aur pkg #1562
aur pkg #1562
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Walkthrough新增 AUR 打包支持：添加可复用 GitHub Actions 工作流在 archlinux:base-devel 容器中构建 AUR 包，新增 PKGBUILD 与 systemd/sysusers/tmpfiles/install 文件，并在 jvm-release 发布流程中集成 aur-dist 构建产物。 Changes
Sequence Diagram(s)sequenceDiagram
participant GA as GitHub Actions
participant Runner as Ubuntu Runner
participant AC as Arch Container (archlinux:base-devel)
participant JI as YunaBraska/java-info-action
participant Storage as Artifact Storage
GA->>Runner: 触发 jvm-release 包含 Build_AUR
Runner->>AC: 启动 archlinux:base-devel 容器并运行工作流步骤
AC->>AC: 安装构建依赖 (git, jdk, gradle, node, pnpm)
AC->>AC: 检出仓库并修复权限
AC->>JI: 调用 java-info-action 获取 x_version
JI-->>AC: 返回 x_version
AC->>AC: 更新 PKGBUILD pkgver 并创建非 root builder 用户
AC->>AC: 以 builder 运行 makepkg 生成 .SRCINFO 并构建包
AC->>Storage: 上传 aur-dist（PKGBUILD、.SRCINFO、包文件）
Storage-->>GA: aur-dist 可供后续作业下载
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @Ghost-chu, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces the necessary files to create an Arch User Repository (AUR) package for PeerBanHelper. It streamlines the installation and management of the PeerBanHelper application on Arch Linux systems by providing a PKGBUILD script, systemd service definitions, and configuration for system users and temporary files. This significantly simplifies the process for users to install, run, and maintain PeerBanHelper. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
您好，感谢您为 PeerBanHelper 创建 AUR 软件包。这是一个很好的开始。我主要在 PKGBUILD 文件中发现了一些需要改进的地方，以更好地遵循 Arch Linux 的打包规范和安全最佳实践。
主要问题包括：
- 安全问题：本地源文件缺少 SHA256 校验和，这会带来安全风险。
- 命名规范：由于软件包是从 git 最新代码构建的，根据 AUR 的惯例，包名应以
-git结尾。 - 版本控制：
pkgver()函数中硬编码了版本号，这会导致版本更新不正确。
其他文件（如 systemd service 文件）看起来很不错，遵循了现代的最佳实践。请查看我的具体评论以获取详细信息和修改建议。
There was a problem hiding this comment.
Pull request overview
This pull request adds AUR (Arch User Repository) packaging support for PeerBanHelper, enabling distribution through Arch Linux's package management system.
Changes:
- Adds AUR package build workflow and integration with the release process
- Creates PKGBUILD and supporting systemd configuration files for Arch Linux packaging
- Updates the release workflow to include AUR package generation alongside existing package formats
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/aur/PKGBUILD | AUR package build script defining dependencies, build process, and installation for Arch Linux |
| pkg/aur/peerbanhelper.service | Systemd service unit file for running PeerBanHelper as a system service |
| pkg/aur/peerbanhelper.tmpfiles | Systemd tmpfiles configuration for creating required directories with proper permissions |
| pkg/aur/peerbanhelper.sysusers | Systemd sysusers configuration for creating the peerbanhelper system user |
| pkg/aur/peerbanhelper.install | Post-installation and post-upgrade scripts providing user instructions |
| .github/workflows/build_aur.yml | GitHub Actions workflow for building the AUR package in an Arch Linux container |
| .github/workflows/jvm-release.yml | Updates release workflow to include AUR package build job and artifact handling |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/build_aur.yml:
- Line 13: Replace the unsafe package install command "pacman -Sy --noconfirm
git jdk-openjdk gradle nodejs pnpm" with a full system upgrade invocation by
using "pacman -Syu --noconfirm" followed by the package list; update the
workflow step that runs this command so the package database is synced and
installed packages are upgraded atomically to avoid partial-upgrade issues.
🧹 Nitpick comments (8)
.github/workflows/build_aur.yml (2)
7-9: 建议为 AUR 构建任务添加超时配置根据编码规范，构建任务应配置适当的超时时间。AUR 包构建可能需要较长时间，建议添加
timeout-minutes配置。♻️ 建议修复
jobs: aur: runs-on: ubuntu-latest container: archlinux:base-devel + timeout-minutes: 30 steps:
21-22: 将外部 Action 版本固定为具体的提交哈希以增强安全性使用
@main引用外部 Action 存在供应链安全风险，因为分支引用是可变的，上游维护者（或攻击者）可以改动该分支，导致任意代码执行。应将其固定到完整的提交哈希值（commit SHA），或至少固定到具体的版本标签。当前工作流中的其他 Action（如actions/checkout@v4、actions/upload-artifact@v4）已经采用版本固定，建议此处保持一致。最新版本为 v2.1.90。pkg/aur/peerbanhelper.service (2)
5-11: 建议添加 systemd 安全加固选项当前服务配置缺少常见的安全加固选项。对于作为非 root 用户运行的守护进程，建议添加以下安全限制以减少攻击面：
🔒 建议添加的安全加固配置
[Service] User=peerbanhelper WorkingDirectory=/usr/lib/peerbanhelper ExecStart=/usr/bin/java --enable-native-access=ALL-UNNAMED -XX:+UseCompactObjectHeaders -Dpbh.release=arch -Dpbh.datadir=/var/lib/peerbanhelper -Dpbh.configdir=/etc/peerbanhelper -Dpbh.logsdir=/var/log/peerbanhelper -Dpbh.log.level=WARN -Djdk.attach.allowAttachSelf=true -XX:MaxRAMPercentage=85.0 -XX:+UseZGC -XX:SoftMaxHeapSize=386M -XX:ZUncommitDelay=1 -Xss512k -XX:+UseStringDeduplication -XX:-ShrinkHeapInSteps -jar PeerBanHelper.jar SuccessExitStatus=143 AmbientCapabilities=CAP_NET_ADMIN Restart=on-failure +ProtectSystem=strict +ProtectHome=true +PrivateTmp=true +ReadWritePaths=/var/lib/peerbanhelper /var/log/peerbanhelper /etc/peerbanhelper
11-11: 建议配置重启延迟和限制
Restart=on-failure是合理的，但建议添加RestartSec和StartLimitBurst/StartLimitIntervalSec以防止服务在持续失败时频繁重启消耗系统资源。♻️ 建议的配置
Restart=on-failure +RestartSec=5pkg/aur/PKGBUILD (4)
19-23: 本地文件应提供校验和虽然 git 源使用
SKIP是可接受的做法，但本地配置文件（peerbanhelper.sysusers、peerbanhelper.tmpfiles、peerbanhelper.service、peerbanhelper.install）应提供实际的 sha256 校验和以确保文件完整性。可以使用以下命令生成校验和：
sha256sum peerbanhelper.sysusers peerbanhelper.tmpfiles peerbanhelper.service peerbanhelper.install
10-10: 建议使用 SPDX 许可证标识符根据 Arch Wiki 的 PKGBUILD 指南，
license字段应使用 SPDX 标识符格式。♻️ 建议的修改
-license=('GPL3') +license=('GPL-3.0-or-later')
25-29: 版本号硬编码重复
pkgver()函数中硬编码了"9.2.5"，与第 5 行的pkgver=9.2.5重复。如果版本更新，需要在两处同时修改，容易造成不一致。♻️ 建议使用变量或从单一来源获取版本
pkgver() { cd "$srcdir/$_pkgname" # Generate version string based on git - printf "%s.r%s.g%s" "9.2.5" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)" + # 从 gradle.properties 或 git tag 获取基础版本 + local _basever=$(grep -oP 'version\s*=\s*\K[\d.]+' gradle.properties 2>/dev/null || echo "$pkgver") + printf "%s.r%s.g%s" "$_basever" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)" }或者如果项目使用 git tags 进行版本管理：
pkgver() { cd "$srcdir/$_pkgname" - printf "%s.r%s.g%s" "9.2.5" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)" + git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' }
56-56:cp -r可能无法正确设置文件权限使用
cp -r复制 libraries 目录可能会保留源文件的权限，但更推荐使用install命令或cp -a以确保权限一致性，或在复制后显式设置权限。♻️ 建议的修改
- cp -r build/libraries "$pkgdir/usr/lib/$pkgname/" + cp -r build/libraries "$pkgdir/usr/lib/$pkgname/" + chmod -R 644 "$pkgdir/usr/lib/$pkgname/libraries" + find "$pkgdir/usr/lib/$pkgname/libraries" -type d -exec chmod 755 {} \;
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (7)
.github/workflows/build_aur.yml.github/workflows/jvm-release.ymlpkg/aur/PKGBUILDpkg/aur/peerbanhelper.installpkg/aur/peerbanhelper.servicepkg/aur/peerbanhelper.sysuserspkg/aur/peerbanhelper.tmpfiles
🧰 Additional context used
📓 Path-based instructions (5)
{pom.xml,Dockerfile,.github/**/*.{yml,yaml}}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Install Java 21.0.4-tem using SDKMAN - Java 21 is REQUIRED. Do NOT use Java 17 or other versions as the build will fail or have runtime issues.
