Skip to content

feat(license): separate app-entry and per-pack activation codes #7

feat(license): separate app-entry and per-pack activation codes

feat(license): separate app-entry and per-pack activation codes #7

name: Bundle Hot Update Checks
on:
pull_request:
paths:
- ".github/workflows/bundle-hot-*.yml"
- ".github/workflows/electron-release.yml"
- "apps/workspace/bundle-update.json"
- "apps/workspace/electron/**"
- "apps/workspace/scripts/**"
- "apps/workspace/src/**"
- "apps/workspace/package.json"
- "pnpm-lock.yaml"
- "Taskfile.yml"
- "scripts/build-server-target.mjs"
- "scripts/sync-workspace-dist.mjs"
- "docs/hot-update-architecture.md"
- "packages/vendor/**"
- "services/server/**"
push:
branches:
- dev
paths:
- ".github/workflows/bundle-hot-*.yml"
- ".github/workflows/electron-release.yml"
- "apps/workspace/bundle-update.json"
- "apps/workspace/electron/**"
- "apps/workspace/scripts/**"
- "apps/workspace/src/**"
- "apps/workspace/package.json"
- "pnpm-lock.yaml"
- "Taskfile.yml"
- "scripts/build-server-target.mjs"
- "scripts/sync-workspace-dist.mjs"
- "docs/hot-update-architecture.md"
- "packages/vendor/**"
- "services/server/**"
permissions:
contents: read
env:
HUSKY: "0"
NODE_VERSION: "24"
PNPM_VERSION: "11.9.0"
jobs:
checks:
name: Bundle safety and reproducibility
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
fetch-depth: 0
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
with:
version: ${{ env.PNPM_VERSION }}
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: ${{ env.NODE_VERSION }}
cache: pnpm
cache-dependency-path: pnpm-lock.yaml
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
with:
go-version-file: go.work
cache-dependency-path: |
go.work.sum
**/go.sum
- uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Format and lint hot-update sources
working-directory: apps/workspace
run: |
pnpm exec oxfmt --check electron/src scripts/package-bundle-update.ts scripts/hot-update-local-test.ts scripts/stage-electron-app.ts scripts/check-bundle-version-bumps.mjs
pnpm exec oxlint electron/src scripts/package-bundle-update.ts scripts/hot-update-local-test.ts scripts/stage-electron-app.ts scripts/check-bundle-version-bumps.mjs
- name: Require schema and workspace-layout version bumps
env:
BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
run: node apps/workspace/scripts/check-bundle-version-bumps.mjs "$BASE_SHA"
- name: Compile Electron and run state-machine tests
run: |
pnpm --dir apps/workspace electron:compile
pnpm --dir apps/workspace exec vitest run electron/src
- name: Build renderer
env:
VITE_ELECTRON_BUILD: "1"
VITE_MEDIAGO_EDITION: community
VITE_MEDIAGO_SERVER_PORT: "48273"
run: pnpm --dir apps/workspace build
- name: Package determinism smoke test
shell: bash
run: |
set -euo pipefail
private_key="$(node -e 'const {generateKeyPairSync}=require("node:crypto"); const {privateKey}=generateKeyPairSync("ed25519"); process.stdout.write(privateKey.export({format:"der",type:"pkcs8"}).toString("base64"))')"
export RENDERER_UPDATE_PRIVATE_KEY="$private_key"
export RENDERER_UPDATE_EXPECTED_PUBLIC_KEY="$(PRIVATE_KEY="$private_key" node -e 'const {createPrivateKey,createPublicKey}=require("node:crypto"); const key=createPrivateKey({key:Buffer.from(process.env.PRIVATE_KEY,"base64"),format:"der",type:"pkcs8"}); process.stdout.write(createPublicKey(key).export({format:"der",type:"spki"}).toString("base64"))')"
export RENDERER_UPDATE_CHANNEL="beta"
export RENDERER_UPDATE_EDITION="community"
export MEDIAGO_BUNDLE_SCHEMA_VERSION="$(node -p 'JSON.parse(require("node:fs").readFileSync("apps/workspace/bundle-update.json", "utf8")).schemaVersion')"
export MEDIAGO_BUNDLE_WORKSPACE_LAYOUT_VERSION="$(node -p 'JSON.parse(require("node:fs").readFileSync("apps/workspace/bundle-update.json", "utf8")).workspaceLayoutVersion')"
export MEDIAGO_SERVER_BINARY_DARWIN_ARM64="/bin/true"
export MEDIAGO_SERVER_BINARY_WINDOWS_X64="/bin/true"
node apps/workspace/scripts/package-bundle-update.ts
find apps/workspace/release/bundle -type f -print0 | sort -z | xargs -0 sha256sum > "$RUNNER_TEMP/first.sha256"
node apps/workspace/scripts/package-bundle-update.ts
find apps/workspace/release/bundle -type f -print0 | sort -z | xargs -0 sha256sum > "$RUNNER_TEMP/second.sha256"
diff -u "$RUNNER_TEMP/first.sha256" "$RUNNER_TEMP/second.sha256"
- name: Go server race tests
working-directory: services/server
run: task test