OpenShell/.github/workflows/snap-package.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Snap Package

on:
  workflow_call:
    inputs:
      checkout-ref:
        required: true
        type: string
      upload-channel:
        required: true
        type: string
        description: "Snap Store channel to upload to (e.g., latest/edge, latest/candidate, latest/stable)"
      github-environment:
        required: true
        type: string
        description: "GitHub deployment environment for approval gates (e.g., latest/edge, latest/stable)"

    secrets:
      publish-credentials:
        required: true
        description: "Snap Store credentials (SNAPCRAFT_STORE_CREDENTIALS)"

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  build-snap:
    name: Build Snap (Linux ${{ matrix.arch }})
    strategy:
      matrix:
        include:
          - arch: amd64
            runner: linux-amd64-cpu8
          - arch: arm64
            runner: linux-arm64-cpu8
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    environment: ${{ inputs.github-environment }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.checkout-ref }}
          fetch-depth: 0

      - name: Install snapd
        run: |
          set -euo pipefail
          if ! command -v snapd >/dev/null 2>&1; then
            sudo apt-get update
            sudo apt-get install -y snapd
          fi
          sudo systemctl enable --now snapd.socket
          sudo systemctl start snapd
          sudo snap wait system seed.loaded

      - name: Install LXD
        run: |
          set -euo pipefail
          sudo snap install lxd
          sudo usermod -aG lxd "$USER"
          sudo lxd waitready
          sudo lxd init --auto
          sudo iptables -P FORWARD ACCEPT
          sudo chgrp lxd /var/snap/lxd/common/lxd/unix.socket
          sudo chmod 660 /var/snap/lxd/common/lxd/unix.socket

      - name: Install snapcraft
        run: |
          set -euo pipefail
          sudo snap install snapcraft --classic

      - name: Download prebuilt CLI binary
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: cli-linux-${{ matrix.arch }}
          path: prebuilt/cli

      - name: Download prebuilt gateway binary
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: gateway-binary-linux-${{ matrix.arch }}
          path: prebuilt/gateway

      - name: Download prebuilt sandbox binary
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: supervisor-binary-linux-${{ matrix.arch }}
          path: prebuilt/sandbox

      - name: Extract prebuilt binaries
        run: |
          set -euo pipefail
          mkdir -p prebuilt/{cli,gateway,sandbox}

          for d in cli gateway sandbox; do
            for tarball in prebuilt/$d/*.tar.gz; do
              if [ -f "$tarball" ]; then
                tar -xzf "$tarball" -C "prebuilt/$d"
              else
                echo "WARNING: no tarball found in prebuilt/$d/" >&2
              fi
            done
          done
          ls -laR prebuilt/

      - name: Prepare snap build directory
        run: |
          set -euo pipefail
          mkdir -p snap/prebuilt

          cp prebuilt/cli/openshell snap/prebuilt/openshell
          cp prebuilt/gateway/openshell-gateway snap/prebuilt/openshell-gateway
          cp prebuilt/sandbox/openshell-sandbox snap/prebuilt/openshell-sandbox

          cp tasks/scripts/snap-gateway-wrapper.sh snap/prebuilt/openshell-gateway-wrapper
          cp LICENSE snap/prebuilt/
          cp README.md snap/prebuilt/

          mkdir -p snap/prebuilt/meta/gui
          cp snap/local/term.desktop snap/prebuilt/meta/gui/term.desktop
          cp snap/local/icon.png snap/prebuilt/meta/gui/icon.png

          python3 tasks/scripts/release.py get-version --snap > snap/prebuilt/version

      - name: Build snap
        run: |
          set -euo pipefail
          runtime_dir="/run/user/$(id -u)"
          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" "$runtime_dir"
          export XDG_RUNTIME_DIR="$runtime_dir"
          sg lxd -c "XDG_RUNTIME_DIR=${runtime_dir} snapcraft pack -v"

      - name: Upload snapcraft logs on failure
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: snapcraft-logs
          path: "~/.local/state/snapcraft/log/snapcraft-*.log"
          retention-days: 7

      - name: Capture snap filename
        id: capture
        run: |
          set -euo pipefail
          SNAP_FILE=$(ls -1 *.snap 2>/dev/null | head -1)
          if [ -z "$SNAP_FILE" ]; then
            echo "ERROR: No .snap file found after snapcraft pack"
            exit 1
          fi
          echo "snap-file=${SNAP_FILE}" >> $GITHUB_OUTPUT
          echo "Built snap: ${SNAP_FILE}"

      - name: Upload snap artifact (${{ matrix.arch }})
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: snap-linux-${{ matrix.arch }}
          path: |
            ${{ steps.capture.outputs.snap-file }}
            *.comp
          retention-days: 5

      - name: Upload snap to Snap Store
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.publish-credentials }}
        run: |
          set -euo pipefail
          SNAP_FILE="${{ steps.capture.outputs.snap-file }}"
          SNAP_NAME="${SNAP_FILE%.snap}"
          SNAP_NAME="${SNAP_NAME%%_*}"

          COMPONENT_ARGS=()
          shopt -s nullglob
          for comp in "${SNAP_NAME}"+*.comp; do
            echo "Adding component: $comp"
            COMPONENT_ARGS+=(--component "$comp")
          done

          echo "Uploading $SNAP_FILE to ${{ inputs.upload-channel }}"
          snapcraft upload --release "${{ inputs.upload-channel }}" "$SNAP_FILE" "${COMPONENT_ARGS[@]}"