--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
.gitea/workflows/build.yml 034a0a6edefdd9ab64a338e45711f607e35d1c71 (034a0a6e) Text, 8.84 KB
T8b949e# Appimage builds produced by action are broken for now
Tff7b72nameTb4b4b4: Ta5d6ffBuildTa5d6ff Ta5d6ffandTa5d6ff Ta5d6ffRelease
Tff7b72onTb4b4b4:
Tff7b72pushTb4b4b4:
Tff7b72tagsTb4b4b4:
Tb4b4b4- Ta5d6ff"Ta5d6ff*Ta5d6ff"
Tff7b72workflow_dispatchTb4b4b4:
Tff7b72inputsTb4b4b4:
Tff7b72versionTb4b4b4:
Tff7b72descriptionTb4b4b4: Ta5d6ff"Ta5d6ffReleaseTe6edf3 Ta5d6ffversionTe6edf3 Ta5d6ff(e.g.,Te6edf3 Ta5d6ffv1.0.0)Ta5d6ff"
Tff7b72requiredTb4b4b4: Ta5d6fffalse
Tff7b72typeTb4b4b4: Ta5d6ffstring
Tff7b72build_dockerTb4b4b4:
Tff7b72descriptionTb4b4b4: Ta5d6ff"Ta5d6ffBuildTe6edf3 Ta5d6ffDockerTa5d6ff"
Tff7b72requiredTb4b4b4: Ta5d6fffalse
Tff7b72defaultTb4b4b4: Ta5d6ff"Ta5d6fftrueTa5d6ff"
Tff7b72typeTb4b4b4: Ta5d6ffboolean
Tff7b72permissionsTb4b4b4:
Tff7b72contentsTb4b4b4: Ta5d6ffwrite
Tff7b72packagesTb4b4b4: Ta5d6ffwrite
Tff7b72envTb4b4b4:
Tff7b72COSIGN_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff3.0.5Ta5d6ff"
Tff7b72jobsTb4b4b4:
Tff7b72buildTb4b4b4:
Tff7b72nameTb4b4b4: Ta5d6ffBuildTa5d6ff Ta5d6ffandTa5d6ff Ta5d6ffRelease
Tff7b72runs-onTb4b4b4: Ta5d6ffubuntu-latest
Tff7b72stepsTb4b4b4:
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffCloneTa5d6ff Ta5d6ffRepo
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -eu
Tff7b72SERVER="${GITEA_SERVER_URL:-${GITHUB_SERVER_URL:-}}"
Tff7b72REPO="${GITEA_REPOSITORY:-${GITHUB_REPOSITORY:-}}"
Tff7b72if [ -z "$SERVER" ] || [ -z "$REPO" ]; then
Tff7b72echo "Checkout: set GITEA_SERVER_URL/GITEA_REPOSITORY or GITHUB_SERVER_URL/GITHUB_REPOSITORY" >&2
Tff7b72exit 1
Tff7b72fi
Tff7b72if [ -n "${GITEA_TOKEN:-}" ] || [ -n "${GITHUB_TOKEN:-}" ]; then
Tff7b72TOKEN="${GITEA_TOKEN:-$GITHUB_TOKEN}"
Tff7b72git config --global credential.helper "!f() { echo username=x-access-token; echo password=${TOKEN}; }; f"
Tff7b72fi
Tff7b72git clone "${SERVER}/${REPO}.git" .
