enricobuehler
eb8c943572
ci / web (pull_request) Successful in 1m4s
ci / bun-nix (pull_request) Successful in 26s
apple / swift (pull_request) Successful in 1m40s
apple / screenshots (pull_request) Skipped
ci / rust (pull_request) Failing after 2m3s
ci / docs-site (pull_request) Successful in 1m41s
ci / rust-arm64 (pull_request) Successful in 2m44s
android / android (pull_request) Successful in 4m50s
nix / flake (pull_request) Failing after 16m12s
Until now the patched gamescope reached exactly four kinds of box: the Bazzite/Fedora-Atomic sysext, the Arch package, the SteamOS installer and a NixOS option. Everyone else was told to build gamescope from source. A traditional Fedora-family box — Nobara, plain Fedora, the HTPCs people actually stream from — therefore ran stock gamescope by default, which streams SDR, cursorless, and tells every game its display is 60 Hz. That is not a user error; there was no package to install. Both new packages REPACK the binary CI already builds rather than building gamescope again: it is a ~10-minute meson compile of an unrelated tree, cached per distro base because the binary is soname-coupled to it. The Arch PKGBUILD stays the one recipe that builds from source, because that is what makepkg is for. - packaging/gamescope/punktfunk-gamescope.spec + build-gamescope-rpm.sh. Version is derived from the binary's own banner (3.16.25.pfhdr4) — the only source that cannot drift from what is in the package. rpmbuild's automatic ELF Requires are what stop an f43 build installing on f44. - packaging/debian/build-gamescope-deb.sh, same shape, with dpkg-shlibdeps for Depends. - rpm.yml packages and publishes it beside the host RPMs; deb.yml gains a cached gamescope build (keyed on packaging/gamescope/** alone) and packages it into the existing publish loop. Both legs are best-effort, matching the sysext's existing rule: no binary, no package, and the host stays on its current SDR path. Neither package Provides or Conflicts with gamescope — it installs as /usr/bin/punktfunk-gamescope and only the sessions the host starts itself resolve it, so a box's own Game Mode keeps using the distro binary. Both refuse to package a binary without the +pfhdr marker. That marker is the host's entire capability probe, so a build that lost the patches would install fine and then silently stream SDR with no cursor. Verified: build-gamescope-deb.sh produces an installable .deb from a stand-in binary (correct version derived from the banner, 0755 tree, control fields) and exits 1 on an unmarked one. The .spec is not yet exercised — no rpm tooling on the box I had; CI's Fedora leg is its first run.
