Build and CI

Both workflows run on a docker runner using the archlinux:latest container.

build.yml — every push to main

1. pacman -Syu base tooling + package dependencies.
2. Checkout.
3. curl the .run from the generic registry using pkgver sourced from PKGBUILD: .../api/packages/software/generic/ida-installer/<pkgver>/<installer>
4. Build as an unprivileged builder user: makepkg -f --noconfirm.
5. Install the resulting .pkg.tar.zst into a fresh pacman root at /mnt/testroot with pacman -U (this resolves and pulls real dependencies, so an unresolvable dep fails the job).
6. Smoke checks: /opt/ida-pro/ida executable, /usr/bin/ida symlink, .desktop file present.

No release, no registry push.

release.yml — on any tag push (*)

Same build + install test, plus:

• Tag check — pkgver-pkgrel sourced from PKGBUILD must equal the tag name (leading v stripped). Mismatch fails the job.
• Changelog — git-cliff --strip all over <previous-tag>..<this-tag> (previous tag via git describe --tags --abbrev=0 <tag>^) into RELEASE_NOTES.md.
• Release — POST /api/v1/repos/<repo>/releases with the notes; reuses the release on HTTP 409. Uploads the .pkg.tar.zst as an asset.
• Arch registry — PUT the package to .../api/packages/software/arch/ida-bin.

Required Actions secrets

Secret	Used for
PKG_TOKEN	Authorization: token on the release API + Arch registry auth
PKG_USER	username for the Arch registry PUT

Running a build locally

# fetch the matching installer next to PKGBUILD, named as in $_installer
makepkg -f

Needs fakechroot, nodejs, base-devel.