From 921ae0b66d1d7d7cb00cb7154413eb7b53fd05c2 Mon Sep 17 00:00:00 2001 From: OmikronApex <45161725+OmikronApex@users.noreply.github.com> Date: Fri, 3 Jul 2026 11:29:33 +0200 Subject: [PATCH] ci: adapt workflows to trunk-based development (#62) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * ci: adapt workflows to trunk-based development Nightly builds main directly (old release/v* discovery pinned nightlies to shipped branches forever). ship-ci adds push triggers on main and release/** for post-merge signal. New rc.yml builds the desktop app matrix from release branches during stabilization (signed, not notarized, 14-day artifacts). Co-Authored-By: Claude Fable 5 * ci: fix rc.yml mac-zip rename skew + drop duplicate build-core rc.yml: glob release/mac*/*.app (was hardcoded Slopsmith.app, which no longer exists after the fee[dB]ack rebrand) and derive the zip name from the bundle; rename the win zip + comments off 'Slopsmith'. nightly.yml: remove build-core — core's own nightly already pushes ghcr feedback:nightly on the same cron (duplicate/race, per PR author's open question). Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Claude Fable 5 Co-authored-by: byrongamatos --- .github/workflows/nightly.yml | 62 ++----------- .github/workflows/rc.yml | 162 ++++++++++++++++++++++++++++++++++ .github/workflows/ship-ci.yml | 5 ++ 3 files changed, 174 insertions(+), 55 deletions(-) create mode 100644 .github/workflows/rc.yml diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 164db5e..82c28cc 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -1,5 +1,9 @@ name: Nightly +# Trunk-based: nightly always builds main — the release/v* branch discovery +# from the old release-centric flow is gone (it pinned nightlies to the +# highest release branch forever, even after it shipped). Stabilization +# builds from release/** come from rc.yml instead. on: schedule: - cron: '0 2 * * *' @@ -9,67 +13,16 @@ jobs: setup: runs-on: ubuntu-latest outputs: - branch: ${{ steps.branch.outputs.branch }} date: ${{ steps.date.outputs.date }} steps: - # Find the most recently created release/v* branch by sorting version - # strings. Falls back to main if no release branch exists (quiet window - # between a release shipping and the next branch being cut). - - name: Find active release branch - id: branch - env: - GH_TOKEN: ${{ github.token }} - run: | - branch=$(gh api "repos/${{ github.repository }}/git/matching-refs/heads/release/v" \ - --jq '[.[].ref | ltrimstr("refs/heads/")] | sort | last // empty' 2>/dev/null || echo "") - if [[ -z "$branch" ]]; then - branch="main" - fi - echo "branch=$branch" >> "$GITHUB_OUTPUT" - echo "Active branch: $branch" - - name: Get date id: date run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT" - build-core: - needs: setup - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - - steps: - - name: Clone core at active branch - env: - GH_CLONE_TOKEN: ${{ secrets.FEEDBACK_CLONE_TOKEN }} - run: | - git clone --depth 1 --branch "${{ needs.setup.outputs.branch }}" \ - "https://x-access-token:${GH_CLONE_TOKEN}@github.com/got-feedback/feedback.git" core - echo "Cloned feedback core @ $(git -C core rev-parse --short HEAD) (${{ needs.setup.outputs.branch }})" - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Log in to GHCR - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: core - platforms: linux/amd64,linux/arm64 - push: true - tags: | - ghcr.io/got-feedback/feedback:nightly - ghcr.io/got-feedback/feedback:nightly-${{ needs.setup.outputs.date }} - cache-from: type=gha - cache-to: type=gha,mode=max + # build-core removed: core's own nightly.yml already builds + pushes + # ghcr.io/got-feedback/feedback:nightly on the same 02:00 UTC cron, so this + # was duplicate/racing work. Core owns its image now. build: needs: setup @@ -92,7 +45,6 @@ jobs: steps: - uses: actions/checkout@v4 with: - ref: ${{ needs.setup.outputs.branch }} submodules: recursive - name: Read build configuration diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml new file mode 100644 index 0000000..3fa29bb --- /dev/null +++ b/.github/workflows/rc.yml @@ -0,0 +1,162 @@ +name: rc + +# Release-candidate desktop builds for stabilization: every push to a +# release/** branch builds the app matrix and uploads rc-* artifacts. +# Core's RC Docker images come from the core repo's own rc.yml; final +# signed/notarized releases still come from release.yml on tag push. +on: + push: + branches: ['release/**'] + workflow_dispatch: + +permissions: + contents: read + +# One build per branch at a time; a newer push supersedes an in-flight one. +concurrency: + group: rc-${{ github.ref }} + cancel-in-progress: true + +jobs: + setup: + runs-on: ubuntu-latest + outputs: + date: ${{ steps.date.outputs.date }} + version: ${{ steps.version.outputs.version }} + + steps: + - name: Get date + id: date + run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT" + + - name: Derive version from branch name + id: version + run: | + # release/v0.3.0 -> 0.3.0 (tolerate a missing v prefix too) + version="${GITHUB_REF_NAME#release/}" + version="${version#v}" + echo "version=$version" >> "$GITHUB_OUTPUT" + + build: + needs: setup + strategy: + fail-fast: false + matrix: + include: + - os: ubuntu-22.04 + platform: linux + arch: x64 + - os: macos-14 + platform: mac + arch: arm64 + - os: windows-latest + platform: win + arch: x64 + + runs-on: ${{ matrix.os }} + + steps: + - uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Read build configuration + id: config + shell: bash + run: | + NODE_VERSION=$(node -p "require('./.build-config.json').versions.node") + PYTHON_VERSION=$(node -p "require('./.build-config.json').versions.python") + echo "node=$NODE_VERSION" >> $GITHUB_OUTPUT + echo "python=$PYTHON_VERSION" >> $GITHUB_OUTPUT + echo "Node ${NODE_VERSION}, Python ${PYTHON_VERSION}" + + - uses: actions/setup-node@v4 + with: + node-version: ${{ steps.config.outputs.node }} + + - uses: actions/setup-python@v5 + with: + python-version: ${{ steps.config.outputs.python }} + + # macOS: import signing cert so build-macos.sh can codesign the .app. + # RC builds are signed but not notarized (same as nightlies) — testers + # clear Gatekeeper with `xattr -dr com.apple.quarantine .app`. + # Graceful fallback: no-op when secrets are absent. + - name: Import Apple signing certificate + if: matrix.platform == 'mac' + env: + APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }} + APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} + KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} + run: | + set -euo pipefail + if [[ -z "${APPLE_CERTIFICATE_P12_BASE64:-}" ]]; then + echo "APPLE_CERTIFICATE_P12_BASE64 not set — skipping (unsigned build)" + exit 0 + fi + printf '%s' "$APPLE_CERTIFICATE_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/cert.p12" + security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain + security default-keychain -s build.keychain + security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain + security set-keychain-settings -lut 21600 build.keychain + security list-keychains -d user -s build.keychain login.keychain-db + security import "$RUNNER_TEMP/cert.p12" -k build.keychain \ + -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign + security set-key-partition-list \ + -S apple-tool:,apple:,codesign: \ + -s -k "$KEYCHAIN_PASSWORD" build.keychain + rm -f "$RUNNER_TEMP/cert.p12" + security find-identity -v -p codesigning build.keychain | grep -q "Developer ID Application" + + - name: Build + run: ./scripts/build-release.sh + shell: bash + env: + # PAT with read access to the private got-feedback repos so + # build-common.sh can clone core + the bundled plugins. + GH_CLONE_TOKEN: ${{ secrets.FEEDBACK_CLONE_TOKEN }} + APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} + # No notarization for RC builds — testers use xattr -dr com.apple.quarantine + CSC_FOR_PULL_REQUEST: "true" + + # macOS: zip the .app for tester distribution (same as nightly.yml). + - name: Zip macOS app + if: matrix.platform == 'mac' + shell: bash + run: | + set -euo pipefail + app=$(ls -d release/mac*/*.app 2>/dev/null | head -n1 || true) + if [[ -z "${app:-}" || ! -d "$app" ]]; then + echo "::error::No .app bundle found under release/mac*/" + exit 1 + fi + name=$(basename "$app" .app) + ditto -c -k --sequesterRsrc --keepParent "$app" "release/${name}-macos-arm64.zip" + echo "Zipped $app -> release/${name}-macos-arm64.zip" + + # Windows: electron-builder's `dir` target leaves win-unpacked/ with no + # packaged installer (Velopack is skipped for RC builds). Zip the directory + # so testers can download and extract, then launch the app .exe directly. + - name: Zip win-unpacked + if: matrix.platform == 'win' + shell: pwsh + run: | + Compress-Archive -Path release\win-unpacked\* -DestinationPath release\feedback-windows-x64.zip + Write-Host "Zipped win-unpacked -> release\feedback-windows-x64.zip" + + - name: Clean up signing keychain + if: always() && matrix.platform == 'mac' + run: | + security delete-keychain build.keychain 2>/dev/null || true + + - name: Upload RC artifacts + uses: actions/upload-artifact@v4 + with: + name: rc-${{ needs.setup.outputs.version }}-${{ needs.setup.outputs.date }}-${{ matrix.platform }}-${{ matrix.arch }} + path: | + release/*.AppImage + release/*.deb + release/*.zip + build/Release/*.pdb + if-no-files-found: warn + retention-days: 14 diff --git a/.github/workflows/ship-ci.yml b/.github/workflows/ship-ci.yml index 4193cb0..925ca6f 100644 --- a/.github/workflows/ship-ci.yml +++ b/.github/workflows/ship-ci.yml @@ -8,6 +8,11 @@ name: Ship CI on: pull_request: branches: [main, 'release/**'] + # Trunk-based: post-merge CI on main catches semantic conflicts between + # independently-green PRs; push on release/** covers stabilization + # cherry-picks that land without a PR. + push: + branches: [main, 'release/**'] workflow_dispatch: concurrency: