Desktop Package #53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Desktop Package | |
| on: | |
| release: | |
| types: | |
| - published | |
| workflow_dispatch: | |
| inputs: | |
| tag_name: | |
| description: "Release tag (stable: v0.2.18, beta: v0.2.18-beta.1)." | |
| required: false | |
| type: string | |
| checkout_ref: | |
| description: "Commit, branch, or tag to build. Defaults to tag_name, then HEAD." | |
| required: false | |
| type: string | |
| release_channel: | |
| description: "Immutable update channel compiled into the Desktop artifact." | |
| required: false | |
| default: stable | |
| type: choice | |
| options: | |
| - stable | |
| - beta | |
| upload_to_release: | |
| description: "Upload built artifacts to the release specified by tag_name." | |
| required: false | |
| default: false | |
| type: boolean | |
| relay_image_only: | |
| description: "Publish only the Relay Server image and signed descriptor (no Desktop packages)." | |
| required: false | |
| default: false | |
| type: boolean | |
| permissions: | |
| contents: write | |
| packages: write | |
| concurrency: | |
| group: desktop-package-${{ (github.event.release.prerelease || inputs.release_channel == 'beta') && 'beta' || github.event.release.tag_name || inputs.tag_name || github.sha }} | |
| cancel-in-progress: false | |
| jobs: | |
| # ── Resolve version info ─────────────────────────────────────────── | |
| prepare: | |
| name: Prepare | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.meta.outputs.version }} | |
| release_tag: ${{ steps.meta.outputs.release_tag }} | |
| upload_to_release: ${{ steps.meta.outputs.upload_to_release }} | |
| checkout_ref: ${{ steps.meta.outputs.checkout_ref }} | |
| release_channel: ${{ steps.meta.outputs.release_channel }} | |
| relay_image_only: ${{ steps.meta.outputs.relay_image_only }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Resolve version metadata | |
| id: meta | |
| shell: bash | |
| env: | |
| GITHUB_EVENT_NAME: ${{ github.event_name }} | |
| GITHUB_SHA: ${{ github.sha }} | |
| RELEASE_TAG_NAME: ${{ github.event.release.tag_name }} | |
| INPUT_TAG_NAME: ${{ inputs.tag_name }} | |
| INPUT_CHECKOUT_REF: ${{ inputs.checkout_ref }} | |
| INPUT_RELEASE_CHANNEL: ${{ inputs.release_channel }} | |
| INPUT_UPLOAD_TO_RELEASE: ${{ inputs.upload_to_release }} | |
| INPUT_RELAY_IMAGE_ONLY: ${{ inputs.relay_image_only }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then | |
| TAG="${RELEASE_TAG_NAME}" | |
| VERSION="${TAG#v}" | |
| UPLOAD="true" | |
| CHECKOUT_REF="${TAG}" | |
| if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then | |
| CHANNEL="beta" | |
| else | |
| CHANNEL="stable" | |
| fi | |
| elif [[ -n "${INPUT_TAG_NAME}" ]]; then | |
| TAG="${INPUT_TAG_NAME}" | |
| VERSION="${TAG#v}" | |
| CHANNEL="${INPUT_RELEASE_CHANNEL:-stable}" | |
| # A one-off image backfill must use the workflow branch: an older | |
| # tag does not contain Dockerfile.release or this publishing job. | |
| if [[ "${INPUT_RELAY_IMAGE_ONLY}" == "true" ]]; then | |
| CHECKOUT_REF="${GITHUB_SHA}" | |
| elif [[ -n "${INPUT_CHECKOUT_REF}" ]]; then | |
| CHECKOUT_REF="${INPUT_CHECKOUT_REF}" | |
| else | |
| CHECKOUT_REF="${TAG}" | |
| fi | |
| if [[ "${INPUT_UPLOAD_TO_RELEASE}" == "true" ]]; then | |
| UPLOAD="true" | |
| else | |
| UPLOAD="false" | |
| fi | |
| else | |
| VERSION="$(jq -r '.version' package.json)" | |
| TAG="v${VERSION}" | |
| UPLOAD="false" | |
| CHECKOUT_REF="${GITHUB_SHA}" | |
| CHANNEL="${INPUT_RELEASE_CHANNEL:-stable}" | |
| fi | |
| node --input-type=module -e \ | |
| "import { validateReleaseVersion } from './scripts/release-channel.mjs'; validateReleaseVersion(process.argv[1], process.argv[2]);" \ | |
| "${CHANNEL}" "${VERSION}" | |
| git fetch origin main --tags --force | |
| CHECKOUT_SHA="$(git rev-parse "${CHECKOUT_REF}^{commit}")" | |
| if [[ "${GITHUB_REPOSITORY}" == "GCWing/BitFun" ]] && \ | |
| ! git merge-base --is-ancestor "${CHECKOUT_SHA}" origin/main; then | |
| echo "Ref ${CHECKOUT_REF} (${CHECKOUT_SHA}) is not part of the protected main history." >&2 | |
| exit 1 | |
| fi | |
| TAG_SHA="$(git rev-parse --verify --quiet "${TAG}^{commit}" || true)" | |
| if [[ -n "${TAG_SHA}" && "${TAG_SHA}" != "${CHECKOUT_SHA}" ]]; then | |
| echo "Existing tag ${TAG} points to ${TAG_SHA}, not requested commit ${CHECKOUT_SHA}." >&2 | |
| exit 1 | |
| fi | |
| CHECKOUT_REF="${CHECKOUT_SHA}" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| echo "release_tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "upload_to_release=$UPLOAD" >> "$GITHUB_OUTPUT" | |
| echo "checkout_ref=$CHECKOUT_REF" >> "$GITHUB_OUTPUT" | |
| echo "release_channel=$CHANNEL" >> "$GITHUB_OUTPUT" | |
| echo "relay_image_only=${INPUT_RELAY_IMAGE_ONLY:-false}" >> "$GITHUB_OUTPUT" | |
| # ── Build per platform ───────────────────────────────────────────── | |
| package: | |
| name: Package (${{ matrix.platform.name }}) | |
| runs-on: ${{ matrix.platform.os }} | |
| needs: prepare | |
| if: needs.prepare.outputs.relay_image_only != 'true' | |
| env: | |
| NODE_OPTIONS: --max-old-space-size=6144 | |
| BITFUN_ENABLE_UPDATER_ARTIFACTS: ${{ needs.prepare.outputs.upload_to_release }} | |
| BITFUN_RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }} | |
| TAURI_UPDATER_ENDPOINT: ${{ github.repository != 'GCWing/BitFun' && needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-beta/latest.json', github.repository) || '' }} | |
| TAURI_UPDATER_FALLBACK_ENDPOINT: ${{ github.repository != 'GCWing/BitFun' && needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-beta/latest.json', github.repository) || '' }} | |
| TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| # Same trust root, compiled into the Desktop binary so one-click relay | |
| # deploy can verify the signed checksum locally and hand the remote host | |
| # a hash it does not have to trust the mirror for. | |
| BITFUN_RELEASE_PUBKEY: ${{ secrets.BITFUN_RELEASE_PUBKEY || secrets.TAURI_UPDATER_PUBKEY }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: | |
| - os: ubuntu-latest | |
| name: linux-x64 | |
| target: x86_64-unknown-linux-gnu | |
| build_command: pnpm run desktop:build:linux -- --target x86_64-unknown-linux-gnu --bundles deb,rpm,appimage | |
| - os: ubuntu-24.04-arm | |
| name: linux-arm64 | |
| target: aarch64-unknown-linux-gnu | |
| # Thin LTO is now the workspace-wide [profile.release] default, so | |
| # the previous CARGO_PROFILE_RELEASE_LTO=thin override is gone. | |
| build_command: pnpm run desktop:build:linux -- --target aarch64-unknown-linux-gnu --bundles deb,rpm,appimage | |
| - os: macos-15 | |
| name: macos-arm64 | |
| target: aarch64-apple-darwin | |
| build_command: pnpm run desktop:build:arm64 | |
| - os: macos-15-intel | |
| name: macos-x64 | |
| target: x86_64-apple-darwin | |
| build_command: pnpm run desktop:build:x86_64 | |
| - os: windows-latest | |
| name: windows-x64 | |
| target: x86_64-pc-windows-msvc | |
| build_command: | | |
| $ErrorActionPreference = 'Stop' | |
| pnpm run desktop:build:nsis --target x86_64-pc-windows-msvc --verbose | |
| if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } | |
| $desktopExe = "target/x86_64-pc-windows-msvc/release/bitfun-desktop.exe" | |
| if (-not (Test-Path $desktopExe)) { | |
| throw "Desktop executable was not found after NSIS build: $desktopExe" | |
| } | |
| pnpm run installer:build:only | |
| if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: ${{ needs.prepare.outputs.checkout_ref }} | |
| - name: Install NSIS (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| choco install nsis -y --no-progress | |
| $nsisRoot = "${env:ProgramFiles(x86)}\NSIS" | |
| $nsisBin = "${env:ProgramFiles(x86)}\NSIS\Bin" | |
| if (Test-Path $nsisRoot) { | |
| Add-Content $env:GITHUB_PATH $nsisRoot | |
| } | |
| if (Test-Path $nsisBin) { | |
| Add-Content $env:GITHUB_PATH $nsisBin | |
| } | |
| - name: Verify NSIS (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| where.exe makensis | |
| makensis /VERSION | |
| - name: Install Linux system dependencies (Tauri bundler) | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| sudo apt-get update | |
| if apt-cache show libwebkit2gtk-4.1-dev >/dev/null 2>&1; then | |
| WEBKIT_PKG=libwebkit2gtk-4.1-dev | |
| else | |
| WEBKIT_PKG=libwebkit2gtk-4.0-dev | |
| fi | |
| if apt-cache show libappindicator3-dev >/dev/null 2>&1; then | |
| APPINDICATOR_PKG=libappindicator3-dev | |
| else | |
| APPINDICATOR_PKG=libayatana-appindicator3-dev | |
| fi | |
| # Tauri pins AppImage GTK input methods to its bundled cache, so the | |
| # fcitx5 GTK3 bridge must be present before linuxdeploy builds it. | |
| sudo apt-get install -y --no-install-recommends \ | |
| pkg-config \ | |
| xdg-utils \ | |
| libglib2.0-dev \ | |
| libgtk-3-dev \ | |
| fcitx5-frontend-gtk3 \ | |
| libxdo-dev \ | |
| "$WEBKIT_PKG" \ | |
| "$APPINDICATOR_PKG" \ | |
| librsvg2-dev \ | |
| patchelf \ | |
| fakeroot \ | |
| rpm \ | |
| libleptonica-dev \ | |
| libtesseract-dev \ | |
| tesseract-ocr \ | |
| tesseract-ocr-eng | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.platform.target }} | |
| - name: Cache Rust build | |
| uses: swatinem/rust-cache@v2 | |
| with: | |
| shared-key: "package-v2-${{ matrix.platform.name }}" | |
| cache-bin: false | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Configure Apple Developer ID signing and notarization | |
| if: runner.os == 'macOS' | |
| shell: bash | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | |
| APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} | |
| APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} | |
| APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| BITFUN_REQUIRE_APPLE_SIGNING: ${{ needs.prepare.outputs.upload_to_release }} | |
| run: bash scripts/ci/setup-macos-signing.sh | |
| - name: Project beta build version | |
| if: needs.prepare.outputs.release_channel == 'beta' | |
| run: node scripts/set-build-version.mjs --version "${{ needs.prepare.outputs.version }}" | |
| - name: Verify release version metadata | |
| run: node scripts/verify-release-version-sync.mjs --version "${{ needs.prepare.outputs.version }}" | |
| - name: Build desktop app | |
| run: ${{ matrix.platform.build_command }} | |
| - name: Verify Apple signature and notarization | |
| if: runner.os == 'macOS' | |
| shell: bash | |
| run: bash scripts/ci/verify-macos-signing.sh "${{ matrix.platform.target }}" | |
| - name: Verify AppImage fcitx5 GTK module | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: bash scripts/ci/verify-appimage-fcitx.sh "${{ matrix.platform.target }}" | |
| - name: Upload bundles | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: bitfun-${{ needs.prepare.outputs.release_tag }}-${{ matrix.platform.name }}-bundle | |
| if-no-files-found: error | |
| path: | | |
| target/*/release/bundle | |
| target/release/bundle | |
| src/apps/desktop/target/release/bundle | |
| BitFun-Installer/src-tauri/target/release/bitfun-installer.exe | |
| linux-binaries: | |
| name: Linux CLI and Relay Server | |
| needs: prepare | |
| if: >- | |
| needs.prepare.outputs.relay_image_only != 'true' && | |
| needs.prepare.outputs.release_channel == 'stable' | |
| uses: ./.github/workflows/linux-binaries.yml | |
| secrets: | |
| release_signing_key: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| release_signing_password: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| release_pubkey: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| with: | |
| checkout_ref: ${{ needs.prepare.outputs.checkout_ref }} | |
| version: ${{ needs.prepare.outputs.version }} | |
| artifact_prefix: ${{ needs.prepare.outputs.release_tag }} | |
