forked from unom/punktfunk
enricobuehler
082c65755f
The previous commit built the layer and taught the host to use it, but only the
Arch PKGBUILD carried the files, so every other channel still landed on the
no-game-HDR fallback. This finishes the job.
The packaging scripts now take `--stage`, the DESTDIR the gamescope build script
wrote, instead of a path to one binary. That is the part worth keeping: the next
file this package needs will not require a new flag in four scripts and two
workflows. CI caches the whole staged tree for the same reason. The gs-cache key
already hashes packaging/gamescope/**, which this commit changes, so stale caches
in the old single-file shape cannot be restored into the new layout.
Channels, all of them:
rpm spec gains Source1/Source2 and %files entries
deb build-gamescope-deb.sh copies the layer into the package root
Arch PKGBUILD (previous commit); the sysext extracts the whole usr tree
sysext bazzite takes --gamescope-stage; arch asserts the layer arrived
nix the derivation keeps, renames and rewrites the layer rather than
deleting it with everything else
A missing layer is fatal in every one of them, not best-effort. A package that
carries the compositor without it looks completely healthy and then silently
denies every game an HDR10 swapchain -- the exact failure this whole change
exists to end, so it must not be possible to ship it again by accident.
Two things needed care:
The layer manifest carries an ABSOLUTE library_path baked in at build time, so
every channel has to install the .so at exactly that path. That means literal
/usr/lib/punktfunk, not %{_libdir} (which is /usr/lib64 on Fedora) and not a
Debian multiarch triplet. Nothing links the .so by soname -- the loader dlopens
it by that path -- so multilib has no claim here. The rpm and nix install checks
now read the path back out of the manifest and fail if it names a file the
package does not install, because a manifest pointing at nothing is the silent
shape of this bug.
NixOS has no /usr, so the layer lives inside the gamescope derivation and the
host's path is overridable via PUNKTFUNK_GAMESCOPE_WSI_LAYER_DIR, which the
module sets -- the same posture as PUNKTFUNK_GAMESCOPE_BIN, and documented.
The manifest rewrite moved out of a heredoc into
packaging/gamescope/rewrite-wsi-layer-manifest.py because the FHS builds and the
Nix store both need it and must rename the layer identically; two copies would
drift into a host looking for a name only one of them produces.
Verified: 214 pf-vdisplay tests pass in a linux container, clippy -D warnings and
rustfmt clean, bash -n on all five changed shell scripts, both workflow YAMLs
parse, and the rewrite script was run against a synthetic FROG manifest to
confirm it renames/repoints/regates while preserving the `functions` block --
which is the field that decides whether the layer loads at all.
NOT verified: no nix on this machine, so gamescope.nix, flake.nix and the module
are unevaluated; no gamescope build, no package build of any kind, and no game
has taken an HDR swapchain on glass.
