274 lines
12 KiB
YAML
274 lines
12 KiB
YAML
|
# SPDX-License-Identifier: AGPL-3.0-only
|
||
|
|
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
||
|
|
name: Flatpak
|
||
|
|
|
||
|
|
# Crafter.Build's workflow, for this app. One job, three outcomes:
|
||
|
|
# pull request -> build the Flatpak, run the suite inside it, smoke-test it
|
||
|
|
# push master -> also publish it as the `beta` branch of the Catcrafts
|
||
|
|
# repo and refresh the rolling `latest` release
|
||
|
|
# tag X.Y.Z -> publish it as `stable` and create release X.Y.Z
|
||
|
|
#
|
||
|
|
# It builds on the Crafter.Build Flatpak (`base:` in the manifest), whose
|
||
|
|
# crafter-build and LLVM compile this project, so the runner installs that
|
||
|
|
# base from the same repo it publishes into.
|
||
|
|
#
|
||
|
|
# The `crafter-flatpak` label is the privileged runner on the Hetzner box
|
||
|
|
# (bubblewrap needs it) with the Sdk install, the flatpak-builder state, the
|
||
|
|
# repo's web root and the signing key mounted. It is registered to
|
||
|
|
# Crafter.Build alone today: until this repository has such a runner, this
|
||
|
|
# workflow does not run.
|
||
|
|
#
|
||
|
|
# Both apps publish into one repo: the publish step holds
|
||
|
|
# /srv/flatpak/.publish.lock, which protects anything once Crafter.Build's
|
||
|
|
# workflow takes it too. This one writes its own flatpakref and never the
|
||
|
|
# shared catcrafts.flatpakrepo, which Crafter.Build's workflow owns.
|
||
|
|
on:
|
||
|
|
pull_request:
|
||
|
|
branches: [master]
|
||
|
|
push:
|
||
|
|
branches: [master]
|
||
|
|
tags: ['[0-9]*.[0-9]*.[0-9]*']
|
||
|
|
workflow_dispatch:
|
||
|
|
|
||
|
|
env:
|
||
|
|
APP_ID: net.catcrafts.CrafterReview
|
||
|
|
MANIFEST: packaging/flatpak/net.catcrafts.CrafterReview.yaml
|
||
|
|
CI_MANIFEST: packaging/flatpak/ci-manifest.yaml
|
||
|
|
METAINFO: packaging/flatpak/net.catcrafts.CrafterReview.metainfo.xml
|
||
|
|
RUNTIME: org.freedesktop.Sdk//26.08
|
||
|
|
BASE: net.catcrafts.CrafterBuild//stable
|
||
|
|
REPO_DIR: /srv/flatpak/repo
|
||
|
|
WEB_DIR: /srv/flatpak
|
||
|
|
|
||
|
|
jobs:
|
||
|
|
flatpak:
|
||
|
|
runs-on: crafter-flatpak
|
||
|
|
container:
|
||
|
|
image: archlinux:latest
|
||
|
|
options: >-
|
||
|
|
-v crafter-flatpak-system:/var/lib/flatpak
|
||
|
|
-v crafter-flatpak-builder:/root/.cache/flatpak-builder
|
||
|
|
-v /var/www/flatpak:/srv/flatpak
|
||
|
|
-v /etc/crafter-flatpak:/run/crafter-flatpak:ro
|
||
|
|
steps:
|
||
|
|
- name: Install tools
|
||
|
|
run: |
|
||
|
|
pacman-key --init
|
||
|
|
pacman-key --populate archlinux
|
||
|
|
pacman -Sy --noconfirm --needed archlinux-keyring
|
||
|
|
pacman -Syu --noconfirm --needed flatpak flatpak-builder ccache git jq gnupg go-yq ostree python util-linux
|
||
|
|
git config --global --add safe.directory '*'
