Update pacman to a patched version that does not deadlock on Windows/…

…ARM64

This downloads the PR build artifact of
msys2/MSYS2-packages#4583 and installs it in
`git-sdk-arm64`.

The idea is that the subsequent `sync` job runs as well as the
subsequent `build-and-deploy` runs in `git-for-windows-automation` won't
hang but instead succeed.

Signed-off-by: Dennis Ameling <dennis@dennisameling.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

.github/workflows/update-pacman.yml

@@ -0,0 +1,57 @@
+name: update-pacman
+
+on:
+  push:
+    branches:
+    - patched-pacman-gpgme
+
+env:
+  GIT_CONFIG_PARAMETERS: "'user.name=Git for Windows Build Agent' 'user.email=ci@git-for-windows.build' 'windows.sdk64.path=${{ github.workspace }}' 'windows.sdk32.path=' 'http.sslbackend=schannel' 'core.autocrlf=false' 'checkout.workers=16'"
+  HOME: "${{ github.workspace }}\\home\\git-ci"
+  MSYSTEM: MSYS
+
+jobs:
+  update-pacman:
+    if: github.repository_owner == 'git-for-windows'
+    # We can get away with using x86_64 runners because `pacman.exe` is actually an x86_64 program
+    runs-on: windows-latest
+    permissions:
+      contents: write
+    steps:
+      - name: clone git-sdk-arm64
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: true
+          token: ${{ secrets.PUSH_TOKEN }}
+      - name: download Pacman package
+        id: download
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Only do this unless `pacman` is already prevented from being upgraded
+          grep '^ *IgnorePkg *= *pacman' etc/pacman.conf && exit 0
+
+          sha="$(gh api repos/msys2/MSYS2-packages/pulls/4583 \
+               --jq '.head.sha')" &&
+          check_run_url="$(gh api repos/msys2/MSYS2-packages/commits/$sha/check-runs \
+                         --jq '.check_runs[] | select(.name=="MSYS") | .url')" &&
+          workflow_job_url="$(gh api "${check_run_url#https://api.github.com/}" --jq '.details_url')" &&
+          workflow_run_url="${workflow_job_url%/job/*}" &&
+          artifacts_url="$(gh api "repos/${workflow_run_url#https://github.com/}" --jq '.artifacts_url')" &&
+          zip_url="$(gh api "${artifacts_url#https://api.github.com/}" --jq '.artifacts[].archive_download_url')" &&
+          curl -H "Authorization: token ${{secrets.GITHUB_TOKEN}}" -#sLo /tmp/MSYS2-packages.zip "$zip_url" &&
+          unzip /tmp/MSYS2-packages.zip &&
+          echo "result=$(echo pacman-*.pkg.tar*)" >>$GITHUB_OUTPUT
+      - name: install and commit ${{ steps.download.outputs.result }}
+        if: steps.download.outputs.result != ''
+        shell: bash
+        run: |
+          pacman -U --noconfirm '${{ steps.download.outputs.result }}' &&
+          git add -A &&
+          git commit -m 'Install ${{ steps.download.outputs.result }}' &&
+          sed -i 's/^# *\(IgnorePkg *=\).*/\1 pacman/' etc/pacman.conf &&
+          git commit -m 'Prevent `pacman` from being upgraded' \
+            -m 'It has been overridden with a version that does not deadlock on Windows/ARM64' \
+            etc/pacman.conf &&
+          git push origin HEAD