chore(ci): drop flatpak bundle from release workflow #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| jobs: | |
| macos: | |
| permissions: | |
| contents: write | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 1 | |
| matrix: | |
| include: | |
| - args: --target aarch64-apple-darwin --bundles dmg,app | |
| - args: --target x86_64-apple-darwin --bundles dmg,app | |
| runs-on: macos-latest | |
| env: | |
| CMAKE_POLICY_VERSION_MINIMUM: '3.5' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: aarch64-apple-darwin,x86_64-apple-darwin | |
| - name: Cache cargo build | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: src-tauri | |
| - name: Install JS deps | |
| run: bun install --frozen-lockfile | |
| - name: Build & release | |
| uses: tauri-apps/tauri-action@v0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| with: | |
| projectPath: src-tauri | |
| tagName: ${{ github.ref_name }} | |
| releaseName: Splitwave ${{ github.ref_name }} | |
| releaseDraft: true | |
| prerelease: false | |
| args: ${{ matrix.args }} | |
| linux: | |
| # last, so the latest.json patch lands after the other jobs write it | |
| needs: [macos, windows] | |
| permissions: | |
| contents: write | |
| # oldest base with WebKitGTK 4.1 -> glibc 2.35 for AppImage compat | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo build | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: src-tauri | |
| - name: Install Linux system deps | |
| # PPA backports a libpipewire new enough for the libspa crate | |
| run: | | |
| sudo add-apt-repository -y ppa:pipewire-debian/pipewire-upstream | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| libwebkit2gtk-4.1-dev libjavascriptcoregtk-4.1-dev \ | |
| libgtk-3-dev librsvg2-dev librsvg2-bin libgtk-3-bin \ | |
| libayatana-appindicator3-dev libsoup-3.0-dev libssl-dev \ | |
| libpipewire-0.3-dev clang libclang-dev \ | |
| libasound2-dev libopus-dev \ | |
| desktop-file-utils xdg-utils patchelf rpm | |
| - name: Install JS deps | |
| run: bun install --frozen-lockfile | |
| - name: Build, sign & release | |
| uses: tauri-apps/tauri-action@v0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| with: | |
| projectPath: src-tauri | |
| tagName: ${{ github.ref_name }} | |
| releaseName: Splitwave ${{ github.ref_name }} | |
| releaseDraft: true | |
| prerelease: false | |
| args: --bundles appimage,deb,rpm | |
| # linuxdeploy bundles libwayland/libpipewire/libspa; on newer Mesa they | |
| # shadow the host libs and break EGL/PipeWire. Drop them, use the host's. | |
| - name: Strip bundled host libs from AppImage | |
| run: | | |
| set -euxo pipefail | |
| export APPIMAGE_EXTRACT_AND_RUN=1 | |
| app=$(find src-tauri/target/release/bundle/appimage -name '*.AppImage' | head -1) | |
| "$app" --appimage-extract | |
| rm -fv squashfs-root/usr/lib/libwayland-client.so* \ | |
| squashfs-root/usr/lib/libwayland-egl.so* \ | |
| squashfs-root/usr/lib/libwayland-cursor.so* \ | |
| squashfs-root/usr/lib/libpipewire-0.3.so* \ | |
| squashfs-root/usr/lib/libspa-0.2.so* | |
| curl -fsSL -o /tmp/appimagetool \ | |
| https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage | |
| chmod +x /tmp/appimagetool | |
| rm -f "$app" | |
| ARCH=x86_64 /tmp/appimagetool squashfs-root "$app" | |
| rm -rf squashfs-root | |
| # updater verifies the .AppImage itself (not the tarball); the strip | |
| # changed it, so the old signature is stale. | |
| - name: Re-sign stripped AppImage | |
| env: | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| run: | | |
| set -euxo pipefail | |
| app=$(find src-tauri/target/release/bundle/appimage -maxdepth 1 -name '*.AppImage' | head -1) | |
| rm -f "$app.sig" | |
| bun run tauri signer sign "$app" | |
| # url still points at the same-named .AppImage; only the signature | |
| # changed. startswith covers linux-x86_64 and linux-x86_64-appimage. | |
| - name: Patch latest.json with new Linux signature | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euxo pipefail | |
| tag="${{ github.ref_name }}" | |
| repo="${{ github.repository }}" | |
| app=$(find src-tauri/target/release/bundle/appimage -maxdepth 1 -name '*.AppImage' | head -1) | |
| newsig=$(cat "$app.sig") | |
| rid=$(gh api "repos/$repo/releases" --jq "[.[] | select(.tag_name==\"$tag\")][0].id") | |
| aid=$(gh api "repos/$repo/releases/$rid/assets" --jq '[.[] | select(.name=="latest.json")][0].id') | |
| gh api "repos/$repo/releases/assets/$aid" -H "Accept: application/octet-stream" > latest.json | |
| jq --arg s "$newsig" '.platforms |= with_entries(if (.key | startswith("linux-x86_64")) then .value.signature = $s else . end)' latest.json > latest.json.tmp | |
| mv latest.json.tmp latest.json | |
| cat latest.json | |
| # softprops replaces the same-named un-stripped assets | |
| - name: Replace AppImage, signature & manifest on release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| draft: true | |
| files: | | |
| src-tauri/target/release/bundle/appimage/*.AppImage | |
| src-tauri/target/release/bundle/appimage/*.AppImage.sig | |
| latest.json | |
| windows: | |
| # Runs after macOS so the draft release already exists to upload into. | |
| needs: macos | |
| permissions: | |
| contents: write | |
| runs-on: windows-latest | |
| env: | |
| # windows-latest ships CMake 4.x, which rejects audiopus_sys's pre-3.5 | |
| # policy version without this override. | |
| CMAKE_POLICY_VERSION_MINIMUM: '3.5' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo build | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: src-tauri | |
| - name: Install JS deps | |
| run: bun install --frozen-lockfile | |
| - name: Build & release | |
| uses: tauri-apps/tauri-action@v0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| with: | |
| projectPath: src-tauri | |
| tagName: ${{ github.ref_name }} | |
| releaseName: Splitwave ${{ github.ref_name }} | |
| releaseDraft: true | |
| prerelease: false | |
| args: --bundles nsis |