fix(workflows): improve AUR SSH key handling and clone/push retries

This update enhances the workflow for interacting with the AUR by
adding robust error handling for SSH key retrieval and repository
cloning/pushing. It implements retry logic with exponential backoff
for both SSH host key retrieval and git operations, improving
resilience against transient network issues.

- Added retries for SSH key retrieval with exponential backoff
- Implemented retry logic for cloning and pushing to AUR repository
- Ensured script exits gracefully with error messages on failure

.gitea/workflows/app_builder.yaml

@@ -5,7 +5,8 @@ on:
     types: [published]
 
 jobs:
-  publish-tauri:
+  publish-windows:
+    name: Build and publish Windows installer
     permissions:
       contents: write
     environment: production
@@ -30,25 +31,7 @@ jobs:
       run:
         working-directory: GitLite
 
-    strategy:
+    runs-on: windows-latest
-      fail-fast: false
-      max-parallel: 1
-      matrix:
-        include:
-          # - platform: 'macos-latest'
-          #   args: '--target aarch64-apple-darwin'
-          # - platform: 'macos-latest'
-          #   args: '--target x86_64-apple-darwin'
-          - platform: "windows-latest"
-            bundles: "nsis"
-            updater_platform: "windows-x86_64"
-            no_strip: ""
-          - platform: "ubuntu-22.04"
-            bundles: "appimage"
-            updater_platform: "linux-x86_64"
-            no_strip: "1"
-
-    runs-on: ${{ matrix.platform }}
 
     steps:
       # cicd_tool/main.py expects the repo at <workspace>/GitLite, so check out there.
@@ -56,25 +39,11 @@ jobs:
         with:
           path: GitLite
 
-      - name: install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential curl wget file libssl-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libxdo-dev libfuse2
-
       - name: setup node
         uses: actions/setup-node@v4
         with:
           node-version: lts/*
 
-      - name: Install uv
-        if: matrix.platform == 'ubuntu-22.04'
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
-
-      - name: install rust toolchain
-        if: matrix.platform == 'ubuntu-22.04'
-        uses: dtolnay/rust-toolchain@stable
-
       - name: install frontend dependencies
         run: npm ci
 
@@ -88,7 +57,6 @@ jobs:
           node -e "const fs=require('fs'); const path='src-tauri/tauri.conf.json'; const config=JSON.parse(fs.readFileSync(path,'utf8')); config.version=process.env.RELEASE_VERSION; fs.writeFileSync(path, JSON.stringify(config,null,2)+'\n');"
 
