From effee71d386db51f8f65142fa22be02f0960bce5 Mon Sep 17 00:00:00 2001
From: alvinlollo <alvin@vilaythong.us>
Date: Mon, 14 Sep 2026 11:42:47 +1000
Subject: [PATCH] Add package verification workflow

---
 .gitea/workflows/check-packages.yml | 143 ++++++++++++++++++++++++++++
 1 file changed, 143 insertions(+)
 create mode 100644 .gitea/workflows/check-packages.yml

diff --git a/.gitea/workflows/check-packages.yml b/.gitea/workflows/check-packages.yml
new file mode 100644
index 0000000..5bad20b
--- /dev/null
+++ b/.gitea/workflows/check-packages.yml
@@ -0,0 +1,143 @@
+name: Check Packages
+
+on:
+  push:
+    paths:
+      - "packages.x86_64"
+  pull_request:
+    paths:
+      - "packages.x86_64"
+  workflow_dispatch:
+
+jobs:
+  check-packages:
+    runs-on: ubuntu-latest
+    container:
+      image: archlinux:latest
+    steps:
+      - name: Install prerequisites
+        run: |
+          pacman -Syu --noconfirm --needed pacman pacman-contrib curl gnupg
+
+      - name: Set up official repos (extra, multilib)
+        run: |
+          cat > /etc/pacman.conf <<'EOF'
+          [options]
+          Architecture = auto
+          SigLevel    = Required DatabaseOptional
+          LocalFileSigLevel = Optional
+
+          [core]
+          Include = /etc/pacman.d/mirrorlist
+
+          [extra]
+          Include = /etc/pacman.d/mirrorlist
+
+          [multilib]
+          Include = /etc/pacman.d/mirrorlist
+          EOF
+
+          # Generate a basic mirrorlist
+          curl -fsSL "https://archlinux.org/mirrorlist/all/status/" \
+            | sed 's/^#Server/Server/' | head -20 > /etc/pacman.d/mirrorlist
+
+          pacman -Syu --noconfirm
+
+      - name: Set up CachyOS repo
+        run: |
+          # Import CachyOS keyring
+          curl -fsSL https://mirror.cachyos.org/cachyos-keyring.pkg.tar.zst \
+            -o /tmp/cachyos-keyring.pkg.tar.zst
+          pacman -U --noconfirm /tmp/cachyos-keyring.pkg.tar.zst || true
+
+          # Add CachyOS mirrorlist
+          cat > /etc/pacman.d/cachyos-mirrorlist <<'MIRROR'
+          Server = https://mirror.cachyos.org/$repo/$arch
+          MIRROR
+
+          # Add CachyOS repo to pacman.conf
+          cat >> /etc/pacman.conf <<'EOF'
+
+          [cachyos]
+          SigLevel = Optional TrustAll
+          Include = /etc/pacman.d/cachyos-mirrorlist
+          EOF
+
+          pacman -Syu --noconfirm
+
+      - name: Set up chaotic-aur repo
+        run: |
+          # Import chaotic-aur keyring
+          pacman-key --recv-key FBA220DFC880C036 --keyserver keyserver.ubuntu.com
+          pacman-key --lsign-key FBA220DFC880C036 || true
+
+          # Add chaotic-aur mirrorlist
+          cat > /etc/pacman.d/chaotic-mirrorlist <<'MIRROR'
+          Server = https://chaotic.archlinux.org/$repo/$arch
+          MIRROR
+
+          # Add chaotic-aur repo to pacman.conf
+          cat >> /etc/pacman.conf <<'EOF'
+
+          [chaotic-aur]
+          SigLevel = Optional TrustAll
+          Include = /etc/pacman.d/chaotic-mirrorlist
+          EOF
+
+          pacman -Syu --noconfirm
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Check all packages
+        run: |
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  Checking packages.x86_64 against repos"
+          echo "  Allowed repos: cachyos, extra, multilib, chaotic-aur"
+          echo "═══════════════════════════════════════════════════════════════"
+
+          ALLOWED_REPOS="^(cachyos|extra|multilib|chaotic-aur)$"
+          MISSING=()
+          FOUND=0
+          TOTAL=0
+
+          while IFS= read -r pkg; do
+            # Skip empty lines and comments
+            [[ -z "$pkg" || "$pkg" =~ ^# ]] && continue
+            TOTAL=$((TOTAL + 1))
+
+            # Query pacman for the package's repository
+            repo=$(pacman -Si "$pkg" 2>/dev/null | grep "^Repository" | awk '{print $3}')
+
+            if [[ -z "$repo" ]]; then
+              echo "❌ MISSING: $pkg"
+              MISSING+=("$pkg")
+            elif [[ "$repo" =~ $ALLOWED_REPOS ]]; then
+              FOUND=$((FOUND + 1))
+            else
+              echo "⚠️  WRONG REPO: $pkg (found in: $repo)"
+              MISSING+=("$pkg")
+            fi
+          done < packages.x86_64
+
+          echo ""
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  Results: $FOUND / $TOTAL packages found in allowed repos"
+          echo "═══════════════════════════════════════════════════════════════"
+
+          if [[ ${#MISSING[@]} -gt 0 ]]; then
+            echo ""
+            echo "⚠️  ${#MISSING[@]} package(s) NOT in allowed repos:"
+            for p in "${MISSING[@]}"; do
+              echo "  • $p"
+            done
+            echo ""
+            echo "These packages must be in:"
+            echo "  • cachyos, extra, multilib, or chaotic-aur"
+            echo "  • OR pre-built in localrepo/"
+            echo "  • OR added to build-end4-deps.sh"
+            exit 1
+          else
+            echo ""
+            echo "✅ All packages verified successfully!"
+          fi