722 lines
40 KiB
YAML
722 lines
40 KiB
YAML
# Build the punktfunk .debs and publish them to Gitea's Debian package registry, so Debian and
|
|
# Ubuntu boxes get new builds via `apt update && apt upgrade`. Five jobs; the four builders all
|
|
# publish to the same apt distribution/component, and the fifth checks the result:
|
|
#
|
|
# build-publish — client + web + scripting, on the Ubuntu 26.04 rust-ci image (the client
|
|
# needs 24.04-absent libs: SDL3, GTK4 ≥ 4.20).
|
|
# build-publish-client-arm64
|
|
# — the same client package for arm64, CROSS-compiled on the same amd64
|
|
# runner in the rust-ci-arm64cross image. No host counterpart: the Linux
|
|
# host's encode stack is x86 (NVENC/QSV/AMF).
|
|
# build-publish-host — the HOST, on the Ubuntu 24.04 rust-ci-noble image with a from-source
|
|
# FFmpeg 8 BUNDLED into the .deb. This lowers the host's glibc floor to 2.39
|
|
# and removes the hard `Depends: libavcodec62`, so the ONE host .deb installs
|
|
# on Ubuntu 24.04 LTS through 26.04 — and, for free, on Debian 13.
|
|
# (A 26.04-built host .deb is uninstallable on 24.04 — the reason this job
|
|
# exists; see packaging/debian/README.md.)
|
|
# build-publish-gamescope
|
|
# — the patched `punktfunk-gamescope`, on DEBIAN 13. It lived in the host job
|
|
# until 2026-08 and never once succeeded there: noble's wayland is 1.22.0
|
|
# and the vendored wlroots floors it at 1.23.1, so v0.26.0 and v0.27.0 both
|
|
# shipped without the package while the docs told apt users to install it.
|
|
# smoke-install — installs what was just published, from the registry, in pristine
|
|
# ubuntu:24.04 / ubuntu:26.04 / debian:trixie images. Nothing here used to
|
|
# install a package it built, which is how both of the above survived.
|
|
#
|
|
# Both compute VERSION identically (scripts/ci/pf-version.sh is deterministic per commit), so the
|
|
# host and client packages always share a version line. The release-attach helpers are race-safe
|
|
# (ensure_release create-or-fetch; upsert_asset only conflicts on same-name), so the jobs run parallel.
|
|
#
|
|
# Registry (public, unom org): https://git.unom.io/unom/-/packages
|
|
# Box setup (once): see packaging/debian/README.md
|
|
#
|
|
# REGISTRY_TOKEN: repo Actions secret, a PAT with write:package scope (shared with docker.yml).
|
|
name: deb
|
|
# One pending run per workflow+ref: a newer push supersedes the queued/running one and cancels
|
|
# it (a canary only needs the latest commit; each release tag is its own ref so tag runs never
|
|
# cancel each other). Keeps a busy push cadence from piling ~10 queued runs per commit onto the
|
|
# runner fleet. Gitea honors this for push triggers (PR triggers: see gitea#35933).
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# Scope canary builds to what this artifact is built FROM — a docs-only or
|
|
# web-only push should not light up the whole fleet. Applies to branch pushes;
|
|
# tag runs are matched by `tags:` (proven by flatpak/windows-msix releases).
|
|
paths:
|
|
- 'crates/**'
|
|
- 'clients/linux/**'
|
|
- 'clients/session/**'
|
|
- 'clients/shared/**'
|
|
- 'clients/cli/**'
|
|
- 'web/**'
|
|
- 'sdk/**'
|
|
- 'packaging/debian/**'
|
|
- 'packaging/linux/**'
|
|
- 'Cargo.toml'
|
|
- 'Cargo.lock'
|
|
- 'rust-toolchain.toml'
|
|
- 'scripts/ci/**'
|
|
- '.gitea/workflows/deb.yml'
|
|
# Single project version: a `vX.Y.Z` tag is THE release for every platform (see
|
|
# docs-site channels.md). The old version-shadow (a client tag shipping a host package
|
|
# that outranked rolling builds) is now structurally impossible — main publishes to the
|
|
# `canary` apt distribution, tags to `stable`, so the two never share a version line.
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY: git.unom.io
|
|
OWNER: unom
|
|
COMPONENT: main
|
|
RUSTC_WRAPPER: sccache
|
|
SCCACHE_BUCKET: unom-ci-sccache
|
|
SCCACHE_ENDPOINT: https://storage.unom.io
|
|
SCCACHE_REGION: home-central
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_SECRET_ACCESS_KEY }}
|
|
# CMake-driven C/C++ through the same cache (aws-lc-sys, the vendored libopus). Workflow level
|
|
# is safe — it names no triple; the CC_*/CXX_* half is per-job below, because the arm64 leg's
|
|
# image needs its own CC_x86_64 wrapper. See ci.yml's `rust` job for the full note.
|
|
CMAKE_C_COMPILER_LAUNCHER: sccache
|
|
CMAKE_CXX_COMPILER_LAUNCHER: sccache
|
|
# sccache and incremental compilation are mutually exclusive; CI wants the shared
|
|
# cache, dev boxes keep incremental.
|
|
CARGO_INCREMENTAL: "0"
|
|
|
|
jobs:
|
|
build-publish:
|
|
runs-on: ubuntu-24.04
|
|
container:
|
|
image: 192.168.1.58:5010/punktfunk-rust-ci:latest
|
|
timeout-minutes: 90
|
|
env:
|
|
# ⚠ Job-scoped, never workflow-scoped: build-publish-client-arm64 runs in the cross image,
|
|
# whose own CC_x86_64_unknown_linux_gnu=pf-host-cc must survive. See ci.yml's `rust` job.
|
|
CC_x86_64_unknown_linux_gnu: sccache cc
|
|
CXX_x86_64_unknown_linux_gnu: sccache c++
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Shared compile cache (sccache -> RustFS S3 over the LAN). Baked into the builder
|
|
# images; this heals the job while the running :latest predates the bake.
|
|
- name: sccache (no-op once the image bakes it)
|
|
run: sh scripts/ci/ensure-sccache.sh
|
|
|
|
- name: Version + channel
|
|
# vX.Y.Z tag -> X.Y.Z, published to the `stable` apt distribution (a real release).
|
|
# A main push -> <next-minor>~ciN.g<sha>, published to the `canary` distribution: the '~' sorts
|
|
# below the eventual tag, it climbs monotonically by run number, and the canary base is
|
|
# derived one minor AHEAD of the latest stable tag (scripts/ci/pf-version.sh) so a
|
|
# stable->canary box re-point still moves forward (see channels.md). Computed BEFORE the build so it's stamped into the binary
|
|
# (PUNKTFUNK_BUILD_VERSION -> build.rs -> --version).
|
|
run: |
|
|
eval "$(bash scripts/ci/pf-version.sh)" # -> PF_BASE (one minor ahead of the latest stable tag)
|
|
SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) V="${GITHUB_REF_NAME#v}"; DIST=stable ;;
|
|
*) V="${PF_BASE}~ci${GITHUB_RUN_NUMBER}.g${SHORT}"; DIST=canary ;;
|
|
esac
|
|
echo "VERSION=$V" >> "$GITHUB_ENV"
|
|
echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
|
|
echo "package version $V -> apt distribution '$DIST'"
|
|
|
|
# dpkg-shlibdeps (Depends resolution) + dpkg-deb live in dpkg-dev. The client's link
|
|
# deps are also baked into the rust-ci image, but this job runs against the image
|
|
# from the PREVIOUS push (docker.yml bootstrap note) — keep it green across image
|
|
# changes; a no-op once the image has them.
|
|
- name: dpkg-dev + client link deps
|
|
run: |
|
|
apt-get update
|
|
# python3 is used by scripts/ci/gitea-release.sh for the stable-tag release attach.
|
|
# No libvulkan-dev: nothing here compiles or links against Vulkan (ash dlopens
|
|
# libvulkan and pf-vkdecode binds nothing at build time), so neither the compile nor
|
|
# dpkg-shlibdeps — which resolves DT_NEEDED sonames only — ever asks for it. The
|
|
# client's `Depends: libvulkan1` is added by hand in packaging/debian/build-client-deb.sh
|
|
# precisely because a dlopen is invisible to shlibdeps.
|
|
# No libav*-dev: the client links no FFmpeg since M10 (§6 of
|
|
# design/client-native-decode.md).
|
|
apt-get install -y --no-install-recommends dpkg-dev python3 \
|
|
libgtk-4-dev libadwaita-1-dev libsdl3-dev
|
|
|
|
# The cargo-home (registry/git) cache IS shared with ci.yml — those are pure downloads,
|
|
# profile-independent, and deduping them across the fleet is the whole point. The target
|
|
# cache is NOT; see below.
|
|
- name: Cache keys
|
|
run: echo "rustc=$(rustc --version | cut -d' ' -f2)" >> "$GITHUB_ENV"
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
/usr/local/cargo/registry
|
|
/usr/local/cargo/git
|
|
key: cargo-home-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-home-
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: target
|
|
# -v3-: bypass a target cache poisoned by a disk-full build (see ci.yml).
|
|
#
|
|
# `-release-`, and NOT ci.yml's key. This step used to read
|
|
# `cargo-target-v3-<rustc>-<lock>` — byte-identical to ci.yml's — under a comment saying
|
|
# the release build "reuses its clean artifacts". It never did, and could not: ci.yml
|
|
# builds DEBUG, this job builds RELEASE, and actions/cache is first-saver-wins on an
|
|
# exact key. ci.yml's `rust` job finishes in ~6 min against this job's ~7-8, so ci.yml
|
|
# always won the save, this job always restored a target/ with an empty target/release,
|
|
# and — the expensive half — its own release artifacts were then never persisted,
|
|
# because the key it would have saved under was already taken. Every canary .deb has
|
|
# therefore been a from-scratch release build (sccache-assisted, but every link and
|
|
# every build script re-run) for as long as both keys have existed.
|
|
key: cargo-target-release-v3-${{ env.rustc }}-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-target-release-v3-${{ env.rustc }}-
|
|
|
|
- name: Build release clients
|
|
env:
|
|
PUNKTFUNK_BUILD_VERSION: ${{ env.VERSION }} # stamped into the binaries (build.rs)
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
# FOUR binaries ship in the client .deb, so all four are built here: the GTK shell,
|
|
# punktfunk-client-session (the Vulkan/Skia streamer the shell execs for a connect),
|
|
# punktfunk-cli (the headless `punktfunk` front-end), and pf-update (the root helper
|
|
# behind `punktfunk-client --apply-update`). build-client-deb.sh installs all four;
|
|
# leaving punktfunk-cli out here made it fall over on `install: No such file or
|
|
# directory`, because its build-if-missing guard only tested the first two and so decided
|
|
# everything was already built. The HOST is built separately in the build-publish-host
|
|
# job (Ubuntu 24.04 image + bundled FFmpeg 8).
|
|
cargo build --release --locked \
|
|
-p punktfunk-client-linux -p punktfunk-client-session -p punktfunk-cli -p pf-update
|
|
|
|
# ── The web console, built ONCE per (web+sdk content, bun) rather than once per job ────────
|
|
# This bundle was being rebuilt six times on every push — ci.yml, here, both RPM legs, arch,
|
|
# and the docker app image — at ~2.5 min each, for output that is a pure function of web/ and
|
|
# sdk/. windows-host.yml has cached it this way for a while; this is the same arrangement for
|
|
# the Linux packaging legs, sharing one key family so a hit in one warms the others.
|
|
#
|
|
# The bun version is IN THE KEY. Each builder image installs its own bun (rust-ci, fedora-rpm
|
|
# and arch-ci each run the bun.sh installer at image-build time), so without it a bundle built
|
|
# by one image's bun could be shipped by a job running a different one. They are usually the
|
|
# same version and do share; when they diverge, they simply stop sharing instead of silently
|
|
# mixing.
|
|
- name: Web console cache key
|
|
run: echo "bunver=$(bun --version 2>/dev/null || echo none)" >> "$GITHUB_ENV"
|
|
- name: Cache the built web console
|
|
id: webconsole
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: web/.output
|
|
key: web-console-linux-bun${{ env.bunver }}-${{ hashFiles('web/**', 'sdk/**') }}
|
|
|
|
- name: Build + smoke-boot web console (bun preset)
|
|
# Skipped when the cache already holds this exact (web+sdk, bun) bundle — the assertion step
|
|
# below is what makes that safe. The bundle in the cache was smoke-booted by the run that
|
|
# produced it, and ci.yml's `web` job still builds and tests the console on every push.
|
|
if: steps.webconsole.outputs.cache-hit != 'true'