       - name: Commit and Push Changes
-        if: matrix.platform == 'windows-latest'
         shell: powershell
         run: |
           git config user.name '${{ vars.USERNAME_GIT }}'
@@ -139,15 +107,15 @@ jobs:
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD}}
-          NO_STRIP: ${{ matrix.no_strip }}
+          NO_STRIP: ""
-        run: npm run tauri -- build --bundles ${{ matrix.bundles }}
+        run: npm run tauri -- build --bundles nsis
       # ----------------------
       # Upload to MinIO (via mc) and create latest.json
       # ----------------------
       - name: Upload artifacts to MinIO with cicd_tool
         working-directory: GitLite/cicd_tool
         env:
-          PUBLISH_PLATFORM: ${{ matrix.updater_platform }}
+          PUBLISH_PLATFORM: windows-x86_64
         run: |
           uv sync
           uv run main.py
@@ -167,11 +135,66 @@ jobs:
       - name: Prepare Arch job container
         working-directory: /
         run: |
-          pacman -Syu --noconfirm
+          set -euo pipefail
-          pacman -S --needed --noconfirm \
+
-            base-devel curl git nodejs npm openssh rust \
+          # The runner image may contain only a single geo mirror. Seed several
-            webkit2gtk-4.1 gtk3 hicolor-icon-theme \
+          # currently active HTTPS mirrors and retain the image's list as a
+          # fallback so one slow CDN cannot fail the complete release.
+          ARCH_MIRROR_BACKUP="$(mktemp)"
+          cp /etc/pacman.d/mirrorlist "$ARCH_MIRROR_BACKUP"
+          printf '%s\n' \
+            'Server = https://frankfurt.mirror.pkgbuild.com/$repo/os/$arch' \
+            'Server = https://mirror.osbeck.com/archlinux/$repo/os/$arch' \
+            'Server = https://mirror.ubrco.de/archlinux/$repo/os/$arch' \
+            'Server = https://ftp.halifax.rwth-aachen.de/archlinux/$repo/os/$arch' \
+            'Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch' \
+            > /etc/pacman.d/mirrorlist
+          sed -n '/^[[:space:]]*Server[[:space:]]*=/p' "$ARCH_MIRROR_BACKUP" \
+            >> /etc/pacman.d/mirrorlist
+
+          ARCH_PACKAGES=(
+            base-devel curl git nodejs npm openssh rust
+            webkit2gtk-4.1 gtk3 hicolor-icon-theme
             libappindicator-gtk3 librsvg xdotool
+          )
+
+          for ARCH_INSTALL_ATTEMPT in 1 2 3; do
+            echo "pacman attempt $ARCH_INSTALL_ATTEMPT of 3"
+            timeout --signal=TERM 30m \
+              pacman -Syu --needed --noconfirm --noprogressbar \
+              "${ARCH_PACKAGES[@]}" \
+              </dev/null &
+            ARCH_PACMAN_PID=$!
+            (
+              ARCH_WAIT_SECONDS=0
+              while true; do
+                sleep 30
+                ((ARCH_WAIT_SECONDS += 30))
+                echo "pacman is still running (${ARCH_WAIT_SECONDS}s elapsed)"
+              done
+            ) &
+            ARCH_HEARTBEAT_PID=$!
+
+            ARCH_PACMAN_STATUS=0
+            wait "$ARCH_PACMAN_PID" || ARCH_PACMAN_STATUS=$?
+            kill "$ARCH_HEARTBEAT_PID" 2>/dev/null || true
+            wait "$ARCH_HEARTBEAT_PID" 2>/dev/null || true
+
+            if [ "$ARCH_PACMAN_STATUS" -eq 0 ]; then
+              break
+            fi
+
+            if [ "$ARCH_PACMAN_STATUS" -eq 124 ]; then
+              echo "pacman attempt timed out after 30 minutes" >&2
+            fi
+
+            if [ "$ARCH_INSTALL_ATTEMPT" -eq 3 ]; then
+              echo "pacman failed after 3 attempts" >&2
+              exit 1
+            fi
+
+            sleep "$((ARCH_INSTALL_ATTEMPT * 5))"
+          done
 
       - uses: actions/checkout@v5
         with:
@@ -218,6 +241,8 @@ jobs:
           AUR_GIT_NAME: ${{ vars.USERNAME_GIT }}
           AUR_GIT_EMAIL: ${{ vars.EMAIL_GIT }}
         run: |
+          set -euo pipefail
+
           if [ -z "$AUR_SSH_PRIVATE_KEY" ]; then
             echo "AUR_SSH_PRIVATE_KEY is required" >&2
             exit 1
@@ -226,13 +251,48 @@ jobs:
           install -d -m 0700 "$HOME/.ssh"
           printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$HOME/.ssh/aur"
           chmod 0600 "$HOME/.ssh/aur"
-          ssh-keyscan -H aur.archlinux.org >> "$HOME/.ssh/known_hosts"
-          chmod 0600 "$HOME/.ssh/known_hosts"
-          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/aur -o IdentitiesOnly=yes"
 
-          AUR_CHECKOUT="$(mktemp -d)/gitty-desktop"
+          AUR_RETRY_DELAYS=(30 60 120 240)
-          git -c init.defaultBranch=master clone \
+          AUR_KNOWN_HOSTS_TEMP="$(mktemp)"
-            ssh://aur@aur.archlinux.org/gitty-desktop.git "$AUR_CHECKOUT"
+          AUR_HOST_KEY_READY=0
+          for AUR_ATTEMPT in 1 2 3 4 5; do
+            echo "AUR host-key attempt $AUR_ATTEMPT of 5"
+            if timeout 30s ssh-keyscan -T 15 -H aur.archlinux.org > "$AUR_KNOWN_HOSTS_TEMP" \
+              && [ -s "$AUR_KNOWN_HOSTS_TEMP" ]; then
+              AUR_HOST_KEY_READY=1
+              break
+            fi
+            if [ "$AUR_ATTEMPT" -lt 5 ]; then
+              sleep "${AUR_RETRY_DELAYS[$((AUR_ATTEMPT - 1))]}"
+            fi
+          done
+          if [ "$AUR_HOST_KEY_READY" -ne 1 ]; then
+            echo "Could not retrieve the AUR SSH host key after 5 attempts" >&2
+            exit 1
+          fi
+          install -m 0600 "$AUR_KNOWN_HOSTS_TEMP" "$HOME/.ssh/known_hosts"
+          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/aur -o IdentitiesOnly=yes -o BatchMode=yes -o ConnectTimeout=30 -o ServerAliveInterval=15 -o ServerAliveCountMax=2"
+
+          AUR_CHECKOUT_ROOT="$(mktemp -d)"
+          AUR_CHECKOUT=""
+          for AUR_ATTEMPT in 1 2 3 4 5; do
+            AUR_CLONE_CANDIDATE="$AUR_CHECKOUT_ROOT/attempt-$AUR_ATTEMPT"
+            echo "AUR clone attempt $AUR_ATTEMPT of 5"
+            if timeout 3m git -c init.defaultBranch=master clone \
+              ssh://aur@aur.archlinux.org/gitty-desktop.git "$AUR_CLONE_CANDIDATE"; then
+              AUR_CHECKOUT="$AUR_CLONE_CANDIDATE"
+              break
+            fi
+            if [ "$AUR_ATTEMPT" -lt 5 ]; then
+              echo "AUR is unavailable; retrying after backoff"
+              sleep "${AUR_RETRY_DELAYS[$((AUR_ATTEMPT - 1))]}"
+            fi
+          done
+          if [ -z "$AUR_CHECKOUT" ]; then
+            echo "Could not clone the AUR repository after 5 attempts" >&2
+            exit 1
+          fi
+
           cp "$AUR_SOURCE_DIR/PKGBUILD" "$AUR_SOURCE_DIR/.SRCINFO" "$AUR_CHECKOUT/"
 
           cd "$AUR_CHECKOUT"
@@ -246,4 +306,93 @@ jobs:
           fi
 
           git commit -m "Update to $PACKAGE_VERSION"
-          git push origin HEAD:master
+          AUR_PUSHED=0
+          for AUR_ATTEMPT in 1 2 3 4 5; do
+            echo "AUR push attempt $AUR_ATTEMPT of 5"
+            if timeout 3m git push origin HEAD:master; then
+              AUR_PUSHED=1
+              break
+            fi
+            if [ "$AUR_ATTEMPT" -lt 5 ]; then
+              echo "AUR push failed; retrying after backoff"
+              sleep "${AUR_RETRY_DELAYS[$((AUR_ATTEMPT - 1))]}"
+            fi
+          done
+          if [ "$AUR_PUSHED" -ne 1 ]; then
+            echo "Could not publish to AUR after 5 attempts" >&2
+            exit 1
+          fi
+
+  publish-ubuntu:
+    name: Build and publish Ubuntu AppImage
+    permissions:
+      contents: write
+    environment: production
+    env:
+      GITEA_API: https://git.cbsk-tech.de/api/v1
+      OWNER: Christoph
+      REPO: GitLite
+      GITEA_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
+      GITEA_FALLBACK_TOKEN: ${{ github.token }}
+
+      MINIO_ENDPOINT: ${{ vars.MINIO_ENDPOINT }}
+      S3_BUCKET: ${{ vars.S3_BUCKET }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_KEY }}
+      ARTIFACT_BASE_URL: ${{ vars.ARTIFACT_BASE_URL }}
+      S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
+      S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
+
+    defaults:
+      run:
+        working-directory: GitLite
+
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          path: GitLite
+
+      - name: Install Ubuntu dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential curl wget file libssl-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libxdo-dev libfuse2
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install frontend dependencies
+        run: npm ci
+
+      - name: Update package.json version
+        run: npm version ${{ github.ref_name }} --no-git-tag-version --allow-same-version
+
+      - name: Update tauri.conf.json version
+        env:
+          RELEASE_VERSION: ${{ github.ref_name }}
+        run: |
+          node -e "const fs=require('fs'); const path='src-tauri/tauri.conf.json'; const config=JSON.parse(fs.readFileSync(path,'utf8')); config.version=process.env.RELEASE_VERSION; fs.writeFileSync(path, JSON.stringify(config,null,2)+'\n');"
+
+      - name: Build Tauri App
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD}}
+          NO_STRIP: "1"
+        run: npm run tauri -- build --bundles appimage
+
+      - name: Upload artifacts to MinIO with cicd_tool
+        working-directory: GitLite/cicd_tool
+        env:
+          PUBLISH_PLATFORM: linux-x86_64
+        run: |
+          uv sync
+          uv run main.py

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "gitty",
-  "version": "2026.7.22",
+  "version": "2026.8.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "gitty",
-      "version": "2026.7.22",
+      "version": "2026.8.1",
       "dependencies": {
         "@lucide/svelte": "^1.21.0",
         "@tailwindcss/vite": "^4.3.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitty",
-  "version": "2026.7.22",
+  "version": "2026.8.1",
   "private": true,
   "type": "module",
   "scripts": {

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Gitty",
-  "version": "2026.7.22",
+  "version": "2026.8.1",
   "identifier": "com.gitty",
   "build": {
     "beforeDevCommand": "npm run dev",

src/App.svelte

@@ -3967,10 +3967,10 @@
       helpOpen = false;
       return;
     }
-    if (event.key === "Escape" && fileHistoryDialogOpen && !isBusy) closeFileHistoryDialog();
+    if (event.key === "Escape" && compareDialogOpen) closeCompareDialog();
+    else if (event.key === "Escape" && fileHistoryDialogOpen && !isBusy) closeFileHistoryDialog();
     else if (event.key === "Escape" && repoTabContextMenu) closeRepoTabContextMenu();
     else if (event.key === "Escape" && pendingDiscard && !isBusy) closeDiscardConfirm();
-    else if (event.key === "Escape" && compareDialogOpen) closeCompareDialog();
     else if (event.key === "Escape" && newBranchCommit) newBranchCommit = null;
     else if (event.key === "Escape" && renameBranchTarget) renameBranchTarget = null;
     else if (event.key === "Escape" && deleteBranchTarget) closeDeleteBranchDialog();

src/app.css

@@ -2882,6 +2882,7 @@
     overflow: hidden;
   }
   .file-history-dialog-backdrop { z-index: 70; }
+  .compare-dialog-backdrop { z-index: 80; }
   .file-history-dialog {
     display: grid;
     grid-template-rows: auto minmax(0, 1fr);

src/lib/components/CompareDialog.svelte

@@ -216,7 +216,7 @@
 </script>
 
 <div
-  class="dialog-backdrop"
+  class="dialog-backdrop compare-dialog-backdrop"
   role="presentation"
 >
   <div class="dialog compare-dialog" role="dialog" aria-modal="true" aria-label="Commit comparison" tabindex="-1">