enricobuehler
b2451e6aea
The re-architected Linux client is now two binaries: the punktfunk-client shell execs its sibling punktfunk-session (ash/Vulkan presenter + Skia console UI) for --connect/--browse. The Decky plugin's stream and browse paths launch the shell with exactly those flags, but the flatpak built and installed only the shell, so streaming and the gamepad library from the Deck failed at exec with "punktfunk-session: No such file" (pair/wake/library still worked — the shell handles them in-process). Build and install both binaries. The session binary pulls in Skia (skia-safe), whose build script downloads a prebuilt libskia — dead in the offline sandbox — so point skia-bindings at a pinned, vendored archive via SKIA_BINARIES_URL=file:// (read directly, no curl); the tarball rides along as a sha256-pinned flatpak source. Widen the flatpak CI path filters to the session binary's crates (linux-session, pf-presenter, pf-console-ui, pf-client-core) and fix the moved library.rs path in the Decky error-classifier comment. All other plugin↔client contracts (flags, pairing/library output, config files, env vars, exit codes, the 47990 mgmt port) already match — no changes needed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
290 lines
17 KiB
YAML
290 lines
17 KiB
YAML
# Build the native punktfunk Linux CLIENT as a single-file Flatpak bundle and publish it to
|
|
# Gitea's GENERIC package registry, so the Steam Deck (and any flatpak distro) installs it
|
|
# the SteamOS-native, update-survivable way: `flatpak install --user <downloaded>.flatpak`.
|
|
# (The HOST stays an RPM/deb — it needs unsandboxed /dev/uinput + zero-copy NVENC; only the
|
|
# CLIENT is sandbox-friendly. See packaging/README.md and packaging/flatpak/README.md.)
|
|
#
|
|
# Gitea has NO flatpak/ostree registry, so the bundle lives in the generic registry:
|
|
# PUT https://git.unom.io/api/packages/unom/generic/punktfunk-client-flatpak/<version>/<file>
|
|
# GET https://git.unom.io/api/packages/unom/generic/punktfunk-client-flatpak/<version>/<file>
|
|
# On tags the bundle is ALSO attached to the Gitea release (mirrors release.yml's DMG).
|
|
#
|
|
# PRIVILEGED-BUILD CONSTRAINT: flatpak-builder runs bubblewrap, which needs user namespaces.
|
|
# In a Gitea/act_runner Docker executor that means the job container must be --privileged
|
|
# (the same runner already runs `docker build` in docker.yml, so its Docker daemon allows it).
|
|
# If your runner CANNOT grant --privileged, this job will fail at `flatpak-builder` with
|
|
# "Creating new namespace failed: Operation not permitted" — see the fallback in
|
|
# packaging/flatpak/README.md (build on the Deck via org.flatpak.Builder, or on a Linux box,
|
|
# then upload with the curl line below).
|
|
#
|
|
# REGISTRY_TOKEN: repo Actions secret, a PAT with write:package scope (shared with deb/rpm/docker).
|
|
name: flatpak
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# The flatpak is the CLIENT — only rebuild when the client/core/manifest change, not on every
|
|
# design/host push (this is a heavy flatpak-builder run). Tags (v*, the client release) build too.
|
|
# The bundle ships BOTH client binaries (shell + Vulkan session), so every crate in either
|
|
# binary's dependency closure must be listed here.
|
|
paths:
|
|
- 'clients/linux/**'
|
|
- 'clients/linux-session/**'
|
|
- 'crates/punktfunk-core/**'
|
|
- 'crates/pf-client-core/**'
|
|
- 'crates/pf-presenter/**'
|
|
- 'crates/pf-console-ui/**'
|
|
- 'packaging/flatpak/**'
|
|
- 'Cargo.lock'
|
|
- '.gitea/workflows/flatpak.yml'
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY: git.unom.io
|
|
OWNER: unom
|
|
APP_ID: io.unom.Punktfunk
|
|
MANIFEST: packaging/flatpak/io.unom.Punktfunk.yml
|
|
PACKAGE: punktfunk-client-flatpak # generic-registry package name
|
|
REPO_URL: https://flatpak.unom.io # shared unom OSTree repo (reusable across unom apps)
|
|
DEPLOY_DIR: unom-flatpak # ~/<dir> on unom-1 (compose + ./site tree)
|
|
|
|
jobs:
|
|
build-publish:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 120
|
|
container:
|
|
# Fedora ships a recent flatpak + flatpak-builder + the kernel userns support.
|
|
# --privileged is required for bubblewrap inside the Docker executor (see header).
|
|
image: fedora:43
|
|
options: --privileged
|
|
steps:
|
|
# fedora:43 has no node, but actions/checkout (a JS action) needs it. A plain `run:` step
|
|
# executes via the container shell (no node needed), so install node BEFORE checkout.
|
|
- name: node for the JS actions
|
|
run: dnf -y install nodejs
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Tooling
|
|
run: |
|
|
# flatpak-cargo-generator.py (master) needs aiohttp + tomlkit (NOT the old `toml`).
|
|
# gnupg2/rsync/openssh-clients: sign the OSTree repo + rsync it to unom-1 (see the deploy step).
|
|
dnf -y install flatpak flatpak-builder git python3 python3-aiohttp python3-tomlkit curl jq \
|
|
gnupg2 rsync openssh-clients
|
|
# Flathub provides the GNOME runtime/SDK + the rust-stable + ffmpeg-full extensions.
|
|
flatpak remote-add --user --if-not-exists flathub \
|
|
https://dl.flathub.org/repo/flathub.flatpakrepo
|
|
git config --global --add safe.directory "$PWD"
|
|
|
|
- name: Version + channel
|
|
# Tag vX.Y.Z -> X.Y.Z on the OSTree `stable` branch (a real release); a main push ->
|
|
# <next-minor>-ciN.g<sha> on the `canary` branch (base one minor ahead of the latest stable
|
|
# tag via scripts/ci/pf-version.sh). The two branches live side-by-side in one repo
|
|
# (rsync runs without --delete), each tracked by its own .flatpakref, so `flatpak update`
|
|
# on a stable box never jumps to a canary build. The generic-registry version string allows
|
|
# letters/dots/hyphens.
|
|
run: |
|
|
eval "$(bash scripts/ci/pf-version.sh)" # -> PF_BASE (one minor ahead of the latest stable tag)
|
|
SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
|
|
case "$GITHUB_REF" in
|
|
refs/tags/v*) V="${GITHUB_REF_NAME#v}"; BRANCH=stable; ALIAS=latest ;;
|
|
*) V="${PF_BASE}-ci${GITHUB_RUN_NUMBER}.g${SHORT}"; BRANCH=canary; ALIAS=canary ;;
|
|
esac
|
|
echo "VERSION=$V" >> "$GITHUB_ENV"
|
|
echo "BUNDLE=punktfunk-client-${V}.flatpak" >> "$GITHUB_ENV"
|
|
echo "FLATPAK_BRANCH=$BRANCH" >> "$GITHUB_ENV"
|
|
echo "ALIAS=$ALIAS" >> "$GITHUB_ENV"
|
|
echo "flatpak version $V -> branch '$BRANCH' alias '$ALIAS'"