Files:
.github/workflows/build_aur.yml.github/workflows/jvm-release.yml
{build.sh,Dockerfile,.github/**/*.{yml,yaml}}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
NEVER CANCEL long-running builds. Build script takes 45-60 seconds, WebUI build takes ~35 seconds, Maven build takes 2-3 minutes, Docker build takes 3-4 minutes. Set appropriate timeouts (120+ seconds for builds, 300+ seconds for Maven, 600+ seconds for Docker).
Files:
.github/workflows/build_aur.yml.github/workflows/jvm-release.yml
{build.sh,.github/**/*.{yml,yaml},Dockerfile}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Always build WebUI before Maven when building manually. WebUI build must be completed first, then copy webui/dist to src/main/resources/static, then run Maven build.
Files:
.github/workflows/build_aur.yml.github/workflows/jvm-release.yml
{build.sh,.github/**/*.{yml,yaml}}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Use the complete build script
./build.shfor building the application - it automates both WebUI and Maven builds and is the recommended approach.
Files:
.github/workflows/build_aur.yml.github/workflows/jvm-release.yml
{Dockerfile,.github/**/*.{yml,yaml}}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Docker build must not be cancelled and should have a timeout of 600+ seconds. The Docker build uses multi-stage build: WebUI build stage, Maven build stage, then runtime container.
Files:
.github/workflows/build_aur.yml.github/workflows/jvm-release.yml
🧠 Learnings (2)
📚 Learning: 2025-01-08T12:53:19.783Z
Learnt from: Ghost-chu
Repo: PBH-BTN/PeerBanHelper PR: 875
File: src/main/java/com/ghostchu/peerbanhelper/PeerBanHelperServer.java:199-205
Timestamp: 2025-01-08T12:53:19.783Z
Learning: The `runTestCode()` method in PeerBanHelperServer is an intentional design feature guarded by the `pbh.release=LiveDebug` system property, used for debug purposes in production code.
Applied to files:
pkg/aur/peerbanhelper.sysuserspkg/aur/peerbanhelper.service
📚 Learning: 2025-01-08T11:52:59.043Z
Learnt from: Ghost-chu
Repo: PBH-BTN/PeerBanHelper PR: 875
File: src/main/java/com/ghostchu/peerbanhelper/module/impl/webapi/PBHBanController.java:120-128
Timestamp: 2025-01-08T11:52:59.043Z
Learning: The ban list in PeerBanHelper is designed to be an in-memory data structure that maintains a relatively small number of entries, making complex search indexing unnecessary.
