TW-5092: add AUR package publishing to release pipeline

.github/workflows/release.yml

@@ -68,6 +68,32 @@ jobs:
       - name: Run tests
         run: go test ./... -short
 
+      - name: Set up AUR SSH key
+        if: github.event_name == 'push'
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "$AUR_SSH_PRIVATE_KEY" ]; then
+            echo "::error::AUR_SSH_PRIVATE_KEY secret is required to publish the AUR package"
+            exit 1
+          fi
+          mkdir -p ~/.ssh
+          aur_key_path="$HOME/.ssh/aur_ed25519"
+          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$aur_key_path"
+          chmod 600 "$aur_key_path"
+          aur_known_hosts="$(mktemp)"
+          ssh-keyscan -t ed25519 aur.archlinux.org > "$aur_known_hosts" 2>/dev/null
+          if ! ssh-keygen -lf "$aur_known_hosts" | grep -Fq 'SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4'; then
+            echo "::error::AUR host key fingerprint did not match the expected ed25519 fingerprint"
+            exit 1
+          fi
+          cat "$aur_known_hosts" >> ~/.ssh/known_hosts
+          rm -f "$aur_known_hosts"
+          chmod 600 ~/.ssh/known_hosts
+          printf '%s\n' 'Host aur.archlinux.org' "  IdentityFile $aur_key_path" '  User aur' >> ~/.ssh/config
+          echo "AUR_SSH_KEY_PATH=$aur_key_path" >> "$GITHUB_ENV"
+
       - name: Validate release build
         if: github.event_name == 'workflow_dispatch'
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6

.goreleaser.yml

@@ -85,6 +85,28 @@ nfpms:
       - src: completions/nylas.fish
         dst: /usr/share/fish/vendor_completions.d/nylas.fish
 
+aurs:
+  - name: nylas
+    homepage: https://cli.nylas.com/
+    description: CLI for Nylas API - manage email, calendar, and contacts
+    maintainers:
+      - "Nylas <support@nylas.com>"
+    license: MIT
+    private_key: "{{ .Env.AUR_SSH_KEY_PATH }}"
+    git_url: "ssh://aur@aur.archlinux.org/nylas.git"
+    disable: "{{ .IsSnapshot }}"
+    depends:
+      - glibc
+    optdepends:
+      - "bash-completion: for bash completions"
+      - "zsh: for zsh completions"
+      - "fish: for fish completions"
+    package: |-
+      install -Dm755 nylas "${pkgdir}/usr/bin/nylas"
+      install -Dm644 completions/nylas.bash "${pkgdir}/usr/share/bash-completion/completions/nylas"
+      install -Dm644 completions/nylas.zsh "${pkgdir}/usr/share/zsh/site-functions/_nylas"
+      install -Dm644 completions/nylas.fish "${pkgdir}/usr/share/fish/vendor_completions.d/nylas.fish"
+
 checksum:
   name_template: 'checksums.txt'
 
@@ -165,6 +187,13 @@ release:
     sudo apk add --allow-untrusted nylas_{{ .Version }}_linux_amd64.apk
     ```
 
+    **Arch Linux (AUR):**
+    ```bash
+    yay -S nylas
+    # or
+    paru -S nylas
+    ```
+
     **Docker:**
     ```bash
     docker pull ghcr.io/nylas/cli:{{ .Version }}