aur

AUR packages for the shellcell CLIs, managed as a mono-repo (one subdir per package) and published to the Arch User Repository.

Each tool ships two packages: a canonical from-source build and a fast prebuilt -bin. Pick whichever you prefer — provides/conflicts keep them mutually exclusive.

Tool	From source	Prebuilt
cnvrt	cnvrt	cnvrt-bin
exex	exex	exex-bin
snailrace	snailrace	snailrace-bin
ttysvg	ttysvg	ttysvg-bin

Install with any AUR helper, e.g. paru -S ttysvg (compiles) or paru -S ttysvg-bin (prebuilt).

• <name> builds from the GitHub release tag following the Arch Go guidelines (PIE + external linking; depends=(glibc)). Needs the Go toolchain at install time; namcap-clean.
• <name>-bin repackages the upstream release tarball (binary + man page + bash/zsh/fish completions + LICENSE). Instant install. The -bin suffix is required by AUR rules whenever prebuilt binaries are shipped and sources exist.

Both install the binary, man page, and shell completions to the standard paths.

How it works

main is the source of truth. A push that changes a package's PKGBUILD is mirrored to that package's AUR git repo. Nothing reaches main except through a reviewed pull request, so merging is the approval to publish.

project release (vX.Y.Z) ──repository_dispatch(aur-bump)──▶ bump.yml
nvcheck.yml (weekly)     ──repository_dispatch(aur-bump)──▶ bump.yml
                                                              │
   bump.sh: set pkgver, updpkgsums, regen .SRCINFO            │
   build-test in an archlinux container (makepkg + namcap)    │
   open PR  ──ci.yml re-verifies──▶  you merge  ─────────────▶│
                                                              ▼
                                                         push-aur.yml
                                       push PKGBUILD + .SRCINFO to the AUR

• bump.yml (dispatch / manual): bumps one package directory, build-tests it, and opens a pull request. A release fires one aur-bump per variant, so both <name> and <name>-bin get their own PR. This workflow never touches the AUR.
• push-aur.yml (push to main): publishes whichever package directories the push changed. AUR_SSH_PRIVATE_KEY is reachable only from here — never from a dispatch-triggered run — so firing a dispatch cannot publish to the AUR on its own. workflow_dispatch with a package name re-pushes one package by hand.
• nvcheck.yml (scheduled): runs nvchecker (packages.toml) and, for any package whose upstream release is newer than the committed pkgver, fires the same aur-bump dispatch — a safety net for a release whose dispatch was missed.
• ci.yml (PRs/pushes): build-tests every package with makepkg + namcap (compiling and running go test for the source ones) and fails if any .SRCINFO is out of sync with its PKGBUILD.

Layout

cnvrt/        cnvrt-bin/        # one dir per AUR package (pkgbase = dir name),
exex/         exex-bin/         #   each with PKGBUILD + .SRCINFO
snailrace/    snailrace-bin/
ttysvg/       ttysvg-bin/
packages.toml                   # nvchecker sources (all 8 packages)
scripts/bump.sh                 # set pkgver, updpkgsums, regen .SRCINFO
.github/workflows/              # ci.yml, bump.yml, push-aur.yml, nvcheck.yml

Local development

On an Arch system with base-devel + pacman-contrib (and go for the source packages):

cd ttysvg            # or ttysvg-bin
makepkg -si                       # build and install
namcap PKGBUILD *.pkg.tar.zst     # lint
../scripts/bump.sh ttysvg 0.1.3   # bump helper (edits PKGBUILD + .SRCINFO)

Optionally aurpublish setup (see aurpublish) installs git hooks that regenerate .SRCINFO and validate sums on commit. CI regenerates .SRCINFO explicitly, so hooks are not required.

-bin packages ship the upstream binary as-is (CGO_ENABLED=0, stripped, non-PIE), so namcap warns lacks PIE / lacks FULL RELRO. This is expected and accepted for -bin. The from-source packages link with -linkmode=external and are namcap-clean.

One-time setup

1. An AUR account with the CI SSH public key added (Account → My Account).
2. The 8 package names (cnvrt, cnvrt-bin, … ttysvg, ttysvg-bin) free on the AUR — verified free; the first publish registers them.
3. Secrets: AUR_SSH_PRIVATE_KEY (this repo); the org TAP_GITHUB_TOKEN PAT extended to cover shellcell/aur (used by the release dispatch and by nvcheck.yml to fire dispatches, and by bump.yml to open PRs that CI will actually run on).
4. aur-bump dispatch job added to each project's release workflow (fires one dispatch per variant).

bump.yml requires TAP_GITHUB_TOKEN and fails fast without it. The PAT is not optional: a PR opened by the default GITHUB_TOKEN does not trigger ci.yml, so the bump would land unverified — and creating one at all needs the org-level Allow GitHub Actions to create and approve pull requests setting, which a PAT sidesteps entirely.