subatomic
-
+permissions:
+  contents: read
 on:
   workflow_dispatch:
 

.github/workflows/build.yml

@@ -1,4 +1,6 @@
 name: Manual Builds
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:
@@ -81,17 +83,20 @@ jobs:
 
       - name: Upload packages to subatomic
         run: |
+          subrepo="${{ fromJson(steps.art.outputs.labels).subrepo }}"
           subatomic-cli upload --prune \
             --server https://subatomic.fyralabs.com \
             --token ${{ secrets.SUBATOMIC_TOKEN }} \
-            terra${{ matrix.version }}${{ fromJson(steps.art.outputs.labels)['extra'] && '-extras' }} anda-build/rpm/rpms/*
+            terra${{ matrix.version }}${{ fromJson(steps.art.outputs.labels)['subrepo'] && '-$subrepo' }} anda-build/rpm/rpms/*
 
       - name: Upload source packages to subatomic
+        if: fromJson(steps.art.outputs.labels)['no_upload_srpms'] != '1'
         run: |
+          subrepo="${{ fromJson(steps.art.outputs.labels).subrepo }}"
           subatomic-cli upload --prune \
             --server https://subatomic.fyralabs.com \
             --token ${{ secrets.SUBATOMIC_TOKEN }} \
-            terra${{ matrix.version }}${{ fromJson(steps.art.outputs.labels)['extra'] && '-extras' }}-source anda-build/rpm/srpm/*
+            terra${{ matrix.version }}${{ fromJson(steps.art.outputs.labels)['subrepo'] && '-$subrepo' }}-source anda-build/rpm/srpm/*
 
       - name: Notify Madoguchi (Success)
         if: success()

.github/workflows/json-build.yml

@@ -1,4 +1,6 @@
 name: JSON Build
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:
@@ -67,6 +69,7 @@ jobs:
             terra${{ matrix.version }}${{ matrix.pkg.labels['subrepo'] && '-$subrepo' || '' }} anda-build/rpm/rpms/*
 
       - name: Upload source packages to subatomic
+        if: matrix.pkg.labels['no_upload_srpms'] != '1'
         run: |
           subrepo="${{ matrix.pkg.labels.subrepo }}"
           subatomic-cli upload --prune \

.github/workflows/sync.yml

@@ -1,5 +1,7 @@
 name: Automatic backport/sync action
-
+permissions:
+  contents: write
+  pull-requests: write
 on:
   pull_request_target:
     types: ["labeled", "closed"]

.github/workflows/update-branch.yml

@@ -1,4 +1,6 @@
 name: Update per branch
+permissions:
+  contents: write
 on:
   schedule:
     - cron: "*/30 * * * *"

.github/workflows/update-comps.yml

@@ -1,4 +1,6 @@
 name: Push comps updates
+permissions:
+  contents: read
 
 on:
   push:

.github/workflows/update-nightly.yml

@@ -1,4 +1,6 @@
 name: Nightly Update
+permissions:
+  contents: write
 on:
   schedule:
     - cron: "0 0 * * *"

.github/workflows/update-weekly.yml

@@ -1,4 +1,6 @@
 name: Weekly Update
+permissions:
+  contents: write
 on:
   schedule:
     - cron: "0 0 * * *"

.github/workflows/update.yml

@@ -1,4 +1,6 @@
 name: Update
+permissions:
+  contents: write
 on:
   schedule:
     - cron: "*/10 * * * *"

anda/fonts/nerd-fonts/anda.hcl

@@ -3,4 +3,7 @@ project pkg {
 	rpm {
 		spec = "nerd-fonts.spec"
 	}
+	labels {
+		no_upload_srpms = 1
+	}
 }