|
||
|
|
|
||
|
|
- name: Sdk and base app
|
||
|
|
# A no-op once the volume is warm; `update` follows point releases
|
||
|
|
# and a new stable base.
|
||
|
|
run: |
|
||
|
|
flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
|
||
|
|
flatpak remote-add --if-not-exists catcrafts https://flatpak.catcrafts.net/catcrafts.flatpakrepo
|
||
|
|
flatpak install -y --noninteractive flathub "$RUNTIME"
|
||
|
|
flatpak install -y --noninteractive catcrafts "$BASE"
|
||
|
|
flatpak update -y --noninteractive
|
||
|
|
|
||
|
|
- name: Checkout
|
||
|
|
uses: actions/checkout@v4
|
||
|
|
with:
|
||
|
|
fetch-depth: 0
|
||
|
|
persist-credentials: true
|
||
|
|
|
||
|
|
- name: Version and channel
|
||
|
|
id: meta
|
||
|
|
run: |
|
||
|
|
set -eu
|
||
|
|
if [ "${GITHUB_REF_TYPE}" = tag ]; then
|
||
|
|
version="$GITHUB_REF_NAME"
|
||
|
|
branch=stable
|
||
|
|
# The metainfo's newest release is the release notes and must be
|
||
|
|
# the version being tagged.
|
||
|
|
top=$(grep -m1 -oP '<release version="\K[^"]+' "$METAINFO")
|
||
|
|
if [ "$top" != "$version" ]; then
|
||
|
|
echo "metainfo lists $top as the newest release, but the tag is $version" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
else
|
||
|
|
# Named after the release it follows, as a checkout describes
|
||
|
|
# itself: 1.0.0-3-g21746b1 is three commits past 1.0.0.
|
||
|
|
described=$(git describe --tags --always --exclude=latest)
|
||
|
|
case "$described" in
|
||
|
|
[0-9]*.[0-9]*.[0-9]*) version="$described" ;;
|
||
|
|
*) version="0.0.0-dev+$described" ;;
|
||
|
|
esac
|
||
|
|
branch=beta
|
||
|
|
fi
|
||
|
|
echo "version=$version" >> "$GITHUB_OUTPUT"
|
||
|
|
echo "branch=$branch" >> "$GITHUB_OUTPUT"
|
||
|
|
echo "version $version, flatpak branch $branch"
|
||
|
|
|
||
|
|
- name: Build
|
||
|
|
# The manifest is rewritten beside the original so its relative
|
||
|
|
# source paths still resolve. The suite runs inside this build.
|
||
|
|
env:
|
||
|
|
VERSION: ${{ steps.meta.outputs.version }}
|
||
|
|
run: |
|
||
|
|
set -eu
|
||
|
|
yq '(.modules[] | select(.name == "crafter-review") | ."build-options".env.CRAFTER_REVIEW_VERSION) = strenv(VERSION)' "$MANIFEST" > "$CI_MANIFEST"
|
||
|
|
grep -n 'CRAFTER_REVIEW_VERSION' "$CI_MANIFEST"
|
||
|
|
flatpak-builder --force-clean --ccache --disable-rofiles-fuse \
|
||
|
|
--state-dir=/root/.cache/flatpak-builder \
|
||
|
|
--repo=repo --default-branch="${{ steps.meta.outputs.branch }}" \
|
||
|
|
build-dir "$CI_MANIFEST"
|
||
|
|
|
||
|
|
- name: Smoke test
|
||
|
|
# In the app as it ships: the version and the home, every library
|
||
|
|
# resolved and none through a RUNPATH outside /app, the bundled
|
||
|
|
# tools, and a freeze and a dry run on a scratch repository (a dry run
|
||
|
|
# joins no board and takes no lifetime lock, so it runs inside
|
||
|
|
# `flatpak build`; it exits 2 by design).
|
||
|
|
env:
|
||
|
|
VERSION: ${{ steps.meta.outputs.version }}
|
||
|
|
run: |
|
||
|
|
set -eu
|
||
|
|
shown=$(flatpak build build-dir crafter-review --version)
|
||
|
|
printf '%s\n' "$shown"
|
||
|
|
printf '%s\n' "$shown" | grep -qF "crafter-review $VERSION (prompt v"
|
||
|
|
flatpak build build-dir sh -euc '
|
||
|
|
for f in /app/bin/crafter-review /app/lib/node/bin/node; do
|
||
|
|
if ldd "$f" | grep "not found"; then echo "$f: a library is missing" >&2; exit 1; fi
|
||
|
|
bad=$(readelf -d "$f" | sed -n "s/.*(R[UN]*PATH).*\[\(.*\)\]/\1/p" | tr ":" "\n" | grep -v -e "^\$" -e "^/app" -e "^\\\$ORIGIN" || true)
|
||
|
|
if [ -n "$bad" ]; then echo "$f: a RUNPATH outside /app: $bad" >&2; exit 1; fi
|
||
|
|
done
|
||
|
|
rg --version | head -1
|
||
|
|
node --version
|
||
|
|
npx --version
|
||
|
|
git --version'
|
||
|
|
flatpak build build-dir sh -euc '
|
||
|
|
export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null
|
||
|
|
export GIT_AUTHOR_NAME=CI GIT_AUTHOR_EMAIL=ci@catcrafts.net GIT_COMMITTER_NAME=CI GIT_COMMITTER_EMAIL=ci@catcrafts.net
|
||
|
|
cd "$(mktemp -d)"
|
||
|
|
git init -q -b main .
