1028 lines
37 KiB
YAML
1028 lines
37 KiB
YAML
name: Build
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
build_android:
|
|
description: Build Android
|
|
default: true
|
|
type: boolean
|
|
build_ios:
|
|
description: Build iOS
|
|
default: true
|
|
type: boolean
|
|
build_macos:
|
|
description: Build macOS
|
|
default: true
|
|
type: boolean
|
|
build_windows:
|
|
description: Build Windows
|
|
default: true
|
|
type: boolean
|
|
build_linux:
|
|
description: Build Linux
|
|
default: true
|
|
type: boolean
|
|
|
|
env:
|
|
SENTRY_DART_DEFINE: ${{ github.repository == 'edde746/plezy' && '--dart-define=ENABLE_SENTRY=true' || '' }}
|
|
GIT_COMMIT_DART_DEFINE: --dart-define=GIT_COMMIT=${{ github.sha }}
|
|
SENTRY_ENV_DART_DEFINE: --dart-define=SENTRY_ENVIRONMENT=github
|
|
DONATIONS_DART_DEFINE: --dart-define=ENABLE_DONATIONS=true
|
|
LINUX_APT_PACKAGES: >
|
|
clang cmake meson ninja-build pkg-config nasm libgtk-3-dev libevdev-dev liblzma-dev
|
|
libstdc++-12-dev libasound2-dev libass-dev libfreetype-dev libfontconfig-dev libfribidi-dev
|
|
libharfbuzz-dev libepoxy-dev libegl-dev libgl-dev libgnutls28-dev libpipewire-0.3-dev
|
|
libva-dev libvdpau-dev libx11-dev libxext-dev libxrandr-dev libxcursor-dev libxi-dev
|
|
libxss-dev libxpresent-dev libxkbcommon-dev libpulse-dev libdbus-1-dev libdrm-dev
|
|
libgbm-dev libwayland-dev wayland-protocols liblcms2-dev libmujs-dev liblua5.2-dev
|
|
ruby ruby-dev rubygems build-essential rpm libarchive-tools imagemagick libcurl4-openssl-dev
|
|
|
|
jobs:
|
|
build-android:
|
|
if: ${{ inputs.build_android }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Java
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: "temurin"
|
|
java-version: "17"
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
flutter-version: "3.44.0"
|
|
cache: true
|
|
pub-cache: false
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.pub-cache
|
|
key: ${{ runner.os }}-${{ runner.arch }}-pub-v2-${{ hashFiles('pubspec.yaml', 'pubspec.lock') }}
|
|
|
|
- name: Cache Gradle
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gradle-
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get --enforce-lockfile --no-example
|
|
|
|
- name: Configure Android signing
|
|
run: |
|
|
echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode > android/app/upload-keystore.jks
|
|
cat > android/key.properties << EOF
|
|
storePassword=${{ secrets.ANDROID_STORE_PASSWORD }}
|
|
keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
|
|
storeFile=upload-keystore.jks
|
|
EOF
|
|
|
|
- name: Build APKs
|
|
run: flutter build apk --release --split-per-abi --dart-define=ENABLE_UPDATE_CHECK=true ${{ env.SENTRY_DART_DEFINE }} ${{ env.GIT_COMMIT_DART_DEFINE }} ${{ env.SENTRY_ENV_DART_DEFINE }} --dart-define=SENTRY_DIST=github-android-apk ${{ env.DONATIONS_DART_DEFINE }} --obfuscate --split-debug-info=debug-info/android-apk --extra-gen-snapshot-options=--save-obfuscation-map=debug-info/android-apk/obfuscation.map.json
|
|
|
|
- name: Upload symbols to bugs.plezy.app
|
|
if: github.repository == 'edde746/plezy'
|
|
env:
|
|
BUGS_ADMIN_TOKEN: ${{ secrets.BUGS_ADMIN_TOKEN }}
|
|
SENTRY_DIST: github-android-apk
|
|
run: ./scripts/upload-symbols.sh android-apk
|
|
|
|
- name: Clean up keystore
|
|
if: always()
|
|
run: rm -f android/app/upload-keystore.jks android/key.properties
|
|
|
|
- name: Package APKs
|
|
run: |
|
|
tar -czf plezy-android-arm64-v8a.tar.gz -C build/app/outputs/flutter-apk app-arm64-v8a-release.apk --transform 's/app-arm64-v8a-release.apk/plezy.apk/'
|
|
tar -czf plezy-android-armeabi-v7a.tar.gz -C build/app/outputs/flutter-apk app-armeabi-v7a-release.apk --transform 's/app-armeabi-v7a-release.apk/plezy.apk/'
|
|
tar -czf plezy-android-x86_64.tar.gz -C build/app/outputs/flutter-apk app-x86_64-release.apk --transform 's/app-x86_64-release.apk/plezy.apk/'
|
|
|
|
- name: Attest APKs
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: |
|
|
plezy-android-arm64-v8a.tar.gz
|
|
plezy-android-armeabi-v7a.tar.gz
|
|
plezy-android-x86_64.tar.gz
|
|
|
|
- name: Upload APKs
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: android-apk
|
|
path: |
|
|
plezy-android-arm64-v8a.tar.gz
|
|
plezy-android-armeabi-v7a.tar.gz
|
|
plezy-android-x86_64.tar.gz
|
|
|
|
build-ios:
|
|
if: ${{ inputs.build_ios }}
|
|
runs-on: macos-26
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
flutter-version: "3.44.0"
|
|
cache: true
|
|
pub-cache: false
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.pub-cache
|
|
key: ${{ runner.os }}-${{ runner.arch }}-pub-v2-${{ hashFiles('pubspec.yaml', 'pubspec.lock') }}
|
|
|
|
- name: Cache CocoaPods
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
ios/Pods
|
|
~/Library/Caches/CocoaPods
|
|
~/.cocoapods
|
|
key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pods-
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get --enforce-lockfile --no-example
|
|
|
|
- name: Build iOS (no codesign)
|
|
run: flutter build ios --release --no-codesign --dart-define=ENABLE_UPDATE_CHECK=true ${{ env.SENTRY_DART_DEFINE }} ${{ env.GIT_COMMIT_DART_DEFINE }} ${{ env.SENTRY_ENV_DART_DEFINE }} --dart-define=SENTRY_DIST=github-ios ${{ env.DONATIONS_DART_DEFINE }} --split-debug-info=debug-info/ios
|
|
|
|
- name: Upload symbols to bugs.plezy.app
|
|
if: github.repository == 'edde746/plezy'
|
|
env:
|
|
BUGS_ADMIN_TOKEN: ${{ secrets.BUGS_ADMIN_TOKEN }}
|
|
SENTRY_DIST: github-ios
|
|
run: ./scripts/upload-symbols.sh ios
|
|
|
|
- name: Create IPA
|
|
run: |
|
|
mkdir -p Payload
|
|
cp -r build/ios/iphoneos/Runner.app Payload/
|
|
zip -r plezy-ios.ipa Payload
|
|
|
|
- name: Attest IPA
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: plezy-ios.ipa
|
|
|
|
- name: Upload IPA
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: ios-ipa
|
|
path: plezy-ios.ipa
|
|
|
|
build-macos:
|
|
if: ${{ inputs.build_macos }}
|
|
runs-on: macos-26
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
flutter-version: "3.44.0"
|
|
cache: true
|
|
pub-cache: false
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.pub-cache
|
|
key: ${{ runner.os }}-${{ runner.arch }}-pub-v2-${{ hashFiles('pubspec.yaml', 'pubspec.lock') }}
|
|
|
|
- name: Cache CocoaPods
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
macos/Pods
|
|
~/Library/Caches/CocoaPods
|
|
~/.cocoapods
|
|
key: ${{ runner.os }}-macos-pods-${{ hashFiles('**/Podfile.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-macos-pods-
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get --enforce-lockfile --no-example
|
|
|
|
- name: Build macOS
|
|
run: flutter build macos --release --dart-define=ENABLE_UPDATE_CHECK=true ${{ env.SENTRY_DART_DEFINE }} ${{ env.GIT_COMMIT_DART_DEFINE }} ${{ env.SENTRY_ENV_DART_DEFINE }} --dart-define=SENTRY_DIST=github-macos ${{ env.DONATIONS_DART_DEFINE }} --split-debug-info=debug-info/macos
|
|
|
|
- name: Upload symbols to bugs.plezy.app
|
|
if: github.repository == 'edde746/plezy'
|
|
env:
|
|
BUGS_ADMIN_TOKEN: ${{ secrets.BUGS_ADMIN_TOKEN }}
|
|
SENTRY_DIST: github-macos
|
|
run: ./scripts/upload-symbols.sh macos
|
|
|
|
- name: Import Code Signing Certificate
|
|
env:
|
|
MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
|
|
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
|
|
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
|
|
run: |
|
|
# Create temporary keychain
|
|
KEYCHAIN_PATH=$RUNNER_TEMP/build.keychain
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
|
|
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
|
|
|
|
# Import certificate to keychain
|
|
CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
|
|
echo "$MACOS_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
|
|
security import $CERTIFICATE_PATH -k $KEYCHAIN_PATH -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
|
|
|
|
# Add keychain to search list
|
|
security list-keychains -d user -s $KEYCHAIN_PATH login.keychain
|
|
|
|
- name: Sign Application
|
|
env:
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
# Find the identity
|
|
IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | grep -o '".*"' | tr -d '"')
|
|
echo "Signing with identity: $IDENTITY"
|
|
|
|
APP_PATH="build/macos/Build/Products/Release/Plezy.app"
|
|
|
|
# Deep sign everything inside-out: executables, dylibs, XPC services, app bundles, frameworks
|
|
find "$APP_PATH/Contents/Frameworks" \( -name "*.xpc" -o -name "*.app" -o -name "*.framework" -o -name "*.dylib" \) -print0 \
|
|
| sort -zr \
|
|
| while IFS= read -r -d '' item; do
|
|
echo "Signing: $item"
|
|
codesign --force --sign "$IDENTITY" --timestamp --options runtime "$item"
|
|
done
|
|
|
|
# Sign any remaining bare executables (e.g. Sparkle's Autoupdate)
|
|
find "$APP_PATH/Contents/Frameworks" -type f -perm +111 ! -name "*.dylib" ! -path "*/Headers/*" ! -path "*/Modules/*" -print0 \
|
|
| while IFS= read -r -d '' exe; do
|
|
codesign --force --sign "$IDENTITY" --timestamp --options runtime "$exe" 2>/dev/null || true
|
|
done
|
|
|
|
# Sign the app bundle itself
|
|
echo "Signing app bundle: $APP_PATH"
|
|
codesign --force --sign "$IDENTITY" --timestamp --options runtime --entitlements macos/Runner/Release.entitlements "$APP_PATH"
|
|
|
|
- name: Verify Signature
|
|
run: |
|
|
APP_PATH="build/macos/Build/Products/Release/Plezy.app"
|
|
echo "Verifying signature..."
|
|
codesign -dvvv "$APP_PATH"
|
|
echo "Verifying signed entitlements..."
|
|
codesign -d --entitlements :- "$APP_PATH" > "$RUNNER_TEMP/macos-entitlements.plist"
|
|
/usr/libexec/PlistBuddy -c "Print" "$RUNNER_TEMP/macos-entitlements.plist"
|
|
/usr/libexec/PlistBuddy -c "Print :com.apple.security.cs.allow-jit" "$RUNNER_TEMP/macos-entitlements.plist"
|
|
/usr/libexec/PlistBuddy -c "Print :com.apple.security.cs.allow-unsigned-executable-memory" "$RUNNER_TEMP/macos-entitlements.plist"
|
|
codesign --verify --deep --strict --verbose=2 "$APP_PATH"
|
|
|
|
- name: Notarize Application
|
|
env:
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
APP_PATH="build/macos/Build/Products/Release/Plezy.app"
|
|
|
|
# Create a temporary ZIP for notarization submission
|
|
echo "Creating ZIP for notarization..."
|
|
ditto -c -k --keepParent "$APP_PATH" notarization.zip
|
|
|
|
# Submit for notarization
|
|
echo "Submitting to Apple's notary service..."
|
|
xcrun notarytool submit notarization.zip \
|
|
--apple-id "$APPLE_ID" \
|
|
--password "$APPLE_APP_SPECIFIC_PASSWORD" \
|
|
--team-id "$APPLE_TEAM_ID" \
|
|
--wait
|
|
|
|
# Staple the notarization ticket to the app
|
|
echo "Stapling notarization ticket..."
|
|
xcrun stapler staple "$APP_PATH"
|
|
|
|
# Verify stapling
|
|
echo "Verifying notarization..."
|
|
xcrun stapler validate "$APP_PATH"
|
|
|
|
- name: Create DMG
|
|
run: |
|
|
mkdir -p dmg-staging
|
|
cp -R build/macos/Build/Products/Release/Plezy.app dmg-staging/
|
|
ln -s /Applications dmg-staging/Applications
|
|
hdiutil create -format ULMO -srcfolder dmg-staging -volname "Plezy" plezy-macos.dmg
|
|
|
|
- name: Sign DMG for Sparkle (EdDSA)
|
|
if: env.SPARKLE_PRIVATE_KEY != ''
|
|
env:
|
|
SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
|
|
run: |
|
|
printf -- "-----BEGIN ED25519 PRIVATE KEY-----\n%s\n-----END ED25519 PRIVATE KEY-----\n" "$SPARKLE_PRIVATE_KEY" > ed25519_key.pem
|
|
OUTPUT=$(dart run auto_updater:sign_update plezy-macos.dmg ed25519_key.pem)
|
|
rm ed25519_key.pem
|
|
# Extract edSignature value from output like: sparkle:edSignature="..." length="..."
|
|
SIGNATURE=$(echo "$OUTPUT" | grep -o 'edSignature="[^"]*"' | sed 's/edSignature="//;s/"//')
|
|
echo "MACOS_ED_SIGNATURE=$SIGNATURE" >> $GITHUB_ENV
|
|
echo "MACOS_DMG_SIZE=$(stat -f%z plezy-macos.dmg)" >> $GITHUB_ENV
|
|
|
|
- name: Attest macOS DMG
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: plezy-macos.dmg
|
|
|
|
- name: Write macOS signature metadata
|
|
run: |
|
|
echo "${{ env.MACOS_ED_SIGNATURE }}" > macos-ed-signature.txt
|
|
echo "${{ env.MACOS_DMG_SIZE }}" > macos-dmg-size.txt
|
|
|
|
- name: Upload macOS DMG
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: macos-dmg
|
|
path: |
|
|
plezy-macos.dmg
|
|
macos-ed-signature.txt
|
|
macos-dmg-size.txt
|
|
|
|
build-windows-x64:
|
|
if: ${{ inputs.build_windows }}
|
|
runs-on: windows-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
flutter-version: "3.44.0"
|
|
cache: true
|
|
pub-cache: false
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~\AppData\Local\Pub\Cache
|
|
key: ${{ runner.os }}-${{ runner.arch }}-pub-v2-${{ hashFiles('pubspec.yaml', 'pubspec.lock') }}
|
|
|
|
- name: Cache Windows native dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: build/windows/x64/_deps
|
|
key: windows-native-x64-${{ hashFiles('windows/CMakeLists.txt') }}
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get --enforce-lockfile --no-example
|
|
|
|
- name: Install patched Flutter engine (DComp)
|
|
shell: pwsh
|
|
run: |
|
|
flutter precache --windows
|
|
.\windows\tool\install-patched-engine.ps1
|
|
|
|
- name: Build Windows x64
|
|
run: flutter build windows --release --dart-define=ENABLE_UPDATE_CHECK=true ${{ env.SENTRY_DART_DEFINE }} ${{ env.GIT_COMMIT_DART_DEFINE }} ${{ env.SENTRY_ENV_DART_DEFINE }} --dart-define=SENTRY_DIST=github-windows-x64 ${{ env.DONATIONS_DART_DEFINE }} --split-debug-info=debug-info/windows-x64
|
|
|
|
- name: Upload symbols to bugs.plezy.app
|
|
if: github.repository == 'edde746/plezy'
|
|
shell: pwsh
|
|
env:
|
|
BUGS_ADMIN_TOKEN: ${{ secrets.BUGS_ADMIN_TOKEN }}
|
|
SENTRY_DIST: github-windows-x64
|
|
run: .\scripts\upload-symbols.ps1 windows-x64
|
|
|
|
- name: Upload x64 build
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: windows-x64-build
|
|
path: build/windows/x64/runner/Release/
|
|
|
|
build-windows-arm64:
|
|
if: ${{ inputs.build_windows }}
|
|
runs-on: windows-11-arm
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Cache Windows native dependencies
|
|
id: windows-native-cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
build/windows/arm64/_deps
|
|
build/windows/arm64/mpv-dev-arm64
|
|
key: windows-native-arm64-${{ hashFiles('windows/CMakeLists.txt') }}
|
|
|
|
- name: Install 7-Zip
|
|
if: steps.windows-native-cache.outputs.cache-hit != 'true'
|
|
run: choco install 7zip -y
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
flutter-version: "3.44.0"
|
|
cache: true
|
|
pub-cache: false
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~\AppData\Local\Pub\Cache
|
|
key: ${{ runner.os }}-${{ runner.arch }}-pub-v2-${{ hashFiles('pubspec.yaml', 'pubspec.lock') }}
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get --no-example
|
|
|
|
- name: Install patched Flutter engine (DComp)
|
|
shell: pwsh
|
|
run: |
|
|
flutter precache --windows
|
|
.\windows\tool\install-patched-engine.ps1
|
|
|
|
- name: Build Windows arm64
|
|
run: flutter build windows --release --dart-define=ENABLE_UPDATE_CHECK=true ${{ env.SENTRY_DART_DEFINE }} ${{ env.GIT_COMMIT_DART_DEFINE }} ${{ env.SENTRY_ENV_DART_DEFINE }} --dart-define=SENTRY_DIST=github-windows-arm64 ${{ env.DONATIONS_DART_DEFINE }} --split-debug-info=debug-info/windows-arm64
|
|
|
|
- name: Upload symbols to bugs.plezy.app
|
|
if: github.repository == 'edde746/plezy'
|
|
shell: pwsh
|
|
env:
|
|
BUGS_ADMIN_TOKEN: ${{ secrets.BUGS_ADMIN_TOKEN }}
|
|
SENTRY_DIST: github-windows-arm64
|
|
run: .\scripts\upload-symbols.ps1 windows-arm64
|
|
|
|
- name: Upload arm64 build
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: windows-arm64-build
|
|
path: build/windows/arm64/runner/Release/
|
|
|
|
package-windows:
|
|
needs: [build-windows-x64, build-windows-arm64]
|
|
if: ${{ inputs.build_windows }}
|
|
runs-on: windows-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Dart
|
|
uses: dart-lang/setup-dart@v1
|
|
|
|
- name: Download x64 build
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: windows-x64-build
|
|
path: build-x64
|
|
|
|
- name: Download arm64 build
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: windows-arm64-build
|
|
path: build-arm64
|
|
|
|
- name: Read version from pubspec
|
|
id: version
|
|
shell: pwsh
|
|
run: |
|
|
$v = (Select-String -Path pubspec.yaml -Pattern '^version:\s*(\S+)').Matches[0].Groups[1].Value -replace '\+.*'
|
|
echo "version=$v" >> $env:GITHUB_OUTPUT
|
|
|
|
- name: Build installer and portables
|
|
run: .\windows\build-installer.ps1 -X64BuildDir "build-x64" -Arm64BuildDir "build-arm64" -Version "${{ steps.version.outputs.version }}"
|
|
|
|
- name: Sign installer for WinSparkle (EdDSA)
|
|
if: env.SPARKLE_PRIVATE_KEY != ''
|
|
env:
|
|
SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
|
|
shell: pwsh
|
|
run: |
|
|
mkdir _signer | Out-Null
|
|
@{name="signer"; environment=@{sdk=">=3.0.0 <4.0.0"}; dependencies=@{cryptography="^2.7.0"}} | ConvertTo-Json -Depth 3 | Out-File _signer/pubspec.yaml
|
|
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/edde746/auto_updater/main/packages/auto_updater/bin/sign_update.dart" -OutFile _signer/sign.dart
|
|
Push-Location _signer
|
|
dart pub get
|
|
Set-Content -Path ed25519_key.pem -Value $env:SPARKLE_PRIVATE_KEY -Encoding ascii -NoNewline
|
|
$output = dart run sign.dart ../plezy-windows-installer.exe ed25519_key.pem
|
|
Pop-Location
|
|
Remove-Item _signer -Recurse -Force
|
|
$sig = [regex]::Match($output, 'edSignature="([^"]*)"').Groups[1].Value
|
|
Set-Content -Path win-ed-signature.txt -Value $sig -Encoding ascii -NoNewline
|
|
Set-Content -Path win-installer-size.txt -Value (Get-Item plezy-windows-installer.exe).Length.ToString() -Encoding ascii -NoNewline
|
|
|
|
- name: Attest Windows artifacts
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: |
|
|
plezy-windows-x64-portable.7z
|
|
plezy-windows-arm64-portable.7z
|
|
plezy-windows-installer.exe
|
|
|
|
- name: Upload x64 portable
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: windows-x64-portable
|
|
path: plezy-windows-x64-portable.7z
|
|
|
|
- name: Upload arm64 portable
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: windows-arm64-portable
|
|
path: plezy-windows-arm64-portable.7z
|
|
|
|
- name: Upload installer
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: windows-installer
|
|
path: |
|
|
plezy-windows-installer.exe
|
|
win-ed-signature.txt
|
|
win-installer-size.txt
|
|
|
|
build-linux-x64:
|
|
if: ${{ inputs.build_linux }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
flutter-version: "3.44.0"
|
|
cache: true
|
|
pub-cache: false
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.pub-cache
|
|
key: ${{ runner.os }}-${{ runner.arch }}-pub-v2-${{ hashFiles('pubspec.yaml', 'pubspec.lock') }}
|
|
|
|
- name: Cache APT packages
|
|
uses: awalsh128/cache-apt-pkgs-action@latest
|
|
with:
|
|
packages: ${{ env.LINUX_APT_PACKAGES }}
|
|
version: 1.1
|
|
|
|
- name: Install Linux dependencies
|
|
run: |
|
|
read -r -a packages <<< "$LINUX_APT_PACKAGES"
|
|
|
|
for attempt in 1 2 3; do
|
|
if sudo apt-get update -o Acquire::Retries=3 && sudo apt-get install -y -o Acquire::Retries=3 "${packages[@]}"; then
|
|
exit 0
|
|
fi
|
|
|
|
sudo apt-get clean
|
|
sudo rm -rf /var/lib/apt/lists/*
|
|
sleep $((attempt * 15))
|
|
done
|
|
|
|
exit 1
|
|
|
|
- name: Cache libmpv build
|
|
id: libmpv-cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: libmpv-prefix
|
|
key: libmpv-${{ runner.arch }}-${{ hashFiles('linux/packaging/build-libmpv.sh') }}
|
|
|
|
- name: Build libmpv
|
|
if: steps.libmpv-cache.outputs.cache-hit != 'true'
|
|
run: bash linux/packaging/build-libmpv.sh
|
|
|
|
- name: Install fpm
|
|
run: sudo gem install fpm
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get --enforce-lockfile --no-example
|
|
|
|
- name: Build Linux x64
|
|
run: flutter build linux --release --dart-define=ENABLE_UPDATE_CHECK=true ${{ env.SENTRY_DART_DEFINE }} ${{ env.GIT_COMMIT_DART_DEFINE }} ${{ env.SENTRY_ENV_DART_DEFINE }} --dart-define=SENTRY_DIST=github-linux-x64 ${{ env.DONATIONS_DART_DEFINE }} --split-debug-info=debug-info/linux-x64
|
|
env:
|
|
PKG_CONFIG_PATH: ${{ github.workspace }}/libmpv-prefix/lib/pkgconfig:${{ github.workspace }}/libmpv-prefix/lib/x86_64-linux-gnu/pkgconfig
|
|
|
|
- name: Upload symbols to bugs.plezy.app
|
|
if: github.repository == 'edde746/plezy'
|
|
env:
|
|
BUGS_ADMIN_TOKEN: ${{ secrets.BUGS_ADMIN_TOKEN }}
|
|
SENTRY_DIST: github-linux-x64
|
|
run: ./scripts/upload-symbols.sh linux-x64
|
|
|
|
- name: Build Linux Packages
|
|
run: ARCH_SUFFIX=x64 OUTPUT_DIR=$GITHUB_WORKSPACE python3 linux/packaging/build-packages.py
|
|
|
|
- name: Copy libmpv into bundle
|
|
run: |
|
|
BUNDLE_LIB=build/linux/x64/release/bundle/lib
|
|
LIBMPV_DIR=$(dirname "$(find libmpv-prefix -name 'libmpv.so' | head -1)")
|
|
cp -a "$LIBMPV_DIR"/libmpv.so* "$BUNDLE_LIB/"
|
|
cp -a libmpv-prefix/lib/libshaderc_shared.so* "$BUNDLE_LIB/"
|
|
|
|
- name: Bundle shared libraries for portable tarball
|
|
run: bash linux/packaging/bundle-libs.sh build/linux/x64/release/bundle
|
|
|
|
- name: Copy wrapper script into bundle
|
|
run: cp linux/packaging/plezy.sh build/linux/x64/release/bundle/plezy.sh
|
|
|
|
- name: Verify no missing dependencies
|
|
run: |
|
|
cd build/linux/x64/release/bundle
|
|
MISSING=$(LD_LIBRARY_PATH=lib ldd ./plezy 2>&1 | grep "not found" || true)
|
|
if [[ -n "$MISSING" ]]; then
|
|
echo "ERROR: Unresolved dependencies found:" >&2
|
|
echo "$MISSING" >&2
|
|
exit 1
|
|
fi
|
|
echo "All dependencies resolved."
|
|
|
|
- name: Create tarball
|
|
run: |
|
|
cd build/linux/x64/release/bundle
|
|
tar -czf $GITHUB_WORKSPACE/plezy-linux-x64.tar.gz *
|
|
|
|
- name: Attest Linux x64 artifacts
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: |
|
|
plezy-linux-x64.tar.gz
|
|
plezy-linux-x64.deb
|
|
plezy-linux-x64.rpm
|
|
plezy-linux-x64.pkg.tar.zst
|
|
|
|
- name: Upload Linux x64 artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: linux-x64
|
|
path: |
|
|
plezy-linux-x64.tar.gz
|
|
plezy-linux-x64.deb
|
|
plezy-linux-x64.rpm
|
|
plezy-linux-x64.pkg.tar.zst
|
|
|
|
build-linux-arm64:
|
|
if: ${{ inputs.build_linux }}
|
|
runs-on: ubuntu-24.04-arm
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "master"
|
|
flutter-version: "3.44.0"
|
|
cache: true
|
|
pub-cache: false
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.pub-cache
|
|
key: ${{ runner.os }}-${{ runner.arch }}-pub-v2-${{ hashFiles('pubspec.yaml', 'pubspec.lock') }}
|
|
|
|
- name: Cache APT packages
|
|
uses: awalsh128/cache-apt-pkgs-action@latest
|
|
with:
|
|
packages: ${{ env.LINUX_APT_PACKAGES }}
|
|
version: 1.1
|
|
|
|
- name: Install Linux dependencies
|
|
run: |
|
|
read -r -a packages <<< "$LINUX_APT_PACKAGES"
|
|
|
|
for attempt in 1 2 3; do
|
|
if sudo apt-get update -o Acquire::Retries=3 && sudo apt-get install -y -o Acquire::Retries=3 "${packages[@]}"; then
|
|
exit 0
|
|
fi
|
|
|
|
sudo apt-get clean
|
|
sudo rm -rf /var/lib/apt/lists/*
|
|
sleep $((attempt * 15))
|
|
done
|
|
|
|
exit 1
|
|
|
|
- name: Cache libmpv build
|
|
id: libmpv-cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: libmpv-prefix
|
|
key: libmpv-${{ runner.arch }}-${{ hashFiles('linux/packaging/build-libmpv.sh') }}
|
|
|
|
- name: Build libmpv
|
|
if: steps.libmpv-cache.outputs.cache-hit != 'true'
|
|
run: bash linux/packaging/build-libmpv.sh
|
|
|
|
- name: Install fpm
|
|
run: sudo gem install fpm
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get --no-example
|
|
|
|
- name: Build Linux arm64
|
|
run: flutter build linux --release --dart-define=ENABLE_UPDATE_CHECK=true ${{ env.SENTRY_DART_DEFINE }} ${{ env.GIT_COMMIT_DART_DEFINE }} ${{ env.SENTRY_ENV_DART_DEFINE }} --dart-define=SENTRY_DIST=github-linux-arm64 ${{ env.DONATIONS_DART_DEFINE }} --split-debug-info=debug-info/linux-arm64
|
|
env:
|
|
PKG_CONFIG_PATH: ${{ github.workspace }}/libmpv-prefix/lib/pkgconfig:${{ github.workspace }}/libmpv-prefix/lib/aarch64-linux-gnu/pkgconfig
|
|
|
|
- name: Upload symbols to bugs.plezy.app
|
|
if: github.repository == 'edde746/plezy'
|
|
env:
|
|
BUGS_ADMIN_TOKEN: ${{ secrets.BUGS_ADMIN_TOKEN }}
|
|
SENTRY_DIST: github-linux-arm64
|
|
run: ./scripts/upload-symbols.sh linux-arm64
|
|
|
|
- name: Find bundle directory
|
|
id: find-bundle
|
|
run: |
|
|
BUNDLE_DIR=$(find build/linux -path "*/release/bundle" -type d | head -1)
|
|
echo "bundle_dir=$BUNDLE_DIR" >> $GITHUB_OUTPUT
|
|
|
|
- name: Build Linux Packages
|
|
run: |
|
|
BUILD_DIR=${{ steps.find-bundle.outputs.bundle_dir }} \
|
|
ARCH_SUFFIX=arm64 \
|
|
OUTPUT_DIR=$GITHUB_WORKSPACE \
|
|
python3 linux/packaging/build-packages.py
|
|
|
|
- name: Copy libmpv into bundle
|
|
run: |
|
|
BUNDLE_LIB=${{ steps.find-bundle.outputs.bundle_dir }}/lib
|
|
LIBMPV_DIR=$(dirname "$(find libmpv-prefix -name 'libmpv.so' | head -1)")
|
|
cp -a "$LIBMPV_DIR"/libmpv.so* "$BUNDLE_LIB/"
|
|
cp -a libmpv-prefix/lib/libshaderc_shared.so* "$BUNDLE_LIB/"
|
|
|
|
- name: Bundle shared libraries for portable tarball
|
|
run: bash linux/packaging/bundle-libs.sh ${{ steps.find-bundle.outputs.bundle_dir }}
|
|
|
|
- name: Copy wrapper script into bundle
|
|
run: cp linux/packaging/plezy.sh ${{ steps.find-bundle.outputs.bundle_dir }}/plezy.sh
|
|
|
|
- name: Verify no missing dependencies
|
|
run: |
|
|
cd ${{ steps.find-bundle.outputs.bundle_dir }}
|
|
MISSING=$(LD_LIBRARY_PATH=lib ldd ./plezy 2>&1 | grep "not found" || true)
|
|
if [[ -n "$MISSING" ]]; then
|
|
echo "ERROR: Unresolved dependencies found:" >&2
|
|
echo "$MISSING" >&2
|
|
exit 1
|
|
fi
|
|
echo "All dependencies resolved."
|
|
|
|
- name: Create tarball
|
|
run: |
|
|
cd ${{ steps.find-bundle.outputs.bundle_dir }}
|
|
tar -czf $GITHUB_WORKSPACE/plezy-linux-arm64.tar.gz *
|
|
|
|
- name: Attest Linux arm64 artifacts
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: |
|
|
plezy-linux-arm64.tar.gz
|
|
plezy-linux-arm64.deb
|
|
plezy-linux-arm64.rpm
|
|
plezy-linux-arm64.pkg.tar.zst
|
|
|
|
- name: Upload Linux arm64 artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: linux-arm64
|
|
path: |
|
|
plezy-linux-arm64.tar.gz
|
|
plezy-linux-arm64.deb
|
|
plezy-linux-arm64.rpm
|
|
plezy-linux-arm64.pkg.tar.zst
|
|
|
|
create-release:
|
|
needs: [build-android, build-ios, build-macos, build-windows-x64, build-windows-arm64, package-windows, build-linux-x64, build-linux-arm64]
|
|
if: ${{ always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') && (inputs.build_android || inputs.build_ios || inputs.build_macos || inputs.build_windows || inputs.build_linux) }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
sparse-checkout: pubspec.yaml
|
|
sparse-checkout-cone-mode: false
|
|
|
|
- name: Download Android artifacts
|
|
if: ${{ inputs.build_android }}
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: android-apk
|
|
path: artifacts/android-apk
|
|
|
|
- name: Download iOS artifact
|
|
if: ${{ inputs.build_ios }}
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: ios-ipa
|
|
path: artifacts/ios-ipa
|
|
|
|
- name: Download macOS artifact
|
|
if: ${{ inputs.build_macos }}
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: macos-dmg
|
|
path: artifacts/macos-dmg
|
|
|
|
- name: Download Windows x64 artifact
|
|
if: ${{ inputs.build_windows }}
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: windows-x64-portable
|
|
path: artifacts/windows-x64-portable
|
|
|
|
- name: Download Windows arm64 artifact
|
|
if: ${{ inputs.build_windows }}
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: windows-arm64-portable
|
|
path: artifacts/windows-arm64-portable
|
|
|
|
- name: Download Windows installer artifact
|
|
if: ${{ inputs.build_windows }}
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: windows-installer
|
|
path: artifacts/windows-installer
|
|
|
|
- name: Download Linux x64 artifacts
|
|
if: ${{ inputs.build_linux }}
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: linux-x64
|
|
path: artifacts/linux-x64
|
|
|
|
- name: Download Linux arm64 artifacts
|
|
if: ${{ inputs.build_linux }}
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: linux-arm64
|
|
path: artifacts/linux-arm64
|
|
|
|
- name: Display structure of downloaded files
|
|
run: ls -R artifacts
|
|
|
|
- name: Read version from pubspec.yaml
|
|
id: version
|
|
run: |
|
|
VERSION=$(grep '^version:' pubspec.yaml | sed 's/version: //' | sed 's/+.*//')
|
|
BUILD_NUMBER=$(grep '^version:' pubspec.yaml | sed 's/.*+//')
|
|
echo "version=$VERSION" >> $GITHUB_OUTPUT
|
|
echo "build_number=$BUILD_NUMBER" >> $GITHUB_OUTPUT
|
|
|
|
- name: Generate appcast.xml
|
|
run: |
|
|
VERSION="${{ steps.version.outputs.version }}"
|
|
BUILD_NUMBER="${{ steps.version.outputs.build_number }}"
|
|
|
|
# Read macOS signature metadata (may be empty if secrets not configured)
|
|
MACOS_ED_SIG=""
|
|
MACOS_DMG_SIZE="0"
|
|
if [ -f artifacts/macos-dmg/macos-ed-signature.txt ]; then
|
|
MACOS_ED_SIG=$(cat artifacts/macos-dmg/macos-ed-signature.txt)
|
|
fi
|
|
if [ -f artifacts/macos-dmg/macos-dmg-size.txt ]; then
|
|
MACOS_DMG_SIZE=$(cat artifacts/macos-dmg/macos-dmg-size.txt)
|
|
fi
|
|
|
|
# Read Windows signature metadata (may be empty if secrets not configured)
|
|
WIN_ED_SIG=""
|
|
WIN_INSTALLER_SIZE="0"
|
|
if [ -f artifacts/windows-installer/win-ed-signature.txt ]; then
|
|
WIN_ED_SIG=$(cat artifacts/windows-installer/win-ed-signature.txt)
|
|
fi
|
|
if [ -f artifacts/windows-installer/win-installer-size.txt ]; then
|
|
WIN_INSTALLER_SIZE=$(cat artifacts/windows-installer/win-installer-size.txt)
|
|
fi
|
|
|
|
cat > appcast.xml << XMLEOF
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
|
|
<channel>
|
|
<title>Plezy Updates</title>
|
|
<item>
|
|
<title>Version ${VERSION}</title>
|
|
<sparkle:version>${BUILD_NUMBER}</sparkle:version>
|
|
<sparkle:shortVersionString>${VERSION}</sparkle:shortVersionString>
|
|
<sparkle:releaseNotesLink>https://gh-html.edde746.dev/edde746/plezy/${VERSION}</sparkle:releaseNotesLink>
|
|
XMLEOF
|
|
|
|
# macOS enclosure
|
|
if [ -n "$MACOS_ED_SIG" ]; then
|
|
cat >> appcast.xml << XMLEOF
|
|
<enclosure url="https://github.com/edde746/plezy/releases/download/${VERSION}/plezy-macos.dmg"
|
|
length="${MACOS_DMG_SIZE}" type="application/octet-stream"
|
|
sparkle:edSignature="${MACOS_ED_SIG}"
|
|
sparkle:os="macos" />
|
|
XMLEOF
|
|
fi
|
|
|
|
# Windows enclosure
|
|
if [ -n "$WIN_ED_SIG" ]; then
|
|
cat >> appcast.xml << XMLEOF
|
|
<enclosure url="https://github.com/edde746/plezy/releases/download/${VERSION}/plezy-windows-installer.exe"
|
|
length="${WIN_INSTALLER_SIZE}" type="application/octet-stream"
|
|
sparkle:edSignature="${WIN_ED_SIG}"
|
|
sparkle:installerArguments="/SILENT /SP-"
|
|
sparkle:os="windows" />
|
|
XMLEOF
|
|
fi
|
|
|
|
cat >> appcast.xml << 'XMLEOF'
|
|
</item>
|
|
</channel>
|
|
</rss>
|
|
XMLEOF
|
|
|
|
# Clean up leading whitespace from heredoc indentation
|
|
sed -i 's/^ //' appcast.xml
|
|
|
|
echo "Generated appcast.xml:"
|
|
cat appcast.xml
|
|
|
|
- name: Collect release files
|
|
id: release-files
|
|
run: |
|
|
{
|
|
echo 'files<<EOF'
|
|
if [ "${{ inputs.build_android }}" = "true" ]; then
|
|
echo artifacts/android-apk/plezy-android-arm64-v8a.tar.gz
|
|
echo artifacts/android-apk/plezy-android-armeabi-v7a.tar.gz
|
|
echo artifacts/android-apk/plezy-android-x86_64.tar.gz
|
|
fi
|
|
if [ "${{ inputs.build_ios }}" = "true" ]; then
|
|
echo artifacts/ios-ipa/plezy-ios.ipa
|
|
fi
|
|
if [ "${{ inputs.build_macos }}" = "true" ]; then
|
|
echo artifacts/macos-dmg/plezy-macos.dmg
|
|
fi
|
|
if [ "${{ inputs.build_windows }}" = "true" ]; then
|
|
echo artifacts/windows-x64-portable/plezy-windows-x64-portable.7z
|
|
echo artifacts/windows-arm64-portable/plezy-windows-arm64-portable.7z
|
|
echo artifacts/windows-installer/plezy-windows-installer.exe
|
|
fi
|
|
if [ "${{ inputs.build_linux }}" = "true" ]; then
|
|
echo 'artifacts/linux-x64/*'
|
|
echo 'artifacts/linux-arm64/*'
|
|
fi
|
|
echo appcast.xml
|
|
echo EOF
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create Release
|
|
uses: softprops/action-gh-release@v1
|
|
with:
|
|
files: ${{ steps.release-files.outputs.files }}
|
|
draft: true
|
|
prerelease: false
|
|
generate_release_notes: true
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|