|
| 1 | +name: Release |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + tags: ["v*.*.*"] |
| 6 | + workflow_dispatch: |
| 7 | + |
| 8 | +permissions: |
| 9 | + contents: read |
| 10 | + |
| 11 | +jobs: |
| 12 | + verify: |
| 13 | + name: Verify release source |
| 14 | + runs-on: ubuntu-latest |
| 15 | + timeout-minutes: 25 |
| 16 | + steps: |
| 17 | + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| 18 | + with: |
| 19 | + fetch-depth: 0 |
| 20 | + persist-credentials: false |
| 21 | + - name: Require tag and product versions to match |
| 22 | + run: | |
| 23 | + if [ "${GITHUB_EVENT_NAME}" = push ]; then |
| 24 | + python3 packaging/version_check.py --tag "${GITHUB_REF_NAME}" |
| 25 | + else |
| 26 | + python3 packaging/version_check.py |
| 27 | + fi |
| 28 | + - name: Install test environment |
| 29 | + run: | |
| 30 | + sudo apt-get update |
| 31 | + sudo apt-get install -y python3-gi python3-cairo gir1.2-gtk-4.0 python3-venv libportaudio2 |
| 32 | + /usr/bin/python3 -m venv --system-site-packages .venv |
| 33 | + .venv/bin/pip install -r packaging/runtime-requirements.txt -r requirements-dev.txt |
| 34 | + - name: Run release gates |
| 35 | + run: | |
| 36 | + make check |
| 37 | + make coverage |
| 38 | + - name: Download pinned secret scanner |
| 39 | + working-directory: ${{ runner.temp }} |
| 40 | + run: | |
| 41 | + curl --fail --location --proto '=https' --tlsv1.2 --output gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz |
| 42 | + echo '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb gitleaks.tar.gz' | sha256sum --check |
| 43 | + tar -xzf gitleaks.tar.gz gitleaks |
| 44 | + - name: Scan history and checkout |
| 45 | + run: | |
| 46 | + "$RUNNER_TEMP/gitleaks" git . --log-opts=--all --redact --no-banner |
| 47 | + "$RUNNER_TEMP/gitleaks" dir . --redact --no-banner |
| 48 | +
|
| 49 | + build: |
| 50 | + name: Build / Python ${{ matrix.python }} |
| 51 | + needs: verify |
| 52 | + runs-on: ubuntu-latest |
| 53 | + timeout-minutes: 20 |
| 54 | + strategy: |
| 55 | + fail-fast: false |
| 56 | + matrix: |
| 57 | + python: ["3.11", "3.12", "3.13", "3.14"] |
| 58 | + steps: |
| 59 | + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| 60 | + with: |
| 61 | + persist-credentials: false |
| 62 | + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 |
| 63 | + with: |
| 64 | + python-version: ${{ matrix.python }} |
| 65 | + cache: pip |
| 66 | + - name: Build offline app and plugin archives |
| 67 | + run: | |
| 68 | + python -m pip wheel --wheel-dir dist/wheelhouse -r packaging/runtime-requirements.txt |
| 69 | + python packaging/build-release.py |
| 70 | + - name: Verify archive checksums |
| 71 | + working-directory: dist |
| 72 | + run: sha256sum --check SHA256SUMS |
| 73 | + - name: Upload archives |
| 74 | + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
| 75 | + with: |
| 76 | + name: release-python-${{ matrix.python }} |
| 77 | + path: dist/doubao-say-*.tar.gz |
| 78 | + if-no-files-found: error |
| 79 | + retention-days: 14 |
| 80 | + |
| 81 | + smoke-install: |
| 82 | + name: Install built Python 3.12 archive |
| 83 | + needs: build |
| 84 | + runs-on: ubuntu-latest |
| 85 | + timeout-minutes: 15 |
| 86 | + steps: |
| 87 | + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| 88 | + with: |
| 89 | + persist-credentials: false |
| 90 | + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| 91 | + with: |
| 92 | + name: release-python-3.12 |
| 93 | + path: dist |
| 94 | + - name: Install desktop runtime dependencies |
| 95 | + run: | |
| 96 | + sudo apt-get update |
| 97 | + sudo apt-get install -y \ |
| 98 | + gir1.2-gtk-4.0 gir1.2-webkit-6.0 gobject-introspection \ |
| 99 | + libgirepository1.0-dev libgtk-4-dev libportaudio2 libwayland-dev \ |
| 100 | + meson ninja-build pipewire-bin python3-cairo python3-gi python3-venv \ |
| 101 | + wayland-protocols wl-clipboard |
| 102 | + layer_dir="$RUNNER_TEMP/gtk4-layer-shell" |
| 103 | + mkdir -p "$layer_dir" |
| 104 | + curl --fail --location --proto '=https' --tlsv1.2 \ |
| 105 | + --output "$layer_dir/source.tar.gz" \ |
| 106 | + https://github.com/wmww/gtk4-layer-shell/archive/536ff516ed68b9bb34afc4c07f942a54b2b4b03f.tar.gz |
| 107 | + echo 'f4c4fd455f5605c7b93b305b6be28990f0f7170968fb2714bf362477f918c4bc source.tar.gz' \ |
| 108 | + | (cd "$layer_dir" && sha256sum --check) |
| 109 | + tar -xzf "$layer_dir/source.tar.gz" -C "$layer_dir" |
| 110 | + meson setup "$layer_dir/build" \ |
| 111 | + "$layer_dir/gtk4-layer-shell-536ff516ed68b9bb34afc4c07f942a54b2b4b03f" \ |
| 112 | + --prefix=/usr -Ddocs=false -Dexamples=false -Dtests=false -Dvapi=false |
| 113 | + sudo meson install -C "$layer_dir/build" |
| 114 | + - name: Install, upgrade and uninstall in isolated user directories |
| 115 | + working-directory: dist |
| 116 | + run: | |
| 117 | + app_archive=(doubao-say-*-app-linux-*.tar.gz) |
| 118 | + test "${#app_archive[@]}" -eq 1 |
| 119 | + /usr/bin/python3 ../tests/manual_clean_install.py "${app_archive[0]}" |
| 120 | +
|
| 121 | + publish: |
| 122 | + name: Publish GitHub release |
| 123 | + if: github.event_name == 'push' |
| 124 | + needs: [build, smoke-install] |
| 125 | + runs-on: ubuntu-latest |
| 126 | + timeout-minutes: 10 |
| 127 | + permissions: |
| 128 | + contents: write |
| 129 | + steps: |
| 130 | + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| 131 | + with: |
| 132 | + persist-credentials: false |
| 133 | + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| 134 | + with: |
| 135 | + pattern: release-python-* |
| 136 | + path: release-assets |
| 137 | + merge-multiple: true |
| 138 | + - name: Create checksums |
| 139 | + working-directory: release-assets |
| 140 | + run: sha256sum doubao-say-*.tar.gz > SHA256SUMS |
| 141 | + - name: Publish immutable tag assets |
| 142 | + env: |
| 143 | + GH_TOKEN: ${{ github.token }} |
| 144 | + run: | |
| 145 | + gh release create "${GITHUB_REF_NAME}" release-assets/* \ |
| 146 | + --verify-tag --title "Doubao Say ${GITHUB_REF_NAME#v}" --generate-notes |
0 commit comments