Electron Rewrite

.github/workflows/aur-publish.yml

@@ -4,39 +4,75 @@ on:
   release:
     types: [published]
 
+concurrency:
+  group: aur-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
 jobs:
-  aur-publish-bin:
+  aur-publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.release.tag_name }}
 
-      - name: Get version from tag
-        id: version
-        run: echo "pkgver=${GITHUB_EVENT_RELEASE_TAG_NAME#v}" >> "$GITHUB_OUTPUT"
+      - name: Resolve release version
+        id: release
         env:
-          GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Release tag must have the form vX.Y.Z: $RELEASE_TAG" >&2
+            exit 1
+          fi
 
-      - name: Get tarball checksum
-        id: checksum
+          echo "version=${RELEASE_TAG#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Calculate package checksums
+        id: checksums
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          VERSION: ${{ steps.release.outputs.version }}
         run: |
-          curl -sL "https://github.com/${{ github.repository }}/releases/download/${{ github.event.release.tag_name }}/kosmos-linux-x86_64.tar.gz" -o kosmos.tar.gz
-          echo "sha256=$(sha256sum kosmos.tar.gz | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+          curl --fail --location --silent --show-error \
+            "https://github.com/${{ github.repository }}/releases/download/${RELEASE_TAG}/Kosmos-${VERSION}-x86_64.AppImage" \
+            --output Kosmos.AppImage
+          curl --fail --location --silent --show-error \
+            "https://raw.githubusercontent.com/${{ github.repository }}/${RELEASE_TAG}/desktop/assets/icon/icon-512.png" \
+            --output kosmos-512.png
+          curl --fail --location --silent --show-error \
+            "https://raw.githubusercontent.com/${{ github.repository }}/${RELEASE_TAG}/LICENSE" \
+            --output LICENSE
+
+          {
+            echo "appimage=$(sha256sum Kosmos.AppImage | cut -d ' ' -f 1)"
+            echo "icon=$(sha256sum kosmos-512.png | cut -d ' ' -f 1)"
+            echo "license=$(sha256sum LICENSE | cut -d ' ' -f 1)"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Update PKGBUILD
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+          APPIMAGE_SHA256: ${{ steps.checksums.outputs.appimage }}
+          ICON_SHA256: ${{ steps.checksums.outputs.icon }}
+          LICENSE_SHA256: ${{ steps.checksums.outputs.license }}
         run: |
-          cd aur/kosmos-bin
-          sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.pkgver }}/" PKGBUILD
-          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
-          sed -i "s/^sha256sums=.*/sha256sums=('${{ steps.checksum.outputs.sha256 }}')/" PKGBUILD
+          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" aur/kosmos-bin/PKGBUILD
+          sed -i "s/^pkgrel=.*/pkgrel=1/" aur/kosmos-bin/PKGBUILD
+          sed -i \
+            "s/^sha256sums=.*/sha256sums=('${APPIMAGE_SHA256}' '${ICON_SHA256}' '${LICENSE_SHA256}')/" \
+            aur/kosmos-bin/PKGBUILD
 
       - name: Publish to AUR
         env:
           AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          VERSION: ${{ steps.release.outputs.version }}
         run: |
           mkdir -p ~/.ssh
-          echo "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
+          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
           chmod 600 ~/.ssh/aur
           ssh-keyscan -t rsa,ecdsa,ed25519 aur.archlinux.org >> ~/.ssh/known_hosts
           cat >> ~/.ssh/config <<'SSH'
@@ -48,58 +84,21 @@ jobs:
           git clone ssh://aur@aur.archlinux.org/kosmos-bin.git aur-repo
           cp aur/kosmos-bin/PKGBUILD aur-repo/PKGBUILD
 
-          cd aur-repo
-          docker run --rm -v "$PWD:/pkg" -e HOST_UID="$(id -u)" archlinux:base bash -c \
-            'pacman -Sy --noconfirm pacman-contrib && useradd -m builder && chown -R builder /pkg && runuser -u builder -- bash -c "cd /pkg && makepkg --printsrcinfo > .SRCINFO" && chown -R $HOST_UID /pkg'
+          docker run --rm \
+            -v "$PWD/aur-repo:/pkg" \
+            -e HOST_UID="$(id -u)" \
+            archlinux:base \
+            bash -c 'pacman -Sy --noconfirm pacman-contrib && useradd -m builder && chown -R builder /pkg && runuser -u builder -- bash -c "cd /pkg && makepkg --printsrcinfo > .SRCINFO" && chown -R "$HOST_UID" /pkg'
 
