mirror of
https://github.com/zhom/donutbrowser.git
synced 2026-09-11 12:19:03 +02:00
refactor: cleanup
This commit is contained in:
zhom
@@ -1,18 +1,17 @@
|
||||
name: Publish sidecars to R2
|
||||
|
||||
# Publishes the `donut-proxy` sidecar to the bucket behind
|
||||
# https://download.wayfern.com, which is where the Wayfern VM fleet's bootstrap
|
||||
# scripts fetch it from.
|
||||
# https://download.wayfern.com, where remote hosts fetch it from.
|
||||
#
|
||||
# WHY THIS EXISTS SEPARATELY FROM release.yml
|
||||
# The desktop app ships donut-proxy INSIDE the bundle as a Tauri sidecar, so a
|
||||
# desktop release never needs it in a bucket. The fleet is the opposite: a leased
|
||||
# macOS or Windows host has no bundle, and its agent refuses to launch a browser
|
||||
# at all when the sidecar is missing (agent/launcher.go). Tying publication to a
|
||||
# desktop release would mean the fleet could only be unblocked by cutting one.
|
||||
# desktop release never needs it in a bucket. Remote execution is the opposite:
|
||||
# a remote host has no bundle and cannot launch a browser without the sidecar.
|
||||
# Tying publication to a desktop release would mean remote execution could only
|
||||
# be unblocked by cutting one.
|
||||
#
|
||||
# The fleet needs exactly two targets. Other platforms get their sidecar from the
|
||||
# app bundle and are deliberately not built here.
|
||||
# Only three targets are needed here. Everything else gets its sidecar from the
|
||||
# app bundle and is deliberately not built.
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
@@ -62,19 +61,26 @@ jobs:
|
||||
name: Build donut-proxy (${{ matrix.target }})
|
||||
runs-on: ${{ matrix.platform }}
|
||||
strategy:
|
||||
# One target failing must not leave the other unpublished and the pair
|
||||
# One target failing must not leave the others unpublished and the set
|
||||
# skewed; publish what built and report the rest.
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
# The leased Mac mini (Apple silicon).
|
||||
# macOS arm64 remote host.
|
||||
- platform: macos-latest
|
||||
target: aarch64-apple-darwin
|
||||
artifact: donut-proxy-aarch64-apple-darwin
|
||||
# The leased Elastic Metal Windows box.
|
||||
# Windows x86_64 remote host.
|
||||
- platform: windows-latest
|
||||
target: x86_64-pc-windows-msvc
|
||||
artifact: donut-proxy-x86_64-pc-windows-msvc.exe
|
||||
# Linux x86_64 remote host. Pinned to 22.04, not -latest: the
|
||||
# deployment target is glibc 2.35, and a binary linked on 24.04
|
||||
# (glibc 2.39) refuses to load there. The stage step proves the pin
|
||||
# held.
|
||||
- platform: ubuntu-22.04
|
||||
target: x86_64-unknown-linux-gnu
|
||||
artifact: donut-proxy-x86_64-unknown-linux-gnu
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
||||
@@ -91,6 +97,15 @@ jobs:
|
||||
toolchain: stable
|
||||
targets: ${{ matrix.target }}
|
||||
|
||||
# The proxy bin links donutbrowser_lib, which pulls in Tauri and therefore
|
||||
# GTK and WebKit at link time even though the proxy never opens a window.
|
||||
# Same package list as release.yml, so the two cannot drift apart.
|
||||
- name: Install Linux build dependencies
|
||||
if: runner.os == 'Linux'
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev pkg-config unzip xdg-utils
|
||||
|
||||
- name: Build donut-proxy
|
||||
shell: bash
|
||||
working-directory: ./src-tauri
|
||||
@@ -117,7 +132,7 @@ jobs:
|
||||
|
||||
# Prove the thing we are about to publish actually runs and is the
|
||||
# binary we think it is. A sidecar that cannot start is indistinguishable
|
||||
# from a missing one once it is on a leased host, except that it fails
|
||||
# from a missing one once it is on a remote host, except that it fails
|
||||
# later and less clearly.
|
||||
version="$("$dest" --version)"
|
||||
case "$version" in
|
||||
@@ -125,6 +140,46 @@ jobs:
|
||||
*) echo "::error::unexpected --version output: $version"; exit 1 ;;
|
||||
esac
|
||||
|
||||
if [ "$RUNNER_OS" = "Linux" ]; then
|
||||
# The Linux deployment target is glibc 2.35. A binary linked on a
|
||||
# newer runner fails there with "version GLIBC_2.xx not found",
|
||||
# which reaches the host only as a sidecar that "will not run".
|
||||
# The runner is pinned to 22.04 for that reason; this proves the
|
||||
# pin held, and that every library the binary names resolves at
|
||||
# all.
|
||||
fleet_glibc_max=2.35
|
||||
if ! ldd_out="$(ldd "$dest")"; then
|
||||
echo "::error::ldd cannot read $dest"
|
||||
printf '%s\n' "$ldd_out"
|
||||
exit 1
|
||||
fi
|
||||
if grep -q 'not found' <<< "$ldd_out"; then
|
||||
echo "::error::$dest needs a shared library this runner cannot resolve, and the fleet host will not either"
|
||||
printf '%s\n' "$ldd_out"
|
||||
exit 1
|
||||
fi
|
||||
needed="$(objdump -p "$dest" | awk '$1 == "NEEDED" { print $2 }')"
|
||||
glibc_max="$(objdump -T "$dest" | grep -o 'GLIBC_[0-9]*\.[0-9]*' | sed 's/^GLIBC_//' | sort -uV | tail -n 1)"
|
||||
if [ -z "$glibc_max" ]; then
|
||||
echo "::error::could not read the glibc symbol versions of $dest"
|
||||
exit 1
|
||||
fi
|
||||
{
|
||||
echo "### ${{ matrix.artifact }} shared libraries (DT_NEEDED)"
|
||||
echo ""
|
||||
echo '```'
|
||||
printf '%s\n' "$needed"
|
||||
echo '```'
|
||||
echo ""
|
||||
echo "- highest glibc symbol version: \`GLIBC_$glibc_max\` (fleet host ceiling: \`GLIBC_$fleet_glibc_max\`)"
|
||||
echo ""
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
if [ "$(printf '%s\n' "$glibc_max" "$fleet_glibc_max" | sort -V | tail -n 1)" != "$fleet_glibc_max" ]; then
|
||||
echo "::error::$dest needs GLIBC_$glibc_max, but the fleet host (Ubuntu 22.04) ships glibc $fleet_glibc_max; build it on ubuntu-22.04"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if command -v sha256sum >/dev/null; then
|
||||
digest="$(sha256sum "$dest" | cut -d' ' -f1)"
|
||||
else
|
||||
@@ -205,9 +260,9 @@ jobs:
|
||||
src="$RUNNER_TEMP/sidecars/$ARTIFACT"
|
||||
|
||||
# no-cache, not a long max-age: this key is deliberately overwritten in
|
||||
# place, and a CDN copy of the previous build would make a host fail
|
||||
# the SHA check the bootstrap performs, which reads as a corrupt
|
||||
# download rather than a stale cache.
|
||||
# place, and a cached copy of the previous build would make a host
|
||||
# fail its integrity check, which reads as a corrupt download rather
|
||||
# than a stale cache.
|
||||
aws s3 cp "$src" "s3://${bucket}/${ARTIFACT}" \
|
||||
--endpoint-url "$endpoint" \
|
||||
--content-type application/octet-stream \
|
||||
@@ -221,7 +276,7 @@ jobs:
|
||||
|
||||
# Read it back and compare. Without this, "published" is an assumption:
|
||||
# a truncated upload or a write to the wrong bucket both look like
|
||||
# success, and the failure would surface days later on a leased host
|
||||
# success, and the failure would surface days later on a remote host
|
||||
# as an unexplained checksum mismatch.
|
||||
verify="$RUNNER_TEMP/verify-$ARTIFACT"
|
||||
aws s3 cp "s3://${bucket}/${ARTIFACT}" "$verify" \
|
||||
|
||||
Reference in New Issue
Block a user