ci: configure snapcraft multi-arch build pipeline - #2
Merged
Conversation
Reviewer's GuideAdds Snapcraft packaging configuration and a GitHub Actions workflow to build and publish qleaner as a multi-architecture (amd64/arm64) Snap to the Snap Store on tagged releases. Sequence diagram for the GitHub Actions Snap build and publish workflowsequenceDiagram
actor Developer
participant GitHub as GitHub_Repository
participant Workflow as GitHub_Actions_Workflow
participant Runner as Ubuntu_22_04_Runner
participant SnapBuild as Snapcore_Action_Build
participant SnapStore as Snap_Store
Developer->>GitHub: Push tag v1.0.0
GitHub-->>Workflow: Trigger workflow snap.yml
Workflow->>Runner: Start job build with matrix amd64, arm64
loop For each architecture
Runner->>Runner: Checkout code actions/checkout
alt architecture is arm64
Runner->>Runner: Setup QEMU docker/setup-qemu-action
end
Runner->>SnapBuild: Run snapcore/action-build\nwith target-arch
SnapBuild-->>Runner: Return built snap path
Runner->>SnapStore: Publish snapcore/action-publish\nusing SNAPCRAFT_STORE_CREDENTIALS
SnapStore-->>Runner: Confirm release to edge
end
Runner-->>Workflow: Job completed for all architectures
Flow diagram for Snapcraft multi-arch build logicflowchart TD
A[Start workflow\ntriggered by tag v* or manual dispatch] --> B[Initialize job build\nwith matrix amd64, arm64]
B --> C{architecture}
C -->|amd64| D1[Run on ubuntu-22.04\nno QEMU setup]
C -->|arm64| D2[Run on ubuntu-22.04\nsetup QEMU via docker/setup-qemu-action]
D1 --> E[Checkout repository\nactions/checkout@v4]
D2 --> E
E --> F[Build Snap\nsnapcore/action-build@v1\n--target-arch=architecture]
F --> G[Obtain built .snap artifact\nfrom snapBuild.outputs.snap]
G --> H[Publish to Snap Store\nsnapcore/action-publish@v1\nrelease=edge]
H --> I[End job for architecture]
I --> J{More architectures?}
J -->|yes| C
J -->|no| K[Workflow complete]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- The snap
version: '1.0.0'insnap/snapcraft.yamlis hard-coded; consider deriving it from the Git tag used to trigger the workflow so the Snap version always matches the released tag. - The workflow always publishes to the
edgechannel regardless of the tag; consider mapping tag patterns (e.g. vX.Y.Z vs pre-releases) to appropriate Snap Store channels to better reflect release stability.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The snap `version: '1.0.0'` in `snap/snapcraft.yaml` is hard-coded; consider deriving it from the Git tag used to trigger the workflow so the Snap version always matches the released tag.
- The workflow always publishes to the `edge` channel regardless of the tag; consider mapping tag patterns (e.g. vX.Y.Z vs pre-releases) to appropriate Snap Store channels to better reflect release stability.
## Individual Comments
### Comment 1
<location path="snap/snapcraft.yaml" line_range="29-36" />
<code_context>
+ source: .
+ npm-node-version: "20.10.0"
+
+ qleaner-gui:
+ after: [node-deps]
+ plugin: rust
+ source: src-tauri
+ override-build: |
+ npm run tauri build
+ mkdir -p $CRAFT_PART_INSTALL/usr/bin
+ cp target/release/qleaner $CRAFT_PART_INSTALL/usr/bin/qleaner
+ build-packages:
+ - libwebkit2gtk-4.1-dev
</code_context>
<issue_to_address>
**suggestion:** Consider whether overriding the Rust plugin build without `craftctl default` is desirable.
Without `craftctl default`, this part won’t use any of the Rust plugin’s standard build/install steps and instead depends entirely on `npm run tauri build` for compilation and artifact placement. If that’s what you want, you may not need the Rust plugin here at all (a `nil` plugin plus explicit commands could be clearer). If you do want the plugin’s defaults (e.g. environment, flags), call `craftctl default` before or after your custom commands.
</issue_to_address>
### Comment 2
<location path=".github/workflows/snap.yml" line_range="16-25" />
<code_context>
+
+ runs-on: ubuntu-22.04
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Set up QEMU
+ if: matrix.architecture == 'arm64'
+ uses: docker/setup-qemu-action@v3
+
+ - name: Build Snap
+ uses: snapcore/action-build@v1
+ id: snapBuild
+ with:
+ build-info: true
+ snapcraft-args: --target-arch=${{ matrix.architecture }}
+
+ - name: Publish to Snap Store
+ uses: snapcore/action-publish@v1
+ env:
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Pin GitHub Actions to specific commit SHAs instead of floating major versions.
These steps are using floating tags (e.g., `@v4`, `@v3`, `@v1`). For stronger supply-chain security and reproducibility, pin each action to a specific commit SHA and, if helpful, add a comment with the corresponding tag to avoid unexpected changes when tags are updated.
Suggested implementation:
```
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.6
```
```
- name: Set up QEMU
if: matrix.architecture == 'arm64'
uses: docker/setup-qemu-action@49a1486a0f41c5204c7116b7e6e9e0a34c5fefaa # v3
```
```
- name: Build Snap
uses: snapcore/action-build@62a453c7fa40a33ecb8b05864f86ce141b0a52f0 # v1
```
```
- name: Publish to Snap Store
uses: snapcore/action-publish@1653a9c7c3d6c02ab73e611b795882ec58c2c299 # v1
```
For maximum correctness and security, you should:
1. Confirm each pinned SHA matches the exact released tag you intend to use (e.g., checkout v4.x, setup-qemu-action v3.x, snapcore actions v1.x) by checking the GitHub Marketplace or the action repositories.
2. Update the SHAs in this workflow if you choose different minor/patch versions than assumed here (the pattern of pinning + comment remains the same).
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+29
to
+36
| qleaner-gui: | ||
| after: [node-deps] | ||
| plugin: rust | ||
| source: src-tauri | ||
| override-build: | | ||
| npm run tauri build | ||
| mkdir -p $CRAFT_PART_INSTALL/usr/bin | ||
| cp target/release/qleaner $CRAFT_PART_INSTALL/usr/bin/qleaner |
There was a problem hiding this comment.
suggestion: Consider whether overriding the Rust plugin build without craftctl default is desirable.
Without craftctl default, this part won’t use any of the Rust plugin’s standard build/install steps and instead depends entirely on npm run tauri build for compilation and artifact placement. If that’s what you want, you may not need the Rust plugin here at all (a nil plugin plus explicit commands could be clearer). If you do want the plugin’s defaults (e.g. environment, flags), call craftctl default before or after your custom commands.
Comment on lines
+16
to
+25
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up QEMU | ||
| if: matrix.architecture == 'arm64' | ||
| uses: docker/setup-qemu-action@v3 | ||
|
|
||
| - name: Build Snap | ||
| uses: snapcore/action-build@v1 | ||
| id: snapBuild | ||
| with: |
There was a problem hiding this comment.
🚨 suggestion (security): Pin GitHub Actions to specific commit SHAs instead of floating major versions.
These steps are using floating tags (e.g., @v4, @v3, @v1). For stronger supply-chain security and reproducibility, pin each action to a specific commit SHA and, if helpful, add a comment with the corresponding tag to avoid unexpected changes when tags are updated.
Suggested implementation:
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.6
- name: Set up QEMU
if: matrix.architecture == 'arm64'
uses: docker/setup-qemu-action@49a1486a0f41c5204c7116b7e6e9e0a34c5fefaa # v3
- name: Build Snap
uses: snapcore/action-build@62a453c7fa40a33ecb8b05864f86ce141b0a52f0 # v1
- name: Publish to Snap Store
uses: snapcore/action-publish@1653a9c7c3d6c02ab73e611b795882ec58c2c299 # v1
For maximum correctness and security, you should:
- Confirm each pinned SHA matches the exact released tag you intend to use (e.g., checkout v4.x, setup-qemu-action v3.x, snapcore actions v1.x) by checking the GitHub Marketplace or the action repositories.
- Update the SHAs in this workflow if you choose different minor/patch versions than assumed here (the pattern of pinning + comment remains the same).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snapcraft mapping.
Summary by Sourcery
Add Snapcraft configuration and CI workflow to build and publish multi-architecture Snap packages for the application.
Build:
CI: