mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vbandClaude Opus 5
9a0ae0dd2a
The separate J3vb/OwnCord-releases repo existed only because this repo was private: it carried the AGPL source snapshot and provided a publicly-readable update feed. Once this repo is public both roles collapse into its own Releases page, so the mirror is pure redundancy. - Server/config/config.go: github.repo default OwnCord-releases -> OwnCord. This one default drives both the server self-update and the client auto-update chain (tauri.conf.json updater.endpoints is empty, so the client resolves through the server). No test pinned the old value. - release.yml: drop the mirror step and its RELEASES_REPO_TOKEN guard, whose AGPL/private-repo premise no longer holds. The existing Create GitHub Release step is now the sole publish target. All 31 SHA pins verified intact. - Repoint the README badge/download link, both SECURITY.md links, the server-configuration table and sample, the system-overview diagram node and the CHANGELOG note. SECURITY.md's advisory link is the load-bearing one: left alone it would 404 once the mirror repo is deleted. - README: Go 1.25+ -> 1.26+ (badge and prerequisite) to match the toolchain actually required. Deleting the mirror repo loses nothing: both repos' v1.1.0-alpha.2 carry byte-identical asset sets, signatures and update manifest included. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
438 lines
17 KiB
YAML
438 lines
17 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
|
|
jobs:
|
|
release-client-windows:
|
|
name: Build Tauri (Windows)
|
|
runs-on: windows-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
cache-dependency-path: Client/tauri-client/package-lock.json
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
|
|
|
|
- name: Rust cache
|
|
uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
|
|
with:
|
|
workspaces: Client/tauri-client/src-tauri
|
|
|
|
- name: Install npm dependencies
|
|
working-directory: Client/tauri-client
|
|
run: npm ci
|
|
|
|
- name: Build Tauri app
|
|
working-directory: Client/tauri-client
|
|
env:
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
run: npm run tauri build
|
|
|
|
- name: Stage Windows release assets
|
|
shell: bash
|
|
run: |
|
|
mkdir -p release-staging
|
|
NSIS_DIR="Client/tauri-client/src-tauri/target/release/bundle/nsis"
|
|
INSTALLER=$(find "$NSIS_DIR" -name "*.exe" | head -1)
|
|
cp "$INSTALLER" release-staging/
|
|
NSIS_ZIP=$(find "$NSIS_DIR" -name "*_x64-setup.nsis.zip" ! -name "*.sig" | head -1)
|
|
if [ -n "$NSIS_ZIP" ] && [ -f "$NSIS_ZIP" ]; then cp "$NSIS_ZIP" release-staging/; fi
|
|
NSIS_SIG=$(find "$NSIS_DIR" -name "*_x64-setup.nsis.zip.sig" | head -1)
|
|
if [ -n "$NSIS_SIG" ] && [ -f "$NSIS_SIG" ]; then cp "$NSIS_SIG" release-staging/; fi
|
|
|
|
- name: Upload Windows release assets
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: windows-release-assets
|
|
path: release-staging/
|
|
|
|
release-client-linux:
|
|
name: Build Tauri (Linux)
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
cache-dependency-path: Client/tauri-client/package-lock.json
|
|
|
|
- name: Install Linux system dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
libwebkit2gtk-4.1-dev \
|
|
libgtk-3-dev \
|
|
libayatana-appindicator3-dev \
|
|
libsecret-1-dev \
|
|
libasound2-dev \
|
|
libssl-dev \
|
|
patchelf \
|
|
librsvg2-dev \
|
|
xdg-utils
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
|
|
|
|
- name: Rust cache
|
|
uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
|
|
with:
|
|
workspaces: Client/tauri-client/src-tauri
|
|
|
|
- name: Install npm dependencies
|
|
working-directory: Client/tauri-client
|
|
run: npm ci
|
|
|
|
- name: Build Tauri app (AppImage + deb)
|
|
working-directory: Client/tauri-client
|
|
env:
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
run: npm run tauri build -- --bundles appimage,deb
|
|
|
|
- name: Stage Linux release assets
|
|
shell: bash
|
|
run: |
|
|
mkdir -p linux-staging
|
|
BUNDLE_DIR="Client/tauri-client/src-tauri/target/release/bundle"
|
|
# AppImage
|
|
APPIMAGE=$(find "$BUNDLE_DIR/appimage" -name "*.AppImage" ! -name "*.sig" | head -1)
|
|
if [ -n "$APPIMAGE" ] && [ -f "$APPIMAGE" ]; then cp "$APPIMAGE" linux-staging/; fi
|
|
APPIMAGE_SIG=$(find "$BUNDLE_DIR/appimage" -name "*.AppImage.sig" | head -1)
|
|
if [ -n "$APPIMAGE_SIG" ] && [ -f "$APPIMAGE_SIG" ]; then cp "$APPIMAGE_SIG" linux-staging/; fi
|
|
APPIMAGE_TAR=$(find "$BUNDLE_DIR/appimage" -name "*.AppImage.tar.gz" ! -name "*.sig" | head -1)
|
|
if [ -n "$APPIMAGE_TAR" ] && [ -f "$APPIMAGE_TAR" ]; then cp "$APPIMAGE_TAR" linux-staging/; fi
|
|
APPIMAGE_TAR_SIG=$(find "$BUNDLE_DIR/appimage" -name "*.AppImage.tar.gz.sig" | head -1)
|
|
if [ -n "$APPIMAGE_TAR_SIG" ] && [ -f "$APPIMAGE_TAR_SIG" ]; then cp "$APPIMAGE_TAR_SIG" linux-staging/; fi
|
|
# .deb
|
|
DEB=$(find "$BUNDLE_DIR/deb" -name "*.deb" | head -1)
|
|
if [ -n "$DEB" ] && [ -f "$DEB" ]; then cp "$DEB" linux-staging/; fi
|
|
|
|
- name: Upload Linux release assets
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: linux-release-assets
|
|
path: linux-staging/
|
|
|
|
release-server:
|
|
name: Build server (${{ matrix.os }})
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: windows-latest
|
|
artifact: server-windows
|
|
- os: ubuntu-latest
|
|
artifact: server-linux
|
|
runs-on: ${{ matrix.os }}
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
|
|
with:
|
|
go-version: "1.26"
|
|
|
|
- name: Extract version from tag
|
|
shell: bash
|
|
run: |
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
echo "VERSION=$VERSION" >> "$GITHUB_ENV"
|
|
|
|
- name: Build server (Windows)
|
|
if: matrix.os == 'windows-latest'
|
|
shell: bash
|
|
run: cd Server && go build -o chatserver.exe -ldflags "-s -w -X main.version=$VERSION" .
|
|
|
|
- name: Build server (Linux)
|
|
if: matrix.os == 'ubuntu-latest'
|
|
working-directory: Server
|
|
env:
|
|
CGO_ENABLED: "0"
|
|
run: go build -o chatserver -ldflags "-s -w -X main.version=$VERSION" .