490 lines
25 KiB
YAML
490 lines
25 KiB
YAML
# Build the punktfunk .debs and publish them to Gitea's Debian package registry, so Ubuntu
|
|
# boxes get new builds via `apt update && apt upgrade`. Three jobs, all publishing to the same
|
|
# apt distribution/component:
|
|
#
|
|
# build-publish — client + web + scripting, on the Ubuntu 26.04 rust-ci image (the client
|
|
# needs 24.04-absent libs: SDL3, GTK4 ≥ 4.20).
|
|
# build-publish-client-arm64
|
|
# — the same client package for arm64, CROSS-compiled on the same amd64
|
|
# runner in the rust-ci-arm64cross image. No host counterpart: the Linux
|
|
# host's encode stack is x86 (NVENC/QSV/AMF).
|
|
# build-publish-host — the HOST, on the Ubuntu 24.04 rust-ci-noble image with a from-source
|
|
# FFmpeg 8 BUNDLED into the .deb. This lowers the host's glibc floor to 2.39
|
|
# and removes the hard `Depends: libavcodec62`, so the ONE host .deb installs
|
|
# on Ubuntu 24.04 LTS through 26.04. (A 26.04-built host .deb is uninstallable
|
|
# on 24.04 — the reason this job exists; see packaging/debian/README.md.)
|
|
#
|
|
# Both compute VERSION identically (scripts/ci/pf-version.sh is deterministic per commit), so the
|
|
# host and client packages always share a version line. The release-attach helpers are race-safe
|
|
# (ensure_release create-or-fetch; upsert_asset only conflicts on same-name), so the jobs run parallel.
|
|
#
|
|
# Registry (public, unom org): https://git.unom.io/unom/-/packages
|
|
# Box setup (once): see packaging/debian/README.md
|
|
#
|
|
# REGISTRY_TOKEN: repo Actions secret, a PAT with write:package scope (shared with docker.yml).
|
|
name: deb
|
|
# One pending run per workflow+ref: a newer push supersedes the queued/running one and cancels
|
|
# it (a canary only needs the latest commit; each release tag is its own ref so tag runs never
|
|
# cancel each other). Keeps a busy push cadence from piling ~10 queued runs per commit onto the
|
|
# runner fleet. Gitea honors this for push triggers (PR triggers: see gitea#35933).
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# Scope canary builds to what this artifact is built FROM — a docs-only or
|
|
# web-only push should not light up the whole fleet. Applies to branch pushes;
|
|
# tag runs are matched by `tags:` (proven by flatpak/windows-msix releases).
|
|
paths:
|
|
- 'crates/**'
|
|
- 'clients/linux/**'
|
|
- 'clients/session/**'
|
|
- 'clients/shared/**'
|
|
- 'clients/cli/**'
|
|
- 'web/**'
|
|
- 'sdk/**'
|
|
- 'packaging/debian/**'
|
|
- 'packaging/linux/**'
|
|
- 'Cargo.toml'
|
|
- 'Cargo.lock'
|
|
- 'rust-toolchain.toml'
|
|
- 'scripts/ci/**'
|
|
- '.gitea/workflows/deb.yml'
|
|
# Single project version: a `vX.Y.Z` tag is THE release for every platform (see
|
|
# docs-site channels.md). The old version-shadow (a client tag shipping a host package
|
|
# that outranked rolling builds) is now structurally impossible — main publishes to the
|
|
# `canary` apt distribution, tags to `stable`, so the two never share a version line.
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY: git.unom.io
|
|
OWNER: unom
|
|
COMPONENT: main
|
|
RUSTC_WRAPPER: sccache
|
|
SCCACHE_BUCKET: unom-ci-sccache
|
|
SCCACHE_ENDPOINT: https://storage.unom.io
|
|
SCCACHE_REGION: home-central
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_SECRET_ACCESS_KEY }}
|
|
# sccache and incremental compilation are mutually exclusive; CI wants the shared
|
|
# cache, dev boxes keep incremental.
|
|
CARGO_INCREMENTAL: "0"
|
|
|
|
jobs:
|
|
build-publish:
|
|
runs-on: ubuntu-24.04
|
|
container:
|
|
image: 192.168.1.58:5010/punktfunk-rust-ci:latest
|
|
timeout-minutes: 90
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Shared compile cache (sccache -> RustFS S3 over the LAN). Baked into the builder
|
|
# images; this fetch keeps the job green while the running :latest predates the bake.
|
|
- name: sccache (no-op once the image bakes it)
|
|
run: |
|
|
command -v sccache >/dev/null 2>&1 || {
|
|
curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
|
|
| tar -xz --wildcards --strip-components=1 -C /usr/local/bin '*/sccache'
|
|
}
|
|
sccache --version
|
|
|
|
- name: Version + channel
|
|
# vX.Y.Z tag -> X.Y.Z, published to the `stable` apt distribution (a real release).
|
|
# A main push -> <next-minor>~ciN.g<sha>, published to the `canary` distribution: the '~' sorts
|
|
# below the eventual tag, it climbs monotonically by run number, and the canary base is
|
|
# derived one minor AHEAD of the latest stable tag (scripts/ci/pf-version.sh) so a
|
|
# stable->canary box re-point still moves forward (see channels.md). Computed BEFORE the build so it's stamped into the binary
