feat: add aur-setup composite chaining the AUR packaging steps (#236)

Co-authored-by: opencode <noreply@opencode.ai>

Author: hrzlgnm

.github/actions/aur-setup/action.yml

@@ -0,0 +1,66 @@
+# Copyright 2026 hrzlgnm
+# SPDX-License-Identifier: MIT
+
+name: Setup AUR packaging
+description: Fix checkout ownership, install the AUR SSH key, clone the AUR repo, and verify the version
+
+# Consumers pin this action directly, e.g.
+#   uses: hrzlgnm/actions/.github/actions/aur-setup@<sha> # v2.12.0
+#
+# Runs all steps in the caller's job (same container and filesystem), so the
+# checkout ownership, ~/.ssh keys, and ~/aur clone are visible to later steps.
+# Sibling scripts are addressed relative to this action's directory; no
+# version pins between actions in this repo, they always move atomically.
+
+inputs:
+  package-name:
+    description: AUR package name, e.g. mdns-browser or mdns-browser-bin
+    required: true
+  release-version:
+    description: Release version, e.g. 1.13.0
+    required: true
+  deploy-key:
+    description: SSH private key for the aur.archlinux.org service user
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        ACTION_DIR: ${{ github.action_path }}
+      run: '"$ACTION_DIR/../aur-fix-ownership/fix-ownership.sh"'
+
+    - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
+      env:
+        ACTION_DIR: ${{ github.action_path }}
+        AUR_DEPLOY_KEY: ${{ inputs.deploy-key }}
+      with:
+        timeout_minutes: 5
+        max_attempts: 5
+        retry_wait_seconds: 10
+        warning_on_retry: true
+        # su without --login keeps the step env and only resets
+        # HOME/SHELL/USER/LOGNAME, so the script reads inputs from env.
+        command: su runner -c '"$ACTION_DIR/../aur-setup-ssh/setup-aur-ssh.sh"'
+
+    - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
+      env:
+        ACTION_DIR: ${{ github.action_path }}
+        PACKAGE_NAME: ${{ inputs.package-name }}
+      with:
+        timeout_minutes: 5
+        max_attempts: 5
+        retry_wait_seconds: 10
+        warning_on_retry: true
+        # su without --login keeps the step env and only resets
+        # HOME/SHELL/USER/LOGNAME, so the script reads inputs from env.
+        command: su runner -c '"$ACTION_DIR/../aur-clone-repo/clone-aur-repo.sh"'
+
+    - shell: bash
+      env:
+        ACTION_DIR: ${{ github.action_path }}
+        RELEASE_VERSION: ${{ inputs.release-version }}
+      # su without --login keeps the step env and only resets
+      # HOME/SHELL/USER/LOGNAME, so the script reads inputs from env.
+      run: su runner -c '"$ACTION_DIR/../aur-check-version/check-aur-version.sh"'

README.md

@@ -136,3 +136,84 @@ jobs:
 | `warning_on_retry` | no | `'true'` |
 | `shell` | no | `'bash'` |
 
+## AUR packaging
+
+Composite actions for Arch Linux AUR publishers running in an Arch
+builder container as root with a `runner` user. `aur-setup` chains the
+full in-job setup in one pinned step; the four granular actions below
+are available separately for custom flows.
+
+### Quick Start
+
+```yml
+    - name: Setup AUR packaging
+      if: github.event.release.tag_name
+      uses: hrzlgnm/actions/.github/actions/aur-setup@v2.12.0
+      with:
+        package-name: ${{ matrix.package.name }}
+        release-version: ${{ needs.release-info.outputs.version }}
+        deploy-key: ${{ secrets.AUR_DEPLOY_KEY }}
+```
+
+| Input | Required | Default |
+| --- | --- | --- |
+| `package-name` | yes | — |
+| `release-version` | yes | — |
+| `deploy-key` | yes | — |
+
+Granular actions (pin like `hrzlgnm/actions/.github/actions/aur-setup-ssh@v2.11.0`):
+
+### Fix AUR checkout ownership
+
+Chowns the checkout to `runner` (AUR builder containers run as root).
+No inputs.
+
+```yml
+    - uses: hrzlgnm/actions/.github/actions/aur-fix-ownership@v2.11.0
+```
+
+### Setup AUR SSH deployment key
+
+Installs the deploy key and pins the `aur.archlinux.org` host keys to
+the Arch-published fingerprints (verified, retrying).
+
+```yml
+    - uses: hrzlgnm/actions/.github/actions/aur-setup-ssh@v2.11.0
+      with:
+        deploy-key: ${{ secrets.AUR_DEPLOY_KEY }}
+```
+
+| Input | Required | Default |
+| --- | --- | --- |
+| `deploy-key` | yes | — |
+
+### Clone AUR repo
+
+Clones the AUR package repository to `~/aur`, discarding any previous
+checkout (retrying).
+
+```yml
+    - uses: hrzlgnm/actions/.github/actions/aur-clone-repo@v2.11.0
+      with:
+        package-name: ${{ matrix.package.name }}
+```
+
+| Input | Required | Default |
+| --- | --- | --- |
+| `package-name` | yes | — |
+
+### Check AUR version
+
+Fails unless the release version is strictly higher than the `pkgver`
+recorded in the `~/aur` checkout.
+
+```yml
+    - uses: hrzlgnm/actions/.github/actions/aur-check-version@v2.11.0
+      with:
+        release-version: ${{ needs.release-info.outputs.version }}
+```
+
+| Input | Required | Default |
+| --- | --- | --- |
+| `release-version` | yes | — |
+