mirror of https://github.com/ospab/ostp.git
655 lines
25 KiB
YAML
655 lines
25 KiB
YAML
name: CI/CD
|
|
|
|
|
|
# `run-name` is evaluated at workflow-start, BEFORE any job runs - it cannot
|
|
# see resolve-channel's computed tag_name (e.g. "0.4.3-alpha"), only the
|
|
# `github.*` context. The old "release version ${{ github.ref_name }}" showed
|
|
# the bare branch name ("alpha"/"beta") for every run, which reads
|
|
# exactly like a literal release tag and caused real confusion - the actual
|
|
# release tag has been correct (versioned) all along; only this label lied
|
|
# about it. Spell out "channel" so nobody mistakes one for the other again.
|
|
# NOTE: this value MUST be quoted. The GHA string literal below contains
|
|
# "Release build: {0}" - an unquoted YAML plain scalar treats ": " (colon
|
|
# then space) as starting a nested mapping, which is exactly what broke every
|
|
# single push since this line was introduced: GitHub rejected the whole
|
|
# workflow file at parse time (before any job runs), silently burning an
|
|
# Actions-minutes-billed run per push for nothing.
|
|
run-name: "${{ startsWith(github.ref, 'refs/tags/') && (contains(github.ref_name, 'beta') && format('CI/CD: beta version {0}', github.ref_name) || contains(github.ref_name, 'alpha') && format('CI/CD: alpha version {0}', github.ref_name) || format('CI/CD: release version {0}', github.ref_name)) || format('CI/CD: {0} channel build', github.ref_name) }}"
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
channel:
|
|
description: >-
|
|
Manually build+release just this rolling channel. Stable releases
|
|
are NEVER picked here on purpose - cut those only via a real
|
|
"vX.Y.Z" tag push, so a manual dispatch can't accidentally publish
|
|
a "stable" release.
|
|
type: choice
|
|
required: true
|
|
default: alpha
|
|
options:
|
|
- alpha
|
|
- beta
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
# -- Global defaults ---------------------------------------------------------
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
CARGO_INCREMENTAL: 0
|
|
RUST_BACKTRACE: short
|
|
|
|
jobs:
|
|
# Computes ONE channel + release tag for this whole run, so every build
|
|
# job (native matrix + all 3 GUI platforms + Android) uploads to the exact
|
|
# same release under the exact same tag, instead of repeating this logic
|
|
# (and risking it drifting out of sync) in five separate places.
|
|
#
|
|
# Tag shape:
|
|
# - real "vX.Y.Z" / "vX.Y.Z-beta.N" tag push -> tag used as-is (stable promotion)
|
|
# - push to `alpha` -> "{version}-alpha" (rolling, same tag every push)
|
|
# - push to `beta` -> "{version}-beta" (rolling, same tag every push)
|
|
# - workflow_dispatch -> forced by the `channel` input (alpha|beta only)
|
|
resolve-channel:
|
|
name: Resolve release channel
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
channel: ${{ steps.resolve.outputs.channel }}
|
|
tag_name: ${{ steps.resolve.outputs.tag_name }}
|
|
prerelease: ${{ steps.resolve.outputs.prerelease }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Resolve channel, version, and release tag
|
|
id: resolve
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
BASE_VERSION=$(grep -m1 '^version' Cargo.toml | sed -E 's/version *= *"([^"]+)"/\1/')
|
|
|
|
if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
|
|
# A pushed tag is authoritative — use it AS-IS (never recompute it
|
|
# from Cargo.toml, or the release would upload to a different tag than
|
|
# the one that triggered this run). The channel, and thus prerelease,
|
|
# is decided by the tag's suffix: v0.4.7-beta / v0.4.7-alpha are
|
|
# prereleases; a bare vX.Y.Z is the only thing that becomes stable.
|
|
TAG="${{ github.ref_name }}"
|
|
case "$TAG" in
|
|
*-alpha*) CHANNEL="alpha" ;;
|
|
*-beta*) CHANNEL="beta" ;;
|
|
*) CHANNEL="stable" ;;