|
|
# (PUNKTFUNK_BUILD_VERSION -> build.rs -> --version).
|
|
run: |
|
|
eval "$(bash scripts/ci/pf-version.sh)" # -> PF_BASE (one minor ahead of the latest stable tag)
|
|
SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) V="${GITHUB_REF_NAME#v}"; DIST=stable ;;
|
|
*) V="${PF_BASE}~ci${GITHUB_RUN_NUMBER}.g${SHORT}"; DIST=canary ;;
|
|
esac
|
|
echo "VERSION=$V" >> "$GITHUB_ENV"
|
|
echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
|
|
echo "package version $V -> apt distribution '$DIST'"
|
|
|
|
# dpkg-shlibdeps (Depends resolution) + dpkg-deb live in dpkg-dev. The client's link
|
|
# deps are also baked into the rust-ci image, but this job runs against the image
|
|
# from the PREVIOUS push (docker.yml bootstrap note) — keep it green across image
|
|
# changes; a no-op once the image has them.
|
|
- name: dpkg-dev + client link deps
|
|
run: |
|
|
apt-get update
|
|
# python3 is used by scripts/ci/gitea-release.sh for the stable-tag release attach.
|
|
# No libvulkan-dev: nothing here compiles or links against Vulkan (ash dlopens
|
|
# libvulkan and pf-vkdecode binds nothing at build time), so neither the compile nor
|
|
# dpkg-shlibdeps — which resolves DT_NEEDED sonames only — ever asks for it. The
|
|
# client's `Depends: libvulkan1` is added by hand in packaging/debian/build-client-deb.sh
|
|
# precisely because a dlopen is invisible to shlibdeps.
|
|
# No libav*-dev: the client links no FFmpeg since M10 (§6 of
|
|
# design/client-native-decode.md).
|
|
apt-get install -y --no-install-recommends dpkg-dev python3 \
|
|
libgtk-4-dev libadwaita-1-dev libsdl3-dev
|
|
|
|
# Share ci.yml's cache keys so the release build reuses its registry + target artifacts.
|
|
- name: Cache keys
|
|
run: echo "rustc=$(rustc --version | cut -d' ' -f2)" >> "$GITHUB_ENV"
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
/usr/local/cargo/registry
|
|
/usr/local/cargo/git
|
|
key: cargo-home-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-home-
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: target
|
|
# -v3-: bypass a target cache poisoned by a disk-full build (see ci.yml). Shares the
|
|
# key with ci.yml so the release build reuses its clean artifacts.
|
|
key: cargo-target-v3-${{ env.rustc }}-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-target-v3-${{ env.rustc }}-
|
|
|
|
- name: Build release clients
|
|
env:
|
|
PUNKTFUNK_BUILD_VERSION: ${{ env.VERSION }} # stamped into the binaries (build.rs)
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
# FOUR binaries ship in the client .deb, so all four are built here: the GTK shell,
|
|
# punktfunk-client-session (the Vulkan/Skia streamer the shell execs for a connect),
|
|
# punktfunk-cli (the headless `punktfunk` front-end), and pf-update (the root helper
|
|
# behind `punktfunk-client --apply-update`). build-client-deb.sh installs all four;
|
|
# leaving punktfunk-cli out here made it fall over on `install: No such file or
|
|
# directory`, because its build-if-missing guard only tested the first two and so decided
|
|
# everything was already built. The HOST is built separately in the build-publish-host
|
|
# job (Ubuntu 24.04 image + bundled FFmpeg 8).
|
|
cargo build --release --locked \
|
|
-p punktfunk-client-linux -p punktfunk-client-session -p punktfunk-cli -p pf-update
|
|
|
|
- name: Build + smoke-boot web console (bun preset)
