chore(deps): bump hono from 4.12.10 to 4.13.0 #1917
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pull Request Checks | |
| on: | |
| pull_request: {} | |
| permissions: | |
| contents: read | |
| actions: read | |
| packages: read | |
| jobs: | |
| detect-affected: | |
| name: Detect Affected Projects | |
| runs-on: ubuntu-latest | |
| outputs: | |
| has_affected: ${{ steps.detect-affected.outputs.has_affected }} | |
| projects: ${{ steps.detect-affected.outputs.projects }} | |
| has_test: ${{ steps.detect-affected.outputs.has_test }} | |
| has_e2e: ${{ steps.detect-affected.outputs.has_e2e }} | |
| has_lint: ${{ steps.detect-affected.outputs.has_lint }} | |
| has_build: ${{ steps.detect-affected.outputs.has_build }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set Nx SHA | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Detect affected projects | |
| id: detect-affected | |
| uses: ./.github/actions/detect-affected | |
| lint_pull_request: | |
| name: Pull Request Lint | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: read | |
| steps: | |
| - uses: amannn/action-semantic-pull-request@v6 | |
| with: | |
| types: | | |
| feat | |
| fix | |
| docs | |
| refactor | |
| cleanup | |
| chore | |
| ci | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| lint_commit: | |
| name: Commit Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set Nx SHA | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Commitlint - Lint Commits | |
| if: github.event_name == 'pull_request' | |
| shell: bash | |
| run: | | |
| npx commitlint --from=origin/${{ github.base_ref }} --to=HEAD --config ./.commitlintrc.json | |
| knowledge-graph-impact: | |
| name: Knowledge Graph Blast Radius | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Build knowledge graph tooling | |
| run: npx nx run graph:build | |
| - name: Compute blast radius vs PR base | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| set -euo pipefail | |
| # Call the CLI directly so Nx banners do not pollute the comment body. | |
| node dist/tools/graph/src/query-cli.js impact \ | |
| --base "$BASE_SHA" \ | |
| --no-uncommitted \ | |
| --format markdown \ | |
| > knowledge-graph-blast-radius.md | |
| - name: Upsert PR blast radius comment | |
| uses: ./.github/actions/upsert-pr-comment | |
| with: | |
| marker: '<!-- knowledge-graph-blast-radius -->' | |
| body-path: knowledge-graph-blast-radius.md | |
| check: | |
| name: Format Check | |
| runs-on: ubuntu-latest | |
| needs: detect-affected | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set Nx SHA | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Nx Format - Check | |
| run: npx nx format:check | |
| - name: Nx Lint - Check | |
| if: needs.detect-affected.outputs.has_lint == 'true' | |
| run: npx nx affected --target=lint --parallel=3 | |
| - name: Skip lint (no affected projects) | |
| if: needs.detect-affected.outputs.has_lint != 'true' | |
| run: echo "No affected projects with lint target; skipping nx affected lint." | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| needs: detect-affected | |
| if: needs.detect-affected.outputs.has_affected == 'true' | |
| permissions: | |
| contents: read | |
| actions: read | |
| packages: read | |
| issues: write | |
| pull-requests: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set Nx SHA | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Collect base-branch coverage (for PR diff) | |
| if: github.event_name == 'pull_request' && needs.detect-affected.outputs.has_test == 'true' | |
| continue-on-error: true | |
| shell: bash | |
| run: | | |
| set -uo pipefail | |
| PR_SHA=$(git rev-parse HEAD) | |
| git fetch origin "${{ github.base_ref }}" --depth=1 | |
| git checkout "${{ github.event.pull_request.base.sha }}" | |
| rm -rf coverage coverage-base | |
| npx nx affected --target=test --parallel=3 --configuration=ci --skip-nx-cache | |
| if [ -d coverage ]; then | |
| mv coverage coverage-base | |
| else | |
| mkdir -p coverage-base | |
| fi | |
| git checkout "$PR_SHA" | |
| - name: Ensure coverage-base exists for diff comment | |
| if: github.event_name == 'pull_request' && needs.detect-affected.outputs.has_test != 'true' | |
| run: mkdir -p coverage-base | |
| - name: Run unit tests | |
| if: needs.detect-affected.outputs.has_test == 'true' | |
| run: | | |
| rm -rf test-results | |
| mkdir -p test-results | |
| npx nx affected --target=test --parallel=3 --configuration=ci --skip-nx-cache | |
| - name: Skip unit tests (no affected projects with test target) | |
| if: needs.detect-affected.outputs.has_test != 'true' | |
| run: echo "No affected projects with test target; skipping unit tests." | |
| - name: Generate coverage PR comment | |
| if: always() && github.event_name == 'pull_request' | |
| run: | | |
| set -euo pipefail | |
| if [ "${{ needs.detect-affected.outputs.has_test }}" != "true" ]; then | |
| node tools/ci/pr-reports.mjs coverage \ | |
| --coverage-dir coverage \ | |
| --coverage-base-dir coverage-base \ | |
| --out pr-coverage.md \ | |
| --no-coverage-ran | |
| else | |
| node tools/ci/pr-reports.mjs coverage \ | |
| --coverage-dir coverage \ | |
| --coverage-base-dir coverage-base \ | |
| --out pr-coverage.md | |
| fi | |
| - name: Upsert PR coverage comment | |
| if: always() && github.event_name == 'pull_request' | |
| uses: ./.github/actions/upsert-pr-comment | |
| with: | |
| marker: '<!-- nx-coverage-report -->' | |
| body-path: pr-coverage.md | |
| - name: Generate test PR comment | |
| if: always() && github.event_name == 'pull_request' | |
| run: | | |
| set -euo pipefail | |
| if [ "${{ needs.detect-affected.outputs.has_test }}" != "true" ]; then | |
| node tools/ci/pr-reports.mjs tests \ | |
| --results-dir test-results \ | |
| --out pr-tests.md \ | |
| --no-tests-ran | |
| else | |
| node tools/ci/pr-reports.mjs tests \ | |
| --results-dir test-results \ | |
| --out pr-tests.md | |
| fi | |
| - name: Upsert PR test comment | |
| if: always() && github.event_name == 'pull_request' | |
| uses: ./.github/actions/upsert-pr-comment | |
| with: | |
| marker: '<!-- nx-test-report -->' | |
| body-path: pr-tests.md | |
| - name: Run end-to-end tests | |
| if: needs.detect-affected.outputs.has_e2e == 'true' | |
| run: npx nx affected --target=e2e --parallel=3 | |
| - name: Skip e2e tests (no affected projects with e2e target) | |
| if: needs.detect-affected.outputs.has_e2e != 'true' | |
| run: echo "No affected projects with e2e target; skipping e2e tests." | |
| trivy-filesystem: | |
| name: Trivy Filesystem Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Run Trivy filesystem scan | |
| uses: ./.github/actions/trivy-scan | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| sarif-category: trivy-fs | |
| trivy-config: | |
| name: Trivy Config Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Run Trivy config scan | |
| uses: ./.github/actions/trivy-scan | |
| with: | |
| scan-type: config | |
| scan-ref: . | |
| sarif-category: trivy-config | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| needs: detect-affected | |
| if: needs.detect-affected.outputs.has_affected == 'true' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Run build | |
| run: | | |
| set -euo pipefail | |
| for attempt in 1 2 3; do | |
| if npx nx affected --target=build --parallel=3; then | |
| exit 0 | |
| fi | |
| echo "Build attempt ${attempt} failed." | |
| if [ "${attempt}" -eq 3 ]; then | |
| exit 1 | |
| fi | |
| sleep 10 | |
| done | |
| - name: Run SBOM generation | |
| env: | |
| VERSION: 0.0.0-SNAPSHOT | |
| run: npx nx affected --target=sbom --parallel=1 | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: build-artifacts | |
| path: | | |
| dist/ | |
| node_modules/ | |
| retention-days: 1 | |
| compression-level: 6 | |
| build-api-container-images: | |
| name: Build API Container Images | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| contents: read | |
