Package as an RPM, built and published by Forgejo Actions

packaging/ builds swap-watchdog and force-quit-gui in a Fedora container and makes an RPM, with the user services pointing at /usr/bin and a preset enabling them; kdotool comes from Fedora's package. .forgejo/workflows/rpm.yml runs that on each push to main and uploads it to the forge's quine RPM group, which quine-linux's image installs from. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-31 03:53:59 -08:00 · 2026-10-31 03:53:59 -08:00 · b820393162
commit b820393162
parent fabe2c664e
3 changed files with 129 additions and 0 deletions
--- a/.forgejo/workflows/rpm.yml
+++ b/.forgejo/workflows/rpm.yml
@ -0,0 +1,52 @@
+name: RPM
+
+# Builds swap-watchdog as an RPM in a Fedora container and uploads it to the
+# forge's `quine` RPM group,
+# https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm/quine,
+# which quine-linux's image installs it from.
+#
+# Secret: REGISTRY_TOKEN, a Forgejo token with package write access.
+# Variable (optional): REGISTRY_USER, the token's owner (default: the actor).
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: rpm-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rpm:
+    runs-on: runner-x86-linux
+    steps:
+      - uses: https://forge.quinefoundation.com/quine-global-labs/mirror-actions-checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build
+        # /var/cache/quine-rpm-build outlives the job (host-mode runner): Go's toolchain and module cache.
+        run: |
+          mkdir -p out /var/cache/quine-rpm-build
+          podman run --rm -v "$PWD":/src -v /var/cache/quine-rpm-build:/cache -v "$PWD/out":/out \
+            registry.fedoraproject.org/fedora:44 bash /src/packaging/build-rpm.sh
+          ls -l out
+
+      - name: Upload to the quine RPM group
+        env:
+          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          [ -n "$REGISTRY_TOKEN" ] || { echo "::error::no REGISTRY_TOKEN secret (org or repo)"; exit 1; }
+          netrc=$(mktemp); trap 'rm -f "$netrc"' EXIT; chmod 600 "$netrc"
+          printf 'machine %s login %s password %s\n' "${GITHUB_SERVER_URL#https://}" "$REGISTRY_USER" "$REGISTRY_TOKEN" >"$netrc"
+          for f in out/*.rpm; do
+            code=$(curl -sS -o /dev/null -w '%{http_code}' --netrc-file "$netrc" --upload-file "$f" \
+              "$GITHUB_SERVER_URL/api/packages/quine-global-labs/rpm/quine/upload")
+            echo "$code ${f#out/}"
+            [ "$code" = 201 ] || [ "$code" = 409 ]
+          done
+
+      - name: Clean up
+        if: always()
+        run: rm -rf out build
--- a/packaging/build-rpm.sh
+++ b/packaging/build-rpm.sh
@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Builds swap-watchdog and force-quit-gui and packages them as an RPM
+# (packaging/swap-watchdog.spec). Runs in a Fedora container
+# (.forgejo/workflows/rpm.yml) with this repo at /src, a cache that outlives
+# the job at /cache (Go's toolchain and modules), and the RPMs going to /out.
+# kdotool isn't built here: Fedora packages it, and the RPM requires it.
+set -euo pipefail
+
+dnf install -y --setopt=install_weak_deps=False golang gtk3-devel git rpm-build
+
+# go.mod asks for a newer Go than Fedora's; GOTOOLCHAIN=auto fetches it (into
+# the module cache, so once).
+export GOTOOLCHAIN=auto GOMODCACHE=/cache/go/mod GOCACHE=/cache/go/build GOFLAGS=-buildvcs=false
+git config --global --add safe.directory '*'
+
+cd /src
+mkdir -p bin
+go build -trimpath -o bin/ ./cmd/swap-watchdog ./cmd/force-quit-gui
+
+version=0
+release=$(date -u +%Y%m%d%H%M).git$(git rev-parse --short=7 HEAD)
+rpmbuild -bb packaging/swap-watchdog.spec \
+  --define "_topdir /tmp/rpmbuild" \
+  --define "version_ $version" --define "release_ $release" --define "srcdir /src"
+cp -v /tmp/rpmbuild/RPMS/*/*.rpm /out/
--- a/packaging/swap-watchdog.spec
+++ b/packaging/swap-watchdog.spec
@ -0,0 +1,52 @@
+# Built by packaging/build-rpm.sh, which compiles the binaries first; not a
+# from-source spec (no %prep/%build).
+%global debug_package %{nil}
+
+Name:           swap-watchdog
+Version:        %{version_}
+Release:        %{release_}%{?dist}
+Summary:        Reveals a Force Quit window when swap or memory pressure turns critical
+License:        Apache-2.0
+URL:            https://forge.quinefoundation.com/quine-global-labs/swap-watchdog
+ExclusiveArch:  x86_64
+
+Requires:       gtk3
+Requires:       kdotool
+
+%description
+swap-watchdog polls swap and memory pressure, and when either turns critical
+reveals the Force Quit Monitor (force-quit-gui), which runs minimized from
+login so it's there without starting anything new under memory pressure.
+Both run as systemd user services.
+
+%install
+# %%license and %%doc read from the build directory, not the checkout.
+cp -p %{srcdir}/LICENSE %{srcdir}/README.md .
+install -D -m 0755 %{srcdir}/bin/swap-watchdog %{buildroot}%{_bindir}/swap-watchdog
+install -D -m 0755 %{srcdir}/bin/force-quit-gui %{buildroot}%{_bindir}/force-quit-gui
+mkdir -p %{buildroot}%{_userunitdir}
+for u in swap-watchdog force-quit-gui; do
+  sed -e "s|^ExecStart=%%h/Code/swap-watchdog/bin/|ExecStart=%{_bindir}/|" \
+      -e "s|^Environment=PATH=%%h/.local/bin:|Environment=PATH=|" \
+      %{srcdir}/systemd/$u.service > %{buildroot}%{_userunitdir}/$u.service
+  grep -q "^ExecStart=%{_bindir}/$u$" %{buildroot}%{_userunitdir}/$u.service
+done
+install -D -m 0644 /dev/stdin %{buildroot}%{_userpresetdir}/80-swap-watchdog.preset <<'PRESET'
+enable force-quit-gui.service
+enable swap-watchdog.service
+PRESET
+
+%post
+%systemd_user_post force-quit-gui.service swap-watchdog.service
+
+%preun
+%systemd_user_preun force-quit-gui.service swap-watchdog.service
+
+%files
+%license LICENSE
+%doc README.md
+%{_bindir}/swap-watchdog
+%{_bindir}/force-quit-gui
+%{_userunitdir}/swap-watchdog.service
+%{_userunitdir}/force-quit-gui.service
+%{_userpresetdir}/80-swap-watchdog.preset