|
|
# Gate the .deb on a real bun boot: the punktfunk-web .deb runs the Nitro `bun` preset
|
|
# (our Bun.serve TLS entry), so prove the build IS a bun bundle and serves /login.
|
|
# No TLS env here, so the custom entry binds plain HTTP — the smoke curl stays simple.
|
|
run: |
|
|
# bun builds AND runs the console. Baked into the rust-ci image; bootstrap here too so the
|
|
# job stays green against the PREVIOUS image (docker.yml bootstrap lag).
|
|
command -v bun >/dev/null || {
|
|
apt-get install -y --no-install-recommends unzip
|
|
curl -fsSL https://bun.sh/install | bash
|
|
}
|
|
export PATH="$HOME/.bun/bin:$PATH"
|
|
cd web
|
|
bun install --frozen-lockfile
|
|
bun run build
|
|
if ! grep -q 'Bun\.serve' .output/server/index.mjs; then
|
|
echo "ERROR: web build is not a bun bundle — need the 'bun' preset + custom entry"; exit 1
|
|
fi
|
|
PORT=3009 HOST=127.0.0.1 PUNKTFUNK_UI_PASSWORD=ci bun .output/server/index.mjs &
|
|
NP=$!; sleep 3
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3009/login || echo 000)
|
|
kill "$NP" 2>/dev/null || true
|
|
echo "web console smoke: /login -> $code"
|
|
[ "$code" = 200 ] || { echo "ERROR: web console failed to boot under bun"; exit 1; }
|
|
|
|
- name: Build .debs
|
|
run: |
|
|
export PATH="$HOME/.bun/bin:$PATH"
|
|
# host .deb is built in build-publish-host (Ubuntu 24.04 image); this job ships the rest.
|
|
VERSION="$VERSION" bash packaging/debian/build-client-deb.sh
|
|
# Reuse CI's bun for the vendored runtime (matches the amd64 runner) instead of downloading.
|
|
VERSION="$VERSION" BUN_BIN="$(command -v bun || true)" bash packaging/debian/build-web-deb.sh
|
|
# The plugin/script runner (bun-bundled Effect SDK) — same vendored-bun mechanics.
|
|
VERSION="$VERSION" BUN_BIN="$(command -v bun || true)" bash packaging/debian/build-scripting-deb.sh
|
|
|
|
- name: Publish to the Gitea apt registry
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
for DEB in dist/*.deb; do
|
|
echo "uploading $DEB"
|
|
# A re-tagged release re-fires this workflow and the apt registry 409s on duplicate
|
|
# package versions — delete any prior copy of this exact name/version/arch first
|
|
# (404 on the first publish is fine).
|
|
NAME=$(dpkg-deb -f "$DEB" Package)
|
|
VER=$(dpkg-deb -f "$DEB" Version)
|
|
ARCH=$(dpkg-deb -f "$DEB" Architecture)
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/$NAME/$VER/$ARCH" || true
|
|
# PAT owner (enricobuehler), not the push actor — matches docker.yml's registry login.
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
|
|
done
|
|
echo "published to $OWNER/debian $DISTRIBUTION/$COMPONENT"
|
|
|
|
# On a real release, also attach the .debs to the unified Gitea Release so they're on the
|
|
# downloads page next to every other platform's artifact (canary builds live in the apt
|
|
# `canary` distribution above — no release page for those).
|
|
- name: Attach .debs to the Gitea release (stable tags only)
|
|
if: startsWith(gitea.ref, 'refs/tags/v')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
. scripts/ci/gitea-release.sh
|
|
RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
|
|
for DEB in dist/*.deb; do
|
|
upsert_asset "$RID" "$DEB"
|
|
done
|
|
|
|
# ---------------------------------------------------------------------------------------------
|
|
# The HOST .deb — built on Ubuntu 24.04 (noble) with a from-source FFmpeg 8 BUNDLED, so it installs
|
|
# on Ubuntu 24.04 LTS through 26.04 (see the file header + packaging/debian/README.md). Runs in
|
|
# parallel with build-publish and publishes to the SAME distribution/component; the version step is
|
|
# byte-identical so host and clients share a version line.
|
|
build-publish-host:
|
|
runs-on: ubuntu-24.04
|
|
container:
|
|
image: 192.168.1.58:5010/punktfunk-rust-ci-noble:latest
|
|
timeout-minutes: 90
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Shared compile cache (sccache -> RustFS S3 over the LAN). Baked into the builder
|
|
# images; this fetch keeps the job green while the running :latest predates the bake.
|
|
- name: sccache (no-op once the image bakes it)
|
|
run: |
|
|
command -v sccache >/dev/null 2>&1 || {
|
|
curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
|
|
| tar -xz --wildcards --strip-components=1 -C /usr/local/bin '*/sccache'
|
|
}
|
|
sccache --version
|
|
|
|
- name: Version + channel
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
eval "$(bash scripts/ci/pf-version.sh)" # -> PF_BASE (one minor ahead of the latest stable tag)
|
|
SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) V="${GITHUB_REF_NAME#v}"; DIST=stable ;;
|
|
*) V="${PF_BASE}~ci${GITHUB_RUN_NUMBER}.g${SHORT}"; DIST=canary ;;
|
|
esac
|
|
echo "VERSION=$V" >> "$GITHUB_ENV"
|
|
echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
|
|
echo "host package version $V -> apt distribution '$DIST'"
|
|
|
|
# dpkg-shlibdeps/dpkg-deb + patchelf are baked into rust-ci-noble; python3 is for the
|
|
# release-attach helper. Re-install defensively so the job stays green against the PREVIOUS
|
|
# image on the same push (docker.yml bootstrap lag) — a no-op once the image ships them.
|
|
- name: dpkg-dev + patchelf + python3
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends dpkg-dev patchelf python3
|
|
|
|
- name: Cache keys
|
|
run: echo "rustc=$(rustc --version | cut -d' ' -f2)" >> "$GITHUB_ENV"
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
/usr/local/cargo/registry
|
|
/usr/local/cargo/git
|
|
key: cargo-home-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-home-
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: target
|
|
# Own key: this target dir is built against 24.04's glibc/toolchain and must NOT share
|
|
# ci.yml's 26.04 target cache (mixing would poison both).
|
|
key: cargo-target-noble-v1-${{ env.rustc }}-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-target-noble-v1-${{ env.rustc }}-
|
|
|
|
- name: Build release host
|
|
env:
|
|
PUNKTFUNK_BUILD_VERSION: ${{ env.VERSION }} # stamped into the binary (build.rs)
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
# Same features the old combined build used: --nvenc (direct-SDK NVENC, real RFI on NVIDIA;
|
|
# NVENC/CUDA is dlopen'd — no link dep, so this image needs no libcuda stub) + --vulkan-encode
|
|
# (raw VK_KHR_video_encode_h265 on AMD/Intel, pure ash). ffmpeg-sys-next links the image's
|
|
# bundled FFmpeg 8 via PKG_CONFIG_PATH (set in rust-ci-noble).
|
|
#
|
|
# punktfunk-tray is deliberately NOT in this invocation — build-deb.sh builds it separately,
|
|
# and that split is load-bearing (see the identical note in the RPM spec / Arch PKGBUILD):
|
|
# cargo unifies features across one build, so co-building the tray with the host pulls the
|
|
# host's ashpd -> zbus/tokio onto the tray's shared zbus and the tray panics at every launch
|
|
# with "there is no reactor running, must be called from the context of a Tokio 1.x runtime".
|
|
# It WAS listed here, which is why only the .deb shipped a crashing tray while the RPM and
|
|
# Arch packages — which already split it — were fine.
|
|
cargo build --release --locked --features punktfunk-host/nvenc,punktfunk-host/vulkan-encode \
|
|
-p punktfunk-host
|
|
|
|
- name: Build host .deb (FFmpeg bundled)
|
|
# BUNDLE_FFMPEG=1 copies the image's /opt/ffmpeg libav* into the package and repoints the
|
|
# binary's rpath, so there is no `Depends: libavcodec62` to block install on 24.04. FFMPEG_PREFIX
|
|
# defaults to /opt/ffmpeg (the image's ENV also sets it).
|
|
run: |
|
|
VERSION="$VERSION" BUNDLE_FFMPEG=1 bash packaging/debian/build-deb.sh
|
|
|
|
# punktfunk-gamescope for apt. Same reasoning as the RPM leg in rpm.yml: without a packaged
|
|
# build, a Debian/Ubuntu box has no route to the patched gamescope except compiling it, and a
|
|
# stock gamescope streams SDR, cursorless, and tells every game its display is 60 Hz.
|
|
#
|
|
# CACHED on packaging/gamescope/** alone — it depends on nothing else in this repo, so a
|
|
# normal push restores a binary instead of spending ~10 minutes on someone else's tree.
|
|
- uses: actions/cache@v4
|
|
id: gamescope
|
|
with:
|
|
path: gs-cache
|
|
key: punktfunk-gamescope-noble-${{ hashFiles('packaging/gamescope/**') }}
|
|
|
|
- name: Build the patched gamescope
|
|
if: steps.gamescope.outputs.cache-hit != 'true'
|
|
# Best-effort, exactly like rpm.yml: the host packages above are the primary delivery and
|
|
# work without this binary, so a hiccup building an unrelated tree must not fail the job.
|
|
# `build-dep gamescope` resolves the distro's much older packaged version, so it can come up
|
|
# short — that is what the `|| true`s absorb, and the marker check downstream is what makes
|
|
# a half-built result impossible to ship.
|
|
run: |
|
|
set -x
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends meson ninja-build glslc git || true
|
|
apt-get build-dep -y gamescope || true
|
|
if bash packaging/gamescope/build-punktfunk-gamescope.sh \
|
|
--destdir "$PWD/gs-stage" --prefix /usr --jobs "$(nproc)"; then
|
|
install -Dm0755 gs-stage/usr/bin/punktfunk-gamescope gs-cache/punktfunk-gamescope
|
|
else
|
|
echo "::warning::punktfunk-gamescope failed to build on noble — no .deb this run (gamescope sessions stay SDR)"
|
|
fi
|
|
|
|
- name: Build punktfunk-gamescope .deb
|
|
# Picked up by the publish loop below, which globs dist/*.deb.
|
|
run: |
|
|
if [ -x gs-cache/punktfunk-gamescope ] && gs-cache/punktfunk-gamescope --version >/dev/null 2>&1; then
|
|
bash packaging/debian/build-gamescope-deb.sh --binary gs-cache/punktfunk-gamescope
|
|
else
|
|
echo "::warning::no usable punktfunk-gamescope — skipping its .deb"
|
|
fi
|
|
|
|
- name: Publish to the Gitea apt registry
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
for DEB in dist/*.deb; do
|
|
echo "uploading $DEB"
|
|
NAME=$(dpkg-deb -f "$DEB" Package)
|
|
VER=$(dpkg-deb -f "$DEB" Version)
|
|
ARCH=$(dpkg-deb -f "$DEB" Architecture)
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/$NAME/$VER/$ARCH" || true
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
|
|
done
|
|
echo "published host to $OWNER/debian $DISTRIBUTION/$COMPONENT"
|
|
|
|
- name: Attach the host .deb to the Gitea release (stable tags only)
|
|
if: startsWith(gitea.ref, 'refs/tags/v')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
. scripts/ci/gitea-release.sh
|
|
RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
|
|
for DEB in dist/*.deb; do
|
|
upsert_asset "$RID" "$DEB"