|
|
# Gate the .deb on a real bun boot: the punktfunk-web .deb runs the Nitro `bun` preset
|
|
# (our Bun.serve TLS entry), so prove the build IS a bun bundle and serves /login.
|
|
# No TLS env here, so the custom entry binds plain HTTP — the smoke curl stays simple.
|
|
run: |
|
|
# bun builds AND runs the console. Baked into the rust-ci image; bootstrap here too so the
|
|
# job stays green against the PREVIOUS image (docker.yml bootstrap lag).
|
|
command -v bun >/dev/null || {
|
|
apt-get install -y --no-install-recommends unzip
|
|
curl -fsSL https://bun.sh/install | bash
|
|
}
|
|
export PATH="$HOME/.bun/bin:$PATH"
|
|
cd web
|
|
# --ignore-scripts, like every other web install in CI (ci.yml, web-screenshots.yml,
|
|
# windows-host.yml, the SDK installs). This was the ONE site still running lifecycle
|
|
# scripts, and web's `postinstall` is `bun2nix -o bun.nix` — a Nix codegen step this job
|
|
# neither consumes nor commits, whose only effect here is to make the install depend on
|
|
# bun2nix resolving. `build` re-runs its own `prebuild` codegen regardless.
|
|
bun install --frozen-lockfile --ignore-scripts
|
|
bun run build
|
|
if ! grep -q 'Bun\.serve' .output/server/index.mjs; then
|
|
echo "ERROR: web build is not a bun bundle — need the 'bun' preset + custom entry"; exit 1
|
|
fi
|
|
PORT=3009 HOST=127.0.0.1 PUNKTFUNK_UI_PASSWORD=ci bun .output/server/index.mjs &
|
|
NP=$!; sleep 3
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3009/login || echo 000)
|
|
kill "$NP" 2>/dev/null || true
|
|
echo "web console smoke: /login -> $code"
|
|
[ "$code" = 200 ] || { echo "ERROR: web console failed to boot under bun"; exit 1; }
|
|
|
|
# ⚠ NOT optional, and it must run on BOTH paths (cache hit and fresh build). The packaging
|
|
# scripts treat a missing web/.output as "build it yourself", which is right for a local run
|
|
# and wrong here: it would silently turn a broken cache restore into a slow, quiet rebuild, or
|
|
# — with the build step skipped and the restore empty — into a package with no console at all.
|
|
# windows-host.yml shipped exactly that in 0.22.1/0.22.2 (an unset WEB_OUTPUT_DIR behind a
|
|
# single Write-Host), which is why its equivalent step throws too. Fail loudly instead.
|
|
- name: The console must exist (cache hit or fresh build)
|
|
run: |
|
|
if [ ! -f web/.output/server/index.mjs ]; then
|
|
echo "::error::web/.output is missing — neither the cache restore nor the build produced it"
|
|
exit 1
|
|
fi
|
|
grep -q 'Bun\.serve' web/.output/server/index.mjs || {
|
|
echo "::error::web/.output is not a bun bundle (wrong nitro preset)"; exit 1; }
|
|
echo "web console present: $(du -sh web/.output | cut -f1)"
|
|
|
|
- name: Build .debs
|
|
run: |
|
|
export PATH="$HOME/.bun/bin:$PATH"
|
|
# host .deb is built in build-publish-host (Ubuntu 24.04 image); this job ships the rest.
|
|
VERSION="$VERSION" bash packaging/debian/build-client-deb.sh
|
|
# Reuse CI's bun for the vendored runtime (matches the amd64 runner) instead of downloading.
|
|
VERSION="$VERSION" BUN_BIN="$(command -v bun || true)" bash packaging/debian/build-web-deb.sh
|
|
# The plugin/script runner (bun-bundled Effect SDK) — same vendored-bun mechanics.
|
|
VERSION="$VERSION" BUN_BIN="$(command -v bun || true)" bash packaging/debian/build-scripting-deb.sh
|
|
|
|
# Visibility only. With the target cache now actually saving release artifacts (see the
|
|
# cache key note above), this is how a regression in that arrangement becomes visible:
|
|
# a run that suddenly reports thousands of misses is a cache that stopped restoring.
|
|
- name: sccache stats (visibility only)
|
|
if: always()
|
|
run: sccache --show-stats
|
|
|
|
- name: Publish to the Gitea apt registry
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
for DEB in dist/*.deb; do
|
|
echo "uploading $DEB"
|
|
# A re-tagged release re-fires this workflow and the apt registry 409s on duplicate
|
|
# package versions — delete any prior copy of this exact name/version/arch first
|
|
# (404 on the first publish is fine).
|
|
NAME=$(dpkg-deb -f "$DEB" Package)
|
|
VER=$(dpkg-deb -f "$DEB" Version)
|
|
ARCH=$(dpkg-deb -f "$DEB" Architecture)
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/$NAME/$VER/$ARCH" || true
|
|
# PAT owner (enricobuehler), not the push actor — matches docker.yml's registry login.
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
|
|
done
|
|
echo "published to $OWNER/debian $DISTRIBUTION/$COMPONENT"
|
|
|
|
# On a real release, also attach the .debs to the unified Gitea Release so they're on the
|
|
# downloads page next to every other platform's artifact (canary builds live in the apt
|
|
# `canary` distribution above — no release page for those).
|
|
- name: Attach .debs to the Gitea release (stable tags only)
|
|
if: startsWith(gitea.ref, 'refs/tags/v')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
. scripts/ci/gitea-release.sh
|
|
RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
|
|
for DEB in dist/*.deb; do
|
|
upsert_asset "$RID" "$DEB"
|
|
done
|
|
|
|
# ---------------------------------------------------------------------------------------------
|
|
# The HOST .deb — built on Ubuntu 24.04 (noble) with a from-source FFmpeg 8 BUNDLED, so it installs
|
|
# on Ubuntu 24.04 LTS through 26.04 (see the file header + packaging/debian/README.md). Runs in
|
|
# parallel with build-publish and publishes to the SAME distribution/component; the version step is
|
|
# byte-identical so host and clients share a version line.
|
|
build-publish-host:
|
|
runs-on: ubuntu-24.04
|
|
container:
|
|
image: 192.168.1.58:5010/punktfunk-rust-ci-noble:latest
|
|
timeout-minutes: 90
|
|
env:
|
|
# ⚠ Job-scoped — see build-publish above and ci.yml's `rust` job.
|
|
CC_x86_64_unknown_linux_gnu: sccache cc
|
|
CXX_x86_64_unknown_linux_gnu: sccache c++
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Shared compile cache (sccache -> RustFS S3 over the LAN). Baked into the builder
|
|
# images; this heals the job while the running :latest predates the bake.
|
|
- name: sccache (no-op once the image bakes it)
|
|
run: sh scripts/ci/ensure-sccache.sh
|
|
|
|
- name: Version + channel
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
eval "$(bash scripts/ci/pf-version.sh)" # -> PF_BASE (one minor ahead of the latest stable tag)
|
|
SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) V="${GITHUB_REF_NAME#v}"; DIST=stable ;;
|
|
*) V="${PF_BASE}~ci${GITHUB_RUN_NUMBER}.g${SHORT}"; DIST=canary ;;
|
|
esac
|
|
echo "VERSION=$V" >> "$GITHUB_ENV"
|
|
echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
|
|
echo "host package version $V -> apt distribution '$DIST'"
|
|
|
|
# dpkg-shlibdeps/dpkg-deb + patchelf are baked into rust-ci-noble; python3 is for the
|
|
# release-attach helper. Re-install defensively so the job stays green against the PREVIOUS
|
|
# image on the same push (docker.yml bootstrap lag) — a no-op once the image ships them.
|
|
- name: dpkg-dev + patchelf + python3
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends dpkg-dev patchelf python3
|
|
|
|
- name: Cache keys
|
|
run: echo "rustc=$(rustc --version | cut -d' ' -f2)" >> "$GITHUB_ENV"
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
/usr/local/cargo/registry
|
|
/usr/local/cargo/git
|
|
key: cargo-home-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-home-
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: target
|
|
# Own key: this target dir is built against 24.04's glibc/toolchain and must NOT share
|
|
# ci.yml's 26.04 target cache (mixing would poison both). It is also the only job using
|
|
# this prefix, so — unlike the amd64/arm64 pairs above — it has always been able to save
|
|
# and restore its own release artifacts. `-release-` is spelled out anyway so the whole
|
|
# file reads consistently and nobody "unifies" it back into a shared key later.
|
|
key: cargo-target-noble-release-v1-${{ env.rustc }}-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-target-noble-release-v1-${{ env.rustc }}-
|
|
|
|
- name: Build release host
|
|
env:
|
|
PUNKTFUNK_BUILD_VERSION: ${{ env.VERSION }} # stamped into the binary (build.rs)
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
# Same features the old combined build used: --nvenc (direct-SDK NVENC, real RFI on NVIDIA;
|
|
# NVENC/CUDA is dlopen'd — no link dep, so this image needs no libcuda stub) + --vulkan-encode
|
|
# (raw VK_KHR_video_encode_h265 on AMD/Intel, pure ash). ffmpeg-sys-next links the image's
|
|
# bundled FFmpeg 8 via PKG_CONFIG_PATH (set in rust-ci-noble).
|
|
#
|
|
# punktfunk-tray is deliberately NOT in this invocation — build-deb.sh builds it separately,
|
|
# and that split is load-bearing (see the identical note in the RPM spec / Arch PKGBUILD):
|
|
# cargo unifies features across one build, so co-building the tray with the host pulls the
|
|
# host's ashpd -> zbus/tokio onto the tray's shared zbus and the tray panics at every launch
|
|
# with "there is no reactor running, must be called from the context of a Tokio 1.x runtime".
|
|
# It WAS listed here, which is why only the .deb shipped a crashing tray while the RPM and
|
|
# Arch packages — which already split it — were fine.
|
|
#
|
|
# punktfunk-encode-worker IS in this invocation: it is the capability-carrying PyroWave
|
|
# encode worker that ships next to the host in /usr/bin, and build-deb.sh only builds it
|
|
# if the artifact is missing — building it here keeps it on the same sccache pass as the
|
|
# host. Unlike the tray it shares the host's dependency graph by design (v1 accepts that
|
|
# the worker links the same FFmpeg), so feature unification here is harmless.
|
|
cargo build --release --locked --features punktfunk-host/nvenc,punktfunk-host/vulkan-encode \
|
|
-p punktfunk-host -p punktfunk-encode-worker
|
|
|
|
- name: Build host .deb (FFmpeg bundled)
