dtourolle
f6653e6a8b
The project shipped signed Android builds and unsigned desktop binaries
with no vulnerability scanning of any kind. Nothing checked the ~500
crate Rust graph or the JS packages against an advisory feed, and nothing
checked that what we redistribute inside an MIT bundle permits it.
The first cargo-deny run found eight vulnerabilities and one
unsoundness -- bytes, four in rustls-webpki, time, two in quick-xml and
rand -- every one of them closed by a `cargo update` nobody had a reason
to run. That update is in this commit; 740 Rust tests and clippy
-D warnings pass on the new lockfile.
Two structural fixes matter as much as the gate itself:
- deny.toml scopes the graph to the targets we actually ship. Without
it the Apple targets pull in plist -> quick-xml and report two DoS
advisories against a crate that is in no binary we release. Ignoring
those by ID would silence them everywhere, including where they
would matter; scoping makes them correctly absent.
- libmpv is pinned by rev instead of branch = "master". A branch means
the revision is whatever Cargo.lock happens to hold and any
`cargo update` silently substitutes new upstream code -- in the one
dependency that is not from crates.io and that links a C library
into the player. The rev is the commit already locked, so this pins
current behaviour rather than changing it.
Licence findings are recorded rather than waved through. libmpv and
libmpv-sys are LGPL-2.1, satisfied here by dynamic linking against the
system library; deny.toml carries the two obligations that follow (keep
the linkage dynamic, ship libmpv's licence text with any bundle carrying
the .so). MPL-2.0 crates are file-level copyleft and fine unmodified.
Releases now publish SHA256SUMS (verified in-job with `sha256sum -c`
before upload) and a CycloneDX SBOM for both halves, so "does this
release contain <vulnerable crate>?" has an answer that is not "rebuild
the tag and re-resolve it".
Workflows pin jellytau-builder:2026.08 instead of :latest. While every
job said :latest, rebuilding the image changed what every build compiled
against, including rebuilds of old release tags.
Also folded in, because both were the same class of problem:
- publish-docs.yml downloaded mdBook from GitHub releases into
/usr/local/bin at job time -- a toolchain install in CI, which
CLAUDE.md explicitly forbids, and a hard dependency on GitHub's CDN
at publish time. It is in the builder image now.
- extract-traces.ts only ever read .ts/.svelte/.rs, so every
requirement implemented by *configuration* was invisible to the
matrix that measures it. DR-205, DR-206, DR-207 and DR-215 all carry
TRACES comments nothing read, and each counted as uncovered while
being covered. Coverage was really 90%, not 88%; MIN_THRESHOLD moves
to 89 accordingly. CI workflows stay excluded and there is a test
saying why: traceability-check.yml quotes "a TRACES: comment" beside
deliberately-undefined example IDs, which the extractor would read
as real traces and then fail its own dangling-ID check.
Supply-chain requirement is DR-216.
🔴 The builder image must be rebuilt and pushed
(scripts/build-builder-image.sh 2026.08) before this reaches master --
the workflows now name a tag and tools that do not exist in the registry
yet.
536 lines
22 KiB
YAML
536 lines
22 KiB
YAML
name: Build & Release
|
||
|
||
on:
|
||
push:
|
||
tags:
|
||
- 'v*'
|
||
workflow_dispatch:
|
||
inputs:
|
||
version:
|
||
description: 'Version to build (e.g., v1.0.0)'
|
||
required: false
|
||
|
||
env:
|
||
RUST_BACKTRACE: 1
|
||
CARGO_TERM_COLOR: always
|
||
# Incremental state is never reused between CI runs -- pure disk cost.
|
||
CARGO_INCREMENTAL: 0
|
||
|
||
jobs:
|
||
test:
|
||
name: Run Tests
|
||
runs-on: linux/amd64
|
||
container:
|
||
image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Cache Rust dependencies
|
||
uses: actions/cache@v3
|
||
with:
|
||
# Registry only -- never src-tauri/target. That directory is ~16 GB and
|
||
# was cached under five separate keys, which filled the runner's 74 GB
|
||
# disk at ~1.15 GB/day (23 GB in 20 days, measured Aug 2026).
|
||
# registry/src is omitted too: cargo re-extracts it for free from
|
||
# registry/cache (155 MB of .crate tarballs vs 1.1 GB extracted).
|
||
path: |
|
||
~/.cargo/registry/index
|
||
~/.cargo/registry/cache
|
||
~/.cargo/git/db
|
||
# One shared key across every job. The old per-job keys existed to stop
|
||
# debug/release target artifacts clobbering each other; with target no
|
||
# longer cached, registry contents are target-independent, so all jobs
|
||
# want the same crates. First job to finish saves; the rest restore.
|
||
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
|
||
restore-keys: |
|
||
${{ runner.os }}-cargo-registry-
|
||
|
||
- name: Cache Node dependencies
|
||
uses: actions/cache@v3
|
||
with:
|
||
path: |
|
||
~/.bun/install/cache
|
||
node_modules
|
||
key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
|
||
restore-keys: |
|
||
${{ runner.os }}-bun-
|
||
|
||
- name: Install dependencies
|
||
run: bun install
|
||
|
||
- name: Run frontend tests
|
||
run: |
|
||
bunx svelte-kit sync
|
||
bun run test --run
|
||
continue-on-error: false
|
||
|
||
# Same gate as build-and-test.yml. A release must not ship from a tree
|
||
# that would fail the per-commit checks. rustfmt/clippy come from the
|
||
# builder image; nothing is installed here.
|
||
- name: Check Rust formatting
|
||
run: |
|
||
cd src-tauri
|
||
cargo fmt --all -- --check
|
||
continue-on-error: false
|
||
|
||
# Advisory until the ~51 pre-existing warnings are cleared; see the longer
|
||
# note in build-and-test.yml. Tighten both to `-- -D warnings` together.
|
||
- name: Run clippy (advisory)
|
||
run: |
|
||
cd src-tauri
|
||
cargo clippy --all-targets
|
||
|
||
- name: Run Rust tests
|
||
run: bun run test:rust
|
||
continue-on-error: false
|
||
|
||
- name: Check TypeScript
|
||
run: bun run check
|
||
continue-on-error: false
|
||
|
||
build-linux:
|
||
name: Build Linux
|
||
runs-on: linux/amd64
|
||
needs: test
|
||
container:
|
||
image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Cache Rust dependencies
|
||
uses: actions/cache@v3
|
||
with:
|
||
# Registry only -- never src-tauri/target. That directory is ~16 GB and
|
||
# was cached under five separate keys, which filled the runner's 74 GB
|
||
# disk at ~1.15 GB/day (23 GB in 20 days, measured Aug 2026).
|
||
# registry/src is omitted too: cargo re-extracts it for free from
|
||
# registry/cache (155 MB of .crate tarballs vs 1.1 GB extracted).
|
||
path: |
|
||
~/.cargo/registry/index
|
||
~/.cargo/registry/cache
|
||
~/.cargo/git/db
|
||
# One shared key across every job. The old per-job keys existed to stop
|
||
# debug/release target artifacts clobbering each other; with target no
|
||
# longer cached, registry contents are target-independent, so all jobs
|
||
# want the same crates. First job to finish saves; the rest restore.
|
||
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
|
||
restore-keys: |
|
||
${{ runner.os }}-cargo-registry-
|
||
|
||
- name: Cache Node dependencies
|
||
uses: actions/cache@v3
|
||
with:
|
||
path: |
|
||
~/.bun/install/cache
|
||
node_modules
|
||
key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
|
||
restore-keys: |
|
||
${{ runner.os }}-bun-
|
||
|
||
- name: Install dependencies
|
||
run: bun install
|
||
|
||
# The Linux job previously had no version step at all, so a tagged release
|
||
# built Linux packages from whatever version happened to be committed.
|
||
- name: Set app version from tag
|
||
run: ./scripts/set-version.sh "${GITHUB_REF#refs/tags/}"
|
||
if: startsWith(github.ref, 'refs/tags/v')
|
||
|
||
- name: Build for Linux
|
||
run: bun run tauri build
|
||
env:
|
||
TAURI_SKIP_UPDATER: true
|
||
|
||
- name: Prepare Linux artifacts
|
||
run: |
|
||
mkdir -p dist/linux
|
||
# Match by extension, not by product name. Bundle filenames follow
|
||
# `productName`, so renaming the app (jellytau -> JellyTau) made the
|
||
# old `jellytau_*.deb` glob match nothing — and because the copy was
|
||
# wrapped in `if [ -f ... ]`, the artifact simply vanished from the
|
||
# release with no error. Each bundle directory holds one file.
|
||
#
|
||
# `if [ -f "dir/"*.ext ]` was also wrong on its own terms: with more
|
||
# than one match `test` gets extra arguments and fails.
|
||
#
|
||
# No `shopt -s nullglob` here: the runner executes `run:` blocks with
|
||
# POSIX sh, where shopt does not exist -- it exited 127 and killed the
|
||
# step (which is why v0.9.0 and v0.9.1 built but never published).
|
||
# Without nullglob an unmatched pattern stays literal, so test each
|
||
# candidate instead. Same POSIX-only rule as traceability-check.yml.
|
||
for bundle in \
|
||
src-tauri/target/release/bundle/appimage/*.AppImage \
|
||
src-tauri/target/release/bundle/deb/*.deb \
|
||
src-tauri/target/release/bundle/rpm/*.rpm; do
|
||
[ -e "$bundle" ] || continue
|
||
cp -v "$bundle" dist/linux/
|
||
done
|
||
|
||
# A release with no Linux package is a failure, not a quiet success.
|
||
if [ -z "$(ls -A dist/linux/)" ]; then
|
||
echo "::error::No Linux bundles found under src-tauri/target/release/bundle/"
|
||
exit 1
|
||
fi
|
||
ls -lah dist/linux/
|
||
|
||
- name: Upload Linux build artifact
|
||
uses: actions/upload-artifact@v3
|
||
with:
|
||
name: jellytau-linux
|
||
path: dist/linux/
|
||
retention-days: 7
|
||
|
||
build-windows:
|
||
name: Build Windows
|
||
runs-on: linux/amd64
|
||
needs: test
|
||
# Cross-compiled from Linux via the official Tauri path (MSVC + cargo-xwin),
|
||
# baked into the builder image. No toolchain installs here — the image has
|
||
# cargo-xwin, clang/clang-cl, lld, llvm, nsis and the msvc target.
|
||
container:
|
||
image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Cache Rust dependencies
|
||
uses: actions/cache@v3
|
||
with:
|
||
# Registry only -- never src-tauri/target. That directory is ~16 GB and
|
||
# was cached under five separate keys, which filled the runner's 74 GB
|
||
# disk at ~1.15 GB/day (23 GB in 20 days, measured Aug 2026).
|
||
# registry/src is omitted too: cargo re-extracts it for free from
|
||
# registry/cache (155 MB of .crate tarballs vs 1.1 GB extracted).
|
||
path: |
|
||
~/.cargo/registry/index
|
||
~/.cargo/registry/cache
|
||
~/.cargo/git/db
|
||
# One shared key across every job. The old per-job keys existed to stop
|
||
# debug/release target artifacts clobbering each other; with target no
|
||
# longer cached, registry contents are target-independent, so all jobs
|
||
# want the same crates. First job to finish saves; the rest restore.
|
||
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
|
||
restore-keys: |
|
||
${{ runner.os }}-cargo-registry-
|
||
|
||
- name: Cache Windows CRT/SDK (cargo-xwin)
|
||
uses: actions/cache@v3
|
||
with:
|
||
path: ~/.cache/cargo-xwin
|
||
# Contents track the xwin version baked into the builder image, not our
|
||
# lockfile -- keying this on Cargo.lock re-downloaded the whole SDK on
|
||
# every release bump. Bump the suffix by hand if the image's xwin moves.
|
||
key: ${{ runner.os }}-cargo-xwin-v1
|
||
|
||
- name: Cache Node dependencies
|
||
uses: actions/cache@v3
|
||
with:
|
||
path: |
|
||
~/.bun/install/cache
|
||
node_modules
|
||
key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
|
||
restore-keys: |
|
||
${{ runner.os }}-bun-
|
||
|
||
# The tag is the single source of truth for a release version; the script
|
||
# stamps every file that carries it (package.json, tauri.conf.json,
|
||
# Cargo.toml, Cargo.lock). This step used to sed only tauri.conf.json, so
|
||
# the other three shipped whatever was committed.
|
||
- name: Set app version from tag
|
||
run: ./scripts/set-version.sh "${GITHUB_REF#refs/tags/}"
|
||
if: startsWith(github.ref, 'refs/tags/v')
|
||
|
||
- name: Build Windows (NSIS installer + exe)
|
||
run: OUTPUT_DIR="$PWD/dist/windows" WIN_BUNDLES=nsis ./scripts/build-windows-cross.sh
|
||
|
||
- name: List Windows artifacts
|
||
run: ls -lah dist/windows/
|
||
|
||
- name: Upload Windows build artifact
|
||
uses: actions/upload-artifact@v3
|
||
with:
|
||
name: jellytau-windows
|
||
path: dist/windows/
|
||
retention-days: 7
|
||
|
||
build-android:
|
||
name: Build Android
|
||
runs-on: linux/amd64
|
||
needs: test
|
||
container:
|
||
image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
|
||
env:
|
||
ANDROID_HOME: /opt/android-sdk
|
||
ANDROID_SDK_ROOT: /opt/android-sdk
|
||
ANDROID_NDK_HOME: /opt/android-sdk/ndk/27.0.11902837
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Cache Rust dependencies
|
||
uses: actions/cache@v3
|
||
with:
|
||
# Registry only -- never src-tauri/target. That directory is ~16 GB and
|
||
# was cached under five separate keys, which filled the runner's 74 GB
|
||
# disk at ~1.15 GB/day (23 GB in 20 days, measured Aug 2026).
|
||
# registry/src is omitted too: cargo re-extracts it for free from
|
||
# registry/cache (155 MB of .crate tarballs vs 1.1 GB extracted).
|
||
path: |
|
||
~/.cargo/registry/index
|
||
~/.cargo/registry/cache
|
||
~/.cargo/git/db
|
||
# One shared key across every job. The old per-job keys existed to stop
|
||
# debug/release target artifacts clobbering each other; with target no
|
||
# longer cached, registry contents are target-independent, so all jobs
|
||
# want the same crates. First job to finish saves; the rest restore.
|
||
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
|
||
restore-keys: |
|
||
${{ runner.os }}-cargo-registry-
|
||
|
||
- name: Cache Node dependencies
|
||
uses: actions/cache@v3
|
||
with:
|
||
path: |
|
||
~/.bun/install/cache
|
||
node_modules
|
||
key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
|
||
restore-keys: |
|
||
${{ runner.os }}-bun-
|
||
|
||
- name: Install dependencies
|
||
run: bun install
|
||
|
||
# Stamp before `android init`: it derives its generated project (including
|
||
# the initial versionCode) from tauri.conf.json.
|
||
- name: Set app version from tag
|
||
run: ./scripts/set-version.sh "${GITHUB_REF#refs/tags/}"
|
||
if: startsWith(github.ref, 'refs/tags/v')
|
||
|
||
- name: Initialize Android project
|
||
run: bun run tauri android init
|
||
|
||
# Re-run after init: tauri.properties only exists now, and its
|
||
# autogenerated versionCode (0.0.15 -> 15) is both tiny and NOT monotonic
|
||
# against the 1000 floor already shipped in the field. The script rewrites
|
||
# it as 1000 + major*10000 + minor*100 + patch. Runs unconditionally so
|
||
# untagged builds get a sane code too, derived from git describe.
|
||
- name: Pin a monotonic Android versionCode
|
||
run: ./scripts/set-version.sh "${GITHUB_REF#refs/tags/}"
|
||
|
||
- name: Sync custom Android sources & gradle config
|
||
run: ./scripts/sync-android-sources.sh
|
||
|
||
- name: Write signing keystore
|
||
run: |
