dtourolle
f49e6e4648
check:boundary passed on the very leak it was written for. The pattern was anchored to `includeItemTypes:` at the query site, so searchScope.ts assigning the same array to a named const and dereferencing it one indirection away was invisible — through every green CI run. The check now matches an array literal naming two or more Jellyfin item types anywhere in src/, catching a const, a Record value, a function return, and an inline query alike. Deliberate limits kept: two adjacent literals required (single-type presentation stays legal), string literals required (item.type === "Audio" is display logic), explicit type list (so ["High","Low"] produces no noise). Verified all five cases: reintroducing the original SCOPE_ITEM_TYPES fails; a new const ["Movie","Series"] fails; the same array in a .test.ts passes; itemType: "Movie" / item.type === / ["High","Low"] pass; a 5th allowlist entry fails on the new cap. Allowlist 1→3 entries, capped at 4 so the next exception forces a conversation rather than a one-line append: - GenericMediaListPage: grid styling over a self-declared itemType — presentation, changes only with a UI redesign. - DownloadedBrowse: borderline, leans domain (the container set grows when Jellyfin adds a container type). Allowlisted with a TODO for a backend MediaItem.isContainer flag. The header now names what the check still cannot see — run-time-built sets, types split across variables, switch/|| taxonomy — and CLAUDE.md states that a green check:boundary is not proof. That matters given this check passed on its own founding violation for months. Also: both gates wired into test-all.sh, which called `bun run test` without --run and would have hung in watch mode. Corrected the Dockerfile comment describing the Windows toolchain as mingw/GNU — it is MSVC via cargo-xwin (GNU cannot bundle NSIS from Linux).
157 lines
5.5 KiB
Docker
157 lines
5.5 KiB
Docker
# Multi-stage build for JellyTau - Tauri Jellyfin client
|
|
#
|
|
# The desktop packaging stages (desktop-linux-build, windows-cross) build FROM
|
|
# the unified registry builder image, which carries every packaging tool. Declared
|
|
# here (before the first FROM) so it's in scope for those stages' FROM lines.
|
|
# Override for local iteration: --build-arg BUILDER_IMAGE=jellytau-builder:latest
|
|
ARG BUILDER_IMAGE=gitea.tourolle.paris/dtourolle/jellytau-builder:latest
|
|
|
|
FROM ubuntu:24.04 AS builder
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
ANDROID_HOME=/opt/android-sdk \
|
|
NDK_VERSION=27.0.11902837 \
|
|
SDK_VERSION=34 \
|
|
RUST_BACKTRACE=1 \
|
|
PATH="/root/.bun/bin:/root/.cargo/bin:$PATH" \
|
|
CARGO_HOME=/root/.cargo
|
|
|
|
# Install system dependencies
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
# Build essentials
|
|
build-essential \
|
|
curl \
|
|
wget \
|
|
git \
|
|
ca-certificates \
|
|
unzip \
|
|
# JDK for Android
|
|
openjdk-17-jdk-headless \
|
|
# Android build tools
|
|
android-sdk-platform-tools \
|
|
# Additional development tools
|
|
pkg-config \
|
|
libssl-dev \
|
|
libclang-dev \
|
|
llvm-dev \
|
|
# Tauri Linux desktop dependencies (needed for `cargo test` on the host target)
|
|
libglib2.0-dev \
|
|
libgtk-3-dev \
|
|
libwebkit2gtk-4.1-dev \
|
|
libjavascriptcoregtk-4.1-dev \
|
|
libsoup-3.0-dev \
|
|
librsvg2-dev \
|
|
libayatana-appindicator3-dev \
|
|
# mpv player library (linked via libmpv-sys)
|
|
libmpv-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Node.js 20.x from NodeSource
|
|
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
|
|
apt-get install -y --no-install-recommends nodejs && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Bun
|
|
RUN curl -fsSL https://bun.sh/install | bash && \
|
|
ln -s /root/.bun/bin/bun /usr/local/bin/bun
|
|
|
|
# Install Rust using rustup
|
|
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && \
|
|
. $HOME/.cargo/env && \
|
|
rustup target add aarch64-linux-android && \
|
|
rustup target add armv7-linux-androideabi && \
|
|
rustup target add x86_64-linux-android
|
|
|
|
# Setup Android SDK
|
|
RUN mkdir -p $ANDROID_HOME && \
|
|
mkdir -p /root/.android && \
|
|
echo '### User Sources for `android` cmd line tool ###' > /root/.android/repositories.cfg && \
|
|
echo 'count=0' >> /root/.android/repositories.cfg
|
|
|
|
# Download and setup Android Command Line Tools
|
|
RUN wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -O /tmp/cmdline-tools.zip && \
|
|
unzip -q /tmp/cmdline-tools.zip -d $ANDROID_HOME && \
|
|
rm /tmp/cmdline-tools.zip && \
|
|
mkdir -p $ANDROID_HOME/cmdline-tools/latest && \
|
|
mv $ANDROID_HOME/cmdline-tools/* $ANDROID_HOME/cmdline-tools/latest/ 2>/dev/null || true
|
|
|
|
# Setup Android SDK components
|
|
RUN $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --sdk_root=$ANDROID_HOME \
|
|
"platforms;android-$SDK_VERSION" \
|
|
"build-tools;34.0.0" \
|
|
"ndk;$NDK_VERSION" \
|
|
--channel=0 2>&1 | grep -v "Warning" || true
|
|
|
|
# Set NDK environment variable
|
|
ENV NDK_HOME=$ANDROID_HOME/ndk/$NDK_VERSION
|
|
|
|
# Create working directory
|
|
WORKDIR /app
|
|
|
|
# Copy project files
|
|
COPY . .
|
|
|
|
# Install Node.js dependencies
|
|
RUN bun install
|
|
|
|
# Install Rust dependencies
|
|
RUN cd src-tauri && cargo fetch && cd ..
|
|
|
|
# Build stage - Tests
|
|
FROM builder AS test
|
|
WORKDIR /app
|
|
RUN echo "Running tests..." && \
|
|
bunx svelte-kit sync && \
|
|
bun run test && \
|
|
cd src-tauri && cargo test && cd .. && \
|
|
echo "All tests passed!"
|
|
|
|
# Build stage - APK
|
|
FROM builder AS android-build
|
|
WORKDIR /app
|
|
RUN cd src-tauri && cargo fetch && cd .. && \
|
|
echo "Building Android APK..." && \
|
|
bun run build && \
|
|
bun run tauri android build --apk true && \
|
|
echo "APK build complete!"
|
|
|
|
# Desktop packaging stages build FROM the unified registry builder image (see the
|
|
# BUILDER_IMAGE ARG at the top), which already carries every packaging tool
|
|
# (rpm/file for Linux, cargo-xwin + nsis + the x86_64-pc-windows-msvc rust
|
|
# target for Windows). ONE source of dependency truth, shared with CI — no
|
|
# per-stage apt/rustup here.
|
|
#
|
|
# NOTE: Windows uses the MSVC target via cargo-xwin, NOT mingw/GNU — the GNU
|
|
# toolchain cannot bundle an NSIS installer from Linux. See
|
|
# scripts/build-windows-cross.sh.
|
|
|
|
# Linux desktop packaging environment (deb + rpm; Arch is Dockerfile.arch).
|
|
# Thin layer over the builder — the actual build runs at container-run time on
|
|
# the bind-mounted source (see docker-compose.yml / scripts/build-desktop-linux.sh),
|
|
# matching the `dev` service model. Run standalone with:
|
|
# docker run --rm -v "$PWD:/app" -v "$PWD/dist:/app/dist" <img> \
|
|
# bash -c "OUTPUT_DIR=/app/dist scripts/build-desktop-linux.sh"
|
|
FROM ${BUILDER_IMAGE} AS desktop-linux-build
|
|
WORKDIR /app
|
|
CMD ["bash", "-c", "OUTPUT_DIR=/app/dist scripts/build-desktop-linux.sh"]
|
|
|
|
# Windows cross-compile environment (MSVC target via cargo-xwin). Video works via
|
|
# WebView2 and audio via the webview <audio> backend; NSIS installer is produced
|
|
# from Linux by cargo-xwin. Default bundles NSIS; override WIN_BUNDLES=none for
|
|
# exe-only. Build runs at container-run time like above.
|
|
FROM ${BUILDER_IMAGE} AS windows-cross
|
|
WORKDIR /app
|
|
CMD ["bash", "-c", "OUTPUT_DIR=/app/dist WIN_BUNDLES=${WIN_BUNDLES:-nsis} scripts/build-windows-cross.sh"]
|
|
|
|
# Final output stage
|
|
FROM ubuntu:24.04 AS final
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
android-sdk-platform-tools \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
COPY --from=android-build /app/src-tauri/gen/android/app/build/outputs/apk /app/apk
|
|
|
|
VOLUME ["/app/apk"]
|
|
CMD ["/bin/bash", "-c", "echo 'APK files are available in /app/apk' && ls -lh /app/apk/"]
|