| # Publish the Relay once, as a multi-platform image. User servers only pull | |
| # this image; they no longer download an archive and build a runtime image. | |
| publish-relay-image: | |
| name: Publish Relay Server Image | |
| needs: [prepare, linux-binaries] | |
| if: >- | |
| always() && | |
| ((needs.prepare.outputs.upload_to_release == 'true' && | |
| needs.prepare.outputs.release_channel == 'stable') || | |
| needs.prepare.outputs.relay_image_only == 'true') && | |
| (needs.prepare.outputs.relay_image_only == 'true' || | |
| needs.linux-binaries.result == 'success') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: write | |
| env: | |
| IMAGE: ghcr.io/gcwing/bitfun-relay-server | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: ${{ needs.prepare.outputs.checkout_ref }} | |
| - name: Download Relay archives from this release run | |
| if: needs.prepare.outputs.relay_image_only != 'true' | |
| uses: actions/download-artifact@v7 | |
| with: | |
| pattern: bitfun-linux-${{ needs.prepare.outputs.release_tag }}-* | |
| path: linux-release-assets | |
| merge-multiple: true | |
| - name: Download Relay archives from the existing release (image-only backfill) | |
| if: needs.prepare.outputs.relay_image_only == 'true' | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }} | |
| run: | | |
| set -euo pipefail | |
| mkdir -p linux-release-assets | |
| gh release download "${RELEASE_TAG}" \ | |
| --repo GCWing/BitFun \ | |
| --dir linux-release-assets \ | |
| --pattern 'bitfun-relay-server-*.tar.gz' \ | |
| --pattern 'bitfun-relay-server-*.tar.gz.sha256' | |
| - name: Verify image inputs | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| test -f linux-release-assets/bitfun-relay-server-x86_64-unknown-linux-gnu.tar.gz | |
| test -f linux-release-assets/bitfun-relay-server-aarch64-unknown-linux-gnu.tar.gz | |
| for archive in linux-release-assets/bitfun-relay-server-*.tar.gz; do | |
| (cd linux-release-assets && sha256sum --check "$(basename "${archive}").sha256") | |
| done | |
| cp src/apps/relay-server/Dockerfile.release linux-release-assets/Dockerfile.release | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| - name: Resolve image tags | |
| id: image-tags | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }} | |
| RELEASE_VERSION: ${{ needs.prepare.outputs.version }} | |
| IMAGE_ONLY: ${{ needs.prepare.outputs.relay_image_only }} | |
| RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }} | |
| run: | | |
| set -euo pipefail | |
| asset_version="${RELEASE_VERSION%%+*}" | |
| { | |
| echo 'value<<EOF' | |
| echo "${IMAGE}:${RELEASE_TAG}" | |
| echo "${IMAGE}:${asset_version}" | |
| if [[ "${IMAGE_ONLY}" == "true" ]]; then | |
| # Backfilling an older release must not roll the floating tag | |
| # backwards. GitHub's latest endpoint excludes prereleases. | |
| latest_release="$(gh api repos/GCWing/BitFun/releases/latest --jq .tag_name)" | |
| if [[ "${RELEASE_TAG}" == "${latest_release}" ]]; then | |
| echo "${IMAGE}:latest" | |
| fi | |
| elif [[ "${RELEASE_CHANNEL}" == "stable" ]]; then | |
| # The normal release workflow can create the GitHub Release only | |
| # after packaging, so it cannot rely on /releases/latest yet. | |
| echo "${IMAGE}:latest" | |
| fi | |
| echo EOF | |
| } >>"$GITHUB_OUTPUT" | |
| - name: Build and push multi-platform image | |
| id: image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: linux-release-assets | |
| file: linux-release-assets/Dockerfile.release | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| provenance: false | |
| sbom: false | |
| build-args: | | |
| VERSION=${{ needs.prepare.outputs.version }} | |
| REVISION=${{ needs.prepare.outputs.release_tag }} | |
| tags: ${{ steps.image-tags.outputs.value }} | |
| - name: Smoke-test published image on both platforms | |
| shell: bash | |
| env: | |
| IMAGE_DIGEST: ${{ steps.image.outputs.digest }} | |
| run: bash scripts/relay/smoke-image.sh "${IMAGE}@${IMAGE_DIGEST}" | |
| - name: Verify manifest and generate signed descriptor | |
| shell: bash | |
| env: | |
| IMAGE_DIGEST: ${{ steps.image.outputs.digest }} | |
| RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }} | |
| RELEASE_VERSION: ${{ needs.prepare.outputs.version }} | |
| BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| run: | | |
| set -euo pipefail | |
| [[ "${IMAGE_DIGEST}" =~ ^sha256:[0-9a-f]{64}$ ]] | |
| docker buildx imagetools inspect "${IMAGE}@${IMAGE_DIGEST}" --raw >relay-image-manifest.json | |
| jq -e ' | |
| [.manifests[].platform | .os + "/" + .architecture] as $platforms | |
| | ($platforms | index("linux/amd64")) != null | |
| and ($platforms | index("linux/arm64")) != null | |
| ' relay-image-manifest.json >/dev/null | |
| jq -n \ | |
| --arg image "${IMAGE}" \ | |
| --arg tag "${RELEASE_TAG}" \ | |
| --arg version "${RELEASE_VERSION}" \ | |
| --arg digest "${IMAGE_DIGEST}" \ | |
| '{ | |
| schema_version: 1, | |
| image: $image, | |
| tag: $tag, | |
| version: $version, | |
| digest: $digest, | |
| platforms: ["linux/amd64", "linux/arm64"] | |
| }' >relay-image.json | |
| bash scripts/sign-release-assets.sh relay-image.json | |
| test -s relay-image.json.sig | |
| - name: Upload signed image descriptor | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: bitfun-relay-image-${{ needs.prepare.outputs.release_tag }} | |
| if-no-files-found: error | |
| retention-days: 7 | |
| path: | | |
| relay-image.json | |
| relay-image.json.sig | |
| # The package is private on first creation. This deliberately fails until | |
| # its visibility is changed to public, preventing an apparently green | |
| # release that anonymous customer servers cannot pull. | |
| - name: Verify anonymous pull access | |
| shell: bash | |
| env: | |
| IMAGE_DIGEST: ${{ steps.image.outputs.digest }} | |
| run: | | |
| set -euo pipefail | |
| docker logout ghcr.io >/dev/null 2>&1 || true | |
| clean_config="$(mktemp -d)" | |
| trap 'rm -rf "$clean_config"' EXIT | |
| DOCKER_CONFIG="$clean_config" docker buildx imagetools inspect \ | |
| "${IMAGE}@${IMAGE_DIGEST}" >/dev/null | |
| - name: Attach descriptor to an existing release (image-only backfill) | |
| if: needs.prepare.outputs.relay_image_only == 'true' | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ needs.prepare.outputs.release_tag }} | |
| files: | | |
| relay-image.json | |
| relay-image.json.sig | |
| fail_on_unmatched_files: true | |
| # ── Upload assets to GitHub Release ──────────────────────────────── | |
| upload-release-assets: | |
| name: Upload Release Assets | |
| needs: [prepare, package, linux-binaries, publish-relay-image] | |
| if: >- | |
| always() && | |
| needs.prepare.outputs.upload_to_release == 'true' && | |
| needs.package.result == 'success' && | |
| (needs.prepare.outputs.release_channel == 'beta' || | |
| (needs.linux-binaries.result == 'success' && | |
| needs.publish-relay-image.result == 'success')) | |
| runs-on: ubuntu-latest | |
| env: | |
| REQUIRED_UPDATER_PLATFORMS: windows-x86_64,darwin-x86_64,darwin-aarch64,linux-x86_64,linux-aarch64 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Download bundled artifacts | |
| uses: actions/download-artifact@v7 | |
| with: | |
| pattern: bitfun-${{ needs.prepare.outputs.release_tag }}-*-bundle | |
| path: release-assets | |
| merge-multiple: true | |
| - name: Download Linux binary artifacts | |
| if: needs.prepare.outputs.release_channel == 'stable' | |
| uses: actions/download-artifact@v7 | |
| with: | |
| pattern: bitfun-linux-${{ needs.prepare.outputs.release_tag }}-* | |
| path: linux-release-assets | |
| merge-multiple: true | |
| - name: Download Relay image descriptor | |
| if: needs.prepare.outputs.release_channel == 'stable' | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: bitfun-relay-image-${{ needs.prepare.outputs.release_tag }} | |
