brew-browser/.github/workflows/linux-build.yml at main · msitarzewski/brew-browser · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
# Linux build — the canonical recipe for producing brew-browser's
# .deb / .rpm / .AppImage bundles.
#
# Tauri 2 builds all three Linux bundle targets natively via
# `cargo tauri build` (driven here through `npm run tauri build`, which
# also runs the SvelteKit frontend build first via beforeBuildCommand).
#
# Why this exists separately from the macOS flow:
#   - macOS releases are built+signed+notarized locally on an Apple
#     machine via tools/build/sign-and-notarize.sh (Developer ID +
#     Apple notary — both macOS-only). That path is untouched.
#   - Linux has no equivalent code-signing requirement for v0:
#       * AppImage ships unsigned (the common convention).
#       * .deb / .rpm GPG signing is a future optional step — NOT
#         implemented here. When we add it, it slots in after the build
#         step (sign the produced .deb/.rpm with a repo GPG key, then
#         publish to an apt/yum repo). Left out deliberately for v0.
#
# What this produces: build artifacts (.deb, .rpm, .AppImage) uploaded
# to the workflow run. Cutting an actual GitHub Release + the in-app
# updater manifest (dist/updater.json via tools/release/publish-manifest.sh)
# remain deliberate human steps for now.

name: Linux Build

on:
  push:
    # feat/linux-support: prove the recipe works during development.
    # Tags v*: every tagged release builds Linux artifacts too.
    branches:
      - feat/linux-support
    tags:
      - "v*"
  # Manual trigger from the Actions tab.
  workflow_dispatch:

jobs:
  build:
    name: Build Linux bundles (.deb / .rpm / .AppImage)
    # Pin to ubuntu-22.04, NOT ubuntu-latest. 22.04 (Jammy) is the
    # webkit2gtk-4.1 era and gives us the oldest glibc we commit to
    # supporting — binaries built here run on 22.04+ and newer distros.
    # ubuntu-latest drifts forward and would silently raise our glibc
    # floor, breaking older targets.
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Standard Tauri 2 Linux build dependencies. Sourced from
      # https://v2.tauri.app/start/prerequisites/ (the -dev packages are
      # the build-time headers), plus:
      #   - libgtk-3-dev:  GTK3 dev headers (Tauri's Linux webview shell)
      #   - patchelf:      required by the AppImage bundler to rewrite
      #                    rpaths in the packaged binary
      #   - file, wget:    used by the AppImage tooling at bundle time
      # libwebkit2gtk-4.1-dev is the 4.1 ABI Tauri 2 targets (22.04+).
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf \
            libssl-dev \
            build-essential \
            file \
            wget

      - name: Set up Rust stable
        uses: dtolnay/rust-toolchain@stable

      # Cache the cargo registry + the src-tauri/target dir keyed on the
      # Linux target, so incremental CI runs skip recompiling unchanged
      # crates. workspaces points at the crate root that holds Cargo.lock.
      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Set up Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install npm dependencies
        run: npm ci

      # Builds the frontend (beforeBuildCommand: npm run build), compiles
      # the Rust binary, and bundles .deb / .rpm / .AppImage. bundle.targets
      # is "all" in tauri.conf.json, which on Linux means these three.
      #
      # Override createUpdaterArtifacts=false here: tauri.conf.json sets it true
      # (macOS needs the signed .app.tar.gz for the in-app updater), but on Linux
      # it makes the build try to sign an updater .AppImage.tar.gz — which needs
      # TAURI_SIGNING_PRIVATE_KEY, a secret CI doesn't hold, so the job failed
      # AFTER building the installers. The Linux auto-updater is unwired anyway
      # (users grab the .deb / .AppImage directly), so skipping the artifact is
      # correct, not a regression.
      - name: Build Tauri app
        run: npm run tauri build -- --config '{"bundle":{"createUpdaterArtifacts":false}}'

      - name: Upload .deb package
        uses: actions/upload-artifact@v4
        with:
          name: brew-browser-deb
          path: src-tauri/target/release/bundle/deb/*.deb
          if-no-files-found: error

      - name: Upload .rpm package
        uses: actions/upload-artifact@v4
        with:
          name: brew-browser-rpm
          path: src-tauri/target/release/bundle/rpm/*.rpm
          if-no-files-found: error

      - name: Upload AppImage
        uses: actions/upload-artifact@v4
        with:
          name: brew-browser-appimage
          path: src-tauri/target/release/bundle/appimage/*.AppImage
          if-no-files-found: error