ci: adapt workflows to trunk-based development (#62)

* ci: adapt workflows to trunk-based development

Nightly builds main directly (old release/v* discovery pinned nightlies
to shipped branches forever). ship-ci adds push triggers on main and
release/** for post-merge signal. New rc.yml builds the desktop app
matrix from release branches during stabilization (signed, not
notarized, 14-day artifacts).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci: fix rc.yml mac-zip rename skew + drop duplicate build-core

rc.yml: glob release/mac*/*.app (was hardcoded Slopsmith.app, which no longer exists after the fee[dB]ack rebrand) and derive the zip name from the bundle; rename the win zip + comments off 'Slopsmith'. nightly.yml: remove build-core — core's own nightly already pushes ghcr feedback:nightly on the same cron (duplicate/race, per PR author's open question).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: byrongamatos <xasiklas@gmail.com>

.github/workflows/nightly.yml

@@ -1,5 +1,9 @@
 name: Nightly
 
+# Trunk-based: nightly always builds main — the release/v* branch discovery
+# from the old release-centric flow is gone (it pinned nightlies to the
+# highest release branch forever, even after it shipped). Stabilization
+# builds from release/** come from rc.yml instead.
 on:
   schedule:
     - cron: '0 2 * * *'
@@ -9,67 +13,16 @@ jobs:
   setup:
     runs-on: ubuntu-latest
     outputs:
-      branch: ${{ steps.branch.outputs.branch }}
       date: ${{ steps.date.outputs.date }}
 
     steps:
-      # Find the most recently created release/v* branch by sorting version
-      # strings. Falls back to main if no release branch exists (quiet window
-      # between a release shipping and the next branch being cut).
-      - name: Find active release branch
-        id: branch
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          branch=$(gh api "repos/${{ github.repository }}/git/matching-refs/heads/release/v" \
-            --jq '[.[].ref | ltrimstr("refs/heads/")] | sort | last // empty' 2>/dev/null || echo "")
-          if [[ -z "$branch" ]]; then
-            branch="main"
-          fi
-          echo "branch=$branch" >> "$GITHUB_OUTPUT"
-          echo "Active branch: $branch"
-
       - name: Get date
         id: date
         run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"
 
-  build-core:
+  # build-core removed: core's own nightly.yml already builds + pushes
-    needs: setup
+  # ghcr.io/got-feedback/feedback:nightly on the same 02:00 UTC cron, so this
-    runs-on: ubuntu-latest
+  # was duplicate/racing work. Core owns its image now.
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Clone core at active branch
-        env:
-          GH_CLONE_TOKEN: ${{ secrets.FEEDBACK_CLONE_TOKEN }}
-        run: |
-          git clone --depth 1 --branch "${{ needs.setup.outputs.branch }}" \
-            "https://x-access-token:${GH_CLONE_TOKEN}@github.com/got-feedback/feedback.git" core
-          echo "Cloned feedback core @ $(git -C core rev-parse --short HEAD) (${{ needs.setup.outputs.branch }})"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: core
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            ghcr.io/got-feedback/feedback:nightly
-            ghcr.io/got-feedback/feedback:nightly-${{ needs.setup.outputs.date }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
 
   build:
     needs: setup
@@ -92,7 +45,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ needs.setup.outputs.branch }}
           submodules: recursive
 
       - name: Read build configuration

.github/workflows/rc.yml

@@ -0,0 +1,162 @@
+name: rc
+
+# Release-candidate desktop builds for stabilization: every push to a
+# release/** branch builds the app matrix and uploads rc-* artifacts.
+# Core's RC Docker images come from the core repo's own rc.yml; final
+# signed/notarized releases still come from release.yml on tag push.
+on:
+  push:
+    branches: ['release/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# One build per branch at a time; a newer push supersedes an in-flight one.
+concurrency:
+  group: rc-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  setup:
+    runs-on: ubuntu-latest
+    outputs:
+      date: ${{ steps.date.outputs.date }}
+      version: ${{ steps.version.outputs.version }}
+
+    steps:
+      - name: Get date
+        id: date
+        run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"
+
+      - name: Derive version from branch name
+        id: version
+        run: |
+          # release/v0.3.0 -> 0.3.0 (tolerate a missing v prefix too)
+          version="${GITHUB_REF_NAME#release/}"
+          version="${version#v}"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: setup
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-22.04
+            platform: linux
+            arch: x64
+          - os: macos-14
+            platform: mac
+            arch: arm64
+          - os: windows-latest
+            platform: win
+            arch: x64
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Read build configuration
+        id: config
+        shell: bash
+        run: |
+          NODE_VERSION=$(node -p "require('./.build-config.json').versions.node")
+          PYTHON_VERSION=$(node -p "require('./.build-config.json').versions.python")
+          echo "node=$NODE_VERSION" >> $GITHUB_OUTPUT
+          echo "python=$PYTHON_VERSION" >> $GITHUB_OUTPUT
+          echo "Node ${NODE_VERSION}, Python ${PYTHON_VERSION}"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.config.outputs.node }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ steps.config.outputs.python }}
+
+      # macOS: import signing cert so build-macos.sh can codesign the .app.
+      # RC builds are signed but not notarized (same as nightlies) — testers
+      # clear Gatekeeper with `xattr -dr com.apple.quarantine <app>.app`.
+      # Graceful fallback: no-op when secrets are absent.
+      - name: Import Apple signing certificate
+        if: matrix.platform == 'mac'
+        env:
+          APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${APPLE_CERTIFICATE_P12_BASE64:-}" ]]; then
+              echo "APPLE_CERTIFICATE_P12_BASE64 not set — skipping (unsigned build)"
+              exit 0
+          fi
+          printf '%s' "$APPLE_CERTIFICATE_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/cert.p12"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security set-keychain-settings -lut 21600 build.keychain
+          security list-keychains -d user -s build.keychain login.keychain-db
+          security import "$RUNNER_TEMP/cert.p12" -k build.keychain \
+              -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list \
+              -S apple-tool:,apple:,codesign: \
+              -s -k "$KEYCHAIN_PASSWORD" build.keychain
+          rm -f "$RUNNER_TEMP/cert.p12"
+          security find-identity -v -p codesigning build.keychain | grep -q "Developer ID Application"
+
+      - name: Build
+        run: ./scripts/build-release.sh
+        shell: bash
+        env:
+          # PAT with read access to the private got-feedback repos so
+          # build-common.sh can clone core + the bundled plugins.
+          GH_CLONE_TOKEN: ${{ secrets.FEEDBACK_CLONE_TOKEN }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          # No notarization for RC builds — testers use xattr -dr com.apple.quarantine
+          CSC_FOR_PULL_REQUEST: "true"
+
+      # macOS: zip the .app for tester distribution (same as nightly.yml).
+      - name: Zip macOS app
+        if: matrix.platform == 'mac'
+        shell: bash
+        run: |
+          set -euo pipefail
+          app=$(ls -d release/mac*/*.app 2>/dev/null | head -n1 || true)
+          if [[ -z "${app:-}" || ! -d "$app" ]]; then
+            echo "::error::No .app bundle found under release/mac*/"
+            exit 1
+          fi
+          name=$(basename "$app" .app)
+          ditto -c -k --sequesterRsrc --keepParent "$app" "release/${name}-macos-arm64.zip"
+          echo "Zipped $app -> release/${name}-macos-arm64.zip"
+
+      # Windows: electron-builder's `dir` target leaves win-unpacked/ with no
+      # packaged installer (Velopack is skipped for RC builds). Zip the directory
+      # so testers can download and extract, then launch the app .exe directly.
+      - name: Zip win-unpacked
+        if: matrix.platform == 'win'
+        shell: pwsh
+        run: |
+          Compress-Archive -Path release\win-unpacked\* -DestinationPath release\feedback-windows-x64.zip
+          Write-Host "Zipped win-unpacked -> release\feedback-windows-x64.zip"
+
+      - name: Clean up signing keychain
+        if: always() && matrix.platform == 'mac'
+        run: |
+          security delete-keychain build.keychain 2>/dev/null || true
+
+      - name: Upload RC artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: rc-${{ needs.setup.outputs.version }}-${{ needs.setup.outputs.date }}-${{ matrix.platform }}-${{ matrix.arch }}
+          path: |
+            release/*.AppImage
+            release/*.deb
+            release/*.zip
+            build/Release/*.pdb
+          if-no-files-found: warn
+          retention-days: 14

.github/workflows/ship-ci.yml

@@ -8,6 +8,11 @@ name: Ship CI
 on:
   pull_request:
     branches: [main, 'release/**']
+  # Trunk-based: post-merge CI on main catches semantic conflicts between
+  # independently-green PRs; push on release/** covers stabilization
+  # cherry-picks that land without a PR.
+  push:
+    branches: [main, 'release/**']
   workflow_dispatch:
 
 concurrency: