feat: add pkgbuild manager (Arch Linux PKGBUILD)

[M0Rf30]

Summary

Adds a new manager for Arch Linux PKGBUILD files. Automatically detects new versions, updates pkgver, resets pkgrel, downloads source archives, computes checksums, and creates pull requests.

What it does

• Automatically detects new versions from source URLs
• Updates pkgver to the new version
• Resets pkgrel to 1 (Arch convention)
• Downloads new source archive and computes checksums programmatically
• Updates sha256sums, sha512sums, b2sums, md5sums
• Creates a pull request with all changes

Supported package sources

GitHub

• Archive and release URLs

GitLab

• gitlab.com and self-hosted instances

PyPI (Python)

• files.pythonhosted.org, pypi.org

npm (Node.js)

• Regular and scoped packages (@org/package)

CPAN (Perl)

• cpan.metacpan.org

Packagist (PHP)

• packagist.org

Gitea

• gitea.com, codeberg.org, and self-hosted

Forgejo

• code.forgejo.org and self-hosted

Generic Git repositories

• Any git hosting with archive URLs or .git URLs

Repology (fallback)

• Used automatically for unknown sources
• Can be manually configured: # renovate: repology=repo/package

Additional features

• Variable expansion: ${pkgver}, $pkgver, ${_pkgver}, $_pkgver
• Architecture-specific checksums: sha256sums_x86_64, sha256sums_aarch64, etc.
• Multi-source arrays (updates all sources that use ${pkgver})
• Handles multiple archive formats: .tar.gz, .tar.bz2, .tar.xz, .zip, .tgz

What it doesn't support

• VCS sources (git+https://...)
• -git packages that track HEAD/latest commit
• Packages with dynamic pkgver() functions

Example

pkgname=example
pkgver=1.2.3
pkgrel=1
source=("https://github.com/owner/repo/archive/v${pkgver}.tar.gz")
sha256sums=('abc123...')

Renovate detects GitHub, updates pkgver, resets pkgrel, downloads new tarball, computes new checksum.

Context

• I accept the risk that this PR may be closed if maintainers disagree

AI assistance disclosure

• Yes — minimal assistance

Documentation

• I have updated documentation

How I've tested my work

• Unit tests + real repository

[RahulGautamSingh]

Thanks for the PR!

I have done a half-review..and will review again after changes are applied.

Please, use the review request feature for notifying.

[M0Rf30]

Thanks for the PR!

I have done a half-review..and will review again after changes are applied.

Please, use the review request feature for notifying.

@RahulGautamSingh I think it's ready now. I'm writing here because I requested a review some time ago. Some time has passed, and here we are 😄

[D3vil0p3r]

@M0Rf30 does your change include also the updpkgsums to have the updated hashes and at the end the creation of a PR?

Does it work also with -git packages to retrieve the latest commit version in PKGBUILD?
Does it work also with Python PyPI libs versioning update?

[M0Rf30]

@M0Rf30 does your change include also the updpkgsums to have the updated hashes and at the end the creation of a PR?

Does it work also with -git packages to retrieve the latest commit version in PKGBUILD? Does it work also with Python PyPI libs versioning update?

@M0Rf30 does your change include also the updpkgsums to have the updated hashes and at the end the creation of a PR?

Does it work also with -git packages to retrieve the latest commit version in PKGBUILD? Does it work also with Python PyPI libs versioning update?

PyPI is fully supported

The implementation downloads the source archive directly and computes all checksums programmatically using Node's crypto module. It automatically calculates all checksum types present in the PKGBUILD (sha256, sha512, b2, md5).

This manager is designed for versioned releases, not VCS sources. Git packages (like -git AUR packages that track HEAD) use git+ URLs and have dynamic pkgver() functions rather than static versions, so they're fundamentally incompatible with this approach. The manager only handles versioned tarballs/archives from known sources.

[D3vil0p3r]

Grande! For git versioning I'll try to look for another bot if existing. For this PR, is there something additional you need to add on the code, or it needs only to be reviewed and merged?

Also svc stable sources are supported?

[viceice]

use named capture groups

[RahulGautamSingh]

 pkgver=1.2.3
  _pkgver=1.2.3
  source=("https://example.com/releases/example-${_pkgver}.tar.gz")

test fails: after bumping to 1.2.4, the updater rewrites pkgver, but _pkgver stays at 1.2.3

Is this expected?

[RahulGautamSingh]

Waiting for reply for: #39466 (review)

[M0Rf30]

 pkgver=1.2.3
  _pkgver=1.2.3
  source=("https://example.com/releases/example-${_pkgver}.tar.gz")

test fails: after bumping to 1.2.4, the updater rewrites pkgver and resets pkgrel, but _pkgver stays at 1.2.3

Is this expected?

Not expected, so I fixed the error. Now custom variables expansion is done correctly in assignments (pkgver="${_pkgver}")

[RahulGautamSingh]

lint failure

[RahulGautamSingh]

A couple more spots that should switch to named capture groups, matching what github.ts / gitlab.ts / cpan.ts etc. now use:

• lib/modules/manager/pkgbuild/extract/pypi.ts:23 — capture name and version by name
• lib/modules/manager/pkgbuild/extract/packagist.ts:33 — same

[RahulGautamSingh]

LGTM overall.