|
||
|
|
git config user.email ci@catcrafts.net
|
||
|
|
printf ".review-gates/push/\n.review-gates/trees/\n" > .gitignore
|
||
|
|
mkdir .review-gates
|
||
|
|
printf "{\"lenses\": {\"repo-functional\": {\"run\": false}}}\n" > .review-gates/config.json
|
||
|
|
git add -A
|
||
|
|
git commit -q -m base
|
||
|
|
base=$(git rev-parse HEAD)
|
||
|
|
printf "def hello(name):\n return name\n" > hello.py
|
||
|
|
git add hello.py
|
||
|
|
git commit -q -m "add hello"
|
||
|
|
crafter-review freeze --slug ci --base "$base"
|
||
|
|
hash=$(jq -r .hash .review-gates/push/ci/freeze.json)
|
||
|
|
code=0
|
||
|
|
crafter-review run --artifact .review-gates/push/ci --hash "$hash" --base "$base" --trees . \
|
||
|
|
--dispositions .review-gates/push/ci/gate-state/dispositions.json --scratch "$PWD/scratch" --dry-run || code=$?
|
||
|
|
if [ "$code" != 2 ]; then echo "the dry run exited $code, not 2" >&2; exit 1; fi
|
||
|
|
ls scratch/*-dry/prompts | head -3'
|
||
|
|
|
||
|
|
# Everything below publishes and only runs on master and on tags.
|
||
|
|
- name: Bundle
|
||
|
|
if: github.event_name != 'pull_request'
|
||
|
|
run: |
|
||
|
|
mkdir -p dist
|
||
|
|
flatpak build-bundle repo "dist/crafter-review-${{ steps.meta.outputs.version }}.flatpak" "$APP_ID" "${{ steps.meta.outputs.branch }}"
|
||
|
|
cp packaging/flatpak/net.catcrafts.CrafterReview.flatpakref dist/
|
||
|
|
(cd dist && sha256sum * > SHA256SUMS)
|
||
|
|
ls -la dist
|
||
|
|
|
||
|
|
- name: Upload bundle
|
||
|
|
if: github.event_name != 'pull_request'
|
||
|
|
uses: actions/upload-artifact@v3
|
||
|
|
with:
|
||
|
|
name: crafter-review-${{ steps.meta.outputs.version }}
|
||
|
|
path: dist/*.flatpak
|
||
|
|
if-no-files-found: error
|
||
|
|
|
||
|
|
- name: Publish to the Catcrafts repo
|
||
|
|
if: github.event_name != 'pull_request'
|
||
|
|
run: |
|
||
|
|
set -eu
|
||
|
|
if [ ! -s /run/crafter-flatpak/signing-key.asc ] || [ ! -s /run/crafter-flatpak/key-id ]; then
|
||
|
|
echo "no signing key under /etc/crafter-flatpak on the runner host (Crafter.Build's AGENTS.md, CI and publishing)" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
export GNUPGHOME=$(mktemp -d)
|
||
|
|
gpg --batch --quiet --import /run/crafter-flatpak/signing-key.asc
|
||
|
|
FLATPAK_GPG_KEY_ID=$(cat /run/crafter-flatpak/key-id)
|
||
|
|
# One publish at a time into the repo both apps share: a commit and
|
||
|
|
# the summary update of one workflow never interleave with the
|
||
|
|
# other's.
|
||
|
|
exec 9> "$WEB_DIR/.publish.lock"
|
||
|
|
flock 9
|
||
|
|
[ -f "$REPO_DIR/config" ] || ostree init --repo="$REPO_DIR" --mode=archive
|
||
|
|
flatpak build-commit-from --src-repo=repo \
|
||
|
|
--gpg-sign="$FLATPAK_GPG_KEY_ID" --gpg-homedir="$GNUPGHOME" \
|
||
|
|
"$REPO_DIR" "app/$APP_ID/x86_64/${{ steps.meta.outputs.branch }}"
|
||
|
|
flatpak build-update-repo --gpg-sign="$FLATPAK_GPG_KEY_ID" --gpg-homedir="$GNUPGHOME" \
|
||
|
|
--generate-static-deltas --prune "$REPO_DIR"
|
||
|
|
# This app's ref file only: catcrafts.flatpakrepo is Crafter.Build's.
|
||
|
|
key=$(gpg --export "$FLATPAK_GPG_KEY_ID" | base64 --wrap=0)
|
||
|
|
sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/net.catcrafts.CrafterReview.flatpakref > "$WEB_DIR/net.catcrafts.CrafterReview.flatpakref"
|
||
|
|
flock -u 9
|
||
|
|
|
||
|
|
- name: Rolling 'latest' release
|
||
|
|
if: github.event_name != 'pull_request' && github.ref_type != 'tag'
|
||
|
|
run: |
|
||
|
|
git config user.email "ci@catcrafts.net"
|
||
|
|
git config user.name "Crafter Review CI"
|
||
|
|
git tag -f latest
|
||
|
|
git push origin latest --force
|
||
|
|
- name: Publish rolling 'latest' release
|
||
|
|
if: github.event_name != 'pull_request' && github.ref_type != 'tag'
|
||
|
|
uses: https://code.forgejo.org/actions/forgejo-release@v2
|
||
|
|
with:
|
||
|
|
direction: upload
|
||
|
|
url: ${{ github.server_url }}
|
||
|
|
repo: ${{ github.repository }}
|
||
|
|
tag: latest
|
||
|
|
title: Latest master build
|
||
|
|
prerelease: true
|
||
|
|
override: true
|
||
|
|
release-dir: dist
|
||
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
||
|
|
|
||
|
|
- name: Release notes
|
||
|
|
if: github.ref_type == 'tag'
|
||
|
|
run: |
|
||
|
|
# The newest <release> block's description as Markdown, the way
|
||
|
|
# Crafter.Build's workflow writes its notes.
|
||
|
|
python3 - > release-notes.md <<'EOF'
|
||
|
|
import xml.etree.ElementTree as ET
|
||
|
|
|
||
|
|
desc = ET.parse("packaging/flatpak/net.catcrafts.CrafterReview.metainfo.xml").getroot().find("releases/release/description")
|
||
|
|
|
||
|
|
def text(el):
|
||
|
|
parts = [el.text or ""]
|
||
|
|
for child in el:
|
||
|
|
inner = text(child)
|
||
|
|
parts.append({"em": f"*{inner}*", "code": f"`{inner}`"}.get(child.tag, inner))
|
||
|
|
parts.append(child.tail or "")
|
||
|
|
return " ".join("".join(parts).split())
|
||
|
|
|
||
|
|
blocks = list(desc)
|
||
|
|
out = []
|
||
|
|
for i, el in enumerate(blocks):
|
||
|
|
heads_list = i + 1 < len(blocks) and blocks[i + 1].tag in ("ul", "ol")
|
||
|
|
if el.tag == "p":
|
||
|
|
out.append(f"## {text(el)}" if heads_list else text(el))
|
||
|
|
elif el.tag == "ul":
|
||
|
|
out.append("\n".join(f"- {text(li)}" for li in el))
|
||
|
|
elif el.tag == "ol":
|
||
|
|
out.append("\n".join(f"{n}. {text(li)}" for n, li in enumerate(el, 1)))
|
||
|
|
print("\n\n".join(out))
|
||
|
|
print("\nInstall:\n\n flatpak remote-add --if-not-exists catcrafts https://flatpak.catcrafts.net/catcrafts.flatpakrepo\n flatpak install catcrafts net.catcrafts.CrafterReview\n")
|
||
|
|
EOF
|
||
|
|
- name: Publish release
|
||
|
|
if: github.ref_type == 'tag'
|
||
|
|
uses: https://code.forgejo.org/actions/forgejo-release@v2
|
||
|
|
with:
|
||
|
|
direction: upload
|
||
|
|
url: ${{ github.server_url }}
|
||
|
|
repo: ${{ github.repository }}
|
||
|
|
tag: ${{ github.ref_name }}
|
||
|
|
title: crafter-review ${{ github.ref_name }}
|
||
|
|
release-notes-file: release-notes.md
|
||
|
|
release-dir: dist
|
||
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|