162 lines
8.5 KiB
YAML
162 lines
8.5 KiB
YAML
# storebound desktop: Linux (AppImage + deb) and Windows (NSIS, per user, unsigned) installers.
|
|
# macOS is built, signed and notarized on the owner's Mac (tools/desktop-release.ts mac); the updater signing key
|
|
# never reaches a runner: the Mac signs these installers after downloading them (tools/desktop-release.ts add).
|
|
# Runner setup (Forgejo runners on the VDS: Linux in Docker, Windows in a KVM VM): docs/desktop-release.md.
|
|
# Publishes nothing: the installers are workflow artifacts only (14 days); `tools/desktop-release.ts add` on the Mac
|
|
# signs and stages them, and only `publish` puts anything on storebound.dev.
|
|
name: desktop
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
windows:
|
|
description: Build Windows too (needs a runner with the "windows" label)
|
|
type: boolean
|
|
default: false
|
|
push:
|
|
tags: ['desktop-v*']
|
|
|
|
env:
|
|
BUN_VERSION: '1.4.0'
|
|
# the path-free build keeps the target folder outside every home folder
|
|
CARGO_TARGET_DIR: /tmp/storebound-target
|
|
CARGO_TERM_COLOR: never
|
|
|
|
jobs:
|
|
linux:
|
|
# runner label: ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04 (glibc 2.35: the AppImage and the
|
|
# deb then run on Ubuntu 22.04 and newer, Debian 12)
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 90
|
|
env:
|
|
# linuxdeploy (AppImage) runs without FUSE inside the container
|
|
APPIMAGE_EXTRACT_AND_RUN: '1'
|
|
# linuxdeploy must not strip: the storebound sidecar is a `bun build --compile` executable whose JS payload strip
|
|
# removes (it then starts as plain bun). The Rust binary is already stripped by Cargo (profile.release strip).
|
|
NO_STRIP: '1'
|
|
# WebKitGTK's DMABUF renderer leaves the window blank on some GPU / VM setups; the app sets this itself at
|
|
# start (src-tauri/src/lib.rs linux_webkit_env) unless the user did; set here too for anything run in CI
|
|
WEBKIT_DISABLE_DMABUF_RENDERER: '1'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: System packages
|
|
run: |
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y -qq --no-install-recommends libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev \
|
|
librsvg2-dev libsoup-3.0-dev libjavascriptcoregtk-4.1-dev libssl-dev libxdo-dev patchelf file build-essential \
|
|
curl unzip squashfs-tools p7zip-full xz-utils >/dev/null
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.bun/install/cache
|
|
~/.cargo/registry/index
|
|
~/.cargo/registry/cache
|
|
~/.cargo/git/db
|
|
key: desktop-${{ runner.os }}-${{ hashFiles('bun.lock', 'apps/desktop/src-tauri/Cargo.lock') }}
|
|
restore-keys: desktop-${{ runner.os }}-
|
|
- name: Bun and Rust
|
|
run: |
|
|
P="${FORGEJO_PATH:-$GITHUB_PATH}"
|
|
curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" >/dev/null
|
|
echo "$HOME/.bun/bin" >> "$P"
|
|
command -v rustup || curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
|
|
echo "$HOME/.cargo/bin" >> "$P"
|
|
- name: Install and check
|
|
run: |
|
|
bun install --frozen-lockfile
|
|
bun tools/desktop-version.ts
|
|
bun tools/build-sidecars.ts --target bun-linux-x64
|
|
# linuxdeploy (AppImage) sets the rpath of every executable with its own patchelf, which corrupts the bun
|
|
# sidecar (segfault, then ldd fails in the gtk plugin). With the rpath already set (Ubuntu's patchelf, which
|
|
# keeps it working), linuxdeploy leaves the file as it is. The sidecar needs only libc, so the rpath is inert.
|
|
patchelf --set-rpath '$ORIGIN/../lib' apps/desktop/src-tauri/binaries/storebound-x86_64-unknown-linux-gnu
|
|
apps/desktop/src-tauri/binaries/storebound-x86_64-unknown-linux-gnu version
|
|
- name: Build AppImage and deb (path-free)
|
|
working-directory: apps/desktop
|
|
run: bun ../../tools/desktop-release.ts exec -- bunx tauri build --bundles appimage,deb --ci
|
|
- name: Self-test the exact artifacts
|
|
run: |
|
|
V=$(bun tools/desktop-version.ts --print)
|
|
B="$CARGO_TARGET_DIR/release/bundle"
|
|
mkdir -p out && cp "$B/appimage/storebound_${V}_amd64.AppImage" "$B/deb/storebound_${V}_amd64.deb" out/
|
|
chmod +x out/*.AppImage
|
|
(cd /tmp && rm -rf squashfs-root && "$GITHUB_WORKSPACE/out/storebound_${V}_amd64.AppImage" --appimage-extract >/dev/null && squashfs-root/usr/bin/storebound-desktop --self-test)
|
|
rm -rf /tmp/deb && dpkg-deb -x "out/storebound_${V}_amd64.deb" /tmp/deb && /tmp/deb/usr/bin/storebound-desktop --self-test
|
|
dpkg-deb -I "out/storebound_${V}_amd64.deb" | sed -n '1,20p'
|
|
- name: Start the app under Xvfb (AppImage and deb)
