OpenResearch/.github/workflows/release-linux-app.yml

# Attaches the Linux desktop app (OpenResearch-<arch>.AppImage for x86_64 and
# aarch64) and linux-app.json, which the AppImage's self-update reads, to a
# GitHub Release. Unlike the CLI's static musl binaries, the app is a glibc build
# with the `desktop` feature, so it is built here from the release's commit.
#
# Triggers mirror release-macos-app.yml: the automatic workflow_run after a
# successful dispatched "Release", or a manual dispatch naming the tag. Gated on
# the repo variable LINUX_APP_ENABLED. See docs/linux.md.

name: Attach Linux app to release

on:
  workflow_run:
    workflows: ["Release"]
    types: [completed]
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag to attach the Linux app to (e.g. v0.2.11)
        required: true
        type: string

# Write access only in `publish`: the build jobs run third-party packaging tools.
permissions:
  actions: read # resolve the upstream release source artifact
  contents: read

concurrency:
  group: release-linux-app
  cancel-in-progress: false

jobs:
  check:
    if: ${{ vars.LINUX_APP_ENABLED == 'true' && (github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'workflow_dispatch')) }}
    runs-on: ubuntu-latest
    outputs:
      ok: ${{ steps.gate.outputs.ok }}
      tag: ${{ steps.gate.outputs.tag }}
      source-sha: ${{ steps.gate.outputs.sha }}
      release-run-id: ${{ steps.gate.outputs.release-run-id }}
    env:
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - id: gate
        env:
          INPUT_TAG: ${{ inputs.tag }}
          RELEASE_RUN_ID: ${{ github.event.workflow_run.id }}
        run: |
          set -euo pipefail
          if [ -n "$INPUT_TAG" ]; then
            tag="$INPUT_TAG"
          else
            gh run download "$RELEASE_RUN_ID" --repo "$GITHUB_REPOSITORY" --name release-source --dir "$RUNNER_TEMP/release-source"
            tag=$(jq -er .tag "$RUNNER_TEMP/release-source/release-source.json")
            expected_sha=$(jq -er .sha "$RUNNER_TEMP/release-source/release-source.json")
          fi
          if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "::notice::No release $tag found — nothing to attach."
            echo "ok=false" >> "$GITHUB_OUTPUT"; exit 0
          fi
          git fetch origin "refs/tags/$tag:refs/tags/$tag"
          sha=$(git rev-parse "refs/tags/$tag^{commit}")
          git merge-base --is-ancestor "$sha" origin/main
          if [ -n "${expected_sha:-}" ]; then test "$sha" = "$expected_sha"; fi
          version=$(git show "$sha:Cargo.toml" | grep -m1 '^version = ' | sed -E 's/version = "(.*)"/\1/')
          test "$tag" = "v$version"
          if [ -z "$RELEASE_RUN_ID" ] && ! git cat-file -e "$sha:ui/dist/index.html" 2>/dev/null; then
            RELEASE_RUN_ID=$(bash scripts/find-release-run.sh "$tag" "$sha")
          fi
          echo "ok=true" >> "$GITHUB_OUTPUT"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "sha=$sha" >> "$GITHUB_OUTPUT"
          echo "release-run-id=$RELEASE_RUN_ID" >> "$GITHUB_OUTPUT"

  appimage:
    needs: check
    if: ${{ needs.check.outputs.ok == 'true' }}
    strategy:
      matrix:
        include:
          - arch: x86_64
            runner: ubuntu-22.04
          - arch: aarch64
            runner: ubuntu-22.04-arm
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ needs.check.outputs.source-sha }}

      - name: Remove checked-in UI
        if: needs.check.outputs.release-run-id != ''
        run: rm -rf ui/dist
      - name: Download release UI
        if: needs.check.outputs.release-run-id != ''
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: release-ui
          path: ui/dist
          run-id: ${{ needs.check.outputs.release-run-id }}
          github-token: ${{ github.token }}

      - name: Install WebKitGTK and packaging tools
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev file patchelf xvfb xdotool

      # The runner's preinstalled stable toolchain, as release-macos-app.yml uses.
      - name: Build the production orx
        run: ORX_OFFICIAL_RELEASE_BUILD=1 cargo build --release --locked --features desktop

      - name: Verify the production channel
        env:
          ORX_TELEMETRY_ENV: "off"
        run: test "$(target/release/orx version --build-channel)" = production

      - name: Package the AppImage
        run: scripts/build-linux-appimage.sh target/release/orx app-dist

      # Otherwise the host's WebKit would stand in for a broken bundled one.
      - name: Remove WebKitGTK from the runner
        run: sudo apt-get remove -y libwebkit2gtk-4.1-0 libjavascriptcoregtk-4.1-0

      - name: Smoke-test the AppImage
        run: scripts/smoke-test-linux-appimage.sh app-dist/OpenResearch-${{ matrix.arch }}.AppImage

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: appimage-${{ matrix.arch }}
          path: app-dist/OpenResearch-${{ matrix.arch }}.AppImage
          if-no-files-found: error

  # linux-app.json is what the AppImage's self-updater reads, so it goes up only
  # after both AppImages it describes, and a re-run deletes the old one first.
  publish:
    needs: [check, appimage]
    runs-on: ubuntu-latest
    permissions:
      contents: write # upload release assets
    env:
      GH_TOKEN: ${{ github.token }}
      TAG: ${{ needs.check.outputs.tag }}
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: appimage-*
          merge-multiple: true
          path: app-dist

      - name: Upload the AppImages and their manifest to the release
        run: |
          set -euo pipefail
          gh release delete-asset "$TAG" linux-app.json --repo "$GITHUB_REPOSITORY" --yes 2>/dev/null || true
          gh release upload "$TAG" app-dist/OpenResearch-*.AppImage --repo "$GITHUB_REPOSITORY" --clobber
          asset() {
            jq -n --arg asset "OpenResearch-$1.AppImage" \
              --arg sha256 "$(sha256sum "app-dist/OpenResearch-$1.AppImage" | cut -d' ' -f1)" '$ARGS.named'
          }
          jq -n \
            --arg version "${TAG#v}" \
            --arg tag "$TAG" \
            --argjson x86_64 "$(asset x86_64)" \
            --argjson aarch64 "$(asset aarch64)" \
            '{version: $version, tag: $tag, assets: {x86_64: $x86_64, aarch64: $aarch64}}' > app-dist/linux-app.json
          cat app-dist/linux-app.json
          gh release upload "$TAG" app-dist/linux-app.json --repo "$GITHUB_REPOSITORY" --clobber

  refresh-downloads:
    needs: [check, publish]
    permissions:
      contents: write
    uses: ./.github/workflows/release-downloads.yml
    with:
      tag: ${{ needs.check.outputs.tag }}