--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit 195c36fe60ccd04a8494a2c2698e4ae2b10c8c78
Parents : c33fb39
Author : Ivan <ivan@quad4.io>
Signature : Invalid signer <e46112d44649266d71fe2193e00a4710>, author is <ivan@quad4.io>
Date : 2026-07-08T15:46:23-05:00
chore(ci): implement nightly build workflows for dev and master branches, replacing preview workflows
Changes
4 files changed, 118 insertions(+), 187 deletions(-)
Diff
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 86089ab2..d20a35d4 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -543,12 +543,13 @@ jobs:
provenance-name: meshchatx-android-flatpak-${{ github.ref_name }}.intoto.jsonl
draft-github-release:
- name: ${{ startsWith(github.ref_name, 'preview-dev-') && 'Preview dev GitHub release (all assets + SLSA)' || (startsWith(github.ref_name, 'preview-') && 'Preview GitHub release (all assets + SLSA)') || 'Draft GitHub release (all assets + SLSA)' }}
+ name: ${{ startsWith(github.ref_name, 'nightly-') && 'Nightly GitHub release (all assets + SLSA)' || startsWith(github.ref_name, 'preview-dev-') && 'Preview-dev GitHub release (all assets + SLSA)' || startsWith(github.ref_name, 'preview-') && 'Preview GitHub release (all assets + SLSA)' || 'Draft GitHub release (all assets + SLSA)' }}
needs:
- linux-release
- collect-linux-slsa-subjects
- slsa-provenance-linux
- build-release
+ - collect-desktop-slsa-subjects
- slsa-provenance-desktop
- flatpak
- android-release
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
new file mode 100644
index 00000000..ce834bc4
--- /dev/null
+++ b/.github/workflows/nightly.yml
@@ -0,0 +1,116 @@
+# Nightly builds from dev: push a nightly-* tag when dev has new
+# commits since the last nightly prerelease, then dispatch build-release.yml.
+# Tag push alone does not start other workflows when using GITHUB_TOKEN
+# (GitHub Actions event loop prevention); workflow_dispatch is required.
+#
+# Pinned first-party actions (bump tag and SHA together when upgrading):
+# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
+#
+name: Nightly Release
+
+on:
+ schedule:
+ - cron: "0 7 * * *"
+ workflow_dispatch:
+
+concurrency:
+ group: nightly-release
+ cancel-in-progress: false
+
+permissions:
+ contents: read
+
+jobs:
+ metadata:
+ name: Prepare nightly tag
+ runs-on: ubuntu-latest
+ outputs:
+ tag_name: ${{ steps.meta.outputs.tag_name }}
+ commit_sha: ${{ steps.meta.outputs.commit_sha }}
+ skip_release: ${{ steps.meta.outputs.skip_release }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ ref: dev
+ fetch-depth: 0
+
+ - name: Compute nightly tag
+ id: meta
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ run: |
+ set -euo pipefail
+ short_sha="$(git rev-parse --short=7 HEAD)"
+ full_sha="$(git rev-parse HEAD)"
+ tag="nightly-$(date -u +%Y.%m.%d)-${short_sha}"
+
+ skip_release=false
+ if [ "${{ github.event_name }}" = "schedule" ]; then
+ last_nightly_tag="$(gh release list --limit 50 --json tagName,isPrerelease \
+ --jq '[.[] | select(.isPrerelease) | select(.tagName | startswith("nightly-"))][0].tagName // empty')"
+ last_nightly_sha=""
+ if [ -n "${last_nightly_tag}" ]; then
+ git fetch --tags --force origin
+ last_nightly_sha="$(git rev-parse "refs/tags/${last_nightly_tag}^{commit}" 2>/dev/null || true)"
+ fi
+ if [ -n "${last_nightly_sha}" ] && [ "${last_nightly_sha}" = "${full_sha}" ]; then
+ echo "No new commits on dev since last nightly (${last_nightly_tag} @ ${last_nightly_sha}); skipping scheduled release."