|
|
# --self-test checks only the sidecar; this opens the real window (GTK, WebKitGTK, the bundled libraries of the
|
|
# AppImage) on a virtual display. "sidecar started" in host.log means the webview ran the UI and called the host.
|
|
run: |
|
|
sudo apt-get install -y -qq --no-install-recommends xvfb xauth dbus-x11 >/dev/null
|
|
V=$(bun tools/desktop-version.ts --print)
|
|
smoke() { # <label> <executable>
|
|
local d; d=$(mktemp -d); local log="$d/data/dev.storebound.desktop/logs/host.log"
|
|
XDG_DATA_HOME="$d/data" XDG_CONFIG_HOME="$d/config" XDG_CACHE_HOME="$d/cache" \
|
|
xvfb-run -a dbus-run-session -- "$2" >"$d/out.txt" 2>&1 &
|
|
local pid=$! ok=0
|
|
for i in $(seq 1 90); do
|
|
if grep -q 'sidecar started' "$log" 2>/dev/null; then ok=1; break; fi
|
|
kill -0 "$pid" 2>/dev/null || break
|
|
sleep 1
|
|
done
|
|
sleep 3; kill -0 "$pid" 2>/dev/null || ok=0
|
|
pkill -TERM -f storebound-desktop || true; wait "$pid" 2>/dev/null || true
|
|
echo "--- $1 host.log"; cat "$log" 2>/dev/null || true
|
|
local wv="$d/data/dev.storebound.desktop/logs/webview.log"
|
|
if [ -f "$wv" ]; then echo "--- $1 webview.log"; cat "$wv"; grep -qE '^\S+ error ' "$wv" && ok=0; fi
|
|
grep -qE '^\S+ error |panicked' "$log" 2>/dev/null && ok=0
|
|
if [ "$ok" != 1 ]; then echo "--- $1 output"; tail -n 60 "$d/out.txt"; echo "$1: the window did not start the UI" >&2; return 1; fi
|
|
echo "$1: window started, UI reached the sidecar"
|
|
}
|
|
smoke AppImage "$GITHUB_WORKSPACE/out/storebound_${V}_amd64.AppImage"
|
|
smoke deb /tmp/deb/usr/bin/storebound-desktop
|
|
- name: Privacy scan
|
|
run: bun tools/privacy-scan.ts out/
|
|
- name: Checksums
|
|
run: (cd out && sha256sum * | tee SHA256SUMS)
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: storebound-desktop-linux
|
|
path: out/
|
|
retention-days: 14
|
|
|
|
windows:
|
|
# only on a manual run with "windows" ticked (a tag push never sets it), so without a Windows runner it is skipped
|
|
if: ${{ github.event_name == 'workflow_dispatch' && inputs.windows }}
|
|
# the Windows runner on the VDS ("windows" label, host mode): Rust (MSVC), Bun, 7-Zip, pwsh
|
|
runs-on: windows
|
|
timeout-minutes: 90
|
|
env:
|
|
CARGO_TARGET_DIR: C:\storebound-target
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install and check
|
|
shell: pwsh
|
|
run: |
|
|
bun install --frozen-lockfile
|
|
bun tools/desktop-version.ts
|
|
bun tools/build-sidecars.ts --target bun-windows-x64
|
|
- name: Build NSIS installer (per user, WebView2 bootstrapper, path-free)
|
|
shell: pwsh
|
|
working-directory: apps/desktop
|
|
run: bun ../../tools/desktop-release.ts exec -- bunx tauri build --bundles nsis --ci
|
|
- name: Install per user, self-test, uninstall
|
|
shell: pwsh
|
|
run: |
|
|
$V = bun tools/desktop-version.ts --print
|
|
New-Item -ItemType Directory -Force out | Out-Null
|
|
Copy-Item "$env:CARGO_TARGET_DIR\release\bundle\nsis\storebound_${V}_x64-setup.exe" out\
|
|
Start-Process -Wait -FilePath "out\storebound_${V}_x64-setup.exe" -ArgumentList '/S'
|
|
$exe = "$env:LOCALAPPDATA\storebound\storebound-desktop.exe"
|
|
if (-not (Test-Path $exe)) { throw "not installed per user at $exe" }
|
|
& $exe --self-test | Tee-Object -Variable st
|
|
if ($LASTEXITCODE -ne 0) { throw "self-test failed" }
|
|
Start-Process -Wait -FilePath "$env:LOCALAPPDATA\storebound\uninstall.exe" -ArgumentList '/S'
|
|
- name: Privacy scan (no .pdb, no paths)
|
|
shell: pwsh
|
|
run: bun tools/privacy-scan.ts out
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: storebound-desktop-windows
|
|
path: out/
|
|
retention-days: 14
|