|
|
|
|
- name: Create tar.gz (Linux)
|
|
if: matrix.os == 'ubuntu-latest'
|
|
working-directory: Server
|
|
run: tar czf ../chatserver-linux-amd64.tar.gz chatserver
|
|
|
|
- name: Upload Windows binary
|
|
if: matrix.os == 'windows-latest'
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: ${{ matrix.artifact }}
|
|
path: Server/chatserver.exe
|
|
|
|
- name: Upload Linux archive
|
|
if: matrix.os == 'ubuntu-latest'
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: ${{ matrix.artifact }}
|
|
path: chatserver-linux-amd64.tar.gz
|
|
|
|
release-client-linux-arm64:
|
|
name: Build Tauri (Linux ARM64)
|
|
runs-on: ubuntu-22.04-arm
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
cache-dependency-path: Client/tauri-client/package-lock.json
|
|
|
|
- name: Install Linux system dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
libwebkit2gtk-4.1-dev \
|
|
libgtk-3-dev \
|
|
libayatana-appindicator3-dev \
|
|
libsecret-1-dev \
|
|
libasound2-dev \
|
|
libssl-dev \
|
|
patchelf \
|
|
librsvg2-dev \
|
|
xdg-utils
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
|
|
|
|
- name: Rust cache
|
|
uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
|
|
with:
|
|
workspaces: Client/tauri-client/src-tauri
|
|
|
|
- name: Install npm dependencies
|
|
working-directory: Client/tauri-client
|
|
run: npm ci
|
|
|
|
- name: Build Tauri app (AppImage + deb)
|
|
working-directory: Client/tauri-client
|
|
env:
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
run: npm run tauri build -- --bundles appimage,deb
|
|
|
|
- name: Stage Linux ARM64 release assets
|
|
shell: bash
|
|
run: |
|
|
mkdir -p linux-arm64-staging
|
|
BUNDLE_DIR="Client/tauri-client/src-tauri/target/release/bundle"
|
|
# AppImage + updater artifact (.tar.gz) + signatures. Every filename
|
|
# must carry the arch: FindClientAssets matches on the
|
|
# _aarch64.AppImage.tar.gz suffix, and arch-less names would collide
|
|
# with the x86_64 assets when both artifact sets are downloaded into
|
|
# the same linux/ directory at publish time. Inserting _aarch64
|
|
# before ".AppImage" renames installer, tar.gz, and .sig
|
|
# consistently, so signatures keep pairing with their artifacts.
|
|
for f in "$BUNDLE_DIR"/appimage/*.AppImage "$BUNDLE_DIR"/appimage/*.AppImage.tar.gz "$BUNDLE_DIR"/appimage/*.sig; do
|
|
[ -f "$f" ] || continue
|
|
base="$(basename "$f")"
|
|
[[ "$base" == *aarch64* ]] || base="${base/.AppImage/_aarch64.AppImage}"
|
|
cp "$f" "linux-arm64-staging/$base"
|
|
done
|
|
# .deb
|
|
for f in "$BUNDLE_DIR"/deb/*.deb; do
|
|
[ -f "$f" ] && cp "$f" linux-arm64-staging/
|
|
done
|
|
|
|
- name: Upload Linux ARM64 release assets
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: linux-arm64-release-assets
|
|
path: linux-arm64-staging/
|
|
|
|
release-server-docker:
|
|
name: Build & Push Server Docker Image
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Extract version from tag
|
|
shell: bash
|
|
run: |
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
echo "VERSION=$VERSION" >> "$GITHUB_ENV"
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
|
|
|
|
- name: Log in to GitHub Container Registry
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Extract Docker metadata
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
|
|
with:
|
|
images: ghcr.io/${{ github.repository_owner }}/owncord-server
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=raw,value=latest
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
|
|
with:
|
|
context: Server/
|
|
push: true
|
|
build-args: VERSION=${{ env.VERSION }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
publish:
|
|
name: Publish GitHub Release
|
|
needs: [release-client-windows, release-client-linux, release-client-linux-arm64, release-server, release-server-docker]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
cache-dependency-path: Client/tauri-client/package-lock.json
|
|
|
|
- name: Download Windows client assets
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: windows-release-assets
|
|
path: windows
|
|
|
|
- name: Download Linux x86_64 client assets
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: linux-release-assets
|
|
path: linux
|
|
|
|
- name: Download Linux ARM64 client assets
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: linux-arm64-release-assets
|
|
path: linux
|
|
|
|
- name: Download Windows server binary
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: server-windows
|
|
path: windows
|
|
|
|
- name: Download Linux server archive
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: server-linux
|
|
path: linux
|
|
|
|
- name: Extract version from tag
|
|
shell: bash
|
|
run: |
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
echo "VERSION=$VERSION" >> "$GITHUB_ENV"
|
|
|
|
- name: Create source snapshot (AGPL source availability)
|
|
shell: bash
|
|
run: |
|
|
git archive --format=tar.gz --prefix="OwnCord-${VERSION}/" \
|
|
-o "owncord-src-${{ github.ref_name }}.tar.gz" HEAD
|
|
|
|
# Checksum lines must use bare asset filenames: the v1.0.0 updater's
|
|
# ParseChecksumFile does an exact match on the last field, so a
|
|
# "windows/" prefix would strand every deployed server on 1.0.0.
|
|
- name: Generate SHA256 checksums
|
|
shell: bash
|
|
run: |
|
|
(cd windows && sha256sum *) > checksums.sha256
|
|
(cd linux && sha256sum *) >> checksums.sha256
|
|
sha256sum owncord-src-*.tar.gz >> checksums.sha256
|
|
|
|
# The legacy top-level asset/sha256 pair stays bound to the Windows
|
|
# binary so already-deployed servers (which only understand the
|
|
# single-asset schema) can still verify and update; the assets list
|
|
# binds every OS. Server-side schema: updater.releaseManifest.
|
|
- name: Generate server update manifest
|
|
shell: bash
|
|
run: |
|
|
WIN_HASH=$(sha256sum windows/chatserver.exe | awk '{print $1}')
|
|
LINUX_HASH=$(sha256sum linux/chatserver-linux-amd64.tar.gz | awk '{print $1}')
|
|
printf '{"version":"v%s","asset":"chatserver.exe","sha256":"%s","assets":[{"asset":"chatserver.exe","sha256":"%s"},{"asset":"chatserver-linux-amd64.tar.gz","sha256":"%s"}]}' \
|
|
"$VERSION" "$WIN_HASH" "$WIN_HASH" "$LINUX_HASH" > windows/server-update-manifest.json
|
|
|
|
- name: Sign server update assets
|
|
working-directory: Client/tauri-client
|
|
shell: bash
|
|
env:
|
|
SERVER_UPDATE_SIGNING_PRIVATE_KEY: ${{ secrets.SERVER_UPDATE_SIGNING_PRIVATE_KEY }}
|
|
SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
run: |
|
|
KEY_PATH=$(mktemp)
|
|
printf '%s' "$SERVER_UPDATE_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
|
|
trap 'rm -f "$KEY_PATH"' EXIT
|
|
npm ci
|
|
npx tauri signer sign -f "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/chatserver.exe
|
|
npx tauri signer sign -f "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/server-update-manifest.json
|
|
|
|
# Fail closed before publishing: prove the freshly signed assets verify
|
|
# against the pinned public key that ships inside the server binary.
|
|
# Catches key/pubkey mismatch, signature format drift, and signer flag
|
|
# regressions — each of which has silently broken this pipeline before.
|
|
- name: Verify signed assets against pinned server update key
|
|
shell: bash
|
|
run: |
|
|
sudo apt-get update && sudo apt-get install -y minisign
|
|
base64 -d Server/updater/server_update_public_key.txt > "$RUNNER_TEMP/server_update.pub"
|
|
for f in windows/chatserver.exe windows/server-update-manifest.json; do
|
|
base64 -d "$f.sig" > "$RUNNER_TEMP/asset.minisig"
|
|
minisign -Vm "$f" -x "$RUNNER_TEMP/asset.minisig" -p "$RUNNER_TEMP/server_update.pub"
|
|
done
|
|
|
|
- name: Install root dependencies (changelogen)
|
|
run: npm ci
|
|
|
|
- name: Generate changelog
|
|
shell: bash
|
|
run: npx changelogen --output CHANGELOG.md
|
|
|
|
# Sole publish target. This repo is public, so its own Releases page both
|
|
# satisfies AGPL source availability (via the owncord-src snapshot below)
|
|
# and serves as the publicly-readable feed that deployed servers and
|
|
# clients poll for updates. The former mirror step to a separate public
|
|
# releases repo existed only to work around this repo being private.
|
|
- name: Create GitHub Release
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
mapfile -t assets < <(find windows linux -type f)
|
|
assets+=(checksums.sha256 owncord-src-*.tar.gz)
|
|
gh release create "${{ github.ref_name }}" \
|
|
--notes-file CHANGELOG.md \
|
|
"${assets[@]}"
|