|
||
echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > "$RUNNER_TEMP/jellytau-release.jks"
|
||
cat > src-tauri/gen/android/keystore.properties <<EOF
|
||
storeFile=$RUNNER_TEMP/jellytau-release.jks
|
||
storePassword=${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
|
||
keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
|
||
keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
|
||
EOF
|
||
|
||
- name: Build signed Android APK
|
||
run: bun run tauri android build --apk true --target aarch64
|
||
|
||
- name: Collect & verify signed APK
|
||
run: |
|
||
mkdir -p dist/android
|
||
APK=$(find src-tauri/gen/android/app/build/outputs/apk -name '*-release.apk' | head -1)
|
||
if [ -z "$APK" ]; then echo "❌ No release APK produced"; exit 1; fi
|
||
cp "$APK" dist/android/jellytau-release.apk
|
||
APKSIGNER=$(find "$ANDROID_SDK_ROOT/build-tools" -name apksigner | sort -V | tail -1)
|
||
echo "🔏 Verifying signature with $APKSIGNER"
|
||
"$APKSIGNER" verify --print-certs dist/android/jellytau-release.apk
|
||
ls -lah dist/android/
|
||
|
||
- name: Upload Android build artifact
|
||
uses: actions/upload-artifact@v3
|
||
with:
|
||
name: jellytau-android
|
||
path: dist/android/
|
||
retention-days: 7
|
||
|
||
create-release:
|
||
name: Create Release
|
||
runs-on: linux/amd64
|
||
needs: [build-linux, build-windows, build-android]
|
||
if: startsWith(github.ref, 'refs/tags/v')
|
||
container:
|
||
image: gitea.tourolle.paris/dtourolle/jellytau-builder:2026.08
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Get version from tag
|
||
id: tag_name
|
||
run: |
|
||
echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
|
||
echo "RELEASE_NAME=JellyTau ${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
|
||
|
||
- name: Download Linux artifacts
|
||
uses: actions/download-artifact@v3
|
||
with:
|
||
name: jellytau-linux
|
||
path: artifacts/linux/
|
||
|
||
- name: Download Windows artifacts
|
||
uses: actions/download-artifact@v3
|
||
with:
|
||
name: jellytau-windows
|
||
path: artifacts/windows/
|
||
|
||
- name: Download Android artifacts
|
||
uses: actions/download-artifact@v3
|
||
with:
|
||
name: jellytau-android
|
||
path: artifacts/android/
|
||
|
||
# Software Bill of Materials, one per half of the app. Without it there is
|
||
# no answer to "does this release contain <vulnerable crate>?" other than
|
||
# rebuilding the tag and re-resolving it. cargo-cyclonedx is in the builder
|
||
# image; the JS side is read straight from the lockfile bun install used.
|
||
- name: Generate SBOM
|
||
run: |
|
||
set -e
|
||
mkdir -p artifacts/sbom
|
||
cd src-tauri
|
||
cargo cyclonedx --format json
|
||
find . -maxdepth 2 -name "*.cdx.json" -exec cp -v {} ../artifacts/sbom/ \;
|
||
cd ..
|
||
bun install --frozen-lockfile
|
||
bun pm ls --all > artifacts/sbom/frontend-dependencies.txt
|
||
ls -lah artifacts/sbom/
|
||
|
||
# Checksums over everything being published. A release of unsigned Linux
|
||
# and Windows binaries with no checksum gives a user no way at all to tell
|
||
# a corrupted or substituted download from a good one — and the AppImage
|
||
# and NSIS installer are both fetched over plain HTTP redirects.
|
||
#
|
||
# Written with paths relative to the asset directory so `sha256sum -c
|
||
# SHA256SUMS` works in the directory a user downloaded into.
|
||
- name: Generate SHA256SUMS
|
||
run: |
|
||
set -e
|
||
mkdir -p artifacts/release
|
||
find artifacts/linux artifacts/windows artifacts/android -type f -exec cp -v {} artifacts/release/ \;
|
||
cd artifacts/release
|
||
sha256sum * > SHA256SUMS
|
||
echo "🔐 Published checksums:"
