Carry PR build artifacts inside a tar so epoch package names survive

actions/upload-artifact rejects any path containing ':', and makepkg names
a package with an epoch `name-1:ver-rel-arch.pkg.tar.zst`. Every PR that
built such a package (cursor-cli in the sync PRs, omasnap once it gained an
epoch) failed at "Upload artifact" after a successful build, and publish
then rebuilt from scratch on merge.

The files now ride inside packages.tar for the artifact hop and come back
out with makepkg's names untouched: pacman clients and bin/publish-artifact
both require the filename to match PKGINFO, and the channels already carry
these names. publish.yml still accepts bare pre-packing artifacts until the
7-day retention drains them.

helpers/artifact-helpers.sh holds both halves; tests/artifact-helpers.sh
covers the round trip and runs with the other self-tests.

.github/workflows/build-pr.yml

@@ -170,12 +170,22 @@ jobs:
       - name: Tree hash
         id: tree
         run: echo "hash=$(git rev-parse "${{ github.event.pull_request.head.sha || github.sha }}:pkgbuilds/${{ matrix.package }}")" >> "$GITHUB_OUTPUT"
-      - name: Upload artifact
+      # The upload action rejects a path containing ':', which is how makepkg
+      # names a package with an epoch. The files ride inside packages.tar
+      # (helpers/artifact-helpers.sh); publish.yml unpacks it.
+      - name: Pack artifact
+        id: pack
         if: always()
+        run: |
+          source helpers/artifact-helpers.sh
+          pack_packages build-output/edge/${{ matrix.arch }} packages.tar
+          tar -tvf packages.tar
+      - name: Upload artifact
+        if: always() && steps.pack.outcome == 'success'
         uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.package }}-${{ matrix.arch }}-${{ steps.tree.outputs.hash }}
-          path: build-output/edge/${{ matrix.arch }}/*.pkg.tar.zst
+          path: packages.tar
           if-no-files-found: error
           retention-days: 7
 

.github/workflows/publish.yml

@@ -83,13 +83,17 @@ jobs:
           cat plan.txt
 
       # Fetch each package's PR artifact into build-output/edge/<arch>/, or
-      # build it when no artifact exists for exactly this tree.
+      # build it when no artifact exists for exactly this tree. An artifact
+      # carries its package files inside packages.tar (see build-pr.yml and
+      # helpers/artifact-helpers.sh: the upload action rejects the colon in
+      # an epoch filename).
       - name: Collect artifacts
         env:
           GH_TOKEN: ${{ github.token }}
           CONTAINER_ENGINE: docker
         run: |
           set -uo pipefail
+          source helpers/artifact-helpers.sh
           # sources.jsonl: where each package's files came from, or that the
           # build failed. A failed build ends the run before any publish, and
           # the record says so instead of the report job finding nothing.
@@ -104,7 +108,10 @@ jobs:
             mkdir -p "build-output/edge/$arch"
             if [[ -n "$found" ]]; then
               echo "==> $label: PR artifact"
-              if curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -o /tmp/artifact.zip "$found" && unzip -oq /tmp/artifact.zip -d "build-output/edge/$arch"; then
+              rm -rf /tmp/artifact; mkdir -p /tmp/artifact
+              if curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -o /tmp/artifact.zip "$found" \
+                && unzip -oq /tmp/artifact.zip -d /tmp/artifact \
+                && unpack_packages /tmp/artifact "build-output/edge/$arch"; then
                 jq -nc --arg p "$package" --arg a "$arch" '{package:$p, arch:$a, source:"pr-artifact"}' >> sources.jsonl
               else
                 jq -nc --arg p "$package" --arg a "$arch" '{package:$p, arch:$a, source:"artifact-download-failed"}' >> sources.jsonl; failed=1; break

.github/workflows/test.yml

@@ -54,6 +54,7 @@ jobs:
               ./tests/partial-release.sh
               ./tests/published-build-plan.sh
               ./tests/controller.sh
+              ./tests/artifact-helpers.sh
               pacman -S --noconfirm --quiet rclone >/dev/null
               ./tests/publish-artifact.sh
             '