+          cd aur-repo
           git config user.name "Martin Etchebarne"
           git config user.email "martin@etchebarne.net"
           git add PKGBUILD .SRCINFO
-          git diff --cached --quiet && echo "No changes to commit" || git commit -m "Update to ${{ steps.version.outputs.pkgver }}"
-          git push
-
-  aur-publish-src:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.release.tag_name }}
-
-      - name: Get version from tag
-        id: version
-        run: echo "pkgver=${GITHUB_EVENT_RELEASE_TAG_NAME#v}" >> "$GITHUB_OUTPUT"
-        env:
-          GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
-
-      - name: Update PKGBUILD
-        run: |
-          cd aur/kosmos
-          sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.pkgver }}/" PKGBUILD
-          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
 
-      - name: Publish to AUR
-        env:
-          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-        run: |
-          mkdir -p ~/.ssh
-          echo "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
-          chmod 600 ~/.ssh/aur
-          ssh-keyscan -t rsa,ecdsa,ed25519 aur.archlinux.org >> ~/.ssh/known_hosts
-          cat >> ~/.ssh/config <<'SSH'
-          Host aur.archlinux.org
-            IdentityFile ~/.ssh/aur
-            User aur
-          SSH
+          if git diff --cached --quiet; then
+            echo "AUR package is already up to date"
+            exit 0
+          fi
 
-          git clone ssh://aur@aur.archlinux.org/kosmos.git aur-repo
-          cp aur/kosmos/PKGBUILD aur-repo/PKGBUILD
-
-          cd aur-repo
-          docker run --rm -v "$PWD:/pkg" -e HOST_UID="$(id -u)" archlinux:base bash -c \
-            'pacman -Sy --noconfirm pacman-contrib && useradd -m builder && chown -R builder /pkg && runuser -u builder -- bash -c "cd /pkg && makepkg --printsrcinfo > .SRCINFO" && chown -R $HOST_UID /pkg'
-
-          git config user.name "Martin Etchebarne"
-          git config user.email "martin@etchebarne.net"
-          git add PKGBUILD .SRCINFO
-          git diff --cached --quiet && echo "No changes to commit" || git commit -m "Update to ${{ steps.version.outputs.pkgver }}"
+          git commit -m "Update to ${VERSION}"
           git push

.github/workflows/checks.yml

@@ -0,0 +1,56 @@
+name: Checks
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: checks-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - uses: swatinem/rust-cache@v2
+
+      - name: Install desktop dependencies
+        run: bun install --cwd desktop --frozen-lockfile
+
+      - name: Check layer boundaries
+        run: bash scripts/check-boundaries.sh
+
+      - name: Check Rust formatting
+        run: cargo fmt --all -- --check
+
+      - name: Lint Rust workspace
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: Test Rust workspace
+        run: cargo test --workspace
+
+      - name: Check IPC contract generation
+        run: bun run --cwd desktop check:ipc
+
+      - name: Typecheck desktop
+        run: bun run --cwd desktop typecheck
+
+      - name: Test desktop
+        run: bun run --cwd desktop test
+
+      - name: Build desktop
+        run: bun run --cwd desktop build

.github/workflows/release.yml

@@ -7,92 +7,129 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Tag to build and release (e.g. v0.1.0)"
+        description: "Tag to build and release (for example, v0.1.0)"
         required: true
 
+concurrency:
+  group: release-${{ github.event.inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: write
 
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.ref }}
+          ref: ${{ github.event.inputs.tag || github.ref }}
 
-      - name: Resolve tag
-        id: tag
-        run: echo "tag=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_OUTPUT"
+      - uses: oven-sh/setup-bun@v2
 
-      - name: Install build dependencies
+      - name: Validate release version
+        id: release
+        env:
+          RELEASE_TAG: ${{ github.event.inputs.tag || github.ref_name }}
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            build-essential pkg-config gettext-base llvm clang libclang-dev curl rpm desktop-file-utils \
-            libssl-dev libfontconfig-dev libxkbcommon-dev \
-            libxcb1-dev libxkbcommon-x11-dev \
-            libwayland-dev libvulkan-dev
+          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Release tag must have the form vX.Y.Z: $RELEASE_TAG" >&2
+            exit 1
+          fi
 
-      - uses: mlugg/setup-zig@v2
-        with:
-          version: 0.16.0
+          version="${RELEASE_TAG#v}"
+          desktop_version="$(bun -e 'console.log(require("./desktop/package.json").version)')"
+          core_version="$(awk -F '"' '/^version = "/ { print $2; exit }' core/Cargo.toml)"
+          server_version="$(awk -F '"' '/^version = "/ { print $2; exit }' server/Cargo.toml)"
+
+          for package_version in "$desktop_version" "$core_version" "$server_version"; do
+            if [[ "$package_version" != "$version" ]]; then
+              echo "Tag $RELEASE_TAG does not match package version $package_version" >&2
+              exit 1
+            fi
+          done
+
+          echo "tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
 
-      - name: Install AppImage tooling
+      - name: Install system dependencies
         run: |
-          curl -fsSL \
-            https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage \
-            -o /tmp/appimagetool
-          chmod +x /tmp/appimagetool
-          sudo mv /tmp/appimagetool /usr/local/bin/appimagetool
+          sudo apt-get update
+          sudo apt-get install -y rpm
 
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
 
       - uses: swatinem/rust-cache@v2
 
-      - name: Bundle
+      - name: Install desktop dependencies
+        run: bun install --cwd desktop --frozen-lockfile
+
+      - name: Test Rust workspace
+        run: cargo test --workspace
+
+      - name: Lint Rust workspace
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: Check Rust formatting
+        run: cargo fmt --all -- --check
+
+      - name: Typecheck desktop
+        run: bun run --cwd desktop typecheck
+
+      - name: Test desktop
+        run: bun run --cwd desktop test
+
+      - name: Build Linux packages
         run: ./scripts/bundle-linux.sh
 
-      - name: Package deb and rpm
-        run: ./scripts/package-linux-deb-rpm.sh
+      - name: Verify release artifacts
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          artifacts=(
+            "desktop/release/Kosmos-${VERSION}-x86_64.AppImage"
+            "desktop/release/Kosmos-${VERSION}-amd64.deb"
+            "desktop/release/Kosmos-${VERSION}-x86_64.rpm"
+          )
+
+          for artifact in "${artifacts[@]}"; do
+            test -f "$artifact" || {
+              echo "Missing release artifact: $artifact" >&2
+              exit 1
+            }
+          done
 
-      - name: Package AppImage
-        run: ./scripts/package-linux-appimage.sh
+          (
+            cd desktop/release
+            sha256sum \
+              "Kosmos-${VERSION}-x86_64.AppImage" \
+              "Kosmos-${VERSION}-amd64.deb" \
+              "Kosmos-${VERSION}-x86_64.rpm" \
+              > SHA256SUMS
+          )
 
-      - name: Create GitHub release
+      - name: Create draft GitHub release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          VERSION: ${{ steps.release.outputs.version }}
         run: |
-          tag="${{ steps.tag.outputs.tag }}"
-          version="${tag#v}"
-          arch="$(uname -m)"
-          case "$arch" in
-            x86_64|amd64)
-              bundle_arch="x86_64"
-              deb_arch="amd64"
-              rpm_arch="x86_64"
-              appimage_arch="x86_64"
-              ;;
-            *)
-              echo "Unsupported release architecture: $arch" >&2
-              exit 1
-              ;;
-          esac
           artifacts=(
-            "target/release/kosmos-linux-${bundle_arch}.tar.gz"
-            "target/release/kosmos_${version}_${deb_arch}.deb"
-            "target/release/kosmos-${version}-1.${rpm_arch}.rpm"
-            "target/release/Kosmos-${version}-${appimage_arch}.AppImage"
-            scripts/install.sh
-            scripts/uninstall.sh
+            "desktop/release/Kosmos-${VERSION}-x86_64.AppImage"
+            "desktop/release/Kosmos-${VERSION}-amd64.deb"
+            "desktop/release/Kosmos-${VERSION}-x86_64.rpm"
+            "desktop/release/SHA256SUMS"
           )
 
-          if gh release view "$tag" >/dev/null 2>&1; then
-            gh release upload "$tag" "${artifacts[@]}" --clobber
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" "${artifacts[@]}" --clobber
           else
-            gh release create "$tag" \
-              --title "Kosmos $tag" \
+            gh release create "$RELEASE_TAG" \
+              --title "Kosmos $RELEASE_TAG" \
               --draft \
               --generate-notes \
+              --verify-tag \
               "${artifacts[@]}"
           fi