|
||
cat SHA256SUMS
|
||
# Verify what we just wrote, so a broken checksum file fails the
|
||
# release rather than shipping and failing for users.
|
||
sha256sum -c SHA256SUMS
|
||
|
||
- name: Prepare release notes
|
||
id: release_notes
|
||
run: |
|
||
VERSION="${{ steps.tag_name.outputs.VERSION }}"
|
||
echo "## JellyTau $VERSION Release" > release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "### Downloads" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "#### Linux" >> release_notes.md
|
||
echo "- **AppImage** - Run directly on most Linux distributions" >> release_notes.md
|
||
echo "- **DEB** - Install via \`sudo dpkg -i JellyTau_*.deb\` (Ubuntu/Debian)" >> release_notes.md
|
||
echo "- **RPM** - Install via \`sudo rpm -i JellyTau-*.rpm\` (Fedora/openSUSE)" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "#### Windows" >> release_notes.md
|
||
echo "- **Installer (.exe)** - Run \`JellyTau_*-setup.exe\` (NSIS). Unsigned — SmartScreen may warn on first run." >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "#### Android" >> release_notes.md
|
||
echo "- **APK** - Install via \`adb install jellytau-release.apk\` or sideload via file manager" >> release_notes.md
|
||
echo "- **AAB** - Upload to Google Play Console or testing platforms" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "### What's New" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "See [CHANGELOG.md](CHANGELOG.md) for detailed changes." >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "### Installation" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "#### Linux (AppImage)" >> release_notes.md
|
||
echo "\`\`\`bash" >> release_notes.md
|
||
echo "chmod +x JellyTau_*.AppImage" >> release_notes.md
|
||
echo "./JellyTau_*.AppImage" >> release_notes.md
|
||
echo "\`\`\`" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "#### Linux (DEB)" >> release_notes.md
|
||
echo "\`\`\`bash" >> release_notes.md
|
||
echo "sudo dpkg -i JellyTau_*.deb" >> release_notes.md
|
||
echo "jellytau" >> release_notes.md
|
||
echo "\`\`\`" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "#### Android" >> release_notes.md
|
||
echo "- Sideload: Download APK and install via file manager or ADB" >> release_notes.md
|
||
echo "- Play Store: Coming soon" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "### Known Issues" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "See [GitHub Issues](../../issues) for reported bugs." >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "### Requirements" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "**Linux:**" >> release_notes.md
|
||
echo "- 64-bit Linux system" >> release_notes.md
|
||
echo "- GLIBC 2.29+" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "**Android:**" >> release_notes.md
|
||
echo "- Android 8.0 or higher" >> release_notes.md
|
||
echo "- 50MB free storage" >> release_notes.md
|
||
echo "" >> release_notes.md
|
||
echo "---" >> release_notes.md
|
||
echo "Built with Tauri, SvelteKit, and Rust" >> release_notes.md
|
||
|
||
- name: Publish Gitea release & upload assets
|
||
env:
|
||
# GITEA_TOKEN (a PAT) is preferred; falls back to the auto-provided token.
|
||
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||
AUTO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
run: |
|
||
set -e
|
||
command -v jq >/dev/null || { echo "❌ jq is required on the runner"; exit 1; }
|
||
VERSION="${{ steps.tag_name.outputs.VERSION }}"
|
||
API="${GITHUB_SERVER_URL}/api/v1"
|
||
REPO="${GITHUB_REPOSITORY}"
|
||
TOKEN="${GITEA_TOKEN:-$AUTO_TOKEN}"
|
||
case "$VERSION" in *rc*|*beta*|*alpha*) PRE=true;; *) PRE=false;; esac
|
||
|
||
PAYLOAD=$(jq -n \
|
||
--arg tag "$VERSION" \
|
||
--arg name "JellyTau $VERSION" \
|
||
--rawfile body release_notes.md \
|
||
--argjson pre "$PRE" \
|
||
'{tag_name:$tag, name:$name, body:$body, draft:false, prerelease:$pre}')
|
||
|
||
echo "📦 Creating release $VERSION on $REPO"
|
||
# -f drops on HTTP error; capture status so an existing release (409) is handled gracefully.
|
||
HTTP=$(curl -sS -o resp.json -w '%{http_code}' -X POST "$API/repos/$REPO/releases" \
|
||
-H "Authorization: token $TOKEN" \
|
||
-H "Content-Type: application/json" \
|
||
-d "$PAYLOAD")
|
||
if [ "$HTTP" = "201" ]; then
|
||
RELEASE_ID=$(jq -r '.id' resp.json)
|
||
elif [ "$HTTP" = "409" ]; then
|
||
echo "ℹ️ Release $VERSION already exists; fetching its id to upload assets"
|
||
RELEASE_ID=$(curl -fsS "$API/repos/$REPO/releases/tags/$VERSION" \
|
||
-H "Authorization: token $TOKEN" | jq -r '.id')
|
||
else
|
||
echo "❌ Failed to create release (HTTP $HTTP):"; cat resp.json; exit 1
|
||
fi
|
||
echo "Release id=$RELEASE_ID"
|
||
|
||
# artifacts/release/ holds a copy of every platform artifact plus the
|
||
# SHA256SUMS generated over exactly that set, so the checksums describe
|
||
# precisely what is uploaded. artifacts/sbom/ rides along.
|
||
for f in artifacts/release/* artifacts/sbom/*; do
|
||
[ -f "$f" ] || continue
|
||
echo "⬆️ Uploading $(basename "$f")"
|
||
curl -fsS -X POST \
|
||
"$API/repos/$REPO/releases/$RELEASE_ID/assets?name=$(basename "$f")" \
|
||
-H "Authorization: token $TOKEN" \
|
||
-F "attachment=@$f" >/dev/null
|
||
done
|
||
echo "✅ Release $VERSION published with assets"
|