|
|
# BUNDLE_FFMPEG=1 copies the image's /opt/ffmpeg libav* into the package and repoints the
|
|
# binary's rpath, so there is no `Depends: libavcodec62` to block install on 24.04. FFMPEG_PREFIX
|
|
# defaults to /opt/ffmpeg (the image's ENV also sets it).
|
|
run: |
|
|
VERSION="$VERSION" BUNDLE_FFMPEG=1 bash packaging/debian/build-deb.sh
|
|
|
|
# Visibility only — placed here, right after the last compile, rather than at the end of the
|
|
# job: the gamescope gate below must stay the final step (see its own note).
|
|
- name: sccache stats (visibility only)
|
|
if: always()
|
|
run: sccache --show-stats
|
|
|
|
# Read the capability matrix out of the BUILT .deb before it is published. dpkg carries no
|
|
# capability metadata — the postinst applies them — so this reads the postinst that will
|
|
# actually run on a user's box, plus the payload. 0.26.0-1 granted the host cap_sys_nice=ep
|
|
# from exactly that postinst and killed every KDE desktop session while every board stayed
|
|
# green: host must carry NOTHING, worker exactly cap_sys_nice=ep. `--self-test` first so a
|
|
# guard that can no longer fail takes the job down instead of waving the release through.
|
|
- name: Assert the capability matrix (host .deb)
|
|
run: |
|
|
bash scripts/ci/assert-cap-matrix.sh --self-test
|
|
bash scripts/ci/assert-cap-matrix.sh dist/punktfunk-host_*.deb
|
|
|
|
- name: Publish to the Gitea apt registry
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
for DEB in dist/*.deb; do
|
|
echo "uploading $DEB"
|
|
NAME=$(dpkg-deb -f "$DEB" Package)
|
|
VER=$(dpkg-deb -f "$DEB" Version)
|
|
ARCH=$(dpkg-deb -f "$DEB" Architecture)
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/$NAME/$VER/$ARCH" || true
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
|
|
done
|
|
echo "published host to $OWNER/debian $DISTRIBUTION/$COMPONENT"
|
|
|
|
- name: Attach the host .deb to the Gitea release (stable tags only)
|
|
if: startsWith(gitea.ref, 'refs/tags/v')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
. scripts/ci/gitea-release.sh
|
|
RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
|
|
for DEB in dist/*.deb; do
|
|
upsert_asset "$RID" "$DEB"
|
|
done
|
|
|
|
# ---------------------------------------------------------------------------------------------
|
|
# `punktfunk-gamescope` for apt — the patched build that gives a gamescope session HDR, a cursor,
|
|
# and the client's real refresh rate instead of a hardcoded 60 Hz. Same reasoning as the RPM leg
|
|
# in rpm.yml: without a package, a Debian/Ubuntu box has no route to it except compiling by hand.
|
|
#
|
|
# ⚠ THIS IS ITS OWN JOB, ON DEBIAN 13, BECAUSE THE NOBLE BUILD COULD NEVER HAVE WORKED.
|
|
# It used to be a few best-effort steps inside build-publish-host (Ubuntu 24.04), where it failed
|
|
# every single time:
|
|
# wlroots| Dependency wayland-server found: NO found 1.22.0 but need: '>=1.23.1'
|
|
# Our pin vendors wlroots 0.19.3, which floors wayland-server at 1.23.1; noble ships 1.22.0 and
|
|
# always will. v0.26.0 AND v0.27.0 both shipped with no gamescope .deb — while the release notes
|
|
# and docs-site told apt users to install it — because every rung of that path was a `::warning::`
|
|
# that returned 0, and the one hard gate ran last by design (so good artifacts still publish) and
|
|
# was simply never acted on. Moving it to trixie makes the build possible; making it a job of its
|
|
# own makes its failure visible instead of a footnote in someone else's log.
|
|
#
|
|
# Debian 13 is the OLDEST apt distro the tree configures on (wayland 1.23.1, libxcb-errors,
|
|
# libdisplay-info 0.2). The binary it produces needs GLIBC_2.38 and links no libstdc++, so what
|
|
# actually bounds it is wayland: Debian 13 and Ubuntu 26.04 YES, Ubuntu 24.04 NO — and 24.04
|
|
# could not run this binary however it was built, so nothing was lost by leaving noble.
|
|
build-publish-gamescope:
|
|
runs-on: ubuntu-24.04
|
|
container:
|
|
image: 192.168.1.58:5010/punktfunk-gamescope-trixie:latest
|
|
timeout-minutes: 90
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Byte-identical to the other jobs' version step (pf-version.sh is deterministic per commit)
|
|
# — but only DISTRIBUTION is used here. The package version is the gamescope upstream
|
|
# version + our patch level, which build-gamescope-deb.sh derives itself; it deliberately
|
|
# does NOT follow the punktfunk version line, because this package moves on its own cadence.
|
|
- name: Channel
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) DIST=stable ;;
|
|
*) DIST=canary ;;
|
|
esac
|
|
echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
|
|
echo "gamescope -> apt distribution '$DIST'"
|
|
|
|
# CACHED on packaging/gamescope/** alone — it depends on nothing else in this repo, so a
|
|
# normal push restores a binary instead of spending ~10 minutes on someone else's tree.
|
|
# Keyed `-trixie-` so the noble cache entries (which only ever held misses) can't be hit.
|
|
- uses: actions/cache@v4
|
|
id: gamescope
|
|
with:
|
|
path: gs-cache
|
|
key: punktfunk-gamescope-trixie-${{ hashFiles('packaging/gamescope/**') }}
|
|
|
|
# NOT best-effort, unlike the noble version of this step. Every dependency now comes from the
|
|
# image (which asserts the wayland floor at build time), so a failure here is a real
|
|
# regression in the tree or the pin — exactly the thing the previous arrangement hid.
|
|
- name: Build the patched gamescope
|
|
if: steps.gamescope.outputs.cache-hit != 'true'
|
|
# `--extra-fallback libdisplay-info` is what makes ONE .deb serve both Debian 13 and
|
|
# Ubuntu 26.04. Built against the distro's copy, the package picks up
|
|
# `Depends: libdisplay-info2 (>= 0.2.0)` on trixie — and Ubuntu 26.04 carries
|
|
# libdisplay-info **3** (0.3.0), so apt refuses it there ("Depends libdisplay-info2 …" —
|
|
# measured, not predicted). gamescope vendors the library as a submodule, so linking the
|
|
# vendored copy drops the dependency entirely. Same reasoning the build script already
|
|
# applies to wlroots: a binary we SHIP must not follow the build host's shared libraries.
|
|
run: |
|
|
bash packaging/gamescope/build-punktfunk-gamescope.sh \
|
|
--destdir "$PWD/gs-stage" --prefix /usr --jobs "$(nproc)" \
|
|
--extra-fallback libdisplay-info
|
|
# The WHOLE staged tree, not just the binary: it also carries the Vulkan WSI layer built
|
|
# beside the compositor, which is the only route to an HDR10 swapchain for a nested game.
|
|
mkdir -p gs-cache && cp -a gs-stage/. gs-cache/
|
|
|
|
# The binary must RUN, not merely link: `--version` is what the old job used as its ship
|
|
# gate, and it is the cheapest proof that the static-libstdc++ trick and the vendored wlroots
|
|
# actually produced a working compositor.
|
|
- name: Build the .deb
|
|
run: |
|
|
gs-cache/usr/bin/punktfunk-gamescope --version
|
|
bash packaging/debian/build-gamescope-deb.sh --stage gs-cache
|
|
|
|
- name: Publish to the Gitea apt registry
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
for DEB in dist/punktfunk-gamescope_*.deb; do
|
|
echo "uploading $DEB"
|
|
NAME=$(dpkg-deb -f "$DEB" Package)
|
|
VER=$(dpkg-deb -f "$DEB" Version)
|
|
ARCH=$(dpkg-deb -f "$DEB" Architecture)
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/$NAME/$VER/$ARCH" || true
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
|
|
done
|
|
echo "published gamescope to $OWNER/debian $DISTRIBUTION/$COMPONENT"
|
|
|
|
- name: Attach the gamescope .deb to the Gitea release (stable tags only)
|
|
if: startsWith(gitea.ref, 'refs/tags/v')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
. scripts/ci/gitea-release.sh
|
|
RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
|
|
for DEB in dist/punktfunk-gamescope_*.deb; do
|
|
upsert_asset "$RID" "$DEB"
|
|
done
|
|
|
|
# ---------------------------------------------------------------------------------------------
|
|
# The aarch64 CLIENT .deb. Cross-compiled on the ordinary amd64 runner in the
|
|
# punktfunk-rust-ci-arm64cross image (the rust-ci toolchain + an arm64 multiarch sysroot — see
|
|
# ci/rust-ci-arm64cross.Dockerfile); there is no arm64 runner in the fleet and none is needed.
|
|
# Client only, by decision: the Linux host encodes with NVENC/QSV/AMF, all x86.
|
|
# Publishes to the same distribution/component as the amd64 jobs — the apt registry keys pool
|
|
# entries by arch, so `apt` on an arm64 box picks this one up with no client-side configuration.
|
|
build-publish-client-arm64:
|
|
runs-on: ubuntu-24.04
|
|
container:
|
|
image: 192.168.1.58:5010/punktfunk-rust-ci-arm64cross:latest
|
|
timeout-minutes: 90
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Shared compile cache (sccache -> RustFS S3 over the LAN). Baked into the builder
|
|
# images; this heals the job while the running :latest predates the bake.
|
|
#
|
|
# NOTE this job deliberately sets no CC_x86_64_unknown_linux_gnu: the cross image already
|
|
# points it at /usr/local/bin/pf-host-cc, which is what keeps ffmpeg-sys-next's HOST probe
|
|
# from picking up arm64 include dirs. The target-side compiles go through
|
|
# CC_aarch64_unknown_linux_gnu (also set by the image) and are not sccache-wrapped.
|
|
- name: sccache (no-op once the image bakes it)
|
|
run: sh scripts/ci/ensure-sccache.sh
|
|
|
|
# Byte-identical to build-publish's version step (pf-version.sh is deterministic per
|
|
# commit), so the arm64 package always shares the amd64 version line.
|
|
- name: Version + channel
|
|
run: |
|
|
eval "$(bash scripts/ci/pf-version.sh)"
|
|
SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) V="${GITHUB_REF_NAME#v}"; DIST=stable ;;
|
|
*) V="${PF_BASE}~ci${GITHUB_RUN_NUMBER}.g${SHORT}"; DIST=canary ;;
|
|
esac
|
|
echo "VERSION=$V" >> "$GITHUB_ENV"
|
|
echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
|
|
echo "package version $V -> apt distribution '$DIST' (arm64)"
|
|
|
|
# dpkg-shlibdeps + dpkg-deb. The arm64 link deps themselves are the cross image's whole
|
|
# point and are already baked in; python3 is for scripts/ci/gitea-release.sh.
|
|
- name: dpkg-dev
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends dpkg-dev python3
|
|
|
|
- name: Cache keys
|
|
run: echo "rustc=$(rustc --version | cut -d' ' -f2)" >> "$GITHUB_ENV"