| path: relay-image-assets | |
| - name: List release assets | |
| env: | |
| RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }} | |
| run: | | |
| echo "Release assets:" | |
| find release-assets -type f | sort | |
| if [[ "${RELEASE_CHANNEL}" == "stable" ]]; then | |
| echo "Linux CLI and Relay Server assets:" | |
| find linux-release-assets -type f | sort | |
| echo "Relay image descriptor:" | |
| find relay-image-assets -type f | sort | |
| fi | |
| - name: Prepare versioned Windows installer | |
| run: | | |
| node scripts/prepare-windows-installer-asset.mjs \ | |
| --assets-dir release-assets \ | |
| --version "${{ needs.prepare.outputs.version }}" \ | |
| --out-dir release-manual-assets | |
| - name: Sign versioned Windows installer | |
| shell: bash | |
| env: | |
| BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| run: bash scripts/sign-release-assets.sh release-manual-assets/*.exe | |
| - name: Collect updater assets | |
| run: | | |
| node scripts/collect-tauri-updater-assets.mjs \ | |
| --assets-dir release-assets \ | |
| --version "${{ needs.prepare.outputs.version }}" \ | |
| --out-dir release-updater-assets \ | |
| --required-platforms "${REQUIRED_UPDATER_PLATFORMS}" | |
| - name: Generate updater manifest | |
| run: | | |
| node scripts/generate-tauri-latest-json.mjs \ | |
| --assets-dir release-updater-assets \ | |
| --manual-assets-dir release-manual-assets \ | |
| --version "${{ needs.prepare.outputs.version }}" \ | |
| --tag "${{ needs.prepare.outputs.release_tag }}" \ | |
| --repo "${{ github.repository }}" \ | |
| --out release-updater-assets/latest.json \ | |
| --required-platforms "${REQUIRED_UPDATER_PLATFORMS}" | |
| - name: Verify updater manifest | |
| run: | | |
| node scripts/verify-tauri-latest-json.mjs \ | |
| --manifest release-updater-assets/latest.json \ | |
| --version "${{ needs.prepare.outputs.version }}" \ | |
| --required-platforms "${REQUIRED_UPDATER_PLATFORMS}" \ | |
| --required-manual-platforms "windows-x86_64" | |
| - name: Generate Linux binaries manifest | |
| if: needs.prepare.outputs.release_channel == 'stable' | |
| run: | | |
| node scripts/generate-linux-binaries-manifest.mjs \ | |
| --assets-dir linux-release-assets \ | |
| --version "${{ needs.prepare.outputs.version }}" \ | |
| --tag "${{ needs.prepare.outputs.release_tag }}" \ | |
| --repo "GCWing/BitFun" \ | |
| --out linux-release-assets/linux-binaries.json | |
| # The Tauri bundler signs the five updater artifacts during `tauri build`, | |
| # but the installers people download by hand from the release page — dmg, | |
| # deb, rpm, the Windows installer and the direct AppImages — shipped with | |
| # no signature at all. Sign them with the same key so every published | |
| # artifact is verifiable. (This is not OS-level code signing: Gatekeeper | |
| # and SmartScreen still need Apple/Authenticode certificates.) | |
| - name: Sign installer packages | |
| shell: bash | |
| env: | |
| BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| run: | | |
| set -euo pipefail | |
| mapfile -t assets < <( | |
| find release-assets -type f \ | |
| \( -name '*.AppImage' -o -name '*.deb' -o -name '*.rpm' \ | |
| -o -name '*.dmg' \) | sort | |
| ) | |
| if [[ "${#assets[@]}" -eq 0 ]]; then | |
| echo "No installer packages found to sign." | |
| exit 0 | |
| fi | |
| bash scripts/sign-release-assets.sh "${assets[@]}" | |
| # Publish the public key alongside the signatures: a signature nobody | |
| # can fetch a key for is not verifiable. | |
| node scripts/write-minisign-public-key.mjs \ | |
| --out release-assets/minisign.pub | |
| - name: Stage stable release assets | |
| if: needs.prepare.outputs.release_channel == 'stable' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s globstar | |
| node scripts/stage-github-release-assets.mjs \ | |
| --out-dir release-upload-assets \ | |
| release-updater-assets/* \ | |
| release-manual-assets/*.exe \ | |
| release-manual-assets/*.exe.sig \ | |
| release-assets/**/*.AppImage \ | |
| release-assets/**/*.AppImage.sig \ | |
| release-assets/**/*.deb \ | |
| release-assets/**/*.deb.sig \ | |
| release-assets/**/*.dmg \ | |
| release-assets/**/*.dmg.sig \ | |
| release-assets/**/*.rpm \ | |
| release-assets/**/*.rpm.sig \ | |
| release-assets/minisign.pub \ | |
| linux-release-assets/bitfun-cli-*.tar.gz \ | |
| linux-release-assets/bitfun-cli-*.tar.gz.sha256 \ | |
| linux-release-assets/bitfun-relay-server-*.tar.gz \ | |
| linux-release-assets/bitfun-relay-server-*.tar.gz.sha256 \ | |
| linux-release-assets/*.tar.gz.sig \ | |
| linux-release-assets/*.tar.gz.sha256.sig \ | |
| linux-release-assets/linux-binaries.json \ | |
| relay-image-assets/relay-image.json \ | |
| relay-image-assets/relay-image.json.sig | |
| - name: Stage beta release assets | |
| if: needs.prepare.outputs.release_channel == 'beta' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s globstar | |
| node scripts/stage-github-release-assets.mjs \ | |
| --out-dir release-upload-assets \ | |
| release-updater-assets/* \ | |
| release-manual-assets/*.exe \ | |
| release-manual-assets/*.exe.sig \ | |
| release-assets/**/*.AppImage \ | |
| release-assets/**/*.AppImage.sig \ | |
| release-assets/**/*.deb \ | |
| release-assets/**/*.deb.sig \ | |
| release-assets/**/*.dmg \ | |
| release-assets/**/*.dmg.sig \ | |
| release-assets/**/*.rpm \ | |
| release-assets/**/*.rpm.sig \ | |
| release-assets/minisign.pub | |
| - name: Upload to release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ needs.prepare.outputs.release_tag }} | |
| target_commitish: ${{ needs.prepare.outputs.checkout_ref }} | |
| prerelease: ${{ needs.prepare.outputs.release_channel == 'beta' }} | |
| name: ${{ needs.prepare.outputs.release_channel == 'beta' && format('BitFun {0} Beta', needs.prepare.outputs.version) || format('BitFun {0}', needs.prepare.outputs.version) }} | |
| generate_release_notes: true | |
| files: release-upload-assets/* | |
| fail_on_unmatched_files: true | |
| - name: Verify published updater manifest | |
| run: | | |
| curl -fsSL --retry 5 --retry-delay 3 \ | |
| "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/latest.json" \ | |
| -o latest.published.json | |
| node scripts/verify-tauri-latest-json.mjs \ | |
| --manifest latest.published.json \ | |
| --version "${{ needs.prepare.outputs.version }}" \ | |
| --required-platforms "${REQUIRED_UPDATER_PLATFORMS}" \ | |
| --required-manual-platforms "windows-x86_64" \ | |
| --check-urls true | |
| - name: Verify published Linux binaries manifest | |
| if: needs.prepare.outputs.release_channel == 'stable' | |
| run: | | |
| curl -fsSL --retry 5 --retry-delay 3 \ | |
| "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \ | |
| -o linux-binaries.published.json | |
| test "$(jq -r '.version' linux-binaries.published.json)" = "${{ needs.prepare.outputs.version }}" | |
| while IFS= read -r cli_url; do | |
| curl -fsSL --retry 5 --retry-delay 3 "${cli_url}.sig" -o /dev/null | |
| curl -fsSL --retry 5 --retry-delay 3 "${cli_url}.sha256.sig" -o /dev/null | |
| done < <(jq -r '.platforms[].cli.url' linux-binaries.published.json) | |
| - name: Verify published Relay image descriptor | |
| if: needs.prepare.outputs.release_channel == 'stable' | |
| run: | | |
| curl -fsSL --retry 5 --retry-delay 3 \ | |
| "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json" \ | |
| -o relay-image.published.json | |
| test "$(jq -r '.tag' relay-image.published.json)" = "${{ needs.prepare.outputs.release_tag }}" | |
| test "$(jq -r '.image' relay-image.published.json)" = "ghcr.io/gcwing/bitfun-relay-server" | |
| jq -e '.digest | test("^sha256:[0-9a-f]{64}$")' relay-image.published.json >/dev/null | |
| curl -fsSL --retry 5 --retry-delay 3 \ | |
