From aa106c86eed77636833091db4ed41010bd5bdab4 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 6 Nov 2026 19:33:10 -0500
Subject: [PATCH] feat: allow additional Arch runtime dependencies (#161)

---
 actions/arch-package/action.yml           |  6 ++++
 actions/arch-package/arch-package.sh      | 12 +++++++-
 actions/arch-package/docker-entrypoint.sh |  2 ++
 tests/test_arch.py                        | 34 +++++++++++++++++++++++
 4 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/actions/arch-package/action.yml b/actions/arch-package/action.yml
index 19f068d..fb029e6 100644
--- a/actions/arch-package/action.yml
+++ b/actions/arch-package/action.yml
@@ -17,6 +17,10 @@ inputs:
     description: "SPDX license expression for the package"
     required: false
     default: "MIT OR Apache-2.0"
+  extra-depends:
+    description: "Additional Arch runtime dependencies, separated by spaces or newlines"
+    required: false
+    default: ""
   pkgrel:
     description: "Package release number"
     required: false
@@ -32,6 +36,7 @@ runs:
         TARGET_ARCH: ${{ inputs.arch }}
         OUTPUT_DIR: ${{ inputs.output-dir }}
         ARCH_LICENSE: ${{ inputs.license }}
+        ARCH_EXTRA_DEPENDS: ${{ inputs.extra-depends }}
         PKGREL: ${{ inputs.pkgrel }}
       run: |
         if [ -z "${SOURCE_DATE_EPOCH:-}" ]; then
@@ -49,6 +54,7 @@ runs:
             -e TARGET_ARCH="$TARGET_ARCH" \
             -e OUTPUT_DIR="$OUTPUT_DIR" \
             -e ARCH_LICENSE="$ARCH_LICENSE" \
+            -e ARCH_EXTRA_DEPENDS="$ARCH_EXTRA_DEPENDS" \
             -e PKGREL="$PKGREL" \
             -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
             -v "$GITHUB_WORKSPACE:/workspace" \
diff --git a/actions/arch-package/arch-package.sh b/actions/arch-package/arch-package.sh
index 243d41d..5dcf276 100755
--- a/actions/arch-package/arch-package.sh
+++ b/actions/arch-package/arch-package.sh
@@ -196,6 +196,16 @@ EOF
 # libxkbcommon-x11 is a hard dependency next to libxkbcommon: the apps build winit's X11 backend,
 # which loads it at startup on X11 and XWayland, and panics without it ("Library
 # libxkbcommon-x11.so could not be loaded"; photocraft#201). Arch packages it separately.
+extra_dependencies=()
+extra_dependencies_input="${ARCH_EXTRA_DEPENDS:-}"
+extra_dependencies_input="${extra_dependencies_input//$'\r'/}"
+read -r -a extra_dependencies <<< "${extra_dependencies_input//$'\n'/ }"
+extra_dependencies_shell=""
+for dependency in "${extra_dependencies[@]}"; do
+  [[ "$dependency" =~ ^[a-zA-Z0-9@_+][a-zA-Z0-9@._+-]*((<=|>=|=|<|>)[a-zA-Z0-9@._+:-]+)?$ ]] || die "invalid extra dependency: $dependency"
+  extra_dependencies_shell+=" $(printf '%q' "$dependency")"
+done
+
 cat > "$work/PKGBUILD" <<EOF
 # Maintainer: Storyteller Authors
 pkgname=$(printf '%q' "$pkgname")
@@ -205,7 +215,7 @@ pkgdesc=$(printf '%q' "$pkgdesc")
 arch=($(printf '%q' "$arch"))
 url=$(printf '%q' "$url")
 license=($license_str)
-depends=('glibc' 'gcc-libs' 'hicolor-icon-theme' 'libxkbcommon' 'libxkbcommon-x11' 'vulkan-icd-loader')
+depends=('glibc' 'gcc-libs' 'hicolor-icon-theme' 'libxkbcommon' 'libxkbcommon-x11' 'vulkan-icd-loader'$extra_dependencies_shell)
 optdepends=(
   'alsa-lib: sound support'
   'pipewire-alsa: audio playback and recording via PipeWire'
diff --git a/actions/arch-package/docker-entrypoint.sh b/actions/arch-package/docker-entrypoint.sh
index 7715710..aa67897 100755
--- a/actions/arch-package/docker-entrypoint.sh
+++ b/actions/arch-package/docker-entrypoint.sh
@@ -37,6 +37,7 @@ run_as_builder() {
       TARGET_ARCH="$target_arch" \
       OUTPUT_DIR="$out_dir" \
       ARCH_LICENSE="$arch_license" \
+      ARCH_EXTRA_DEPENDS="${ARCH_EXTRA_DEPENDS:-}" \
       PKGREL="$pkgrel" \
       SOURCE_DATE_EPOCH="$source_date_epoch" \
       bash /action/arch-package.sh "$tarball" "$target_arch" "$out_dir"
@@ -47,6 +48,7 @@ run_as_builder() {
       TARGET_ARCH="$target_arch" \
       OUTPUT_DIR="$out_dir" \
       ARCH_LICENSE="$arch_license" \
+      ARCH_EXTRA_DEPENDS="${ARCH_EXTRA_DEPENDS:-}" \
       PKGREL="$pkgrel" \
       SOURCE_DATE_EPOCH="$source_date_epoch" \
       bash /action/arch-package.sh "$tarball" "$target_arch" "$out_dir"
diff --git a/tests/test_arch.py b/tests/test_arch.py
index 28eacde..98506f6 100644
--- a/tests/test_arch.py
+++ b/tests/test_arch.py
@@ -107,6 +107,40 @@ exit 0
         mp.chmod(0o755)
         return tools
 
+    def test_extra_runtime_dependencies(self):
+        """Validate and append extra runtime dependencies to the PKGBUILD depends array."""
+        test_cases = (
+            ("webkit2gtk-4.1 gtk3 openssl", True),
+            ("webkit2gtk-4.1\ngtk3\r\nopenssl>=3", True),
+            ("webkit;touch-injected", False),
+            ("openssl>=", False),
+        )
+        for dependencies, valid in test_cases:
+            with self.subTest(dependencies=dependencies), tempfile.TemporaryDirectory() as tmpdir:
+                root = Path(tmpdir)
+                tarball = self._create_fixture_tarball(root)
+                tools = self._setup_mock_tools(root)
+                capture = root / "capture"
+                capture.mkdir()
+                result = subprocess.run(
+                    [str(ARCH_SCRIPT), str(tarball), "x86_64", str(root / "out")],
+                    capture_output=True, text=True,
+                    env={**os.environ, "PATH": f"{tools}:{os.environ['PATH']}",
+                         "MOCK_CAPTURE": str(capture), "ARCH_EXTRA_DEPENDS": dependencies},
+                )
+                if not valid:
+                    self.assertNotEqual(result.returncode, 0)
+                    self.assertIn("invalid extra dependency", result.stderr)
+                else:
+                    self.assertEqual(result.returncode, 0, result.stderr)
+                    depends = subprocess.run(
+                        ["bash", "-c", 'source "$1" && printf "%s\\n" "${depends[@]}"',
+                         "_", str(capture / "PKGBUILD")],
+                        capture_output=True, text=True, check=True,
+                    ).stdout.splitlines()
+                    for dependency in dependencies.split():
+                        self.assertIn(dependency, depends)
+
     def test_unsupported_architecture_rejected(self):
         with tempfile.TemporaryDirectory() as tmpdir:
             tmp_path = Path(tmpdir)