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
/usr/local/cargo/registry
|
|
/usr/local/cargo/git
|
|
key: cargo-home-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-home-
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: target
|
|
# Its OWN key — these are aarch64 artifacts under target/aarch64-unknown-linux-gnu/
|
|
# and must never share the amd64 jobs' target cache.
|
|
#
|
|
# `-release-`: this key was previously identical to ci.yml's `rust-arm64` key, which
|
|
# builds DEBUG (clippy) and finishes in ~1.5 min against this job's ~5. Exactly the
|
|
# amd64 collision described on the release key above — ci.yml won every save, this job
|
|
# restored a tree with no release artifacts and could never persist its own.
|
|
key: cargo-target-arm64-release-v1-${{ env.rustc }}-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-target-arm64-release-v1-${{ env.rustc }}-
|
|
|
|
- name: Build the arm64 client .deb
|
|
env:
|
|
PUNKTFUNK_BUILD_VERSION: ${{ env.VERSION }} # stamped into the binaries (build.rs)
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
ARCH=arm64 TARGET=aarch64-unknown-linux-gnu \
|
|
bash packaging/debian/build-client-deb.sh
|
|
# Fail here rather than shipping an amd64 binary under an arm64 package name.
|
|
readelf -h target/aarch64-unknown-linux-gnu/release/punktfunk-session \
|
|
| grep -q AArch64 || { echo "ERROR: session binary is not AArch64"; exit 1; }
|
|
|
|
- name: sccache stats (visibility only)
|
|
if: always()
|
|
run: sccache --show-stats
|
|
|
|
- name: Publish to the Gitea apt registry
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
for DEB in dist/*.deb; do
|
|
echo "uploading $DEB"
|
|
NAME=$(dpkg-deb -f "$DEB" Package)
|
|
VER=$(dpkg-deb -f "$DEB" Version)
|
|
ARCH=$(dpkg-deb -f "$DEB" Architecture)
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/$NAME/$VER/$ARCH" || true
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
|
|
done
|
|
echo "published arm64 client to $OWNER/debian $DISTRIBUTION/$COMPONENT"
|
|
|
|
- name: Attach the arm64 .deb to the Gitea release (stable tags only)
|
|
if: startsWith(gitea.ref, 'refs/tags/v')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
. scripts/ci/gitea-release.sh
|
|
RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
|
|
for DEB in dist/*.deb; do
|
|
upsert_asset "$RID" "$DEB"
|
|
done
|
|
|
|
# ---------------------------------------------------------------------------------------------
|
|
# Does the thing we just published actually INSTALL? Nothing in this repo asked that before, and
|
|
# the cost of not asking was two independent, long-lived facts nobody knew:
|
|
# * `punktfunk-host` has installed cleanly on Debian 13 for a long time — while docs-site said
|
|
# "Debian isn't a supported target … nobody has verified it".
|
|
# * `punktfunk-gamescope` was missing from apt entirely across two releases.
|
|
# Both are exactly what a five-minute install check catches, so it is now a job.
|
|
#
|
|
# It runs on the RUNNER (no `container:`) and drives docker directly — the same access
|
|
# docker.yml's image builds use — because the check must happen in a pristine distro image, not
|
|
# in a builder image with the deps already present.
|
|
#
|
|
# It installs FROM THE REGISTRY, after the publish jobs, rather than from a local .deb: that
|
|
# exercises the real path a user takes (repo key, apt distribution, dependency resolution against
|
|
# the distro's own package set), and it matches this workflow's established order — publish the
|
|
# good artifacts first, go red afterwards, never let a gate withhold a shipping fix.
|
|
smoke-install:
|
|
needs: [build-publish, build-publish-host, build-publish-gamescope]
|
|
# `needs` for ORDER only — this must still run when a builder went red, or the failure that
|
|
# matters most (a package that did not publish) is exactly the one that skips its own check and
|
|
# leaves the run looking merely "partly red" instead of saying what a user would hit.
|
|
if: ${{ !cancelled() }}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Recomputes the SAME version string the builder jobs stamped — pf-version.sh is
|
|
# deterministic per commit and GITHUB_RUN_NUMBER is shared across a run's jobs — so the check
|
|
# below can insist the registry is serving THIS run's build. Without that, a smoke job that
|
|
# beats the index regeneration installs the previous build, passes, and proves nothing.
|
|
- name: Channel + expected version
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
eval "$(bash scripts/ci/pf-version.sh)"
|
|
SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) V="${GITHUB_REF_NAME#v}"; DIST=stable ;;
|
|
*) V="${PF_BASE}~ci${GITHUB_RUN_NUMBER}.g${SHORT}"; DIST=canary ;;
|
|
esac
|
|
echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
|
|
echo "EXPECT_VERSION=$V" >> "$GITHUB_ENV"
|
|
echo "expecting $V in apt distribution '$DIST'"
|
|
|
|
# The support matrix, asserted rather than asserted-in-prose. Each row names the packages
|
|
# that MUST install on that distro; anything absent from the row is expected not to and is
|
|
# not checked here (the client's glibc 2.43 floor keeps it off 24.04 and Debian 13 —
|
|
# see docs-site/content/docs/debian.md).
|
|
- name: Install from the apt registry on every supported distro
|
|
run: bash scripts/ci/deb-install-smoke.sh
|
|
env:
|
|
PF_APT_DISTRIBUTION: ${{ env.DISTRIBUTION }}
|
|
PF_EXPECT_VERSION: ${{ env.EXPECT_VERSION }}
|