| actions: read | |
| packages: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Build API container images | |
| run: | | |
| npx nx affected --target=api-container-image --configuration=test --parallel=3 | |
| - name: Scan API container images with Trivy | |
| uses: ./.github/actions/trivy-scan-local-images | |
| with: | |
| sarif-category: trivy-images-api | |
| - name: Generate container image SBOMs | |
| uses: ./.github/actions/generate-container-image-sboms | |
| with: | |
| project-version: 0.0.0-SNAPSHOT | |
| artifact-name: sbom-container-images-api | |
| build-worker-container-images: | |
| name: Build Worker Container Images | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| contents: read | |
| actions: read | |
| packages: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Build Worker container images | |
| run: | | |
| npx nx affected --target=worker-container-image --configuration=test --parallel=3 | |
| - name: Scan Worker container images with Trivy | |
| uses: ./.github/actions/trivy-scan-local-images | |
| with: | |
| sarif-category: trivy-images-worker | |
| - name: Generate container image SBOMs | |
| uses: ./.github/actions/generate-container-image-sboms | |
| with: | |
| project-version: 0.0.0-SNAPSHOT | |
| artifact-name: sbom-container-images-worker | |
| build-vnc-container-images: | |
| name: Build VNC Container Images | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| contents: read | |
| actions: read | |
| packages: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Build VNC container images | |
| run: | | |
| npx nx affected --target=vnc-container-image --configuration=test --parallel=3 | |
| - name: Scan VNC container images with Trivy | |
| uses: ./.github/actions/trivy-scan-local-images | |
| with: | |
| sarif-category: trivy-images-vnc | |
| - name: Generate container image SBOMs | |
| uses: ./.github/actions/generate-container-image-sboms | |
| with: | |
| project-version: 0.0.0-SNAPSHOT | |
| artifact-name: sbom-container-images-vnc | |
| build-ssh-container-images: | |
| name: Build SSH Container Images | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| contents: read | |
| actions: read | |
| packages: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Build SSH container images | |
| run: | | |
| npx nx affected --target=ssh-container-image --configuration=test --parallel=3 | |
| - name: Scan SSH container images with Trivy | |
| uses: ./.github/actions/trivy-scan-local-images | |
| with: | |
| sarif-category: trivy-images-ssh | |
| - name: Generate container image SBOMs | |
| uses: ./.github/actions/generate-container-image-sboms | |
| with: | |
| project-version: 0.0.0-SNAPSHOT | |
| artifact-name: sbom-container-images-ssh | |
| build-agi-container-images: | |
| name: Build AGI Container Images | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| contents: read | |
| actions: read | |
| packages: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Build AGI container images | |
| run: | | |
| npx nx affected --target=agi-container-image --configuration=test --parallel=3 | |
| - name: Scan AGI container images with Trivy | |
| uses: ./.github/actions/trivy-scan-local-images | |
| with: | |
| sarif-category: trivy-images-agi | |
| - name: Generate container image SBOMs | |
| uses: ./.github/actions/generate-container-image-sboms | |
| with: | |
| project-version: 0.0.0-SNAPSHOT | |
| artifact-name: sbom-container-images-agi | |
| build-server-container-images: | |
| name: Build Server Container Images | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| contents: read | |
| actions: read | |
| packages: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Build Server container images | |
| run: | | |
| npx nx affected --target=server-container-image --configuration=test --parallel=3 | |
| - name: Scan Server container images with Trivy | |
| uses: ./.github/actions/trivy-scan-local-images | |
| with: | |
| sarif-category: trivy-images-server | |
| - name: Generate container image SBOMs | |
| uses: ./.github/actions/generate-container-image-sboms | |
| with: | |
| project-version: 0.0.0-SNAPSHOT | |
| artifact-name: sbom-container-images-server | |
| collect-sbom-artifacts: | |
| name: Collect SBOM artifacts | |
| runs-on: ubuntu-latest | |
| needs: | |
| - detect-affected | |
| - build | |
| - build-api-container-images | |
| - build-worker-container-images | |
| - build-vnc-container-images | |
| - build-ssh-container-images | |
| - build-agi-container-images | |
| - build-server-container-images | |
| if: always() && needs.detect-affected.outputs.has_affected == 'true' | |
| steps: | |
| - name: Download service SBOMs from build | |
| uses: actions/download-artifact@v8 | |
| continue-on-error: true | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Download container image SBOM artifacts | |
| uses: actions/download-artifact@v8 | |
| continue-on-error: true | |
| with: | |
| pattern: sbom-container-images-* | |
| merge-multiple: true | |
| path: container-sbom-download | |
| - name: Merge SBOM artifacts | |
| run: | | |
| mkdir -p dist/sboms | |
| if [ -d container-sbom-download ]; then | |
| find container-sbom-download -type f -name 'container-*.cdx.json' -exec cp -n {} dist/sboms/ \; | |
| fi | |
| ls -la dist/sboms/ 2>/dev/null || true | |
| - name: Upload SBOM artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: sbom-artifacts | |
| path: dist/sboms/ | |
| retention-days: 7 | |
| compression-level: 6 | |
| if-no-files-found: ignore | |
| - name: Fail if required upstream jobs failed | |
| if: always() | |
| env: | |
| BUILD: ${{ needs.build.result }} | |
| API: ${{ needs.build-api-container-images.result }} | |
| WORKER: ${{ needs.build-worker-container-images.result }} | |
| VNC: ${{ needs.build-vnc-container-images.result }} | |
| SSH: ${{ needs.build-ssh-container-images.result }} | |
| AGI: ${{ needs.build-agi-container-images.result }} | |
| SERVER: ${{ needs.build-server-container-images.result }} | |
| run: | | |
| for result in "$BUILD" "$API" "$WORKER" "$VNC" "$SSH" "$AGI" "$SERVER"; do | |
| if [ "$result" = "failure" ]; then | |
| echo "::error::An upstream SBOM build job failed" | |
| exit 1 | |
| fi | |
| done | |
| build-scripts-binary: | |
| name: Build Scripts Binaries | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Build binaries | |
| run: npx nx affected --target=scripts-binary --parallel=3 | |
| build-openapi-clients-js: | |
| name: Build OpenAPI JavaScript/TypeScript Clients | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Install OpenAPI Generator CLI | |
| run: | | |
| npm install --ignore-scripts=false @openapitools/openapi-generator-cli | |
| npx @openapitools/openapi-generator-cli version | |
| - name: Build JavaScript/TypeScript clients | |
| run: | | |
| npx nx affected --target=openapi-client-js --configuration=test --parallel=3 | |
| build-native-applications-linux: | |
| name: Build Linux Applications | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Build binaries | |
| env: | |
| ELECTRON_FORGE_PLATFORM: linux | |
| run: | | |
| xvfb-run -a npx nx affected --target=package --configuration=development-linux --parallel=3 | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: binary-artifacts-linux | |
| path: | | |
| dist/**/out/make/**/*.zip | |
| dist/**/out/make/**/*.deb | |
| dist/**/out/make/**/*.rpm | |
| retention-days: 1 | |
| compression-level: 6 | |
| build-native-applications-windows: | |
| name: Build Windows Applications | |
| runs-on: ubuntu-latest | |
| needs: build | |
| outputs: | |
| has_windows_bundle: ${{ steps.detect-windows-bundle.outputs.exists }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-artifacts | |
| path: . | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Setup Windows build environment | |
| uses: ./.github/actions/setup-windows-build-env | |
