284 lines
11 KiB
YAML
284 lines
11 KiB
YAML
name: OneClient Nightly (Unsigned)
|
|
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: oneclient-nightly-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Nightlies are unsigned test builds, so they do not need the release profile's
|
|
# whole-program optimization - and that optimization is exactly what makes them
|
|
# slow. `lto = "fat"` + `codegen-units = 1` force a single-threaded re-optimization
|
|
# of the entire dependency graph at link time, on every run, which no cache can
|
|
# ever skip. Thin LTO keeps nearly all of the runtime benefit at a fraction of the
|
|
# link cost, and 16 codegen units lets the whole compile use every runner core.
|
|
#
|
|
# These are cargo's documented profile overrides, so `target/release` stays the
|
|
# output directory and every path below is unaffected. The shipped release binary
|
|
# is untouched: oneclient_release.yml still builds the fat-LTO profile from
|
|
# Cargo.toml. That difference is why the two workflows must not share a cache
|
|
# namespace - see `cache-namespace` on the Setup Rust step.
|
|
env:
|
|
CARGO_PROFILE_RELEASE_LTO: thin
|
|
CARGO_PROFILE_RELEASE_CODEGEN_UNITS: '16'
|
|
|
|
jobs:
|
|
build:
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- platform: macos-latest
|
|
target: aarch64-apple-darwin
|
|
os_key: darwin
|
|
arch: aarch64
|
|
formats: app,dmg
|
|
- platform: macos-latest
|
|
target: x86_64-apple-darwin
|
|
os_key: darwin
|
|
arch: x86_64
|
|
formats: app,dmg
|
|
macos_deployment_target: '10.14'
|
|
- platform: ubuntu-22.04
|
|
target: ''
|
|
os_key: linux
|
|
arch: x86_64
|
|
formats: deb,appimage
|
|
- platform: windows-latest
|
|
target: ''
|
|
os_key: windows
|
|
arch: x86_64
|
|
formats: nsis
|
|
|
|
runs-on: ${{ matrix.platform }}
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
|
|
- name: (macOS) Pin deployment target
|
|
if: matrix.macos_deployment_target != ''
|
|
shell: bash
|
|
run: echo "MACOSX_DEPLOYMENT_TARGET=${{ matrix.macos_deployment_target }}" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup Rust
|
|
uses: ./.github/actions/setup-rust
|
|
with:
|
|
target: ${{ matrix.target }}
|
|
save-cache: true
|
|
restore-cache: true
|
|
# Separate namespace: nightly's thin-LTO dependency artifacts have
|
|
# different cargo fingerprints than the release workflow's fat-LTO ones,
|
|
# so a shared cache would just thrash between the two.
|
|
cache-namespace: nightly-cache
|
|
|
|
- name: (Linux) Install system dependencies
|
|
if: matrix.platform == 'ubuntu-22.04'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
build-essential cmake pkg-config clang python3 \
|
|
libfontconfig-dev libfreetype-dev \
|
|
libgl1-mesa-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev \
|
|
libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libdbus-1-dev \
|
|
libgtk-3-dev libayatana-appindicator3-dev \
|
|
libfuse2
|
|
|
|
- name: Install cargo-packager
|
|
uses: ./.github/actions/install-cargo-tool
|
|
with:
|
|
tool: cargo-packager
|
|
version: 0.11.8
|
|
|
|
- name: Build release binary
|
|
shell: bash
|
|
run: |
|
|
if [ -n "${{ matrix.target }}" ]; then
|
|
cargo build --release --bin oneclient_app --target ${{ matrix.target }}
|
|
else
|
|
cargo build --release --bin oneclient_app
|
|
fi
|
|
|
|
- name: (macOS) Verify deployment target
|
|
if: matrix.macos_deployment_target != ''
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
bin="target/${{ matrix.target }}/release/oneclient_app"
|
|
minos="$(vtool -show-build "$bin" | awk '/minos/ {print $2; exit}')"
|
|
echo "linked minos=$minos, declared minimum=${{ matrix.macos_deployment_target }}"
|
|
if [ "$(printf '%s\n%s\n' "$minos" "${{ matrix.macos_deployment_target }}" | sort -V | tail -n1)" != "${{ matrix.macos_deployment_target }}" ]; then
|
|
echo "::error::Binary requires macOS $minos but the bundle advertises ${{ matrix.macos_deployment_target }}."
|
|
exit 1
|
|
fi
|
|
|
|
- name: (macOS) Compile app icon catalog
|
|
if: startsWith(matrix.platform, 'macos')
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
out="packages/oneclient_app/icons/generated"
|
|
mkdir -p "$out"
|
|
xcrun actool packages/oneclient_app/icons/OneClient.icon \
|
|
--compile "$out" \
|
|
--app-icon OneClient \
|
|
--output-partial-info-plist "$out/partial.plist" \
|
|
--platform macosx \
|
|
--minimum-deployment-target 26.0 \
|
|
--errors --warnings --notices
|
|
rm -f "$out/OneClient.icns"
|
|
test -f "$out/Assets.car" || { echo "::error::actool produced no Assets.car"; exit 1; }
|
|
|
|
- name: (Windows) Stage app-local VC++ runtime
|
|
if: matrix.platform == 'windows-latest'
|
|
shell: bash
|
|
run: python3 distribution/windows/bundle-crt.py
|
|
|
|
- name: (Windows) Verify staged runtime is Microsoft-signed
|
|
if: matrix.platform == 'windows-latest'
|
|
shell: pwsh
|
|
run: |
|
|
$dlls = @(Get-ChildItem 'target/crt/*.dll')
|
|
if ($dlls.Count -eq 0) { Write-Error 'no CRT DLLs staged'; exit 1 }
|
|
foreach ($dll in $dlls) {
|
|
$sig = Get-AuthenticodeSignature $dll.FullName
|
|
Write-Host "$($dll.Name): $($sig.Status) $($sig.SignerCertificate.Subject)"
|
|
if ($sig.Status -ne 'Valid') {
|
|
Write-Error "$($dll.Name) signature is $($sig.Status), refusing to ship it"
|
|
exit 1
|
|
}
|
|
if ($sig.SignerCertificate.Subject -notmatch 'O=Microsoft Corporation') {
|
|
Write-Error "$($dll.Name) is not signed by Microsoft"
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
- name: Package (unsigned)
|
|
shell: bash
|
|
env:
|
|
CI: 'true'
|
|
run: |
|
|
ARGS="--release --formats ${{ matrix.formats }}"
|
|
if [ -n "${{ matrix.target }}" ]; then
|
|
ARGS="$ARGS --target ${{ matrix.target }}"
|
|
fi
|
|
cargo packager $ARGS --verbose
|
|
|
|
- name: Resolve packager output dir
|
|
id: outdir
|
|
shell: bash
|
|
run: |
|
|
if [ -n "${{ matrix.target }}" ]; then
|
|
echo "dir=target/${{ matrix.target }}/release" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "dir=target/release" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: (Linux) Install cargo-generate-rpm
|
|
if: matrix.platform == 'ubuntu-22.04'
|
|
uses: ./.github/actions/install-cargo-tool
|
|
with:
|
|
tool: cargo-generate-rpm
|
|
version: 0.21.0
|
|
|
|
- name: (Linux) Build RPM
|
|
if: matrix.platform == 'ubuntu-22.04'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
cp target/release/.cargo-packager/deb/*/data/usr/share/applications/oneclient_app.desktop \
|
|
target/release/oneclient_app.desktop
|
|
cargo generate-rpm -p packages/oneclient_app
|
|
cp target/generate-rpm/*.rpm "${{ steps.outdir.outputs.dir }}/"
|
|
|
|
- name: (Windows) Smoke-test installer layout
|
|
if: matrix.platform == 'windows-latest'
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$dest = 'C:\oneclient-smoke'
|
|
Remove-Item -Recurse -Force $dest -ErrorAction SilentlyContinue
|
|
$exe = Resolve-Path (Get-ChildItem '${{ steps.outdir.outputs.dir }}/*-setup.exe')[0].FullName
|
|
# NSIS: /S is silent, /D= sets the install dir and must be the last arg.
|
|
$p = Start-Process -FilePath $exe -ArgumentList '/S', "/D=$dest" -Wait -PassThru
|
|
if ($p.ExitCode -ne 0) { Write-Error "installer exited $($p.ExitCode)"; exit 1 }
|
|
|
|
Write-Host '--- installed layout ---'
|
|
Get-ChildItem -Recurse $dest | ForEach-Object { Write-Host $_.FullName }
|
|
|
|
if (-not (Test-Path "$dest\oneclient_app.exe")) {
|
|
Write-Error "oneclient_app.exe is not at the root of $dest"
|
|
exit 1
|
|
}
|
|
foreach ($dll in @(Get-ChildItem 'target/crt/*.dll')) {
|
|
if (-not (Test-Path (Join-Path $dest $dll.Name))) {
|
|
Write-Error "$($dll.Name) did not land beside oneclient_app.exe - cargo-packager put resources elsewhere, so app-local CRT loading will not work"
|
|
exit 1
|
|
}
|
|
}
|
|
Write-Host "OK: $($(Get-ChildItem 'target/crt/*.dll').Count) CRT DLLs sit beside oneclient_app.exe"
|
|
|
|
# Upload debug info (dSYM / .dwp / .pdb produced by the release profile's
|
|
# split-debuginfo) to Sentry so nightly crash reports get real file/function/
|
|
# line stack traces instead of raw addresses. Runs on every main push, so
|
|
# each unique build's symbols land in Sentry (matched by debug-id). Skips
|
|
# silently unless SENTRY_AUTH_TOKEN secret + SENTRY_ORG/SENTRY_PROJECT vars
|
|
# are configured.
|
|
- name: Upload debug symbols to Sentry
|
|
shell: bash
|
|
env:
|
|
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
SENTRY_ORG: ${{ vars.SENTRY_ORG }}
|
|
SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT }}
|
|
OUT_DIR: ${{ steps.outdir.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${SENTRY_AUTH_TOKEN:-}" ] || [ -z "${SENTRY_ORG:-}" ] || [ -z "${SENTRY_PROJECT:-}" ]; then
|
|
echo "Sentry credentials not configured (need SENTRY_AUTH_TOKEN secret + SENTRY_ORG/SENTRY_PROJECT vars); skipping debug-symbol upload."
|
|
exit 0
|
|
fi
|
|
curl -sL https://sentry.io/get-cli/ | bash
|
|
export PATH="/usr/local/bin:$PATH"
|
|
SYMS="$(mktemp -d)"
|
|
shopt -s nullglob
|
|
for f in "$OUT_DIR"/oneclient_app "$OUT_DIR"/oneclient_app.exe \
|
|
"$OUT_DIR"/oneclient_app.pdb "$OUT_DIR"/*.dwp "$OUT_DIR"/*.dSYM; do
|
|
[ -e "$f" ] || continue
|
|
cp -R "$f" "$SYMS/"
|
|
done
|
|
sentry-cli debug-files upload --include-sources "$SYMS"
|
|
|
|
- name: Collect installers
|
|
id: collect
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
shopt -s nullglob
|
|
mkdir -p dist
|
|
# Human-facing installers only; skip the .sig-paired updater bundles
|
|
# (no updater manifest is produced for unsigned nightly builds).
|
|
for f in "${{ steps.outdir.outputs.dir }}"/*.dmg \
|
|
"${{ steps.outdir.outputs.dir }}"/*.deb \
|
|
"${{ steps.outdir.outputs.dir }}"/*.rpm \
|
|
"${{ steps.outdir.outputs.dir }}"/*.AppImage \
|
|
"${{ steps.outdir.outputs.dir }}"/*-setup.exe; do
|
|
[ -e "$f" ] || continue
|
|
cp "$f" dist/
|
|
done
|
|
if [ -z "$(ls -A dist)" ]; then
|
|
echo "::error::No installers found in ${{ steps.outdir.outputs.dir }}"
|
|
exit 1
|
|
fi
|
|
ls -la dist
|
|
|
|
- name: Upload unsigned installers
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: oneclient-nightly-${{ matrix.os_key }}-${{ matrix.arch }}
|
|
path: dist/*
|
|
if-no-files-found: error
|
|
retention-days: 14
|