+ skip_release=true
+ fi
+ fi
+
+ echo "tag_name=${tag}" >> "$GITHUB_OUTPUT"
+ echo "commit_sha=${full_sha}" >> "$GITHUB_OUTPUT"
+ echo "skip_release=${skip_release}" >> "$GITHUB_OUTPUT"
+ echo "Nightly tag: ${tag} @ ${full_sha} (skip_release=${skip_release})"
+
+ tag:
+ name: Tag dev and dispatch build-release
+ needs: metadata
+ if: needs.metadata.outputs.skip_release != 'true'
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ actions: write
+ steps:
+ - name: Checkout
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ ref: dev
+ fetch-depth: 0
+
+ - name: Create and push nightly tag
+ env:
+ TAG: ${{ needs.metadata.outputs.tag_name }}
+ SHA: ${{ needs.metadata.outputs.commit_sha }}
+ run: |
+ set -euo pipefail
+ if git rev-parse "refs/tags/${TAG}" >/dev/null 2>&1; then
+ echo "Tag ${TAG} already exists; skipping push."
+ else
+ git config user.name "github-actions[bot]"
+ git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+ git tag -a "${TAG}" -m "Nightly build for ${SHA}" "${SHA}"
+ git push origin "${TAG}"
+ fi
+
+ - name: Dispatch build-release for tag
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ TAG: ${{ needs.metadata.outputs.tag_name }}
+ SHA: ${{ needs.metadata.outputs.commit_sha }}
+ run: |
+ set -euo pipefail
+ # GITHUB_TOKEN tag pushes do not trigger other workflows; dispatch explicitly.
+ # Retry briefly so the newly pushed tag is visible to the API.
+ for attempt in 1 2 3 4 5; do
+ if gh workflow run build-release.yml --ref "refs/tags/${TAG}"; then
+ echo "Dispatched build-release.yml for ref ${TAG} (${SHA})"
+ exit 0
+ fi
+ echo "Dispatch attempt ${attempt} failed; waiting for tag to propagate..."
+ sleep 5
+ done
+ echo "Failed to dispatch build-release.yml for ${TAG}" >&2
+ exit 1
diff --git a/.github/workflows/preview-dev.yml b/.github/workflows/preview-dev.yml
deleted file mode 100644
index 2d62a4fb..00000000
--- a/.github/workflows/preview-dev.yml
+++ /dev/null
@@ -1,93 +0,0 @@
-# Weekly preview builds from dev: push a preview-dev-* tag when dev has new
-# commits since the last dev prerelease, which triggers build-release.yml.
-#
-# Pinned first-party actions (bump tag and SHA together when upgrading):
-# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
-#
-name: Preview Dev Release
-
-on:
- schedule:
- - cron: "0 7 * * 0"
- workflow_dispatch:
-
-concurrency:
- group: preview-release-dev
- cancel-in-progress: false
-
-permissions:
- contents: read
-
-jobs:
- metadata:
- name: Prepare preview-dev tag
- runs-on: ubuntu-latest
- outputs:
- tag_name: ${{ steps.meta.outputs.tag_name }}
- commit_sha: ${{ steps.meta.outputs.commit_sha }}
- skip_release: ${{ steps.meta.outputs.skip_release }}
- steps:
- - name: Checkout
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- with:
- ref: dev
- fetch-depth: 0
-
- - name: Compute preview-dev tag
- id: meta
- env:
- GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: |
- set -euo pipefail
- short_sha="$(git rev-parse --short=7 HEAD)"
- full_sha="$(git rev-parse HEAD)"
- tag="preview-dev-$(date -u +%Y.%m.%d)-${short_sha}"
-
- skip_release=false
- if [ "${{ github.event_name }}" = "schedule" ]; then
- last_preview_tag="$(gh release list --limit 50 --json tagName,isPrerelease \
- --jq '[.[] | select(.isPrerelease) | select(.tagName | startswith("preview-dev-"))][0].tagName // empty')"
- last_preview_sha=""
- if [ -n "${last_preview_tag}" ]; then
- git fetch --tags --force origin
- last_preview_sha="$(git rev-parse "refs/tags/${last_preview_tag}^{commit}" 2>/dev/null || true)"
- fi
- if [ -n "${last_preview_sha}" ] && [ "${last_preview_sha}" = "${full_sha}" ]; then
- echo "No new commits on dev since last preview-dev (${last_preview_tag} @ ${last_preview_sha}); skipping scheduled release."
- skip_release=true
- fi
- fi
-
- echo "tag_name=${tag}" >> "$GITHUB_OUTPUT"
- echo "commit_sha=${full_sha}" >> "$GITHUB_OUTPUT"
- echo "skip_release=${skip_release}" >> "$GITHUB_OUTPUT"
- echo "Preview-dev tag: ${tag} @ ${full_sha} (skip_release=${skip_release})"
-
- tag:
- name: Tag dev and trigger build-release
- needs: metadata
- if: needs.metadata.outputs.skip_release != 'true'
- runs-on: ubuntu-latest
- permissions:
- contents: write
- steps:
- - name: Checkout
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- with:
- ref: dev
- fetch-depth: 0
-
- - name: Create and push preview-dev tag
- env:
- TAG: ${{ needs.metadata.outputs.tag_name }}
- SHA: ${{ needs.metadata.outputs.commit_sha }}
- run: |
- set -euo pipefail
- if git rev-parse "refs/tags/${TAG}" >/dev/null 2>&1; then
- echo "Tag ${TAG} already exists; skipping push."
- exit 0
- fi
- git config user.name "github-actions[bot]"
- git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
- git tag -a "${TAG}" -m "Weekly preview-dev build for ${SHA}" "${SHA}"
- git push origin "${TAG}"
diff --git a/.github/workflows/preview-release.yml b/.github/workflows/preview-release.yml
deleted file mode 100644
index 93f0de68..00000000
--- a/.github/workflows/preview-release.yml
+++ /dev/null
@@ -1,93 +0,0 @@
-# Weekly preview builds from master: push a preview-* tag when master has new
-# commits since the last prerelease, which triggers build-release.yml.
-#
-# Pinned first-party actions (bump tag and SHA together when upgrading):
-# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
-#
-name: Preview Release
-
-on:
- schedule:
- - cron: "0 6 * * 0"
- workflow_dispatch:
-
-concurrency:
- group: preview-release
- cancel-in-progress: false
-
-permissions:
- contents: read
-
-jobs:
- metadata:
- name: Prepare preview tag
- runs-on: ubuntu-latest
- outputs:
- tag_name: ${{ steps.meta.outputs.tag_name }}
- commit_sha: ${{ steps.meta.outputs.commit_sha }}
- skip_release: ${{ steps.meta.outputs.skip_release }}
- steps:
- - name: Checkout
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- with:
- ref: master
- fetch-depth: 0
-
- - name: Compute preview tag
- id: meta
- env:
- GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: |
- set -euo pipefail
- short_sha="$(git rev-parse --short=7 HEAD)"
- full_sha="$(git rev-parse HEAD)"
- tag="preview-$(date -u +%Y.%m.%d)-${short_sha}"
-
- skip_release=false
- if [ "${{ github.event_name }}" = "schedule" ]; then
- last_preview_tag="$(gh release list --limit 50 --json tagName,isPrerelease \
- --jq '[.[] | select(.isPrerelease) | select(.tagName | startswith("preview-")) | select(.tagName | startswith("preview-dev-") | not)][0].tagName // empty')"
- last_preview_sha=""
- if [ -n "${last_preview_tag}" ]; then
- git fetch --tags --force origin
- last_preview_sha="$(git rev-parse "refs/tags/${last_preview_tag}^{commit}" 2>/dev/null || true)"
- fi
- if [ -n "${last_preview_sha}" ] && [ "${last_preview_sha}" = "${full_sha}" ]; then
- echo "No new commits on master since last preview (${last_preview_tag} @ ${last_preview_sha}); skipping scheduled release."
- skip_release=true
- fi
- fi
-
- echo "tag_name=${tag}" >> "$GITHUB_OUTPUT"
- echo "commit_sha=${full_sha}" >> "$GITHUB_OUTPUT"
- echo "skip_release=${skip_release}" >> "$GITHUB_OUTPUT"
- echo "Preview tag: ${tag} @ ${full_sha} (skip_release=${skip_release})"
-
- tag:
- name: Tag master and trigger build-release
- needs: metadata
- if: needs.metadata.outputs.skip_release != 'true'
- runs-on: ubuntu-latest
- permissions:
- contents: write
- steps:
- - name: Checkout
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- with:
- ref: master
- fetch-depth: 0
-
- - name: Create and push preview tag
- env:
- TAG: ${{ needs.metadata.outputs.tag_name }}
- SHA: ${{ needs.metadata.outputs.commit_sha }}
- run: |
- set -euo pipefail
- if git rev-parse "refs/tags/${TAG}" >/dev/null 2>&1; then
- echo "Tag ${TAG} already exists; skipping push."
- exit 0
- fi
- git config user.name "github-actions[bot]"
- git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
- git tag -a "${TAG}" -m "Weekly preview build for ${SHA}" "${SHA}"
- git push origin "${TAG}"
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────