| - name: Build binaries | |
| env: | |
| ELECTRON_FORGE_PLATFORM: win32 | |
| run: | | |
| xvfb-run -a npx nx affected --target=package --configuration=development-windows --parallel=3 | |
| - name: Upload Windows Electron bundle | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: windows-electron-bundle | |
| path: dist/apps/agenstra/native-agent-console/out/native-agent-console-win32-x64 | |
| if-no-files-found: ignore | |
| retention-days: 1 | |
| - name: Upload Windows zip artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: binary-artifacts-windows | |
| path: dist/**/out/make/**/win32/**/*.zip | |
| if-no-files-found: ignore | |
| retention-days: 1 | |
| compression-level: 6 | |
| - name: Detect Windows Electron bundle | |
| id: detect-windows-bundle | |
| if: ${{ !cancelled() }} | |
| run: | | |
| bundle_path="dist/apps/agenstra/native-agent-console/out/native-agent-console-win32-x64" | |
| if [ -d "$bundle_path" ]; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| build-native-applications-windows-installer: | |
| name: Build Windows Installer | |
| runs-on: windows-latest | |
| needs: build-native-applications-windows | |
| if: >- | |
| needs.build-native-applications-windows.result == 'success' && | |
| needs.build-native-applications-windows.outputs.has_windows_bundle == 'true' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Download Windows Electron bundle | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: windows-electron-bundle | |
| path: windows-electron-bundle | |
| - name: Build NSIS installer from prepackaged bundle | |
| shell: pwsh | |
| run: ./tools/ci/build-windows-installer.ps1 | |
| - name: Upload Windows installer artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: binary-artifacts-windows-installer | |
| path: apps/agenstra/native-agent-console/installer-out/*.exe | |
| if-no-files-found: ignore | |
| retention-days: 1 | |
| compression-level: 6 | |
| publish-native-applications: | |
| name: Publish Native Applications | |
| runs-on: ubuntu-latest | |
| needs: | |
| - detect-affected | |
| - build-native-applications-linux | |
| - build-native-applications-windows | |
| - build-native-applications-windows-installer | |
| if: needs.detect-affected.outputs.has_affected == 'true' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set nx shas | |
| uses: nrwl/nx-set-shas@v5 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup-env | |
| - name: Download binaries | |
| uses: actions/download-artifact@v8 | |
| continue-on-error: true | |
| with: | |
| path: artifacts | |
| pattern: binary-artifacts-* | |
| merge-multiple: true | |
| - name: Consolidate binaries | |
| run: | | |
| mkdir -p release | |
| mkdir -p artifacts | |
| find artifacts -type f -name '*.zip' -exec cp {} release/ \; | |
| find artifacts -type f -name '*.deb' -exec cp {} release/ \; | |
| find artifacts -type f -name '*.rpm' -exec cp {} release/ \; | |
| find artifacts -type f -name '*.exe' -exec cp {} release/ \; | |
| find artifacts -type f -name '*.msi' -exec cp {} release/ \; | |
| find artifacts -type f -name '*.msix' -exec cp {} release/ \; | |
| - name: Generate desktop integrity manifests (SHA256SUMS + integrity-manifest.json) | |
| run: | | |
| shopt -s nullglob | |
| files=(release/*) | |
| if [ ${#files[@]} -eq 0 ]; then | |
| echo "No desktop binaries in release/; skipping integrity manifests." | |
| exit 0 | |
| fi | |
| npx nx run release-integrity:build | |
| node tools/release-integrity/dist/src/cli.js --input release | |
| node tools/release-integrity/dist/src/cli.js verify --input release | |
| - name: Upload binaries to GitHub Actions artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: binary-bundle | |
| path: | | |
| release/*.zip | |
| release/*.deb | |
| release/*.rpm | |
| release/*.exe | |
| release/*.msi | |
| release/*.msix | |
| release/SHA256SUMS | |
| release/integrity-manifest.json | |
| retention-days: 1 | |
| compression-level: 6 |