Nightly Build #146
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nightly Build | |
| on: | |
| schedule: | |
| # Weekdays at 02:00 UTC | |
| - cron: "0 2 * * 1-5" | |
| workflow_dispatch: | |
| inputs: | |
| build_only: | |
| description: "Build and package every artifact without publishing it." | |
| required: false | |
| default: false | |
| type: boolean | |
| artifact_retention_days: | |
| description: "Retention for build artifacts." | |
| required: false | |
| default: 7 | |
| type: number | |
| permissions: | |
| contents: read | |
| concurrency: | |
| # The release, tag, and GHCR image tags are repository-wide resources. Keep | |
| # manual runs from other refs serialized with the scheduled main run. | |
| group: nightly-${{ github.repository }} | |
| cancel-in-progress: true | |
| env: | |
| NIGHTLY_TAG: nightly | |
| jobs: | |
| # ── Check if there are new commits since last nightly ────────────── | |
| check-changes: | |
| name: Check for Changes | |
| runs-on: ubuntu-latest | |
| outputs: | |
| should_build: ${{ steps.check.outputs.should_build }} | |
| nightly_version: ${{ steps.check.outputs.nightly_version }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check for recent changes | |
| id: check | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| BASE_VERSION="$(jq -r '.version' package.json)" | |
| DATE_SUFFIX="$(date -u '+%Y%m%d')" | |
| SHORT_SHA="$(git rev-parse --short HEAD)" | |
| NIGHTLY_VERSION="${BASE_VERSION}-nightly.${DATE_SUFFIX}+${SHORT_SHA}" | |
| echo "nightly_version=$NIGHTLY_VERSION" >> "$GITHUB_OUTPUT" | |
| if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then | |
| echo "should_build=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| # Check if any commits landed in the last 25 hours | |
| LAST_COMMIT_TIME="$(git log -1 --format='%ct')" | |
| NOW="$(date -u '+%s')" | |
| HOURS_AGO=$(( (NOW - LAST_COMMIT_TIME) / 3600 )) | |
| if [[ "$HOURS_AGO" -lt 25 ]]; then | |
| echo "should_build=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "No new commits in the last 25 hours, skipping nightly build." | |
| echo "should_build=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # ── Build every Nightly artifact through the reusable CI contract ── | |
| build-artifacts: | |
| name: Build Nightly Artifacts | |
| needs: check-changes | |
| if: needs.check-changes.outputs.should_build == 'true' | |
| uses: ./.github/workflows/nightly-artifacts.yml | |
| permissions: | |
| contents: read | |
| secrets: | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| with: | |
| checkout_ref: ${{ github.sha }} | |
| version: ${{ needs.check-changes.outputs.nightly_version }} | |
| artifact_prefix: nightly | |
| artifact_retention_days: ${{ fromJSON(inputs.artifact_retention_days || '7') }} | |
| build_desktop_packages: true | |
| desktop_platforms: '["linux-x64","linux-arm64","macos-arm64","macos-x64","windows-x64"]' | |
| build_linux_binaries: true | |
| build_relay_image: true | |
| upload_artifacts: true | |
| # Fork validation is intentionally cache-read-only. Only the upstream | |
| # repository may seed long-lived Nightly caches. | |
| cache_write: ${{ github.repository_owner == 'GCWing' }} | |
| # ── Publish nightly pre-release ──────────────────────────────────── | |
| publish-nightly: | |
| name: Publish Nightly | |
| needs: [check-changes, build-artifacts] | |
| if: >- | |
| needs.check-changes.outputs.should_build == 'true' && | |
| inputs.build_only != true | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Download bundled artifacts | |
| uses: actions/download-artifact@v7 | |
| with: | |
| pattern: bitfun-nightly-*-bundle | |
| path: release-assets | |
| merge-multiple: true | |
| - name: Download Linux binary artifacts | |
| uses: actions/download-artifact@v7 | |
| with: | |
| pattern: bitfun-linux-nightly-* | |
| path: linux-release-assets | |
| merge-multiple: true | |
| - name: Verify Relay image inputs | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| test -f linux-release-assets/bitfun-relay-server-x86_64-unknown-linux-gnu.tar.gz | |
| test -f linux-release-assets/bitfun-relay-server-aarch64-unknown-linux-gnu.tar.gz | |
| for archive in linux-release-assets/bitfun-relay-server-*.tar.gz; do | |
| (cd linux-release-assets && sha256sum --check "$(basename "${archive}").sha256") | |
| done | |
| cp src/apps/relay-server/Dockerfile.release linux-release-assets/Dockerfile.release | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| - name: Resolve nightly image metadata | |
| id: nightly-image-meta | |
| shell: bash | |
| env: | |
| NIGHTLY_VERSION: ${{ needs.check-changes.outputs.nightly_version }} | |
| run: | | |
| echo "asset_version=${NIGHTLY_VERSION%%+*}" >>"$GITHUB_OUTPUT" | |
| echo "image=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/bitfun-relay-server" >>"$GITHUB_OUTPUT" | |
| - name: Build and push multi-platform Relay image | |
| id: relay-image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: linux-release-assets | |
| file: linux-release-assets/Dockerfile.release | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| provenance: false | |
| sbom: false | |
| build-args: | | |
| VERSION=${{ needs.check-changes.outputs.nightly_version }} | |
| REVISION=${{ github.sha }} | |
| tags: | | |
| ${{ steps.nightly-image-meta.outputs.image }}:${{ env.NIGHTLY_TAG }} | |
| ${{ steps.nightly-image-meta.outputs.image }}:${{ steps.nightly-image-meta.outputs.asset_version }} | |
| - name: Smoke-test published Relay image on both platforms | |
| shell: bash | |
| env: | |
| IMAGE_DIGEST: ${{ steps.relay-image.outputs.digest }} | |
| run: | | |
| bash scripts/relay/smoke-image.sh \ | |
| "${{ steps.nightly-image-meta.outputs.image }}@${IMAGE_DIGEST}" | |
| - name: Generate signed Relay image descriptor | |
| shell: bash | |
| env: | |
| IMAGE_DIGEST: ${{ steps.relay-image.outputs.digest }} | |
| NIGHTLY_VERSION: ${{ needs.check-changes.outputs.nightly_version }} | |
| BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| run: | | |
| set -euo pipefail | |
| asset_version="${NIGHTLY_VERSION%%+*}" | |
| [[ "${IMAGE_DIGEST}" =~ ^sha256:[0-9a-f]{64}$ ]] | |
| docker buildx imagetools inspect \ | |
| "${{ steps.nightly-image-meta.outputs.image }}@${IMAGE_DIGEST}" \ | |
| --raw >relay-image-manifest.json | |
| jq -e ' | |
| [.manifests[].platform | .os + "/" + .architecture] as $platforms | |
| | ($platforms | index("linux/amd64")) != null | |
| and ($platforms | index("linux/arm64")) != null | |
| ' relay-image-manifest.json >/dev/null | |
| jq -n \ | |
| --arg image "${{ steps.nightly-image-meta.outputs.image }}" \ | |
| --arg tag "${NIGHTLY_TAG}" \ | |
| --arg version "${asset_version}" \ | |
| --arg digest "${IMAGE_DIGEST}" \ | |
| '{ | |
| schema_version: 1, | |
| image: $image, | |
| tag: $tag, | |
| version: $version, | |
| digest: $digest, | |
| platforms: ["linux/amd64", "linux/arm64"] | |
| }' >relay-image.json | |
| bash scripts/sign-release-assets.sh relay-image.json | |
| test -s relay-image.json.sig | |
| - name: Verify anonymous Relay image access | |
| shell: bash | |
| env: | |
| IMAGE_DIGEST: ${{ steps.relay-image.outputs.digest }} | |
| run: | | |
| set -euo pipefail | |
| docker logout ghcr.io >/dev/null 2>&1 || true | |
| clean_config="$(mktemp -d)" | |
| trap 'rm -rf "$clean_config"' EXIT | |
| DOCKER_CONFIG="$clean_config" docker buildx imagetools inspect \ | |
| "${{ steps.nightly-image-meta.outputs.image }}@${IMAGE_DIGEST}" >/dev/null | |
| - name: List release assets | |
| run: | | |
| echo "Nightly assets:" | |
| find release-assets -type f | sort | |
| echo "Nightly Linux CLI and Relay Server assets:" | |
| find linux-release-assets -type f | sort | |
| - name: Delete previous nightly release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh release delete "${{ env.NIGHTLY_TAG }}" --yes --cleanup-tag 2>/dev/null || true | |
| - name: Generate Linux binaries manifest | |
| env: | |
| NIGHTLY_VERSION: ${{ needs.check-changes.outputs.nightly_version }} | |
| run: | | |
| set -euo pipefail | |
| # Asset names drop the `+<sha>` build metadata (see linux-binaries.yml). | |
| node scripts/generate-linux-binaries-manifest.mjs \ | |
| --assets-dir linux-release-assets \ | |
| --version "${NIGHTLY_VERSION%%+*}" \ | |
| --tag "${{ env.NIGHTLY_TAG }}" \ | |
| --repo "${{ github.repository }}" \ | |
| --out linux-release-assets/linux-binaries.json | |
| - name: Prepare versioned Windows installer | |
| env: | |
| NIGHTLY_VERSION: ${{ needs.check-changes.outputs.nightly_version }} | |
| run: | | |
| node scripts/prepare-windows-installer-asset.mjs \ | |
| --assets-dir release-assets \ | |
| --version "${NIGHTLY_VERSION%%+*}" \ | |
| --out-dir release-manual-assets | |
| # The Tauri bundler signs the five updater artifacts during `tauri build`, | |
| # but the installers people download by hand from the release page — dmg, | |
| # deb, rpm, the Windows installer and the direct AppImages — shipped with | |
| # no signature at all. Sign them with the same key so every published | |
| # artifact is verifiable. (This is not OS-level code signing: Gatekeeper | |
| # and SmartScreen still need Apple/Authenticode certificates.) | |
| - name: Sign installer packages | |
| shell: bash | |
| env: | |
| BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }} | |
| run: | | |
| set -euo pipefail | |
| mapfile -t assets < <({ | |
| find release-assets -type f \ | |
| \( -name '*.AppImage' -o -name '*.deb' -o -name '*.rpm' \ | |
| -o -name '*.dmg' \) | |
| find release-manual-assets -type f -name '*.exe' | |
| } | sort) | |
| if [[ "${#assets[@]}" -eq 0 ]]; then | |
| echo "No installer packages found to sign." | |
| exit 0 | |
| fi | |
| bash scripts/sign-release-assets.sh "${assets[@]}" | |
| # Publish the public key alongside the signatures: a signature nobody | |
| # can fetch a key for is not verifiable. | |
| node scripts/write-minisign-public-key.mjs \ | |
| --out release-assets/minisign.pub | |
| - name: Create nightly release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ env.NIGHTLY_TAG }} | |
| name: "Nightly Build (${{ needs.check-changes.outputs.nightly_version }})" | |
| body: | | |
| Automated nightly build from `main` branch. | |
| **Version**: `${{ needs.check-changes.outputs.nightly_version }}` | |
| **Commit**: ${{ github.sha }} | |
| **Date**: ${{ github.event.head_commit.timestamp || github.event.repository.updated_at }} | |
| > **Warning**: Nightly builds are untested and may be unstable. | |
| prerelease: true | |
| files: | | |
| release-assets/**/*.AppImage | |
| release-assets/**/*.deb | |
| release-assets/**/*.dmg | |
| release-assets/**/*.rpm | |
| release-assets/**/*.sig | |
| release-manual-assets/*.exe | |
| release-manual-assets/*.exe.sig | |
| release-assets/minisign.pub | |
| release-assets/**/bitfun-cli-*-apple-darwin.tar.gz | |
| release-assets/**/bitfun-cli-*-apple-darwin.tar.gz.sha256 | |
| linux-release-assets/bitfun-cli-*.tar.gz | |
| linux-release-assets/bitfun-cli-*.tar.gz.sha256 | |
| linux-release-assets/bitfun-relay-server-*.tar.gz | |
| linux-release-assets/bitfun-relay-server-*.tar.gz.sha256 | |
| linux-release-assets/*.tar.gz.sig | |
| linux-release-assets/*.tar.gz.sha256.sig | |
| linux-release-assets/linux-binaries.json | |
| relay-image.json | |
| relay-image.json.sig | |
| - name: Verify published Linux CLI signatures | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| while IFS= read -r cli_url; do | |
| curl -fsSL --retry 5 --retry-delay 3 "${cli_url}.sig" -o /dev/null | |
| curl -fsSL --retry 5 --retry-delay 3 "${cli_url}.sha256.sig" -o /dev/null | |
| done < <(jq -r '.platforms[].cli.url' linux-release-assets/linux-binaries.json) | |
| - name: Verify published Relay image descriptor | |
| shell: bash | |
| env: | |
| NIGHTLY_VERSION: ${{ needs.check-changes.outputs.nightly_version }} | |
| run: | | |
| set -euo pipefail | |
| curl -fsSL --retry 5 --retry-delay 3 \ | |
| "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/${NIGHTLY_TAG}/relay-image.json" \ | |
| -o relay-image.published.json | |
| test "$(jq -r '.tag' relay-image.published.json)" = "${NIGHTLY_TAG}" | |
| test "$(jq -r '.version' relay-image.published.json)" = "${NIGHTLY_VERSION%%+*}" | |
| test "$(jq -r '.image' relay-image.published.json)" = "${{ steps.nightly-image-meta.outputs.image }}" | |
| jq -e '.digest | test("^sha256:[0-9a-f]{64}$")' relay-image.published.json >/dev/null | |
| curl -fsSL --retry 5 --retry-delay 3 \ | |
| "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/${NIGHTLY_TAG}/relay-image.json.sig" \ | |
| -o /dev/null | |
| - name: Verify published macOS CLI assets | |
| shell: bash | |
| env: | |
| NIGHTLY_VERSION: ${{ needs.check-changes.outputs.nightly_version }} | |
| run: | | |
| set -euo pipefail | |
| ASSET_VERSION="${NIGHTLY_VERSION%%+*}" | |
| RELEASE_ROOT="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/${{ env.NIGHTLY_TAG }}" | |
| for target in aarch64-apple-darwin x86_64-apple-darwin; do | |
| archive="${RELEASE_ROOT}/bitfun-cli-${ASSET_VERSION}-${target}.tar.gz" | |
| curl -fsSL --retry 5 --retry-delay 3 "$archive" -o /dev/null | |
| curl -fsSL --retry 5 --retry-delay 3 "${archive}.sha256" -o /dev/null | |
| curl -fsSL --retry 5 --retry-delay 3 "${archive}.sig" -o /dev/null | |
| curl -fsSL --retry 5 --retry-delay 3 "${archive}.sha256.sig" -o /dev/null | |
| done |