|
|
esac
|
|
else
|
|
# No tag (workflow_dispatch, or a legacy branch push): pick the
|
|
# channel, then synthesize the rolling tag from Cargo.toml's version.
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
CHANNEL="${{ github.event.inputs.channel }}"
|
|
elif [ "${{ github.ref_name }}" = "beta" ]; then
|
|
CHANNEL="beta"
|
|
else
|
|
CHANNEL="alpha"
|
|
fi
|
|
TAG="v${BASE_VERSION}-${CHANNEL}"
|
|
fi
|
|
|
|
echo "Resolved channel=$CHANNEL tag=$TAG (base version $BASE_VERSION)"
|
|
echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
|
|
echo "tag_name=$TAG" >> "$GITHUB_OUTPUT"
|
|
echo "prerelease=$([ "$CHANNEL" = "stable" ] && echo false || echo true)" >> "$GITHUB_OUTPUT"
|
|
|
|
check-and-test:
|
|
name: Check & Test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
toolchain: stable
|
|
|
|
- name: Restore Cargo cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry/index/
|
|
~/.cargo/registry/cache/
|
|
~/.cargo/git/db/
|
|
target/
|
|
key: cargo-check-${{ hashFiles('**/Cargo.lock') }}
|
|
restore-keys: cargo-check-
|
|
|
|
- name: Install musl-tools
|
|
run: sudo apt-get update && sudo apt-get install -y musl-tools
|
|
|
|
- name: Create dummy dist for rust-embed
|
|
run: mkdir -p ostp-control/dist && touch ostp-control/dist/index.html
|
|
|
|
- name: cargo check
|
|
run: cargo check --workspace
|
|
|
|
- name: cargo test
|
|
run: cargo test --workspace --lib
|
|
|
|
publish-release-matrix:
|
|
name: Release for ${{ matrix.target }}
|
|
needs: [check-and-test, resolve-channel]
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# -- Windows ------------------------------------------------------
|
|
- os: windows-latest
|
|
target: x86_64-pc-windows-msvc
|
|
artifact_name: ostp.exe
|
|
release_name: ostp-windows-amd64.zip
|
|
wintun_arch: amd64
|
|
|
|
- os: windows-latest
|
|
target: i686-pc-windows-msvc
|
|
artifact_name: ostp.exe
|
|
release_name: ostp-windows-386.zip
|
|
wintun_arch: x86
|
|
|
|
- os: windows-latest
|
|
target: aarch64-pc-windows-msvc
|
|
artifact_name: ostp.exe
|
|
release_name: ostp-windows-arm64.zip
|
|
wintun_arch: arm64
|
|
|
|
# -- macOS ---------------------------------------------------------
|
|
- os: macos-latest
|
|
target: x86_64-apple-darwin
|
|
artifact_name: ostp
|
|
release_name: ostp-darwin-amd64.tar.gz
|
|
|
|
- os: macos-latest
|
|
target: aarch64-apple-darwin
|
|
artifact_name: ostp
|
|
release_name: ostp-darwin-arm64.tar.gz
|
|
|
|
# -- Linux native --------------------------------------------------
|
|
- os: ubuntu-latest
|
|
target: x86_64-unknown-linux-musl
|
|
artifact_name: ostp
|
|
release_name: ostp-linux-amd64.tar.gz
|
|
|
|
- os: ubuntu-latest
|
|
target: i686-unknown-linux-musl
|
|
artifact_name: ostp
|
|
release_name: ostp-linux-386.tar.gz
|
|
use_cross: true
|
|
|
|
# -- Linux cross ---------------------------------------------------
|
|
- os: ubuntu-latest
|
|
target: aarch64-unknown-linux-musl
|
|
artifact_name: ostp
|
|
release_name: ostp-linux-arm64.tar.gz
|
|
use_cross: true
|
|
|
|
- os: ubuntu-latest
|
|
target: armv7-unknown-linux-musleabihf
|
|
artifact_name: ostp
|
|
release_name: ostp-linux-armv7.tar.gz
|
|
use_cross: true
|
|
|
|
- os: ubuntu-latest
|
|
target: x86_64-unknown-freebsd
|
|
artifact_name: ostp
|
|
release_name: ostp-freebsd-amd64.tar.gz
|
|
use_cross: true
|
|
|
|
- os: ubuntu-latest
|
|
target: mipsel-unknown-linux-musl
|
|
artifact_name: ostp
|
|
release_name: ostp-linux-mipsle.tar.gz
|
|
use_cross: true
|
|
toolchain: nightly
|
|
|
|
- os: ubuntu-latest
|
|
target: riscv64gc-unknown-linux-gnu
|
|
artifact_name: ostp
|
|
release_name: ostp-linux-riscv64.tar.gz
|
|
use_cross: true
|
|
|
|
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
# -- Frontend Build -----------------------------------------------------
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
- name: Build Web Panel (skip if no source; use committed dist/)
|
|
shell: bash
|
|
run: |
|
|
mkdir -p ostp-control/dist
|
|
cd ostp-control
|
|
if [ -f package.json ]; then
|
|
npm install && npm run build
|
|
else
|
|
echo "ostp-control has no package.json - using committed dist/"
|
|
[ -f dist/index.html ] || echo '<!doctype html><title>OSTP</title>' > dist/index.html
|
|
fi
|
|
|
|
# -- Rust toolchain -----------------------------------------------------
|
|
- name: Setup Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
toolchain: ${{ matrix.toolchain || 'stable' }}
|
|
targets: ${{ !matrix.use_cross && matrix.target || '' }}
|
|
|
|
# -- Cargo cache (shared per target) -----------------------------------
|
|
- name: Restore Cargo cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry/index/
|
|
~/.cargo/registry/cache/
|
|
~/.cargo/git/db/
|
|
target/
|
|
key: cargo-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
|
|
restore-keys: |
|
|
cargo-${{ matrix.target }}-
|
|
|
|
# -- MUSL tools for native Linux musl builds ----------------------------
|
|
- name: Install musl-tools
|
|
if: ${{ matrix.os == 'ubuntu-latest' && !matrix.use_cross }}
|
|
run: sudo apt-get update && sudo apt-get install -y musl-tools
|
|
|
|
# -- Native build -------------------------------------------------------
|
|
- name: Build (native)
|
|
if: ${{ !matrix.use_cross }}
|
|
shell: bash
|
|
run: cargo build --release --target ${{ matrix.target }} --bin ostp
|
|
|
|
# -- Cross build --------------------------------------------------------
|
|
- name: Restore cross binary cache
|
|
if: ${{ matrix.use_cross }}
|
|
id: cross-cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ~/.cargo/bin/cross
|
|
key: cross-bin-${{ runner.os }}-v1
|
|
|
|
- name: Install cross (if not cached)
|
|
if: ${{ matrix.use_cross && steps.cross-cache.outputs.cache-hit != 'true' }}
|
|
# cross-rs's own source (not ours, not a dependency of ours) uses a
|
|
# macro-at-end-of-block pattern that trips rustc's
|
|
# semicolon_in_expressions_from_macros lint on current toolchains -
|
|
# harmless in cross's actual behavior, but `cargo install` compiles
|
|
# the installed package as the "local" crate, so dependency lint
|
|
# capping doesn't shield it. --cap-lints=warn is the standard escape
|
|
# hatch for building a third-party tool against a newer compiler than
|
|
# its own lint config assumed; it doesn't touch our own build.
|
|
run: RUSTFLAGS="--cap-lints=warn" cargo install cross --git https://github.com/cross-rs/cross.git --locked
|
|
|
|
- name: Build (cross)
|
|
if: ${{ matrix.use_cross }}
|
|
run: cross build --release --target ${{ matrix.target }} --bin ostp
|
|
|
|
# -- Driver dependencies ------------------------------------------------
|
|
- name: Download wintun (Windows)
|
|
if: ${{ matrix.os == 'windows-latest' }}
|
|
shell: pwsh
|
|
run: |
|
|
$ProgressPreference = 'SilentlyContinue'
|
|
$dir = "target/${{ matrix.target }}/release"
|
|
Invoke-WebRequest -Uri "https://www.wintun.net/builds/wintun-0.14.1.zip" -OutFile "$dir/wt.zip"
|
|
Expand-Archive "$dir/wt.zip" -DestinationPath "$dir/wt_tmp" -Force
|
|
Get-ChildItem "$dir/wt_tmp" -Filter "wintun.dll" -Recurse | Where-Object { $_.FullName -match 'bin[\\/]${{ matrix.wintun_arch }}[\\/]' } | Copy-Item -Destination "$dir/"
|
|
Remove-Item "$dir/wt.zip","$dir/wt_tmp" -Recurse -Force
|
|
|
|
# -- Package ------------------------------------------------------------
|
|
- name: Package (Windows)
|
|
if: ${{ matrix.os == 'windows-latest' }}
|
|
shell: pwsh
|
|
run: |
|
|
$dir = "target/${{ matrix.target }}/release"
|
|
$files = @("ostp.exe")
|
|
if (Test-Path "$dir/wintun.dll") { $files += "wintun.dll" }
|
|
Push-Location $dir
|
|
Compress-Archive -Path $files -DestinationPath "../../../${{ matrix.release_name }}" -Force
|
|
Pop-Location
|
|
|
|
- name: Package (Unix)
|
|
if: ${{ matrix.os != 'windows-latest' }}
|
|
run: |
|
|
dir="target/${{ matrix.target }}/release"
|
|
FILES="${{ matrix.artifact_name }}"
|
|
tar -czf "${{ matrix.release_name }}" -C "$dir" $FILES
|
|
|
|
# -- Upload -------------------------------------------------------------
|
|
- name: Upload to GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
# Computed once in resolve-channel so every platform/job in this run
|
|
# lands on the exact same tag: "{version}-alpha" / "{version}-beta"
|
|
# for rolling channel pushes, or the pushed "vX.Y.Z" tag as-is for a
|
|
# real stable release.
|
|
tag_name: ${{ needs.resolve-channel.outputs.tag_name }}
|
|
prerelease: ${{ needs.resolve-channel.outputs.prerelease }}
|
|
files: ${{ matrix.release_name }}
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
build-windows-gui:
|
|
name: Build Windows GUI (Tauri) - ${{ matrix.arch }}
|
|
needs: [check-and-test, resolve-channel]
|
|
runs-on: windows-latest
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- arch: amd64
|
|
target: x86_64-pc-windows-msvc
|
|
- arch: arm64
|
|
target: aarch64-pc-windows-msvc
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
|
|
- name: Setup Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
|
|
- name: Install Tauri CLI
|
|
run: npm install -g @tauri-apps/cli
|
|
|
|
- name: Cache cargo
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry/index/
|
|
~/.cargo/registry/cache/
|
|
~/.cargo/git/db/
|
|
target/
|
|
key: cargo-windows-gui-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
|
|
|
|
- name: Download wintun
|
|
shell: pwsh
|
|
run: |
|
|
$ProgressPreference = 'SilentlyContinue'
|
|
|
|
# Download wintun
|
|
New-Item -ItemType Directory -Force -Path "target/${{ matrix.target }}/release"
|
|
Invoke-WebRequest -Uri "https://www.wintun.net/builds/wintun-0.14.1.zip" -OutFile "target/wt.zip"
|
|
Expand-Archive "target/wt.zip" -DestinationPath "target/wt_tmp" -Force
|
|
Get-ChildItem "target/wt_tmp" -Filter "wintun.dll" -Recurse | Where-Object { $_.FullName -match 'bin[\\/]${{ matrix.arch }}[\\/]' } | Copy-Item -Destination "target/${{ matrix.target }}/release/wintun.dll" -Force
|
|
|
|
- name: Build Tauri App
|
|
working-directory: ostp-gui
|
|
run: |
|
|
npm install
|
|
cargo build -p ostp-tun-helper --release --target ${{ matrix.target }}
|
|
npx tauri build --no-bundle --target ${{ matrix.target }}
|
|
|
|
- name: Package Portable ZIP
|
|
shell: pwsh
|
|
run: |
|
|
$dir = "ostp-gui-dist"
|
|
New-Item -ItemType Directory -Force -Path $dir
|
|
Copy-Item "ostp-gui/src-tauri/target/${{ matrix.target }}/release/ostp-gui.exe" $dir
|
|
Copy-Item "target/${{ matrix.target }}/release/ostp-tun-helper.exe" $dir
|
|
Copy-Item "target/${{ matrix.target }}/release/wintun.dll" $dir
|
|
|
|
Compress-Archive -Path "$dir/*" -DestinationPath "ostp-windows-gui-${{ matrix.arch }}.zip" -Force
|
|
|
|
- name: Upload to GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
# Computed once in resolve-channel so every platform/job in this run
|
|
# lands on the exact same tag: "{version}-alpha" / "{version}-beta"
|
|
# for rolling channel pushes, or the pushed "vX.Y.Z" tag as-is for a
|
|
# real stable release.
|
|
tag_name: ${{ needs.resolve-channel.outputs.tag_name }}
|
|
prerelease: ${{ needs.resolve-channel.outputs.prerelease }}
|
|
files: ostp-windows-gui-${{ matrix.arch }}.zip
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
build-linux-gui:
|
|
name: Build Linux GUI (Tauri) - ${{ matrix.arch }}
|
|
needs: [check-and-test, resolve-channel]
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- arch: amd64
|
|
target: x86_64-unknown-linux-gnu
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
|
|
- name: Setup Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
|
|
- name: Install Linux Dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
|
|
|
|
- name: Install Tauri CLI
|
|
run: npm install -g @tauri-apps/cli
|
|
|
|
- name: Cache cargo
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry/index/
|
|
~/.cargo/registry/cache/
|
|
~/.cargo/git/db/
|
|
target/
|
|
key: cargo-linux-gui-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
|
|
|
|
- name: Build Tauri App
|
|
working-directory: ostp-gui
|
|
run: |
|
|
npm install
|
|
npx tauri build --no-bundle --target ${{ matrix.target }}
|
|
|
|
- name: Package Portable Tarball
|
|
run: |
|
|
mkdir ostp-linux-gui-${{ matrix.arch }}
|
|
cp ostp-gui/src-tauri/target/${{ matrix.target }}/release/ostp-gui ostp-linux-gui-${{ matrix.arch }}/
|
|
tar -czf ostp-linux-gui-${{ matrix.arch }}.tar.gz ostp-linux-gui-${{ matrix.arch }}
|
|
|
|
- name: Upload to GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
# Computed once in resolve-channel so every platform/job in this run
|
|
# lands on the exact same tag: "{version}-alpha" / "{version}-beta"
|
|
# for rolling channel pushes, or the pushed "vX.Y.Z" tag as-is for a
|
|
# real stable release.
|
|
tag_name: ${{ needs.resolve-channel.outputs.tag_name }}
|
|
prerelease: ${{ needs.resolve-channel.outputs.prerelease }}
|
|
files: ostp-linux-gui-${{ matrix.arch }}.tar.gz
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
build-macos-gui:
|
|
name: Build macOS GUI (Tauri) - ${{ matrix.arch }}
|
|
needs: [check-and-test, resolve-channel]
|
|
runs-on: macos-latest
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- arch: amd64
|
|
target: x86_64-apple-darwin
|
|
- arch: arm64
|
|
target: aarch64-apple-darwin
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
|
|
- name: Setup Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
|
|
- name: Install Tauri CLI
|
|
run: npm install -g @tauri-apps/cli
|
|
|
|
- name: Cache cargo
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry/index/
|
|
~/.cargo/registry/cache/
|
|
~/.cargo/git/db/
|
|
target/
|
|
key: cargo-macos-gui-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
|
|
|
|
- name: Build Tauri App
|
|
working-directory: ostp-gui
|
|
run: |
|
|
npm install
|
|
npx tauri build --no-bundle --target ${{ matrix.target }}
|
|
|
|
- name: Package Portable Tarball
|
|
run: |
|
|
mkdir ostp-macos-gui-${{ matrix.arch }}
|
|
cp ostp-gui/src-tauri/target/${{ matrix.target }}/release/ostp-gui ostp-macos-gui-${{ matrix.arch }}/
|
|
tar -czf ostp-macos-gui-${{ matrix.arch }}.tar.gz ostp-macos-gui-${{ matrix.arch }}
