fix(release): verify downloads before local Pacman installation [publ… #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Native application | |
| on: | |
| push: | |
| branches: [main, 'codex/**'] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| native: | |
| name: Rust and Qt workflow | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install Qt build and runtime dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y cmake g++ qt6-base-dev qt6-declarative-dev qt6-wayland qml6-module-qtquick qml6-module-qtquick-controls qml6-module-qtquick-layouts qml6-module-qtquick-dialogs qml6-module-qtquick-window qml6-module-qtqml-workerscript qml6-module-qtquick-templates libgl1-mesa-dev desktop-file-utils | |
| - run: cargo fmt --check | |
| - run: cargo clippy --locked --all-targets -- -D warnings | |
| - run: cargo test --locked | |
| - name: Compile native window | |
| run: | | |
| cmake -S . -B build -DCMAKE_BUILD_TYPE=Release | |
| cmake --build build --parallel 2 | |
| ctest --test-dir build --output-on-failure | |
| - name: Render the actual QML window | |
| env: | |
| QT_QPA_PLATFORM: offscreen | |
| QT_QUICK_BACKEND: software | |
| ASDECIDED_BACKEND: ${{ github.workspace }}/target/debug/asdecided-desktop-backend | |
| run: | | |
| ./build/asdecided --smoke-test "$PWD/tests/fixture" --screenshot "$PWD/build/smoke.png" 2> build/qml.log | |
| cat build/qml.log | |
| test -s build/smoke.png | |
| if grep -E 'qrc:|failed to load component' build/qml.log; then exit 1; fi | |
| desktop-file-validate packaging/io.github.asdecided.AsDecided.desktop | |
| - name: Build and verify installable bundle | |
| run: | | |
| cargo build --release --locked | |
| ./packaging/bundle.sh | |
| bundle=$(find dist -mindepth 1 -maxdepth 1 -type d -name 'asdecided-*' -print -quit) | |
| "$bundle/install.sh" "$RUNNER_TEMP/asdecided install" | |
| "$bundle/install.sh" "$RUNNER_TEMP/asdecided install" | |
| QT_QPA_PLATFORM=offscreen QT_QUICK_BACKEND=software "$RUNNER_TEMP/asdecided install/bin/asdecided" --smoke-test "$PWD/tests/fixture" | |
| desktop-file-validate "$RUNNER_TEMP/asdecided install/share/applications/io.github.asdecided.AsDecided.desktop" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: asdecided-linux-x86_64 | |
| path: | | |
| dist/*.tar.gz | |
| dist/*.sha256 | |
| build/smoke.png | |
| build/qml.log | |
| arch: | |
| name: Arch package and Pacman lifecycle | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 40 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Build with makepkg in Arch Linux | |
| run: | | |
| docker run --rm -v "$GITHUB_WORKSPACE:/work" \ | |
| archlinux:base-devel bash /work/packaging/arch/ci-build.sh | |
| - name: Install, upgrade and remove in a clean Arch runtime | |
| run: | | |
| docker run --rm \ | |
| -v "$GITHUB_WORKSPACE/dist/arch:/packages:ro" \ | |
| -v "$GITHUB_WORKSPACE/tests/fixture:/fixture:ro" \ | |
| -v "$GITHUB_WORKSPACE/packaging/arch/ci-lifecycle.sh:/test.sh:ro" \ | |
| archlinux:base bash /test.sh | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: asdecided-arch-x86_64 | |
| if-no-files-found: error | |
| path: | | |
| dist/arch/*.pkg.tar.zst | |
| dist/arch/*.pkg.tar.zst.sha256 | |
| dist/arch/PKGBUILD | |
| dist/arch/.SRCINFO | |
| dist/arch/SOURCE_COMMIT | |
| include-hidden-files: true | |
| publish: | |
| name: Publish and verify public development package | |
| needs: [native, arch] | |
| if: >- | |
| github.repository == 'asdecided/omarchy-asdecided' && | |
| github.event_name == 'push' && | |
| (github.ref == 'refs/heads/main' || | |
| (github.ref == 'refs/heads/codex/native-companion' && | |
| contains(github.event.head_commit.message, '[publish-dev]'))) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: public-development-${{ github.sha }} | |
| cancel-in-progress: false | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: asdecided-arch-x86_64 | |
| path: release-artifact | |
| - name: Publish verified package without replacing existing assets | |
| id: release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: ./packaging/release/publish.sh release-artifact | |
| - name: Install from the public URL without GitHub credentials | |
| env: | |
| PACKAGE_URL: ${{ steps.release.outputs.package_url }} | |
| CHECKSUM_URL: ${{ steps.release.outputs.checksum_url }} | |
| EXPECTED_REVISION: ${{ github.sha }} | |
| run: | | |
| docker run --rm -e PACKAGE_URL -e CHECKSUM_URL -e EXPECTED_REVISION \ | |
| -v "$GITHUB_WORKSPACE/tests/fixture:/fixture:ro" \ | |
| -v "$GITHUB_WORKSPACE/packaging/release/verify-public.sh:/test.sh:ro" \ | |
| archlinux:base bash /test.sh |