|
|
|
|
- name: Generate offline cargo sources
|
|
# flatpak builds with no network; vendor every crate from Cargo.lock into
|
|
# cargo-sources.json next to the manifest (referenced by the manifest's
|
|
# punktfunk-client module).
|
|
#
|
|
# Prune the microsoft/windows-rs git crates first: they belong to
|
|
# punktfunk-client-windows, which the flatpak never builds, and leaving them in makes
|
|
# flatpak-builder full-clone that multi-GB repo at build time → "No space left on
|
|
# device" (see packaging/flatpak/prune-windows-lock.py). The committed Cargo.lock is
|
|
# untouched; cargo --offline only needs sources for the crates it compiles.
|
|
run: |
|
|
curl -fsSL -o /tmp/flatpak-cargo-generator.py \
|
|
https://raw.githubusercontent.com/flatpak/flatpak-builder-tools/master/cargo/flatpak-cargo-generator.py
|
|
python3 packaging/flatpak/prune-windows-lock.py Cargo.lock /tmp/Cargo.flatpak.lock
|
|
python3 /tmp/flatpak-cargo-generator.py /tmp/Cargo.flatpak.lock \
|
|
-o packaging/flatpak/cargo-sources.json
|
|
|
|
- name: Seed the local OSTree repo from the live server (keep BOTH channels in the summary)
|
|
# Each CI run builds only ONE branch (canary on main, stable on a tag). The deploy step's
|
|
# `flatpak build-update-repo` regenerates the repo SUMMARY from whatever refs are in the
|
|
# LOCAL repo, and the rsync publishes it (without --delete). A fresh single-branch local
|
|
# repo therefore produces a single-branch summary that CLOBBERS the other channel on the
|
|
# server — the exact bug that made `app/io.unom.Punktfunk/x86_64/stable` unresolvable
|
|
# ("No such ref") after a canary main-push overwrote the post-release summary, even though
|
|
# the stable commit's objects were still on disk. Fix: mirror the published repo DOWN first,
|
|
# so the local repo carries every existing branch; the build below then only ADDS this run's
|
|
# commit and the regenerated+signed summary keeps both channels. No-op on a fresh repo (first
|
|
# publish) or when the deploy secrets aren't set (the build still produces a valid bundle).
|
|
env:
|
|
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
|
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
|
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${DEPLOY_HOST:-}" ] || [ -z "${DEPLOY_SSH_KEY:-}" ]; then
|
|
echo "::warning::DEPLOY_* not set — no seed; building a fresh single-branch repo."
|
|
exit 0
|
|
fi
|
|
install -d -m700 ~/.ssh
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy; chmod 600 ~/.ssh/deploy
|
|
SSH="ssh -i $HOME/.ssh/deploy -p ${DEPLOY_PORT:-22} -o StrictHostKeyChecking=accept-new"
|
|
DEST="${DEPLOY_USER}@${DEPLOY_HOST}"
|
|
mkdir -p "$PWD/repo"
|
|
# Pull the currently-published repo (all channels' objects + refs) into the repo the build
|
|
# will extend. No --delete: the local repo starts empty, so this only ADDS. A missing
|
|
# server repo (very first publish) is fine — we continue with a fresh repo.
|
|
rsync -az --info=stats1 -e "$SSH" "$DEST:$DEPLOY_DIR/site/repo/" "$PWD/repo/" \
|
|
|| echo "::warning::no published repo to seed (first publish?) — continuing fresh"
|
|
echo "seeded refs:"; ls "$PWD/repo/refs/heads/app/$APP_ID/x86_64/" 2>/dev/null || echo " (none)"
|
|
|
|
- name: Build the flatpak (install deps from Flathub, offline build)
|
|
run: |
|
|
# --install-deps-from=flathub pulls everything the manifest declares: the GNOME 50
|
|
# runtime/SDK + the rust-stable (//25.08, rustc 1.96) and llvm20 SDK extensions, plus
|
|
# the runtime's auto codecs-extra (HEVC libavcodec). --disable-rofiles-fuse is the
|
|
# container-safe path (no FUSE).
|
|
# --default-branch=$FLATPAK_BRANCH pins the ref to app/io.unom.Punktfunk/x86_64/<branch>
|
|
# (canary or stable) so the matching hosted .flatpakref resolves deterministically
|
|
# (manifest sets no branch).
|
|
flatpak-builder --user --force-clean --disable-rofiles-fuse \
|
|
--default-branch="$FLATPAK_BRANCH" \
|
|
--install-deps-from=flathub \
|
|
--repo="$PWD/repo" \
|
|
"$PWD/build-dir" "$MANIFEST"
|
|
|
|
- name: Export single-file bundle
|
|
run: |
|
|
# Branch must be passed explicitly (matches --default-branch above); build-bundle
|
|
# otherwise defaults to `master` and errors "Refspec … not found".
|
|
flatpak build-bundle "$PWD/repo" "$BUNDLE" "$APP_ID" "$FLATPAK_BRANCH"
|
|
ls -lh "$BUNDLE"
|
|
|
|
- name: Publish to the Gitea generic registry
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
BASE="https://$REGISTRY/api/packages/$OWNER/generic/$PACKAGE"
|
|
# 1) Versioned URL. A re-tagged release re-fires this workflow and the registry 409s on
|
|
# duplicate uploads — delete any prior copy first (404 on the first publish is fine).
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"$BASE/$VERSION/$BUNDLE" || true
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$BUNDLE" \
|
|
"$BASE/$VERSION/$BUNDLE"
|
|
echo "published $BASE/$VERSION/$BUNDLE"
|
|
# 2) Channel alias (stable release -> latest/, canary main build -> canary/) for the
|
|
# Decky fallback + scripts. The generic registry rejects re-uploading an existing
|
|
# version/file (409), so delete the prior alias file first (ignore 404 on run #1).
|
|
curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
|
|
"$BASE/$ALIAS/punktfunk-client.flatpak" || true
|
|
curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$BUNDLE" \
|
|
"$BASE/$ALIAS/punktfunk-client.flatpak"
|
|
echo "published $BASE/$ALIAS/punktfunk-client.flatpak"
|
|
|
|
# Sign the OSTree repo flatpak-builder already produced and publish it to flatpak.unom.io on
|
|
# unom-1, so users get `flatpak update` (the single-file bundle above has no remote). Mirrors
|
|
# docker.yml's deploy-docs (DEPLOY_* = the unom-ci-deploy key). No-ops cleanly until the GPG
|
|
# secret + DEPLOY_* exist, so the bundle build stays green during setup.
|
|
- name: Sign + deploy the OSTree repo to unom-1 (flatpak.unom.io)
|
|
env:
|
|
FLATPAK_GPG_PRIVATE_KEY: ${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}
|
|
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
|
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
|
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${FLATPAK_GPG_PRIVATE_KEY:-}" ] || [ -z "${DEPLOY_HOST:-}" ]; then
|
|
echo "::warning::FLATPAK_GPG_PRIVATE_KEY/DEPLOY_* not set — skipping repo deploy (bundle still published)."
|
|
exit 0
|
|
fi
|
|
# 1) Import the signing key into a throwaway keyring; sign the repo.
|
|
export GNUPGHOME="$(mktemp -d)"; chmod 700 "$GNUPGHOME"
|
|
echo "$FLATPAK_GPG_PRIVATE_KEY" | base64 -d | gpg --batch --import
|
|
KEYID="$(gpg --list-keys --with-colons | awk -F: '/^fpr:/{print $10; exit}')"
|
|
# build-sign signs the COMMIT objects; build-update-repo signs the SUMMARY. Both are
|
|
# required — clients with gpg-verify=true verify the commit, so summary-only signing
|
|
# fails the pull with "GPG verification enabled, but no signatures found".
|
|
flatpak build-sign "$PWD/repo" "$APP_ID" "$FLATPAK_BRANCH" \
|
|
--gpg-sign="$KEYID" --gpg-homedir="$GNUPGHOME"
|
|
flatpak build-update-repo --generate-static-deltas \
|
|
--gpg-sign="$KEYID" --gpg-homedir="$GNUPGHOME" "$PWD/repo"
|
|
# The regenerated summary advertises exactly these refs — must include EVERY channel that
|
|
# has ever published (the seed step ensures the other channel's commit is present). If this
|
|
# ever shows only one branch on a repo that had two, the seed didn't run — investigate.
|
|
echo "published summary advertises:"; ls "$PWD/repo/refs/heads/app/$APP_ID/x86_64/" 2>/dev/null || echo " (none)"
|
|
# 2) Build the install descriptors (GPGKey = the committed public key, base64).
|
|
GPGKEY="$(base64 -w0 packaging/flatpak/unom-flatpak.gpg)"
|
|
rm -rf site && mkdir -p site
|
|
cat > site/unom.flatpakrepo <<EOF
|
|
[Flatpak Repo]
|
|
Title=unom
|
|
Url=$REPO_URL/repo/
|
|
Homepage=https://punktfunk.unom.io
|
|
Comment=unom Flatpak applications
|
|
GPGKey=$GPGKEY
|
|
EOF
|
|
# Two refs, one per channel. Both descriptor files are regenerated every run and rsync'd
|
|
# without --delete; the repo SUMMARY carries both branches because the build was seeded
|
|
# from the live repo above (so build-update-repo below re-signs a summary listing every
|
|
# published channel, not just this run's). The stable ref resolves for good once any
|
|
# release has built the `stable` branch. A box installs ONE; `flatpak update` then tracks
|
|
# that channel's branch.
|
|
write_ref() { # <filename> <branch> <title>
|
|
cat > "site/$1" <<EOF
|
|
[Flatpak Ref]
|
|
Name=$APP_ID
|
|
Branch=$2
|
|
Url=$REPO_URL/repo/
|
|
Title=$3
|
|
Homepage=https://punktfunk.unom.io
|
|
IsRuntime=false
|
|
GPGKey=$GPGKEY
|
|
RuntimeRepo=https://dl.flathub.org/repo/flathub.flatpakrepo
|
|
EOF
|
|
}
|
|
write_ref "${APP_ID}.flatpakref" stable "Punktfunk"
|
|
write_ref "${APP_ID}.Canary.flatpakref" canary "Punktfunk (Canary)"
|
|
cat > site/index.html <<EOF
|
|
<!doctype html><meta charset=utf-8><title>unom flatpak repo</title>
|
|
<h1>unom Flatpak repository</h1>
|
|
<p>Install the Punktfunk Linux client (auto-adds Flathub for the GNOME runtime, then tracks updates).</p>
|
|
<p><b>Stable</b> (recommended — only moves on releases):</p>
|
|
<pre>flatpak install --user $REPO_URL/${APP_ID}.flatpakref
|
|
flatpak run $APP_ID</pre>
|
|
<p><b>Canary</b> (latest main build, unstable):</p>
|
|
<pre>flatpak install --user $REPO_URL/${APP_ID}.Canary.flatpakref</pre>
|
|
<p>Or add the whole remote: <code>flatpak remote-add --user --if-not-exists unom $REPO_URL/unom.flatpakrepo</code></p>
|
|
EOF
|
|
# 3) Ship to unom-1 and (re)start the static server. rsync WITHOUT --delete keeps old
|
|
# objects so clients mid-update aren't broken; the fresh signed summary advertises latest.
|
|
install -d -m700 ~/.ssh
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy; chmod 600 ~/.ssh/deploy
|
|
SSH="ssh -i $HOME/.ssh/deploy -p ${DEPLOY_PORT:-22} -o StrictHostKeyChecking=accept-new"
|
|
DEST="${DEPLOY_USER}@${DEPLOY_HOST}"
|
|
$SSH "$DEST" "mkdir -p ~/$DEPLOY_DIR/site/repo"
|
|
rsync -az --info=stats1 -e "$SSH" repo/ "$DEST:$DEPLOY_DIR/site/repo/"
|
|
rsync -az -e "$SSH" site/unom.flatpakrepo "site/${APP_ID}.flatpakref" "site/${APP_ID}.Canary.flatpakref" site/index.html "$DEST:$DEPLOY_DIR/site/"
|
|
rsync -az -e "$SSH" packaging/flatpak/server/compose.production.yml packaging/flatpak/server/Caddyfile "$DEST:$DEPLOY_DIR/"
|
|
$SSH "$DEST" "cd ~/$DEPLOY_DIR && docker compose -f compose.production.yml up -d"
|
|
echo "deployed → $REPO_URL/${APP_ID}.flatpakref"
|
|
|
|
- name: Attach bundle to the Gitea release (stable tags only)
|
|
if: startsWith(gitea.ref, 'refs/tags/v')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
. scripts/ci/gitea-release.sh
|
|
RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
|
|
upsert_asset "$RID" "$BUNDLE"
|