Tff7b72git checkout "${GITHUB_SHA}"
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffDetermineTa5d6ff Ta5d6ffversion
Tff7b72idTb4b4b4: Ta5d6ffversion
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72VERSION=""
Tff7b72if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
Tff7b72VERSION="${{ inputs.version || github.event.inputs.version }}"
Tff7b72fi
Tff7b72if [ -n "$VERSION" ]; then
Tff7b72echo "Using version from input: $VERSION"
Tff7b72elif [[ "${{ github.ref }}" == refs/tags/* ]]; then
Tff7b72VERSION="${GITHUB_REF#refs/tags/}"
Tff7b72if [ -z "${VERSION}" ]; then
Tff7b72VERSION="${{ github.ref_name }}"
Tff7b72fi
Tff7b72echo "Using version from tag: $VERSION"
Tff7b72else
Tff7b72VERSION=$(git rev-parse --short HEAD)
Tff7b72echo "Using version from SHA: $VERSION"
Tff7b72fi
Tff7b72if [ "${VERSION}" = "master" ] || [ "${VERSION}" = "dev" ] || [ -z "${VERSION}" ]; then
Tff7b72echo "Error: Invalid version '${VERSION}'. Version cannot be a branch name or empty." >&2
Tff7b72exit 1
Tff7b72fi
Tff7b72echo "version=${VERSION}" >> $GITHUB_OUTPUT
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetupTa5d6ff Ta5d6ffNode.js
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/setup-node.shTa5d6ff Ta5d6ff24
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetupTa5d6ff Ta5d6ffPython
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/setup-python.shTa5d6ff Ta5d6ff3.14
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffInstallTa5d6ff Ta5d6ffPoetry
Tff7b72runTb4b4b4: Ta5d6ffpython3Ta5d6ff Ta5d6ff-mTa5d6ff Ta5d6ffpipTa5d6ff Ta5d6ffinstallTa5d6ff Ta5d6ff--upgradeTa5d6ff Ta5d6ffpipTa5d6ff Ta5d6ffpoetry>=2.0.0
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetupTa5d6ff Ta5d6ffpnpm
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/setup-pnpm.sh
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffInstallTa5d6ff Ta5d6ffsystemTa5d6ff Ta5d6ffdependencies
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72sh scripts/ci/exec-priv.sh dpkg --add-architecture i386
Tff7b72sh scripts/ci/exec-priv.sh apt-get update
Tff7b72sh scripts/ci/exec-priv.sh apt-get install -y patchelf libopusfile0 ffmpeg espeak-ng zip rpm elfutils
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetupTa5d6ff Ta5d6ffTask
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/setup-task.sh
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffInstallTa5d6ff Ta5d6ffdependencies
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72. scripts/ci/ci-node-path.sh
Tff7b72task install
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffBuildTa5d6ff Ta5d6ffFrontend
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72. scripts/ci/ci-node-path.sh
Tff7b72task build:fe
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffBuildTa5d6ff Ta5d6ffPythonTa5d6ff Ta5d6ffwheel
Tff7b72runTb4b4b4: Ta5d6fftaskTa5d6ff Ta5d6ffbuild:wheel
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffBuildTa5d6ff Ta5d6ffElectronTa5d6ff Ta5d6ffAppTa5d6ff Ta5d6ff(x64Ta5d6ff Ta5d6ffAppImageTa5d6ff Ta5d6ff+Ta5d6ff Ta5d6ffdeb)
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72. scripts/ci/ci-node-path.sh
Tff7b72pnpm run dist:linux-x64
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffBuildTa5d6ff Ta5d6ffElectronTa5d6ff Ta5d6ffAppTa5d6ff Ta5d6ff(arm64Ta5d6ff Ta5d6ffAppImageTa5d6ff Ta5d6ff+Ta5d6ff Ta5d6ffdeb)
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72. scripts/ci/ci-node-path.sh
Tff7b72pnpm run dist:linux-arm64
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffBuildTa5d6ff Ta5d6ffElectronTa5d6ff Ta5d6ffAppTa5d6ff Ta5d6ff(RPM)
Tff7b72continue-on-errorTb4b4b4: Ta5d6fftrue
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72. scripts/ci/ci-node-path.sh
Tff7b72task dist:fe:rpm
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffPrepareTa5d6ff Ta5d6ffreleaseTa5d6ff Ta5d6ffassets
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72mkdir -p release-assets
Tff7b72find dist -maxdepth 1 -type f \( -name "*-linux*.AppImage" -o -name "*-linux*.deb" -o -name "*-linux*.rpm" \) -exec cp {} release-assets/ \;
Tff7b72find python-dist -maxdepth 1 -type f -name "*.whl" -exec cp {} release-assets/ \;
Tff7b72# Create frontend zip
Tff7b72(cd meshchatx/public && zip -r ../../release-assets/meshchatx-frontend.zip .)
Tff7b72# Generate SBOM (CycloneDX)
Tff7b72curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb
Tff7b72sh scripts/ci/exec-priv.sh dpkg -i /tmp/trivy.deb || sh scripts/ci/exec-priv.sh apt-get install -f -y
Tff7b72trivy fs --format cyclonedx --include-dev-deps --output release-assets/sbom.cyclonedx.json .
Tff7b72# Generate checksums
Tff7b72cd release-assets
Tff7b72for file in *; do
Tff7b72if [ -f "$file" ] && [[ "$file" != *.sha256 ]]; then
Tff7b72sha256sum "$file" | tee "${file}.sha256"
Tff7b72fi
Tff7b72done
Tff7b72# Generate release notes (outside release-assets directory)
Tff7b72cd ..
Tff7b72echo "## SHA256 Checksums" > release-body.md
Tff7b72echo "" >> release-body.md
Tff7b72for file in release-assets/*; do
Tff7b72if [ -f "$file" ] && [[ "$file" != *.sha256 ]] && [[ "$file" != *.cosign.bundle ]] && [[ "$file" != *release-body.md* ]]; then
Tff7b72filename=$(basename "$file")
Tff7b72if [ -f "release-assets/${filename}.sha256" ]; then
Tff7b72# Extract just the filename and its sha256 (format: <sha256> <filename>)
Tff7b72echo "\`$(cat "release-assets/${filename}.sha256")\`" >> release-body.md
Tff7b72fi
Tff7b72fi
Tff7b72done
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSLSATa5d6ff Ta5d6ffattestationsTa5d6ff Ta5d6ff(cosign)
Tff7b72envTb4b4b4:
Tff7b72COSIGN_PRIVATE_KEYTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.COSIGN_PRIVATE_KEYTa5d6ff Ta5d6ff}}
Tff7b72COSIGN_PASSWORDTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.COSIGN_PASSWORDTa5d6ff Ta5d6ff}}
Tff7b72GITHUB_SERVER_URLTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.server_urlTa5d6ff Ta5d6ff}}
Tff7b72GITHUB_REPOSITORYTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.repositoryTa5d6ff Ta5d6ff}}
Tff7b72GITHUB_SHATb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.shaTa5d6ff Ta5d6ff}}
Tff7b72GITHUB_REFTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.refTa5d6ff Ta5d6ff}}
Tff7b72GITHUB_RUN_IDTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.run_idTa5d6ff Ta5d6ff}}
Tff7b72GITHUB_RUN_ATTEMPTTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.run_attemptTa5d6ff Ta5d6ff}}
Tff7b72GITHUB_WORKFLOWTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.workflowTa5d6ff Ta5d6ff}}
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -eu
Tff7b72if [ -z "${COSIGN_PRIVATE_KEY:-}" ]; then
Tff7b72echo "Skipping SLSA attestations: add repository secret COSIGN_PRIVATE_KEY (PEM) to sign releases."
Tff7b72exit 0
Tff7b72fi
Tff7b72sh scripts/ci/setup-cosign.sh "${COSIGN_VERSION}"
Tff7b72printf '%s\n' "$COSIGN_PRIVATE_KEY" > /tmp/cosign.key
Tff7b72chmod 600 /tmp/cosign.key
Tff7b72export COSIGN_KEY_PATH=/tmp/cosign.key
Tff7b72sh scripts/ci/attest-release-assets.sh ./release-assets
Tff7b72rm -f /tmp/cosign.key
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffValidateTa5d6ff Ta5d6ffversion
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72VERSION="${{ steps.version.outputs.version }}"
Tff7b72if [ -z "${VERSION}" ]; then
Tff7b72echo "Error: Version is empty" >&2
Tff7b72exit 1
Tff7b72fi
Tff7b72if [ "${VERSION}" = "master" ] || [ "${VERSION}" = "dev" ]; then
Tff7b72echo "Error: Invalid version '${VERSION}'. Version cannot be a branch name." >&2
Tff7b72exit 1
Tff7b72fi
Tff7b72echo "Using version: ${VERSION}"
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffCreateTa5d6ff Ta5d6ffRelease
Tff7b72ifTb4b4b4: Ta5d6ffgithub.event_nameTa5d6ff Ta5d6ff==Ta5d6ff Ta5d6ff'push'Ta5d6ff Ta5d6ff||Ta5d6ff Ta5d6ffgithub.event_nameTa5d6ff Ta5d6ff==Ta5d6ff Ta5d6ff'workflow_dispatch'
Tff7b72usesTb4b4b4: Ta5d6ffhttps://git.quad4.io/actions/gitea-release-action@4875285c0950474efb7ca2df55233c51333eeb74 T8b949e# v1
Tff7b72withTb4b4b4:
Tff7b72api_urlTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.GITEA_API_URLTa5d6ff Ta5d6ff}}
Tff7b72gitea_tokenTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.GITEA_TOKENTa5d6ff Ta5d6ff}}
Tff7b72titleTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsteps.version.outputs.versionTa5d6ff Ta5d6ff}}
Tff7b72tagTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsteps.version.outputs.versionTa5d6ff Ta5d6ff}}
Tff7b72filesTb4b4b4: Ta5d6ffrelease-assets/*
Tff7b72body_pathTb4b4b4: Ta5d6ff"Ta5d6ffrelease-body.mdTa5d6ff"
Tff7b72draftTb4b4b4: Ta5d6fftrue
Tff7b72prereleaseTb4b4b4: Ta5d6fffalse
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────