RPM: build with the shared quine-global/app-build action

Its build script moves there, shared with our other apps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/rpm.yml

@@ -1,9 +1,10 @@
 name: RPM
 
-# Builds dnf-package-store as an RPM in a Fedora container and uploads it to the
+# Builds dnf-package-store as RPMs for x86_64 and aarch64 and uploads them to the
 # forge's `quine` RPM group,
 # https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm/quine,
-# which quine-linux's image installs it from.
+# which quine-linux's image installs it from. The build itself is the shared
+# quine-global/app-build action; packaging/dnf-package-store.spec is this app's part.
 #
 # Secret: REGISTRY_TOKEN, a Forgejo token with package write access.
 # Variable (optional): REGISTRY_USER, the token's owner (default: the actor).
@@ -24,33 +25,9 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Build
+      - uses: https://forge.quinefoundation.com/quine-global/app-build@v1
-        # /var/cache/quine-rpm-build outlives the job (host-mode runner): the Flutter SDKs and pub packages.
+        with:
-        # Once per architecture: Flutter can't cross-compile, so arm64 builds in an arm64 Fedora under
+          name: dnf-package-store
-        # the runner's QEMU emulation (slow). quine-linux's arm64 image installs that one.
+          kind: flutter
-        run: |
+          registry-username: ${{ vars.REGISTRY_USER || github.actor }}
-          mkdir -p out /var/cache/quine-rpm-build
+          registry-password: ${{ secrets.REGISTRY_TOKEN }}
-          for arch in amd64 arm64; do
-            podman run --rm --platform "linux/$arch" -v "$PWD":/src -v /var/cache/quine-rpm-build:/cache -v "$PWD/out":/out \
-              registry.fedoraproject.org/fedora:44 bash /src/packaging/build-flutter-rpm.sh dnf-package-store
-          done
-          ls -l out
-
-      - name: Upload to the quine RPM group
-        env:
-          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: |
-          [ -n "$REGISTRY_TOKEN" ] || { echo "::error::no REGISTRY_TOKEN secret (org or repo)"; exit 1; }
-          netrc=$(mktemp); trap 'rm -f "$netrc"' EXIT; chmod 600 "$netrc"
-          printf 'machine %s login %s password %s\n' "${GITHUB_SERVER_URL#https://}" "$REGISTRY_USER" "$REGISTRY_TOKEN" >"$netrc"
-          for f in out/*.rpm; do
-            code=$(curl -sS -o /dev/null -w '%{http_code}' --netrc-file "$netrc" --upload-file "$f" \
-              "$GITHUB_SERVER_URL/api/packages/quine-global-labs/rpm/quine/upload")
-            echo "$code ${f#out/}"
-            [ "$code" = 201 ] || [ "$code" = 409 ]
-          done
-
-      - name: Clean up
-        if: always()
-        run: rm -rf out build

packaging/build-flutter-rpm.sh

@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-# Builds the Flutter Linux release bundle and packages it as an RPM
-# (packaging/$NAME.spec). Runs in a Fedora container (.forgejo/workflows/rpm.yml)
-# with this repo at /src, a cache that outlives the job at /cache (the
-# Flutter SDK and pub packages), and the RPMs going to /out.
-#
-#   podman run --rm -v "$PWD":/src -v /var/cache/quine-rpm-build:/cache \
-#     -v "$PWD/out":/out registry.fedoraproject.org/fedora:44 \
-#     bash /src/packaging/build-flutter-rpm.sh dnf-package-store
-set -euo pipefail
-NAME=$1
-
-# Flutter's stable release, pinned (storage.googleapis.com/flutter_infra_release/releases/releases_linux.json).
-FLUTTER_VERSION=3.47.9
-FLUTTER_SHA256=25ed8c3c29d51a7353f2a944310b478af8214920639524b19c50a19e6c044c5a
-
-dnf install -y --setopt=install_weak_deps=False \
-  clang cmake ninja-build pkgconf-pkg-config gtk3-devel xz-devel libstdc++-devel \
-  git xz which unzip rpm-build desktop-file-utils
-
-# Flutter builds for the machine it runs on: x64 natively, arm64 in an arm64
-# container (the runner's QEMU emulation). One SDK per architecture.
-case $(uname -m) in x86_64) arch=x64 ;; aarch64) arch=arm64 ;; *) echo "unsupported: $(uname -m)" >&2; exit 1 ;; esac
-sdk=/cache/flutter-$FLUTTER_VERSION-$arch
-if [ ! -x "$sdk/bin/flutter" ]; then
-  curl -fL --retry 3 -o "/cache/flutter-$arch.tar.xz" \
-    "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_$FLUTTER_VERSION-stable.tar.xz"
-  echo "$FLUTTER_SHA256  /cache/flutter-$arch.tar.xz" | sha256sum -c
-  rm -rf "$sdk.tmp" && mkdir -p "$sdk.tmp"
-  tar -xJf "/cache/flutter-$arch.tar.xz" -C "$sdk.tmp" --strip-components=1
-  # The release tarball carries an x64 Dart SDK; without it, the first run
-  # fetches the one for this machine.
-  [ "$arch" = x64 ] || rm -rf "$sdk.tmp/bin/cache"
-  mv "$sdk.tmp" "$sdk" && rm "/cache/flutter-$arch.tar.xz"
-fi
-# The SDK and this checkout belong to other users than the container's root.
-git config --global --add safe.directory '*'
-export PUB_CACHE=/cache/pub PATH="$sdk/bin:$PATH"
-flutter --disable-analytics >/dev/null 2>&1 || true
-
-cd /src
-flutter build linux --release
-
-version=$(sed -n 's/^version: *\([0-9][0-9.]*\).*/\1/p' pubspec.yaml)
-release=$(date -u +%Y%m%d%H%M).git$(git rev-parse --short=7 HEAD)
-rpmbuild -bb "packaging/$NAME.spec" \
-  --define "_topdir /tmp/rpmbuild" \
-  --define "version_ $version" --define "release_ $release" \
-  --define "bundle /src/build/linux/$arch/release/bundle" --define "srcdir /src"
-cp -v /tmp/rpmbuild/RPMS/*/*.rpm /out/

packaging/dnf-package-store.spec

@@ -1,4 +1,4 @@
-# Built by packaging/build-flutter-rpm.sh from Flutter's release bundle; not
+# Built by quine-global/app-build (kind flutter) from Flutter's release bundle; not
 # a from-source spec (no %prep/%build).
 %global debug_package %{nil}
 # The bundle's own libraries (libflutter_linux_gtk.so, plugins) are private,