| "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json.sig" \ | |
| -o /dev/null | |
| - name: Resolve beta channel promotion | |
| id: beta-channel | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }} | |
| run: | | |
| set -euo pipefail | |
| channel_status="$(curl -sS --retry 5 --retry-delay 3 \ | |
| --output channel.release.json \ | |
| --write-out '%{http_code}' \ | |
| -H "Authorization: Bearer ${GH_TOKEN}" \ | |
| -H 'Accept: application/vnd.github+json' \ | |
| -H 'X-GitHub-Api-Version: 2022-11-28' \ | |
| "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/tags/channel-beta")" | |
| case "${channel_status}" in | |
| 200) | |
| echo "channel_exists=true" >>"$GITHUB_OUTPUT" | |
| curl -fsSL --retry 5 --retry-delay 3 \ | |
| "https://github.com/${GITHUB_REPOSITORY}/releases/download/channel-beta/latest.json" \ | |
| -o current.beta.json | |
| ;; | |
| 404) | |
| echo "channel_exists=false" >>"$GITHUB_OUTPUT" | |
| if [[ "${RELEASE_CHANNEL}" == "stable" ]]; then | |
| echo "promote=false" >>"$GITHUB_OUTPUT" | |
| echo "No beta channel exists; stable release does not need to create one." | |
| exit 0 | |
| fi | |
| ;; | |
| *) | |
| echo "Could not inspect channel-beta release (GitHub API returned ${channel_status})." >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| args=(--candidate latest.published.json --github-output "$GITHUB_OUTPUT") | |
| if [[ -s current.beta.json ]]; then | |
| args+=(--current current.beta.json) | |
| fi | |
| node scripts/plan-channel-promotion.mjs "${args[@]}" | |
| - name: Publish beta channel manifest | |
| if: steps.beta-channel.outputs.promote == 'true' | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| CHECKOUT_REF: ${{ needs.prepare.outputs.checkout_ref }} | |
| CHANNEL_EXISTS: ${{ steps.beta-channel.outputs.channel_exists }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "${CHANNEL_EXISTS}" != "true" ]]; then | |
| gh release create channel-beta \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --target "${CHECKOUT_REF}" \ | |
| --prerelease \ | |
| --title "BitFun Beta Update Channel" \ | |
| --notes "Mutable updater pointer. Installable beta releases use immutable version tags." | |
| fi | |
| mkdir -p beta-channel | |
| cp latest.published.json beta-channel/latest.json | |
| gh release upload channel-beta beta-channel/latest.json \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --clobber | |
| curl -fsSL --retry 5 --retry-delay 3 \ | |
| "https://github.com/${GITHUB_REPOSITORY}/releases/download/channel-beta/latest.json" \ | |
| -o channel-beta.published.json | |
| test "$(jq -r '.version' channel-beta.published.json)" = \ | |
| "${{ steps.beta-channel.outputs.candidate_version }}" | |
| # Nudge the openbitfun.com mirror to sync now instead of on its next | |
| # 10-minute cron tick. Until the mirror has these bytes, CN clients have | |
| # only the GitHub origin to fall back to. Best effort: the cron run is | |
| # still the source of truth, so a failed or unconfigured ping never fails | |
| # the release. Receiver setup: scripts/openbitfun-release-sync.sh. | |
| - name: Request openbitfun mirror sync | |
| if: github.repository == 'GCWing/BitFun' | |
| continue-on-error: true | |
| env: | |
| SYNC_WEBHOOK_URL: ${{ secrets.OPENBITFUN_SYNC_WEBHOOK_URL }} | |
| RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }} | |
| RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "${SYNC_WEBHOOK_URL:-}" ]]; then | |
| echo "OPENBITFUN_SYNC_WEBHOOK_URL is not configured; the mirror will pick this up on its next cron run." | |
| exit 0 | |
| fi | |
| curl -fsSL -X POST --retry 3 --retry-delay 5 --max-time 30 \ | |
| -H 'Content-Type: application/json' \ | |
| -d "{\"tag\":\"${RELEASE_TAG}\",\"channel\":\"${RELEASE_CHANNEL}\"}" \ | |
| "${SYNC_WEBHOOK_URL}" >/dev/null | |
| echo "Mirror sync requested for ${RELEASE_TAG}." |