|
|
done
|
|
|
|
# ---------------------------------------------------------------------------------------------
|
|
# The aarch64 CLIENT .deb. Cross-compiled on the ordinary amd64 runner in the
|
|
# punktfunk-rust-ci-arm64cross image (the rust-ci toolchain + an arm64 multiarch sysroot — see
|
|
# ci/rust-ci-arm64cross.Dockerfile); there is no arm64 runner in the fleet and none is needed.
|
|
# Client only, by decision: the Linux host encodes with NVENC/QSV/AMF, all x86.
|
|
# Publishes to the same distribution/component as the amd64 jobs — the apt registry keys pool
|
|
# entries by arch, so `apt` on an arm64 box picks this one up with no client-side configuration.
|
|
build-publish-client-arm64:
|
|
runs-on: ubuntu-24.04
|
|
container:
|
|
image: 192.168.1.58:5010/punktfunk-rust-ci-arm64cross:latest
|
|
timeout-minutes: 90
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Shared compile cache (sccache -> RustFS S3 over the LAN). Baked into the builder
|
|
# images; this fetch keeps the job green while the running :latest predates the bake.
|
|
- name: sccache (no-op once the image bakes it)
|
|
run: |
|
|
command -v sccache >/dev/null 2>&1 || {
|
|
curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
|
|
| tar -xz --wildcards --strip-components=1 -C /usr/local/bin '*/sccache'
|
|
}
|
|
sccache --version
|
|
|
|
# Byte-identical to build-publish's version step (pf-version.sh is deterministic per
|
|
# commit), so the arm64 package always shares the amd64 version line.
|
|
- name: Version + channel
|
|
run: |
|
|
eval "$(bash scripts/ci/pf-version.sh)"
|
|
SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) V="${GITHUB_REF_NAME#v}"; DIST=stable ;;
|
|
*) V="${PF_BASE}~ci${GITHUB_RUN_NUMBER}.g${SHORT}"; DIST=canary ;;
|
|
esac
|
|
echo "VERSION=$V" >> "$GITHUB_ENV"
|
|
echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
|
|
echo "package version $V -> apt distribution '$DIST' (arm64)"
|
|
|
|
# dpkg-shlibdeps + dpkg-deb. The arm64 link deps themselves are the cross image's whole
|
|
# point and are already baked in; python3 is for scripts/ci/gitea-release.sh.
|
|
- name: dpkg-dev
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends dpkg-dev python3
|
|
|
|
- name: Cache keys
|
|
run: echo "rustc=$(rustc --version | cut -d' ' -f2)" >> "$GITHUB_ENV"
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
/usr/local/cargo/registry
|
|
/usr/local/cargo/git
|
|
key: cargo-home-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-home-
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: target
|
|
# Its OWN key — these are aarch64 artifacts under target/aarch64-unknown-linux-gnu/
|
|
# and must never share the amd64 jobs' target cache.
|
|
key: cargo-target-arm64-v1-${{ env.rustc }}-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: cargo-target-arm64-v1-${{ env.rustc }}-
|
|
|
|
- name: Build the arm64 client .deb
|
|
env:
|
|
PUNKTFUNK_BUILD_VERSION: ${{ env.VERSION }} # stamped into the binaries (build.rs)
|
|
run: |
|
|
git config --global --add safe.directory "$PWD"
|
|
ARCH=arm64 TARGET=aarch64-unknown-linux-gnu \
|
|
bash packaging/debian/build-client-deb.sh
|
|
# Fail here rather than shipping an amd64 binary under an arm64 package name.
|
|
readelf -h target/aarch64-unknown-linux-gnu/release/punktfunk-session \
|
|
| grep -q AArch64 || { echo "ERROR: session binary is not AArch64"; exit 1; }
|
|
|
|
- name: Publish to the Gitea apt registry
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
for DEB in dist/*.deb; do
|
|
echo "uploading $DEB"
|
|
NAME=$(dpkg-deb -f "$DEB" Package)
|
|
VER=$(dpkg-deb -f "$DEB" Version)
|
|
ARCH=$(dpkg-deb -f "$DEB" Architecture)
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/$NAME/$VER/$ARCH" || true
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
|
|
"https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
|
|
done
|
|
echo "published arm64 client to $OWNER/debian $DISTRIBUTION/$COMPONENT"
|
|
|
|
- name: Attach the arm64 .deb to the Gitea release (stable tags only)
|
|
if: startsWith(gitea.ref, 'refs/tags/v')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
. scripts/ci/gitea-release.sh
|
|
RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
|
|
for DEB in dist/*.deb; do
|
|
upsert_asset "$RID" "$DEB"
|
|
done
|