|
|
|
|
- name: Upload to GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
# Computed once in resolve-channel so every platform/job in this run
|
|
# lands on the exact same tag: "{version}-alpha" / "{version}-beta"
|
|
# for rolling channel pushes, or the pushed "vX.Y.Z" tag as-is for a
|
|
# real stable release.
|
|
tag_name: ${{ needs.resolve-channel.outputs.tag_name }}
|
|
prerelease: ${{ needs.resolve-channel.outputs.prerelease }}
|
|
files: ostp-macos-gui-${{ matrix.arch }}.tar.gz
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
build-android:
|
|
name: Build Android Client (Flutter) - ${{ matrix.arch }}
|
|
needs: [check-and-test, resolve-channel]
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- arch: arm64-v8a
|
|
rust_target: aarch64-linux-android
|
|
flutter_target: android-arm64
|
|
- arch: armeabi-v7a
|
|
rust_target: armv7-linux-androideabi
|
|
flutter_target: android-arm
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Java
|
|
uses: actions/setup-java@v3
|
|
with:
|
|
distribution: 'zulu'
|
|
java-version: '17'
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
flutter-version: '3.41.6'
|
|
channel: 'stable'
|
|
|
|
- name: Setup Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: ${{ matrix.rust_target }}
|
|
|
|
- name: Setup Android NDK
|
|
uses: nttld/setup-ndk@v1
|
|
with:
|
|
ndk-version: r26b
|
|
|
|
- name: Install cargo-ndk
|
|
run: cargo install cargo-ndk
|
|
|
|
- name: Build Android APK
|
|
shell: bash
|
|
working-directory: ostp-flutter
|
|
env:
|
|
OSTP_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
OSTP_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
|
|
OSTP_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
OSTP_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# 1. Materialise the upload keystore from secrets. Android keys an app
|
|
# by applicationId + signing key and refuses to update across a key
|
|
# change, so every published build MUST use this one key. Releases
|
|
# used to fall through to the per-machine debug keystore, which on
|
|
# ephemeral CI runners meant a different random key every build -
|
|
# hence "App not installed" on upgrade.
|
|
if [ -z "${OSTP_KEYSTORE_B64:-}" ]; then
|
|
echo "::error::ANDROID_KEYSTORE_BASE64 secret is not set. Refusing to publish a"
|
|
echo "::error::debug-signed APK: users could not update over it and the key is"
|
|
echo "::error::not reproducible. See docs for the one-time keystore setup."
|
|
exit 1
|
|
fi
|
|
export OSTP_KEYSTORE_PATH="$RUNNER_TEMP/ostp-upload.jks"
|
|
echo "$OSTP_KEYSTORE_B64" | base64 -d > "$OSTP_KEYSTORE_PATH"
|
|
|
|
# 2. Compile JNI
|
|
mkdir -p android/app/src/main/jniLibs/${{ matrix.arch }}
|
|
|
|
cd ../ostp-jni
|
|
cargo ndk -t ${{ matrix.arch }} -o "../ostp-flutter/android/app/src/main/jniLibs" build --release
|
|
cd ../ostp-flutter
|
|
|
|
# 3. Build Flutter APK
|
|
flutter build apk --release --target-platform ${{ matrix.flutter_target }}
|
|
|
|
# 4. Fail loudly if the APK somehow still came out debug-signed, rather
|
|
# than shipping another un-updatable build.
|
|
APK=build/app/outputs/flutter-apk/app-release.apk
|
|
if "$ANDROID_HOME"/build-tools/*/apksigner verify --print-certs "$APK" 2>/dev/null \
|
|
| grep -qi "CN=Android Debug"; then
|
|
echo "::error::APK is signed with the Android debug certificate - aborting."
|
|
exit 1
|
|
fi
|
|
|
|
# 5. Copy to output
|
|
cp "$APK" ostp-android-${{ matrix.arch }}.apk
|
|
|
|
- name: Upload to GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
# Computed once in resolve-channel so every platform/job in this run
|
|
# lands on the exact same tag: "{version}-alpha" / "{version}-beta"
|
|
# for rolling channel pushes, or the pushed "vX.Y.Z" tag as-is for a
|
|
# real stable release.
|
|
tag_name: ${{ needs.resolve-channel.outputs.tag_name }}
|
|
prerelease: ${{ needs.resolve-channel.outputs.prerelease }}
|
|
files: ostp-flutter/ostp-android-${{ matrix.arch }}.apk
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
|