feat: add pkgbuild manager (Arch Linux PKGBUILD)

[M0Rf30]

Summary

Adds a new manager for Arch Linux PKGBUILD files. Automatically detects new versions, updates pkgver, resets pkgrel, downloads source archives, computes checksums, and creates pull requests.

What it does

• Automatically detects new versions from source URLs
• Updates pkgver to the new version
• Resets pkgrel to 1 (Arch convention)
• Downloads new source archive and computes checksums programmatically
• Updates sha256sums, sha512sums, b2sums, md5sums
• Creates a pull request with all changes

Supported package sources

GitHub

• Archive and release URLs

GitLab

• gitlab.com and self-hosted instances

PyPI (Python)

• files.pythonhosted.org, pypi.org

npm (Node.js)

• Regular and scoped packages (@org/package)

CPAN (Perl)

• cpan.metacpan.org

Packagist (PHP)

• packagist.org

Gitea

• gitea.com, codeberg.org, and self-hosted

Forgejo

• code.forgejo.org and self-hosted

Generic Git repositories

• Any git hosting with archive URLs or .git URLs

Repology (fallback)

• Used automatically for unknown sources
• Can be manually configured: # renovate: repology=repo/package

Additional features

• Variable expansion: ${pkgver}, $pkgver, ${_pkgver}, $_pkgver
• Architecture-specific checksums: sha256sums_x86_64, sha256sums_aarch64, etc.
• Multi-source arrays (updates all sources that use ${pkgver})
• Handles multiple archive formats: .tar.gz, .tar.bz2, .tar.xz, .zip, .tgz

What it doesn't support

• VCS sources (git+https://...)
• -git packages that track HEAD/latest commit
• Packages with dynamic pkgver() functions

Example

pkgname=example
pkgver=1.2.3
pkgrel=1
source=("https://github.com/owner/repo/archive/v${pkgver}.tar.gz")
sha256sums=('abc123...')

Renovate detects GitHub, updates pkgver, resets pkgrel, downloads new tarball, computes new checksum.

Context

• I accept the risk that this PR may be closed if maintainers disagree

AI assistance disclosure

• Yes — minimal assistance

Documentation

• I have updated documentation

How I've tested my work

• Unit tests + real repository

[RahulGautamSingh]

Thanks for the PR!

I have done a half-review..and will review again after changes are applied.

Please, use the review request feature for notifying.

[M0Rf30]

Thanks for the PR!

I have done a half-review..and will review again after changes are applied.

Please, use the review request feature for notifying.

@RahulGautamSingh I think it's ready now. I'm writing here because I requested a review some time ago. Some time has passed, and here we are 😄

[D3vil0p3r]

@M0Rf30 does your change include also the updpkgsums to have the updated hashes and at the end the creation of a PR?

Does it work also with -git packages to retrieve the latest commit version in PKGBUILD?
Does it work also with Python PyPI libs versioning update?

[M0Rf30]

@M0Rf30 does your change include also the updpkgsums to have the updated hashes and at the end the creation of a PR?

Does it work also with -git packages to retrieve the latest commit version in PKGBUILD? Does it work also with Python PyPI libs versioning update?

@M0Rf30 does your change include also the updpkgsums to have the updated hashes and at the end the creation of a PR?

Does it work also with -git packages to retrieve the latest commit version in PKGBUILD? Does it work also with Python PyPI libs versioning update?

PyPI is fully supported

The implementation downloads the source archive directly and computes all checksums programmatically using Node's crypto module. It automatically calculates all checksum types present in the PKGBUILD (sha256, sha512, b2, md5).

This manager is designed for versioned releases, not VCS sources. Git packages (like -git AUR packages that track HEAD) use git+ URLs and have dynamic pkgver() functions rather than static versions, so they're fundamentally incompatible with this approach. The manager only handles versioned tarballs/archives from known sources.

[D3vil0p3r]

Grande! For git versioning I'll try to look for another bot if existing. For this PR, is there something additional you need to add on the code, or it needs only to be reviewed and merged?

Also svc stable sources are supported?

[M0Rf30]

@RahulGautamSingh @viceice I think it's ready now. just FYK. waiting for your bless

[RahulGautamSingh]

Will do a review tomorrow. It is big so clearing chunks at a time 😄

[D3vil0p3r]

Will do a review tomorrow. It is big so clearing chunks at a time 😄

Any news about the review?

[D3vil0p3r]

I checked the changes, they seem ok. @RahulGautamSingh what do you think? Is there some additional point to take care?

[D3vil0p3r]

@M0Rf30 one question: could it be good to integrate how to use renovate with your implemented changes inside Renovate docs? For example, configuration and examples of usage?

[viceice]

Suggested change

	const content = `
	pkgname=example-package
	pkgver=1.2.3
	pkgrel=1
	source=("https://github.com/example/example/archive/v\${pkgver}.tar.gz")
	sha256sums=('abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890')
	`;
	const content = codeBlock`
	pkgname=example-package
	pkgver=1.2.3
	pkgrel=1
	source=("https://github.com/example/example/archive/v\${pkgver}.tar.gz")
	sha256sums=('abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890')
	`;

use our codeBlock template helper

[viceice]

use string.matchAll

• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/matchAll

[viceice]

please move the platform specific function to separate files eg ./extract/github.ts

utils can be moved to ./extract/utils.ts if they're need in platform code.

this file is otherwise very big and hard to review.

splittet files can also be much easier tested.

[viceice]

Suggested change

	const downloadPath = upath.join(cacheDir, `temp-${Date.now()}-${fileName}`);
	const downloadPath = upath.join(cacheDir, `${fileName}`);

don't use date based file names, delete in finally block

[viceice]

    finally {
      // delete zip file
      await fs.rmCache(downloadPath);
    }

[viceice]

please move hash computation to separate file and do it similar to terraform, especially the caching to avoid repeated downloads

renovate/lib/modules/manager/terraform/lockfile/hash.ts

Line 18 in e0112da

export class TerraformProviderHash {