mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
TylerGitHubnpub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgytanpub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57ccnpub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67dDawnnpub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyfnpub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr# Kubernetes backend plugin (crates/buzz-backend-kubernetes) + desktop deploy path Implements docs/remote-agents.md (merged @28ae6cd21) as ONE PR: the provider binary, the desktop changes that make it work, the harness inactivity reaper, the Sprig image, and the conformance/live-test suites. Channel: buzz-remote-agents (29414326-dba7-402d-b384-b1b34d63a2e6), thread c42b70ef. ## What's here (by lane) - **crates/buzz-backend-kubernetes** (Dawn): stdin/stdout JSON provider, info + deploy; pure classify.rs (one match arm per spec state-machine row); reconcile/GC with ownership-marker gate + same-clock orphan check; per-attempt immutable Secrets; three-tier env with clear-then-write authoritative tier. - **Desktop** (Mari): KD3 launch block from resolved descriptor, KD5 pre-secret negotiation gate (resolve-once → stage-and-digest → info → protocol gate → deploy), KD1 Windows extension strip, bundling (externalBin + Justfile + release/canary workflows + stub loops), tauri.windows.conf.json platform override (Decision B: no Windows artifact). - **buzz-acp** (Max): KD4 BUZZ_ACP_EXIT_AFTER_INACTIVITY reaper (pool-independent; reset only at accepted dispatch; in-flight turn/heartbeat defers, never resets); BUZZ_ACP_EXIT_AFTER_INACTIVITY + BUZZ_ACP_NO_PRESENCE reserved. KD8 fix. - **Image + tests** (Perci): Dockerfile.sprig (digest-pinned bases, exec buzz-acp PID 1, relay-scoped credential config), image contract script, provider conformance suites (golden wire fixtures shared with desktop tests), live-local runbook (namespace-scoped, shared-cluster safe). - **Docs** (Sami, first commit): citation re-pin c1bca1b56 →28ae6cd21(44/49 were already byte-exact; 3 offsets fixed) + I3 presence-bound correction (below). ## Named spec deviations (deliberate, each with rationale) 1. **No baked default image yet.** ghcr.io/block/buzz-sprig is unpublished (verified: anonymous pull 403 vs control 200). Omitted `image` returns an in-band field-required error instead of a default. 2. **Image override STRICTER than spec §Image:** digest-only (`name@sha256:<64hex>`); ALL tags rejected; `name:tag@digest` normalized. With no baked default the override is the only path, so tag-acceptance would make mutability the v1 norm. Strictness is reversible; a moved tag under an nsec is not. Baked digest default + tag re-acceptance = follow-up with image publish. 3. **imagePullSecrets not in schema (v1).** Explicit user images may rely on namespace-preprovisioned pull credentials — the substrate boundary. Field added only if the publish decision proves it necessary. 9-field budget intact. 4. **Decision A closed: writable empty workspace.** Nest projection = named follow-up; no image-side scaffolding. 5. **Decision D overridden by Tyler (event b55398d8):** provider ships bundled with the desktop like buzz-acp/buzz-agent; spec §Distribution's separate release workflow deleted for v1. 6. **I3/vision presence bound corrected 90s → 180s.** PRESENCE_TTL_SECS moved in #3783 during this spec's base→merge window; the number was inherited, not chosen. Spec :206/:216/:928 + inline quote + VISION_REMOTE_AGENTS.md:59 corrected. ← Tyler: the vision is your document; this edit is flagged for your explicit eyes. 7. **Spec citations are pinned to 28ae6cd21** (main at spec merge) and resolve there, not at this PR's head — this PR's own lanes move crates/buzz-acp/src/lib.rs by ~100 lines (19 citations across KD4/KD6/KD7/ §Stop/§Launch data). Known Defects rows fixed BY this PR retire on merge; the section documents main as of the pin. 8. **KD7 grace tension declared:** pod terminationGracePeriodSeconds=60 vs KD7's measured ~87s shutdown tail at parallelism 10 (~197s at cap 32). KD7 is ruled out of scope, so L1-3's "enough grace for full graceful shutdown" is NOT met at default config — deliberate, resolved by the KD7 follow-up, not silently. ## Question for Tyler Will ghcr.io/block/buzz-sprig publish PUBLIC? If private-by-policy, §Image needs an imagePullSecrets story before the baked-default follow-up can land. ## Out of scope (named follow-ups) KD6 exit-code contract + KD7 shutdown budget (gate OnFailure), OnFailure restart policy, Windows provider binary, PVCs/nest projection, mesh deployability, sprig image publish workflow + baked multi-arch digest default. ## Reproduce locally (four traps that cost us real time) **1. Git hooks inherit the invoking shell's PATH — pin the shell, not just your verification commands.** `rust-toolchain.toml` pins `1.95.0`, but the rustup shim that honors that pin lives in `~/.cargo/bin`. If Homebrew's cargo is earlier on PATH, `cargo` in this repo is 1.89.0, which cannot build the workspace at all: ``` $ /opt/homebrew/bin/cargo check -p buzz-db error: rustc 1.89.0 is not supported by the following packages: sqlx@0.9.0 requires rustc 1.94.0 ... # exit 101 ``` Verifying with `PATH="$HOME/.cargo/bin:$PATH" cargo test` does *not* protect the push: lefthook's `pre-push` → `just test-unit` re-resolves `cargo` from the shell's own PATH, so a green local run is followed by a hook failure on a crate you never touched. Export the PATH for the whole shell, not per-command. This bit twice. **2. Line-scope your mutations, or the mutation edits its own detector.** When mutation-testing the respond-to guard, a whole-file `sed` on the mode literal touches 5 sites — the guard *and* the fixtures/assertions that test it. The mutation and its detector move together and the suite stays green, which reads as "this code is dead" when it actually means "you deleted the experiment": ``` # WRONG — 5 sites, guard and tests mutate together $ sed -i '' 's/"allowlist"/"allowlist-DISABLED"/g' src/env.rs test result: ok. 145 passed; 0 failed # false survivor # RIGHT — 1 site, anchored to the guard's own definition line $ sed -i '' '/^const RESPOND_TO_ALLOWLIST/s/"allowlist"/"allowlist-DISABLED"/' src/env.rs failures: env::tests::allowlist_mode_with_an_empty_list_is_refused env::tests::an_allowlist_entry_that_is_not_64_hex_is_refused test result: FAILED. 143 passed; 2 failed # real kill ``` Restore by copying a pristine file back and confirming `git diff --stat` is empty, not by re-running an inverse `sed`. **3. A completeness guard is not a correctness guard.** The shared wire fixture `tests/fixtures/provider-wire/deploy-full-launch.request.json` passed every test we had while containing four classes of invented data (wrong `respond_to` encoding, an env key no emitter writes, allowlist entries that fail the harness's own 64-hex rule, a `launch.env` key from no descriptor layer). The provider's tests could not have caught this: its types are deliberately indifferent to these values (`Option<String>`, `Vec<String>`, arbitrary map), so "the provider parses it" was never evidence that the desktop emits it. The fix was not a stronger provider assertion but a rule about provenance — "recorded" means executed-and-transcribed, and the desktop's whole-object equality test is the only enforcement that can exist. See the fixture README. **4. Every drift this arc was a value that agreed with itself.** Five invented values were found, and not one was caught by an assertion failing — each was caught by someone asking where a value came from. A named constant referenced symbolically on both the fixture and assertion side. A `sed` that mutated its own detector. Six probe rows that all died at the same unrelated error. A descriptor struct literal compared against a fixture built from that literal (`launch.args: ["run","--session"]`, which the resolver actually returns as `["acp"]`). The general defense is not more assertions but provenance: a stub is a control that varies nothing, and the more faithful it looks the better it hides. Ask what executed, not what passed. *Fixture-test determinism caveat (post-verification, Quinn + Dawn).* The desktop's whole-object fixture test calls the real resolver, which consults a process-global harness registry whose own docs require `registry_test_lock` for any test touching it. The fixture test holds no lock and is nonetheless deterministic — but by containment, not by ordering. Measured, not derived: planting a definition with `id: "goose"` directly into the registry (bypassing the loader) changes the resolved descriptor from `args: ["acp"]` to `args: ["--poisoned"]`, so `resolve_effective_harness_descriptor` **does** reach the registry for this id — it does not short-circuit on the builtin table first. Two controls discriminate: an empty registry and a registry poisoned under a *different* id both return `["acp"]`. What actually protects the test is that the registry has exactly one writer (`update_loaded_harness_registry`, reached only via `warm_harness_registry_from_dir`) — but that writer concatenates **two** sources of unequal strength (`custom_harnesses.rs:319-326`). Custom files pass through `load_custom_harnesses`, whose `check_id_collision` rejects the reserved builtin id `goose` case-insensitively at the loader — and that leg is tested (`load_applies_id_collision_check` writes a real `goose.json` and asserts the loader drops it). Preset definitions (`preset_harness_definitions`, `presets.rs:177-193`) are a bare `.map` over `PRESET_HARNESSES` with **no collision check** — exhaustive call-site enumeration at `60007fda4` finds four production `check_id_collision` sites, none on the preset path. That leg holds only because `goose` is not in the preset table today (intersection of TIER1 and preset ids is empty) — executed, not just read: adding a preset with `id: "goose"`, `args: ["--poisoned"]` and warming via the normal preset-only path (`warm_harness_registry_from_dir(None)`, no custom dir, no direct writer) flips the fixture's emitted `launch.args` from `["acp"]` to `["--poisoned"]` at `60007fda4`, command/env/policy_env unchanged. So: no test in the suite can put a `goose` entry in the registry via the custom path, and no preset currently carries one, so no interleaving can perturb this fixture — containment with one checked leg and one coincidental one. A future fixture built on a **non-builtin** runtime id has no containment at all — it would be order-dependent against whatever registry-writing test ran last and must take the lock. *Late instance, found while reviewing the mode guard.* The guard exact-matches `respond_to` untrimmed and case-sensitively, which is only correct if clap's `ValueEnum` derive is case-sensitive. `config.rs` gives two answers: the derive at `:448-453` carries no `ignore_case`, while the crate's own tests call `RespondTo::from_str(s, true)` — `ignore_case = true`. Reading the source supports either. Measured on the built binary instead: `owner-only` starts, `OWNER-ONLY` / `Owner-Only` / `ALLOWLIST` / `NOBODY` all exit rc=2 `invalid value`. Case-sensitive at the CLI, so the guard is right — and right for a reason the source does not state. The `from_str(_, true)` tests exercise a different surface and are not evidence about the CLI. *Corollary, and the sharper half.* When a test helper **reimplements** production instead of calling it, the helper is a fork — and a fork can be right while production is wrong, or wrong in the same way, and the suite reports green either way. Both `BUZZ_ACP_ALLOWED_*` gates are forked like this: production compares **strings** while the helpers compare **post-parse enums** (`config.rs:2623`) or re-derive the split (`buzz-cli/.../channels.rs:1296`). Production and the helper each carry their *own* copy of the empty-entry filter (`:1025` and `:1300`), so fixing one says nothing about the other. Measured on `buzz-cli`, restoring byte-exact between runs: | tree | result | |---|---| | baseline | 274 passed | | drop the empty-filter in **production** only (the real fix) | **274 passed** — no signal | | drop it in the **test helper** only | **273 passed, 1 failed** (`channels.rs:1338`) | Two independent defects, stacked, and worse together than either alone: production can be fixed with no test ever noticing, *and* the helper cannot be corrected without a false alarm demanding the bug back. The root cause is one bit of type information — `check_allowed_channel_add_policy(allowed_raw: &str, ..)` cannot represent "unset", while production reads `env::var(..) -> Result`, where unset and `""` are different states. A helper whose parameter type can't represent all of production's input states isn't testing production's states — it's testing a subset it silently chose. Same family as the struct-literal descriptor and the fixture drift: the test and the thing it tests agreeing with each other, rather than the test measuring the thing. Neither defect is in this PR's diff (`git diff --name-only28ae6cd21<head> -- crates/buzz-cli` is empty); both are now filed as NIP-34 issues on this repo: the fail-open + fork-helper defect at issue event `0524a4113f2d97fd…` and the respond-to self-lock at `e32837498969b5e7…` (filed 2026-08-02 after Quinn measured that no prior filing existed — zero hits on GitHub `block/buzz` open *or* closed and zero on the relay's kind:1621 issues, against working positive controls). The prescription was itself mutation-tested before being written down: repairing the fork's signature (`Option<&str>` + assertion → `None`) still let the reintroduced production bug ship 274-green — an expressive fork is still a fork; it never executes production. So the `buzz-cli` fix has **three parts and one explicit keep**: drop the production filter; **delete** the helper and point its tests at the real `cmd_set_add_policy` (which self-discriminates by error variant — `Usage` = refused, `Network(BadScheme)` = passed the gate — no relay needed); serialize the env-var tests behind one **`tokio::sync::Mutex::const_new`** lock taken with `.lock().await`, including the pre-existing `:1362` integration test (the fork was silently buying test isolation — without the lock, parallel runs flake nondeterministically; a `std::sync::Mutex` held across `.await` trips `clippy::await_holding_lock` under `-D warnings`); and **keep** the then-dead `!allowed.is_empty()` clause with a comment saying why. It is unreachable-false (`split(',')` never yields an empty vec), but it is the only thing that keeps the reintroduced production bug detectable — mutation-tested: on a tree that deletes the clause, reintroducing the empty-filter bug survives 275/0, because `""`/`","`/`" "` refuse either way and the filter goes semantically inert. Dead code can be load-bearing for tests: "provably unreachable" is an argument about behavior, never about coverage. When a helper forks production, the fix has to delete the fork: any change that leaves two implementations standing can only ever be verified against the one the tests call. *Final shape:* the keep and the broad lock are both artifacts of the fork surviving in some form. The extraction variant (Dawn, mutation-tested at `60007fda4`) removes the tension: extract one `check_channel_add_policy_allowed(Option<&str>, &str)` that **production calls**, with the `Option` placed at the env boundary where the `Result<String, VarError>` bit actually lives. 5/6 mutants killed; the empty-filter survivor is proven **equivalent** (exhaustive 6174-pair check, 0 divergences, with a diverging negative control; independently re-derived by a second generator — different tokens and shape — 0 divergences on admitted policies, 500 on a non-admitted control), not a coverage hole — on a one-implementation tree there is no fork left to witness, so no dead clause needs keeping. One scope line on that equivalence: it is **caller-conditional**, a property of the only current caller, not of the gate function — `cmd_set_add_policy`'s own match at `:1027-1034` admits only three policies before the gate runs; a second caller reaching the gate with arbitrary strings resurrects m1 as a real hole. The lock does not disappear, it narrows (Dawn's own correction, caught by Mari): lock exactly the tests that mutate the process env — three-plus-one on a fork tree, two on the extraction tree — behind one `tokio::sync::Mutex`, and the lock is part of the assertion, not hygiene: with it deleted, the gate test fails 8/8 runs deterministically by receiving `Network(BadScheme)` where it expects `Usage` — the unset test's `remove_var` clobbers the other's `set_var`, and **the gate test passes straight through the gate**, a false negative on the exact authz assertion the test exists to make. State it as an outcome: these two tests must not observe each other's env writes. 276/0 stable across 5 parallel runs, clippy `-D warnings` clean; independently verified (patch applied to a second worktree: result blob `d67e584be` matches the patch index, full mutant matrix reproduces row for row). One new row no earlier prescription covered: collapsing unset into `Some("")` fails **closed** — an unconfigured deployment refuses every policy — killed by the unset test. Patch: `OUTBOX/BUZZ_CLI_ADD_POLICY_GATE_EXTRACT_FIX.patch`. The filed issue (`0524a411…`) carries the fork-shape prescription; whoever picks it up should prefer the extraction shape, drop the dead-clause keep with it, and keep part 3 outcome-shaped: serialize whichever tests mutate the env. ## Verification (final HEAD `60007fda4`) - Full touched-package suites at each integration merge (log in plan file). At candidate parent `00e5b5fe9`: buzz-backend-kubernetes 154, buzz-acp 673, desktop tauri 2100+3, pnpm 3908, workspace clippy/fmt/tsc all clean. The only delta to `60007fda4` is one character in `scripts/test-k8s-sprig-image-live.sh` (heredoc escape so the readlink probe evaluates pod-side, not host-side at render); `crates/` tree hash is byte-identical at both SHAs, so the Rust receipts attach by tree identity. buzz-backend-kubernetes suite re-run in-shell at `HEAD == 60007fda4`: 154 passed. - Adversarial one-HEAD gate (Sami): guard matrix 12/12, predicate mutants 7/7, doomed-invocation finding closed end-to-end; tree-hash carry to `60007fda4` confirmed (crates/buzz-backend-kubernetes blob unchanged). - Live-local pass per TESTING.md + skill-buzz-testing (Perci, at `60007fda4`): explicit `docker-desktop` context, digest-qualified image imported into node containerd `k8s.io` namespace, pull policy `Never`; pod printed `DIGEST_ABI_OK`, `resolved_spec` and `image_id` both the exact requested digest, script exit 0. Dedicated per-run namespace, ownership labels on every object, scoped cleanup verified empty after. - Implementation review (Wren) at `60007fda4`: 9.6 minimalness / 9.4 elegance / 9.3 correctness, no blocker. - `origin/eva/k8s-backend` == `60007fda4` (ls-remote verified; SHA identity is byte identity). --------- Signed-off-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@buzz.block.builderlab.xyz> Signed-off-by: Tyler <109685178+tlongwell-block@users.noreply.github.com> Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com> Signed-off-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz> Signed-off-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@buzz.block.builderlab.xyz> Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@buzz.block.builderlab.xyz> Co-authored-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz> Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz> Co-authored-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@buzz.block.builderlab.xyz>
953 lines
41 KiB
YAML
953 lines
41 KiB
YAML
name: Release
|
|
|
|
concurrency:
|
|
group: desktop-release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'desktop-v[0-9]*'
|
|
|
|
jobs:
|
|
# Shared setup: verify the immutable release tag, determine the version, and
|
|
# create the release objects all four platform jobs upload into.
|
|
setup:
|
|
name: Setup
|
|
if: github.repository == 'block/buzz'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
version: ${{ steps.version.outputs.version }}
|
|
source_sha: ${{ steps.source.outputs.source_sha }}
|
|
steps:
|
|
- name: Determine version
|
|
id: version
|
|
run: echo "version=${GITHUB_REF_NAME#desktop-v}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Validate version
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: |
|
|
if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
|
|
echo "::error::Invalid version '$VERSION'. Expected semver (e.g. 0.4.0 or 1.0.0-beta.1)"
|
|
exit 1
|
|
fi
|
|
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Verify tag-bound release source
|
|
id: source
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: |
|
|
scripts/verify-release-ref.sh desktop-v "$VERSION"
|
|
echo "source_sha=$(git rev-parse 'HEAD^{commit}')" >> "$GITHUB_OUTPUT"
|
|
|
|
release:
|
|
name: Release
|
|
if: github.repository == 'block/buzz'
|
|
runs-on: macos-latest
|
|
needs: setup
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: read
|
|
id-token: write # required by block/apple-codesign-action for OIDC
|
|
outputs:
|
|
archive_name: ${{ steps.artifacts.outputs.archive_name }}
|
|
sig: ${{ steps.read-sig.outputs.sig }}
|
|
env:
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ needs.setup.outputs.source_sha }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Verify tag-bound release source
|
|
run: scripts/verify-release-ref.sh desktop-v "$VERSION"
|
|
|
|
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
|
|
|
- name: Install desktop dependencies
|
|
run: just desktop-install-ci
|
|
|
|
- name: Patch version
|
|
run: |
|
|
cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
|
|
cd src-tauri && cargo update --workspace
|
|
|
|
- name: Generate release config
|
|
run: cd desktop && node scripts/build-release-config.mjs
|
|
env:
|
|
BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
|
|
BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
|
|
|
|
- name: Build sidecars
|
|
run: |
|
|
cargo build --release -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
|
|
./scripts/bundle-sidecars.sh
|
|
|
|
# Mesh rev derived from Cargo.lock (no lockstep edit on dep bump); cache key tracks it.
|
|
- name: Resolve mesh-llm rev
|
|
id: mesh_rev
|
|
run: |
|
|
set -euo pipefail
|
|
REV=$(python3 -c 'import tomllib; d=tomllib.load(open("Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
|
|
[[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from Cargo.lock"; exit 1; }
|
|
echo "rev=$REV" >> "$GITHUB_OUTPUT"
|
|
echo "short=${REV:0:7}" >> "$GITHUB_OUTPUT"
|
|
- name: Restore mesh llama build cache
|
|
id: llama_cache
|
|
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
|
with:
|
|
path: ${{ github.workspace }}/.cache/mesh-llama
|
|
key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
|
|
- name: Build mesh llama native libraries
|
|
if: steps.llama_cache.outputs.cache-hit != 'true'
|
|
env:
|
|
MESH_REV_SHORT: ${{ steps.mesh_rev.outputs.short }}
|
|
run: |
|
|
set -euo pipefail
|
|
cargo fetch --manifest-path desktop/src-tauri/Cargo.toml
|
|
SHORT="$MESH_REV_SHORT"
|
|
MESH_ROOT=$(find "${CARGO_HOME:-$HOME/.cargo}/git/checkouts" -path "*/$SHORT" -type d -name "$SHORT" | head -1)
|
|
if [[ -z "$MESH_ROOT" ]]; then
|
|
echo "::error::mesh-llm checkout for $SHORT not found after cargo fetch"
|
|
exit 1
|
|
fi
|
|
export LLAMA_STAGE_BACKEND=metal
|
|
export LLAMA_STAGE_BUILD_DIR="$GITHUB_WORKSPACE/.cache/mesh-llama/build-stage-abi-metal"
|
|
export CMAKE_OSX_DEPLOYMENT_TARGET=10.15
|
|
"$MESH_ROOT/scripts/prepare-llama.sh" pinned
|
|
"$MESH_ROOT/scripts/build-llama.sh" -DCMAKE_OSX_DEPLOYMENT_TARGET=10.15
|
|
- name: Save mesh llama build cache
|
|
if: steps.llama_cache.outputs.cache-hit != 'true'
|
|
uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
|
|
with:
|
|
path: ${{ github.workspace }}/.cache/mesh-llama
|
|
key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
|
|
|
|
- name: Build unsigned Tauri app
|
|
run: cd desktop && pnpm tauri build --verbose --no-sign --features mesh-llm --config src-tauri/tauri.release.conf.json
|
|
env:
|
|
BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
|
|
BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
CMAKE_POLICY_VERSION_MINIMUM: "3.5"
|
|
MACOSX_DEPLOYMENT_TARGET: "10.15"
|
|
CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
|
|
LLAMA_STAGE_BACKEND: metal
|
|
LLAMA_STAGE_BUILD_DIR: ${{ github.workspace }}/.cache/mesh-llama/build-stage-abi-metal
|
|
SKIPPY_LLAMA_AUTO_BUILD: "0"
|
|
TAURI_BUNDLER_DMG_IGNORE_CI: "true"
|
|
|
|
- name: Locate unsigned DMG
|
|
id: unsigned
|
|
run: |
|
|
BUNDLE_DIR="desktop/src-tauri/target/release/bundle"
|
|
DMG=$(find "$BUNDLE_DIR/dmg" -name '*.dmg' -type f | head -1)
|
|
if [[ -z "$DMG" ]]; then
|
|
echo "::error::No DMG found in $BUNDLE_DIR/dmg"
|
|
exit 1
|
|
fi
|
|
echo "dmg=$DMG" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set DMG Finder label text size
|
|
env:
|
|
DMG_PATH: ${{ steps.unsigned.outputs.dmg }}
|
|
run: desktop/scripts/set-dmg-finder-text-size.sh "$DMG_PATH" 14
|
|
|
|
# mdx-ios-codesign-helper discovers this file by its exact lowercase basename.
|
|
- name: Stage signing entitlements
|
|
run: cp desktop/src-tauri/Entitlements.plist "${RUNNER_TEMP}/entitlements.plist"
|
|
|
|
- name: Codesign and Notarize
|
|
id: codesign
|
|
uses: block/apple-codesign-action@679535d1ab7c5a7c18e6f9afcba3464512cc3dde # v1.1.0
|
|
with:
|
|
osx-codesign-role: ${{ secrets.OSX_CODESIGN_ROLE }}
|
|
codesign-s3-bucket: ${{ secrets.CODESIGN_S3_BUCKET }}
|
|
unsigned-artifact-path: ${{ steps.unsigned.outputs.dmg }}
|
|
entitlements-plist-path: ${{ runner.temp }}/entitlements.plist
|
|
artifact-name: buzz-${{ github.sha }}-${{ github.run_id }}-arm64
|
|
|
|
- name: Replace DMG and rebuild updater archive
|
|
env:
|
|
SIGNED_DMG: ${{ steps.codesign.outputs.signed-dmg-path }}
|
|
SIGNED_APP_ZIP: ${{ steps.codesign.outputs.signed-artifact-path }}
|
|
UNSIGNED_DMG: ${{ steps.unsigned.outputs.dmg }}
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
BUNDLE_DIR="desktop/src-tauri/target/release/bundle"
|
|
APP_DIR="${BUNDLE_DIR}/macos"
|
|
|
|
# Replace unsigned DMG with the signed/notarized one.
|
|
cp "$SIGNED_DMG" "$UNSIGNED_DMG"
|
|
|
|
# Swap the unsigned .app for the signed .app extracted from the action's zip.
|
|
EXTRACT_DIR="${RUNNER_TEMP}/signed-app-extract"
|
|
rm -rf "$EXTRACT_DIR" && mkdir -p "$EXTRACT_DIR"
|
|
ditto -x -k "$SIGNED_APP_ZIP" "$EXTRACT_DIR"
|
|
rm -rf "${APP_DIR}/Buzz.app"
|
|
cp -R "${EXTRACT_DIR}/Buzz.app" "${APP_DIR}/Buzz.app"
|
|
|
|
# Rebuild the updater archive from the signed .app and re-sign it with the Tauri updater key.
|
|
rm -f "${APP_DIR}/Buzz.app.tar.gz" "${APP_DIR}/Buzz.app.tar.gz.sig"
|
|
(cd "$APP_DIR" && tar -czf Buzz.app.tar.gz Buzz.app)
|
|
TARBALL_ABS="$(pwd)/${APP_DIR}/Buzz.app.tar.gz"
|
|
(cd desktop && pnpm tauri signer sign "$TARBALL_ABS")
|
|
|
|
- name: Verify code signature
|
|
run: |
|
|
codesign --verify --deep --strict --verbose=2 \
|
|
desktop/src-tauri/target/release/bundle/macos/Buzz.app
|
|
spctl --assess --type execute --verbose=4 \
|
|
desktop/src-tauri/target/release/bundle/macos/Buzz.app
|
|
desktop/scripts/verify-macos-entitlements.sh \
|
|
desktop/src-tauri/target/release/bundle/macos/Buzz.app
|
|
|
|
- name: Locate build artifacts
|
|
id: artifacts
|
|
run: |
|
|
BUNDLE_DIR="desktop/src-tauri/target/release/bundle"
|
|
|
|
# Find the DMG (Tauri names it Buzz_<version>_<arch>.dmg)
|
|
DMG=$(find "$BUNDLE_DIR/dmg" -name '*.dmg' -type f | head -1)
|
|
if [[ -z "$DMG" ]]; then
|
|
echo "::error::No DMG found in $BUNDLE_DIR/dmg"
|
|
exit 1
|
|
fi
|
|
echo "dmg=$DMG" >> "$GITHUB_OUTPUT"
|
|
|
|
# Find the updater .tar.gz and .sig. Give each architecture a unique
|
|
# release basename before artifacts are merged by the final writer.
|
|
ARCHIVE=$(find "$BUNDLE_DIR/macos" -name '*.tar.gz' ! -name '*.sig' -type f | head -1)
|
|
SIG="${ARCHIVE}.sig"
|
|
if [[ -z "$ARCHIVE" || ! -f "$SIG" ]]; then
|
|
echo "::error::Updater archive or signature not found in $BUNDLE_DIR/macos"
|
|
exit 1
|
|
fi
|
|
RENAMED="$(dirname "$ARCHIVE")/Buzz_${VERSION}_aarch64.app.tar.gz"
|
|
mv "$ARCHIVE" "$RENAMED"
|
|
mv "$SIG" "${RENAMED}.sig"
|
|
ARCHIVE="$RENAMED"
|
|
SIG="${RENAMED}.sig"
|
|
echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT"
|
|
echo "archive_name=$(basename "$ARCHIVE")" >> "$GITHUB_OUTPUT"
|
|
echo "sig=$SIG" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Read updater signature
|
|
id: read-sig
|
|
run: echo "sig=$(cat "$SIG_PATH")" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
SIG_PATH: ${{ steps.artifacts.outputs.sig }}
|
|
|
|
- name: Stage Apple Silicon release artifacts
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: desktop-release-macos-arm64
|
|
if-no-files-found: error
|
|
path: |
|
|
${{ steps.artifacts.outputs.dmg }}
|
|
${{ steps.artifacts.outputs.archive }}
|
|
${{ steps.artifacts.outputs.sig }}
|
|
|
|
release-macos-x64:
|
|
name: Release macOS (Intel)
|
|
if: github.repository == 'block/buzz'
|
|
runs-on: macos-latest
|
|
needs: setup
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: read
|
|
id-token: write # required by block/apple-codesign-action for OIDC
|
|
outputs:
|
|
archive_name: ${{ steps.artifacts.outputs.archive_name }}
|
|
sig: ${{ steps.read-sig.outputs.sig }}
|
|
env:
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
TARGET: x86_64-apple-darwin
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ needs.setup.outputs.source_sha }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Verify tag-bound release source
|
|
run: scripts/verify-release-ref.sh desktop-v "$VERSION"
|
|
|
|
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
|
|
|
- name: Install desktop dependencies
|
|
run: just desktop-install-ci
|
|
|
|
- name: Add Rust target
|
|
run: rustup target add "$TARGET"
|
|
|
|
- name: Patch version
|
|
run: |
|
|
cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
|
|
cd src-tauri && cargo update --workspace
|
|
|
|
- name: Generate release config
|
|
run: cd desktop && node scripts/build-release-config.mjs
|
|
env:
|
|
BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
|
|
BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
|
|
|
|
- name: Build sidecars
|
|
run: |
|
|
cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
|
|
./scripts/bundle-sidecars.sh "$TARGET"
|
|
|
|
- name: Build unsigned Tauri app
|
|
run: cd desktop && pnpm tauri build --verbose --no-sign --target "$TARGET" --config src-tauri/tauri.release.conf.json
|
|
env:
|
|
BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
|
|
BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
CMAKE_POLICY_VERSION_MINIMUM: "3.5"
|
|
MACOSX_DEPLOYMENT_TARGET: "10.15"
|
|
CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
|
|
TAURI_BUNDLER_DMG_IGNORE_CI: "true"
|
|
|
|
- name: Locate unsigned DMG
|
|
id: unsigned
|
|
run: |
|
|
BUNDLE_DIR="desktop/src-tauri/target/${TARGET}/release/bundle"
|
|
DMG=$(find "$BUNDLE_DIR/dmg" -name '*.dmg' -type f | head -1)
|
|
if [[ -z "$DMG" ]]; then
|
|
echo "::error::No DMG found in $BUNDLE_DIR/dmg"
|
|
exit 1
|
|
fi
|
|
echo "dmg=$DMG" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set DMG Finder label text size
|
|
env:
|
|
DMG_PATH: ${{ steps.unsigned.outputs.dmg }}
|
|
run: desktop/scripts/set-dmg-finder-text-size.sh "$DMG_PATH" 14
|
|
|
|
# mdx-ios-codesign-helper discovers this file by its exact lowercase basename.
|
|
- name: Stage signing entitlements
|
|
run: cp desktop/src-tauri/Entitlements.plist "${RUNNER_TEMP}/entitlements.plist"
|
|
|
|
- name: Codesign and Notarize
|
|
id: codesign
|
|
uses: block/apple-codesign-action@679535d1ab7c5a7c18e6f9afcba3464512cc3dde # v1.1.0
|
|
with:
|
|
osx-codesign-role: ${{ secrets.OSX_CODESIGN_ROLE }}
|
|
codesign-s3-bucket: ${{ secrets.CODESIGN_S3_BUCKET }}
|
|
unsigned-artifact-path: ${{ steps.unsigned.outputs.dmg }}
|
|
entitlements-plist-path: ${{ runner.temp }}/entitlements.plist
|
|
artifact-name: buzz-${{ github.sha }}-${{ github.run_id }}-x64
|
|
|
|
- name: Replace DMG and rebuild updater archive
|
|
env:
|
|
SIGNED_DMG: ${{ steps.codesign.outputs.signed-dmg-path }}
|
|
SIGNED_APP_ZIP: ${{ steps.codesign.outputs.signed-artifact-path }}
|
|
UNSIGNED_DMG: ${{ steps.unsigned.outputs.dmg }}
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
APP_DIR="desktop/src-tauri/target/${TARGET}/release/bundle/macos"
|
|
|
|
# Replace the unsigned DMG with the signed/notarized one.
|
|
cp "$SIGNED_DMG" "$UNSIGNED_DMG"
|
|
|
|
# Swap the unsigned .app for the signed .app from the action's zip.
|
|
EXTRACT_DIR="${RUNNER_TEMP}/signed-app-extract-x64"
|
|
rm -rf "$EXTRACT_DIR" && mkdir -p "$EXTRACT_DIR"
|
|
ditto -x -k "$SIGNED_APP_ZIP" "$EXTRACT_DIR"
|
|
rm -rf "${APP_DIR}/Buzz.app"
|
|
cp -R "${EXTRACT_DIR}/Buzz.app" "${APP_DIR}/Buzz.app"
|
|
|
|
# Rebuild the updater archive from the signed .app and re-sign with the Tauri updater key.
|
|
rm -f "${APP_DIR}/Buzz.app.tar.gz" "${APP_DIR}/Buzz.app.tar.gz.sig"
|
|
(cd "$APP_DIR" && tar -czf Buzz.app.tar.gz Buzz.app)
|
|
TARBALL_ABS="$(pwd)/${APP_DIR}/Buzz.app.tar.gz"
|
|
(cd desktop && pnpm tauri signer sign "$TARBALL_ABS")
|
|
|
|
- name: Verify code signature
|
|
run: |
|
|
APP_DIR="desktop/src-tauri/target/${TARGET}/release/bundle/macos/Buzz.app"
|
|
codesign --verify --deep --strict --verbose=2 "$APP_DIR"
|
|
spctl --assess --type execute --verbose=4 "$APP_DIR"
|
|
desktop/scripts/verify-macos-entitlements.sh "$APP_DIR"
|
|
|
|
- name: Locate updater archive
|
|
id: artifacts
|
|
run: |
|
|
BUNDLE_DIR="desktop/src-tauri/target/${TARGET}/release/bundle"
|
|
|
|
ARCHIVE=$(find "$BUNDLE_DIR/macos" -name '*.tar.gz' ! -name '*.sig' -type f | head -1)
|
|
SIG="${ARCHIVE}.sig"
|
|
if [[ -z "$ARCHIVE" || ! -f "$SIG" ]]; then
|
|
echo "::error::Updater archive or signature not found in $BUNDLE_DIR/macos"
|
|
exit 1
|
|
fi
|
|
RENAMED="$(dirname "$ARCHIVE")/Buzz_${VERSION}_x64.app.tar.gz"
|
|
mv "$ARCHIVE" "$RENAMED"
|
|
mv "$SIG" "${RENAMED}.sig"
|
|
ARCHIVE="$RENAMED"
|
|
SIG="${RENAMED}.sig"
|
|
echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT"
|
|
echo "archive_name=$(basename "$ARCHIVE")" >> "$GITHUB_OUTPUT"
|
|
echo "sig=$SIG" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Read updater signature
|
|
id: read-sig
|
|
run: echo "sig=$(cat "$SIG_PATH")" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
SIG_PATH: ${{ steps.artifacts.outputs.sig }}
|
|
|
|
- name: Stage Intel macOS release artifacts
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: desktop-release-macos-x64
|
|
if-no-files-found: error
|
|
path: |
|
|
${{ steps.unsigned.outputs.dmg }}
|
|
${{ steps.artifacts.outputs.archive }}
|
|
${{ steps.artifacts.outputs.sig }}
|
|
|
|
release-linux:
|
|
name: Release Linux
|
|
if: github.repository == 'block/buzz'
|
|
runs-on: ubuntu-latest
|
|
# Digest-pinned like the SHA-pinned actions below; Renovate keeps it fresh.
|
|
container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
|
|
needs: setup
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
# AppImage tools (linuxdeploy, appimagetool) are themselves AppImages.
|
|
# Containers lack FUSE, so we must use the extract-and-run fallback.
|
|
APPIMAGE_EXTRACT_AND_RUN: "1"
|
|
# This job runs in a container where the default run shell is dash;
|
|
# the AppImage steps below use bash-only syntax ([[ ]], mapfile, arrays).
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
outputs:
|
|
archive_name: ${{ steps.linux-artifacts.outputs.archive_name }}
|
|
sig: ${{ steps.read-sig.outputs.sig }}
|
|
steps:
|
|
- name: Install system dependencies
|
|
env:
|
|
DEBIAN_FRONTEND: noninteractive
|
|
run: |
|
|
# Must run first: bare ubuntu:24.04 ships without curl, wget, git, or
|
|
# ca-certificates. activate-hermit bootstraps via curl+HTTPS (needs
|
|
# both), and actions/checkout falls back to a REST tarball without git.
|
|
# Running as root — no sudo needed.
|
|
apt-get update \
|
|
-o Acquire::Retries=3 \
|
|
-o Acquire::http::Timeout=30 \
|
|
-o Acquire::https::Timeout=30
|
|
apt-get install -y --no-install-recommends \
|
|
-o Acquire::Retries=3 \
|
|
-o Acquire::http::Timeout=30 \
|
|
-o Acquire::https::Timeout=30 \
|
|
-o DPkg::Lock::Timeout=120 \
|
|
build-essential \
|
|
ca-certificates \
|
|
curl \
|
|
desktop-file-utils \
|
|
file \
|
|
git \
|
|
libasound2-dev \
|
|
libayatana-appindicator3-dev \
|
|
libgtk-3-dev \
|
|
librsvg2-dev \
|
|
libssl-dev \
|
|
libwebkit2gtk-4.1-dev \
|
|
libxdo-dev \
|
|
patchelf \
|
|
pkg-config \
|
|
squashfs-tools \
|
|
wget \
|
|
xdg-utils
|
|
# Install GitHub CLI — preinstalled on runners but absent in containers.
|
|
# wget and ca-certificates are now available from the step above.
|
|
mkdir -p -m 755 /etc/apt/keyrings
|
|
wget -q --tries=3 --timeout=30 -O /usr/share/keyrings/githubcli-archive-keyring.gpg \
|
|
https://cli.github.com/packages/githubcli-archive-keyring.gpg
|
|
# Pin the keyring like appimagetool below. If GitHub rotates the
|
|
# keyring this fails loudly — recompute and update the hash.
|
|
echo "6084d5d7bd8e288441e0e94fc6275570895da18e6751f70f057485dc2d1a811b /usr/share/keyrings/githubcli-archive-keyring.gpg" | sha256sum -c
|
|
chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
|
|
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
|
|
> /etc/apt/sources.list.d/github-cli.list
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends gh
|
|
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ needs.setup.outputs.source_sha }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Mark workspace safe for git (containerized job)
|
|
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
|
|
- name: Verify tag-bound release source
|
|
env:
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
run: scripts/verify-release-ref.sh desktop-v "$VERSION"
|
|
|
|
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
|
|
|
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
|
|
with:
|
|
workspaces: desktop/src-tauri
|
|
lookup-only: true
|
|
|
|
- name: Install appimagetool
|
|
run: |
|
|
# Pin to an immutable release tag to avoid supply-chain drift from the
|
|
# mutable `continuous` tag. Tag: 1.9.1, asset: appimagetool-<arch>.AppImage
|
|
# (https://github.com/AppImage/appimagetool/releases/tag/1.9.1)
|
|
case "$(uname -m)" in
|
|
x86_64) ARCH_SUFFIX="x86_64" ;;
|
|
aarch64) ARCH_SUFFIX="aarch64" ;;
|
|
*)
|
|
echo "::error::Unsupported architecture: $(uname -m)"
|
|
exit 1
|
|
;;
|
|
esac
|
|
wget -q --tries=3 --timeout=30 -O /tmp/appimagetool \
|
|
"https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-${ARCH_SUFFIX}.AppImage"
|
|
# SHA256 integrity check. Refuse to run an unverified binary: if a new
|
|
# arch (e.g. aarch64) is enabled in CI, compute its hash and add it here.
|
|
if [[ "$ARCH_SUFFIX" == "x86_64" ]]; then
|
|
echo "ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0 /tmp/appimagetool" | sha256sum -c
|
|
else
|
|
echo "::error::No pinned SHA256 for appimagetool-${ARCH_SUFFIX} — add it before enabling this architecture"
|
|
exit 1
|
|
fi
|
|
install -m 755 /tmp/appimagetool /usr/local/bin/appimagetool
|
|
# appimagetool otherwise fetches the AppImage type2 runtime from the
|
|
# MUTABLE `continuous` tag at repack time — the runtime is the first
|
|
# code users execute, so pin it too. Tag: 20251108, hash is for the
|
|
# x86_64 asset (non-x86_64 already hard-fails above).
|
|
# (https://github.com/AppImage/type2-runtime/releases/tag/20251108)
|
|
wget -q --tries=3 --timeout=30 -O /tmp/appimage-runtime \
|
|
"https://github.com/AppImage/type2-runtime/releases/download/20251108/runtime-${ARCH_SUFFIX}"
|
|
echo "2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d /tmp/appimage-runtime" | sha256sum -c
|
|
install -D -m 644 /tmp/appimage-runtime /usr/local/lib/appimage-runtime
|
|
echo "APPIMAGETOOL_RUNTIME_FILE=/usr/local/lib/appimage-runtime" >> "$GITHUB_ENV"
|
|
|
|
- name: Install desktop dependencies
|
|
run: just desktop-install-ci
|
|
|
|
- name: Patch version
|
|
env:
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
run: |
|
|
cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
|
|
cd src-tauri && cargo update --workspace
|
|
|
|
- name: Build sidecars
|
|
run: |
|
|
cargo build --release -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
|
|
./scripts/bundle-sidecars.sh
|
|
|
|
- name: Generate release config
|
|
run: cd desktop && node scripts/build-release-config.mjs
|
|
env:
|
|
BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
|
|
BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
|
|
|
|
- name: Build Linux Tauri app
|
|
run: cd desktop && pnpm tauri build --verbose --ci --bundles deb,appimage --config src-tauri/tauri.release.conf.json
|
|
env:
|
|
BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
|
|
BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
|
|
CMAKE_POLICY_VERSION_MINIMUM: "3.5"
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
|
|
- name: Fix AppImage (remove infra libs, shim host GStreamer)
|
|
run: |
|
|
mapfile -t APPIMAGES < <(find desktop/src-tauri/target/release/bundle/appimage -name '*.AppImage' -type f)
|
|
if [[ ${#APPIMAGES[@]} -eq 0 ]]; then
|
|
echo "::error::No AppImage found to post-process"
|
|
exit 1
|
|
fi
|
|
if [[ ${#APPIMAGES[@]} -gt 1 ]]; then
|
|
echo "::error::Expected exactly one AppImage, found ${#APPIMAGES[@]}: ${APPIMAGES[*]}"
|
|
exit 1
|
|
fi
|
|
bash desktop/scripts/fix-appimage.sh "${APPIMAGES[0]}"
|
|
env:
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
|
|
- name: Locate Linux build artifacts
|
|
id: linux-artifacts
|
|
run: |
|
|
BUNDLE_DIR="desktop/src-tauri/target/release/bundle"
|
|
|
|
DEB=$(find "$BUNDLE_DIR/deb" -name '*.deb' -type f | head -1)
|
|
if [[ -z "$DEB" ]]; then
|
|
echo "::error::No DEB found in $BUNDLE_DIR/deb"
|
|
exit 1
|
|
fi
|
|
echo "deb=$DEB" >> "$GITHUB_OUTPUT"
|
|
|
|
APPIMAGE=$(find "$BUNDLE_DIR/appimage" -name '*.AppImage' -type f | head -1)
|
|
if [[ -z "$APPIMAGE" ]]; then
|
|
echo "::error::No AppImage found in $BUNDLE_DIR/appimage"
|
|
exit 1
|
|
fi
|
|
echo "appimage=$APPIMAGE" >> "$GITHUB_OUTPUT"
|
|
|
|
# Updater archive: Tauri 2.11+ with createUpdaterArtifacts signs the
|
|
# AppImage directly (*.AppImage + *.AppImage.sig). Earlier versions
|
|
# wrapped it in a tar.gz. Try the new format first, fall back to legacy.
|
|
ARCHIVE=$(find "$BUNDLE_DIR/appimage" -name '*.AppImage.tar.gz' ! -name '*.sig' -type f | head -1)
|
|
if [[ -n "$ARCHIVE" ]]; then
|
|
SIG="${ARCHIVE}.sig"
|
|
else
|
|
ARCHIVE="$APPIMAGE"
|
|
SIG="${APPIMAGE}.sig"
|
|
fi
|
|
if [[ -z "$ARCHIVE" || ! -f "$SIG" ]]; then
|
|
echo "::error::AppImage updater archive or signature not found in $BUNDLE_DIR/appimage"
|
|
exit 1
|
|
fi
|
|
echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT"
|
|
echo "archive_name=$(basename "$ARCHIVE")" >> "$GITHUB_OUTPUT"
|
|
echo "sig=$SIG" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Read updater signature
|
|
id: read-sig
|
|
run: echo "sig=$(cat "$SIG_PATH")" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
SIG_PATH: ${{ steps.linux-artifacts.outputs.sig }}
|
|
|
|
# NOTE: .deb is NOT auto-updatable (Tauri updater constraint — only AppImage supports it on Linux)
|
|
- name: Stage Linux release artifacts
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: desktop-release-linux-x64
|
|
if-no-files-found: error
|
|
path: |
|
|
${{ steps.linux-artifacts.outputs.deb }}
|
|
${{ steps.linux-artifacts.outputs.appimage }}
|
|
${{ steps.linux-artifacts.outputs.archive }}
|
|
${{ steps.linux-artifacts.outputs.sig }}
|
|
|
|
release-windows:
|
|
name: Release Windows
|
|
runs-on: windows-latest
|
|
needs: setup
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
archive_name: ${{ steps.artifacts.outputs.archive_name }}
|
|
sig: ${{ steps.read-sig.outputs.sig }}
|
|
env:
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
TARGET: x86_64-pc-windows-msvc
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ needs.setup.outputs.source_sha }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Verify tag-bound release source
|
|
shell: bash
|
|
run: scripts/verify-release-ref.sh desktop-v "$VERSION"
|
|
|
|
- uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
|
|
with:
|
|
targets: ${{ env.TARGET }}
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: 24.14.1
|
|
# Disable dependency caching: a writable cache in this release workflow
|
|
# (contents: read, feeds a signed installer) is a poisoning vector. pnpm
|
|
# install runs uncached below.
|
|
package-manager-cache: false
|
|
|
|
- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
|
|
with:
|
|
version: 11.4.0
|
|
|
|
- name: Install desktop dependencies
|
|
shell: bash
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Patch version
|
|
shell: bash
|
|
run: |
|
|
cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
|
|
cd src-tauri && cargo update --workspace
|
|
|
|
- name: Generate release config
|
|
shell: bash
|
|
run: cd desktop && node scripts/build-release-config.mjs
|
|
env:
|
|
BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
|
|
BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
|
|
|
|
- name: Build sidecars
|
|
shell: bash
|
|
run: |
|
|
cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
|
|
./scripts/bundle-sidecars.sh "$TARGET"
|
|
|
|
- name: Build Windows NSIS installer (unsigned)
|
|
shell: bash
|
|
run: cd desktop && pnpm tauri build --verbose --target "$TARGET" --bundles nsis --config src-tauri/tauri.release.conf.json
|
|
env:
|
|
BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
|
|
BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
CMAKE_POLICY_VERSION_MINIMUM: "3.5"
|
|
|
|
- name: Locate Windows build artifacts
|
|
id: artifacts
|
|
shell: bash
|
|
run: |
|
|
BUNDLE_DIR="desktop/src-tauri/target/${TARGET}/release/bundle"
|
|
|
|
# Find the NSIS installer .exe
|
|
EXE=$(find "$BUNDLE_DIR/nsis" -name '*.exe' -type f | head -1)
|
|
if [[ -z "$EXE" ]]; then
|
|
echo "::error::No NSIS installer found in $BUNDLE_DIR/nsis"
|
|
exit 1
|
|
fi
|
|
|
|
# Tauri 2.x with createUpdaterArtifacts: true signs the NSIS
|
|
# installer in place (<name>-setup.exe + <name>-setup.exe.sig).
|
|
SIG="${EXE}.sig"
|
|
if [[ ! -f "$SIG" ]]; then
|
|
echo "::error::NSIS installer signature not found: $SIG"
|
|
exit 1
|
|
fi
|
|
|
|
# Rename with _alpha-unsigned marker, keeping the detached signature
|
|
# in lockstep so latest.json matches the uploaded updater artifact.
|
|
EXE_DIR=$(dirname "$EXE")
|
|
EXE_BASE=$(basename "$EXE" .exe)
|
|
MARKED_EXE="${EXE_DIR}/${EXE_BASE}_alpha-unsigned.exe"
|
|
MARKED_SIG="${MARKED_EXE}.sig"
|
|
mv "$EXE" "$MARKED_EXE"
|
|
mv "$SIG" "$MARKED_SIG"
|
|
echo "exe=$MARKED_EXE" >> "$GITHUB_OUTPUT"
|
|
echo "archive=$MARKED_EXE" >> "$GITHUB_OUTPUT"
|
|
echo "archive_name=$(basename "$MARKED_EXE")" >> "$GITHUB_OUTPUT"
|
|
echo "sig=$MARKED_SIG" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Read updater signature
|
|
id: read-sig
|
|
shell: bash
|
|
run: echo "sig=$(cat "$SIG_PATH")" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
SIG_PATH: ${{ steps.artifacts.outputs.sig }}
|
|
|
|
- name: Stage Windows release artifacts
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: desktop-release-windows-x64
|
|
if-no-files-found: error
|
|
path: |
|
|
${{ steps.artifacts.outputs.exe }}
|
|
${{ steps.artifacts.outputs.sig }}
|
|
|
|
assemble-manifest:
|
|
name: Assemble multi-platform latest.json
|
|
# Only the tag-bound setup path can reach this job.
|
|
if: |
|
|
always() &&
|
|
needs.setup.result == 'success' &&
|
|
needs.release.result == 'success' &&
|
|
needs.release-macos-x64.result == 'success' &&
|
|
needs.release-linux.result == 'success' &&
|
|
needs.release-windows.result == 'success' &&
|
|
github.ref == format('refs/tags/desktop-v{0}', needs.setup.outputs.version)
|
|
runs-on: ubuntu-latest
|
|
needs: [setup, release, release-macos-x64, release-linux, release-windows]
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
env:
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ needs.setup.outputs.source_sha }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Verify tag-bound release source
|
|
run: scripts/verify-release-ref.sh desktop-v "$VERSION"
|
|
|
|
- name: Download staged release artifacts
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
pattern: desktop-release-*
|
|
path: staged-by-platform
|
|
|
|
- name: Flatten staged artifacts without basename collisions
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir staged
|
|
while IFS= read -r -d '' file; do
|
|
name="$(basename "$file")"
|
|
[[ ! -e "staged/$name" ]] || {
|
|
echo "::error::release artifact basename collision: $name"
|
|
exit 1
|
|
}
|
|
cp "$file" "staged/$name"
|
|
done < <(find staged-by-platform -type f -print0)
|
|
|
|
- name: Write signature files
|
|
env:
|
|
RESULT_ARM64: ${{ needs.release.result }}
|
|
RESULT_X64: ${{ needs.release-macos-x64.result }}
|
|
RESULT_LINUX: ${{ needs.release-linux.result }}
|
|
RESULT_WIN: ${{ needs.release-windows.result }}
|
|
SIG_ARM64: ${{ needs.release.outputs.sig }}
|
|
SIG_X64: ${{ needs.release-macos-x64.outputs.sig }}
|
|
SIG_LINUX: ${{ needs.release-linux.outputs.sig }}
|
|
SIG_WIN: ${{ needs.release-windows.outputs.sig }}
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p /tmp/sigs
|
|
|
|
write_sig() {
|
|
local result="$1" platform="$2" sig="$3"
|
|
if [[ "$result" == "success" ]]; then
|
|
[[ -n "$sig" ]] || { echo "::error::Missing signature for successful platform: $platform"; exit 1; }
|
|
printf '%s' "$sig" > "/tmp/sigs/${platform}.sig"
|
|
fi
|
|
}
|
|
|
|
write_sig "$RESULT_ARM64" darwin-aarch64 "$SIG_ARM64"
|
|
write_sig "$RESULT_X64" darwin-x86_64 "$SIG_X64"
|
|
write_sig "$RESULT_LINUX" linux-x86_64 "$SIG_LINUX"
|
|
write_sig "$RESULT_WIN" windows-x86_64 "$SIG_WIN"
|
|
|
|
- name: Verify draft release has every updater archive
|
|
env:
|
|
RESULT_ARM64: ${{ needs.release.result }}
|
|
RESULT_X64: ${{ needs.release-macos-x64.result }}
|
|
RESULT_LINUX: ${{ needs.release-linux.result }}
|
|
RESULT_WIN: ${{ needs.release-windows.result }}
|
|
ARCHIVE_ARM64: ${{ needs.release.outputs.archive_name }}
|
|
ARCHIVE_X64: ${{ needs.release-macos-x64.outputs.archive_name }}
|
|
ARCHIVE_LINUX: ${{ needs.release-linux.outputs.archive_name }}
|
|
ARCHIVE_WIN: ${{ needs.release-windows.outputs.archive_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
assets=$(find staged -type f -exec basename {} \;)
|
|
for spec in \
|
|
"$RESULT_ARM64:$ARCHIVE_ARM64" \
|
|
"$RESULT_X64:$ARCHIVE_X64" \
|
|
"$RESULT_LINUX:$ARCHIVE_LINUX" \
|
|
"$RESULT_WIN:$ARCHIVE_WIN"; do
|
|
result="${spec%%:*}"
|
|
archive="${spec#*:}"
|
|
if [[ "$result" == success ]]; then
|
|
[[ -n "$archive" ]] || { echo "::error::successful platform has no archive"; exit 1; }
|
|
grep -Fxq "$archive" <<<"$assets" || { echo "::error::draft release missing $archive"; exit 1; }
|
|
fi
|
|
done
|
|
|
|
- name: Generate unified latest.json
|
|
env:
|
|
RESULT_ARM64: ${{ needs.release.result }}
|
|
RESULT_X64: ${{ needs.release-macos-x64.result }}
|
|
RESULT_LINUX: ${{ needs.release-linux.result }}
|
|
RESULT_WIN: ${{ needs.release-windows.result }}
|
|
ARCHIVE_ARM64: ${{ needs.release.outputs.archive_name }}
|
|
ARCHIVE_X64: ${{ needs.release-macos-x64.outputs.archive_name }}
|
|
ARCHIVE_LINUX: ${{ needs.release-linux.outputs.archive_name }}
|
|
ARCHIVE_WIN: ${{ needs.release-windows.outputs.archive_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
BASE="https://github.com/block/buzz/releases/download/desktop-v${VERSION}"
|
|
TRIPLES=()
|
|
|
|
add_triple() {
|
|
local result="$1" platform="$2" archive="$3"
|
|
if [[ "$result" == "success" ]]; then
|
|
[[ -n "$archive" ]] || { echo "::error::Missing archive name for successful platform: $platform"; exit 1; }
|
|
TRIPLES+=("${platform}:/tmp/sigs/${platform}.sig:${BASE}/${archive}")
|
|
fi
|
|
}
|
|
|
|
add_triple "$RESULT_ARM64" darwin-aarch64 "$ARCHIVE_ARM64"
|
|
add_triple "$RESULT_X64" darwin-x86_64 "$ARCHIVE_X64"
|
|
add_triple "$RESULT_LINUX" linux-x86_64 "$ARCHIVE_LINUX"
|
|
add_triple "$RESULT_WIN" windows-x86_64 "$ARCHIVE_WIN"
|
|
|
|
[ "${#TRIPLES[@]}" -ge 3 ] || { echo "::error::too few platforms (${#TRIPLES[@]})"; exit 1; }
|
|
bash desktop/scripts/generate-oss-latest-json.sh "$VERSION" "${TRIPLES[@]}" > latest.json
|
|
cat latest.json
|
|
|
|
- name: Create or verify versioned draft
|
|
run: |
|
|
set -euo pipefail
|
|
NOTES_FILE="${RUNNER_TEMP}/release-notes.md"
|
|
awk "/^## v${VERSION}\$/{found=1; next} found && /^## v/{exit} found" CHANGELOG.md > "$NOTES_FILE"
|
|
[[ -s "$NOTES_FILE" ]] || { echo "::error::missing non-empty changelog block for v${VERSION}"; exit 1; }
|
|
PRERELEASE_FLAGS=()
|
|
if [[ "$VERSION" == *-* ]]; then
|
|
PRERELEASE_FLAGS=(--prerelease --latest=false)
|
|
fi
|
|
if gh release view "desktop-v${VERSION}" >/dev/null 2>&1; then
|
|
EXISTING_SHA=$(gh release view "desktop-v${VERSION}" --json targetCommitish --jq .targetCommitish)
|
|
IS_DRAFT=$(gh release view "desktop-v${VERSION}" --json isDraft --jq .isDraft)
|
|
[[ "$EXISTING_SHA" == "${{ needs.setup.outputs.source_sha }}" ]] || {
|
|
echo "::error::existing release targets $EXISTING_SHA, not the immutable source"; exit 1;
|
|
}
|
|
if [[ "$IS_DRAFT" != true ]]; then
|
|
echo "already_published=true" >> "$GITHUB_ENV"
|
|
fi
|
|
else
|
|
gh release create "desktop-v${VERSION}" \
|
|
--draft \
|
|
--target "${{ needs.setup.outputs.source_sha }}" \
|
|
--title "Buzz Desktop v${VERSION}" \
|
|
--notes-file "$NOTES_FILE" \
|
|
"${PRERELEASE_FLAGS[@]}"
|
|
fi
|
|
|
|
- name: Upload complete artifact set to versioned draft
|
|
if: env.already_published != 'true'
|
|
run: |
|
|
mapfile -t files < <(find staged -type f -print)
|
|
[[ "${#files[@]}" -gt 0 ]] || { echo "::error::no staged release artifacts"; exit 1; }
|
|
gh release upload "desktop-v${VERSION}" "${files[@]}" --clobber
|
|
|
|
- name: Publish complete versioned release
|
|
if: env.already_published != 'true'
|
|
run: gh release edit "desktop-v${VERSION}" --draft=false
|
|
|
|
- name: Upload latest.json to rolling release last
|
|
if: ${{ !contains(needs.setup.outputs.version, '-') }}
|
|
run: gh release upload buzz-desktop-latest latest.json --clobber
|