Applied to files:
pkg/aur/peerbanhelper.sysusers
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)
- GitHub Check: CI
- GitHub Check: Generate Synology Package / pkgcreate
- GitHub Check: Generate FreeBSD Package / pkg (14.1)
- GitHub Check: Generate Debian Package / dpkg
- GitHub Check: Generate Installers / install4jc
- GitHub Check: Build and Push Docker Images
- GitHub Check: Generate Portable Version / dpkg
- GitHub Check: Generate FreeBSD Package / pkg (13.4)
- GitHub Check: Agent
- GitHub Check: Build Standalone Docker Images
🔇 Additional comments (11)
.github/workflows/build_aur.yml (2)
32-35: LGTM!正确地使用非 root 用户运行
makepkg，符合 Arch Linux 打包规范。makepkg -s会自动安装构建依赖。
37-44: LGTM!构建产物上传配置正确，包含了 PKGBUILD、.SRCINFO 和编译后的包文件。
.github/workflows/jvm-release.yml (3)
47-50: LGTM!新的 Build_AUR 任务正确集成到发布流程中，依赖于 Build_Executable 完成后执行。
60-60: LGTM!依赖链正确更新，确保 AUR 包构建完成后才执行后续的 S3 上传和产物上传任务。
Also applies to: 67-67, 94-94
134-137: LGTM!aur-dist 产物下载配置与其他发行版产物保持一致。
pkg/aur/peerbanhelper.sysusers (1)
1-1: LGTM!systemd-sysusers 配置格式正确，系统用户
peerbanhelper的家目录与 tmpfiles 配置一致。pkg/aur/peerbanhelper.tmpfiles (1)
1-3: LGTM!tmpfiles 配置正确创建了服务所需的目录结构：
/var/lib/peerbanhelper- 数据目录/var/log/peerbanhelper- 日志目录/etc/peerbanhelper- 配置目录权限 0750 和所有者设置合理，与 sysusers 定义一致。
pkg/aur/peerbanhelper.install (1)
1-12: LGTM!安装脚本遵循 Arch Linux 标准格式，提供了清晰的用户指引：
- 安装后提示启用服务
- 升级后正确建议先执行
daemon-reload再重启服务pkg/aur/PKGBUILD (2)
36-48: 构建过程逻辑清晰WebUI 构建、资源复制和 Gradle 构建的步骤组织合理，流程清晰。
50-69: 安装过程结构良好使用
install命令设置正确的目录和文件权限，systemd 相关配置文件安装到标准路径，符合 Arch Linux 打包规范。pkg/aur/peerbanhelper.service (1)
8-8:-XX:+UseCompactObjectHeaders在 JDK 25 中已成为标准产品选项（不再是实验性功能），可直接使用，无需-XX:+UnlockExperimentalVMOptions标志。JEP 519 确认该功能已在 JDK 25 正式发布。当前 ExecStart 命令行中的用法正确，无需修改。Likely an incorrect or invalid review comment.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/jvm-release.yml:
- Around line 54-58: The build_aur.yml workflow is missing an explicit timeout
for the aur job; update build_aur.yml and add timeout-minutes: 600 to the aur
job definition so the long-running makepkg steps won't be killed (locate the aur
job block in build_aur.yml referenced by the Build_AUR usage and insert
timeout-minutes: 600 under that job's top-level properties).
| Build_AUR: | ||
| name: Generate AUR Package | ||
| needs: Build_Executable | ||
| uses: ./.github/workflows/build_aur.yml | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# 查找并检查 build_aur.yml 文件
fd -t f "build_aur.yml" .github/workflows/ && cat .github/workflows/build_aur.ymlRepository: PBH-BTN/PeerBanHelper
Length of output: 1388
🏁 Script executed:
# 检查 jvm-release.yml 中的相关行和依赖关系
cat -n .github/workflows/jvm-release.yml | sed -n '40,150p'Repository: PBH-BTN/PeerBanHelper
Length of output: 4458
Build_AUR 任务结构正确，但 build_aur.yml 缺少超时配置。
任务定义与现有的 Build_DEB 和 Build_PKG 保持一致，依赖关系和工件下载也已正确配置。确认工作流确实产出 aur-dist 工件。
但是，build_aur.yml 工作流中缺少显式的超时设置。根据编码指南要求，匹配 {.github/**/*.yml} 的构建工作流应设置适当的超时（120+ 秒）。请在 build_aur.yml 的 aur 任务中添加 timeout-minutes: 600 以确保长时间运行的 makepkg 构建不会被意外中断。
🤖 Prompt for AI Agents
In @.github/workflows/jvm-release.yml around lines 54 - 58, The build_aur.yml
workflow is missing an explicit timeout for the aur job; update build_aur.yml
and add timeout-minutes: 600 to the aur job definition so the long-running
makepkg steps won't be killed (locate the aur job block in build_aur.yml
referenced by the Build_AUR usage and insert timeout-minutes: 600 under that
job's top-level properties).
Arch Linux 的包管理器软件包打包流程
Summary by CodeRabbit
新功能
工程管理
✏️ Tip: You can customize this high-level summary in your review settings.