punktfunk/.gitea/workflows/deb.yml

# Build the punktfunk .debs and publish them to Gitea's Debian package registry, so Ubuntu
# boxes get new builds via `apt update && apt upgrade`. Two jobs, both publishing to the same
# apt distribution/component:
#
#   build-publish       — client + web + scripting, on the Ubuntu 26.04 rust-ci image (the client
#                         needs 24.04-absent libs: SDL3, GTK4 ≥ 4.20).
#   build-publish-host  — the HOST, on the Ubuntu 24.04 rust-ci-noble image with a from-source
#                         FFmpeg 8 BUNDLED into the .deb. This lowers the host's glibc floor to 2.39
#                         and removes the hard `Depends: libavcodec62`, so the ONE host .deb installs
#                         on Ubuntu 24.04 LTS through 26.04. (A 26.04-built host .deb is uninstallable
#                         on 24.04 — the reason this job exists; see packaging/debian/README.md.)
#
# Both compute VERSION identically (scripts/ci/pf-version.sh is deterministic per commit), so the
# host and client packages always share a version line. The release-attach helpers are race-safe
# (ensure_release create-or-fetch; upsert_asset only conflicts on same-name), so the jobs run parallel.
#
# Registry (public, unom org): https://git.unom.io/unom/-/packages
# Box setup (once):  see packaging/debian/README.md
#
# REGISTRY_TOKEN: repo Actions secret, a PAT with write:package scope (shared with docker.yml).
name: deb

on:
  push:
    branches: [main]
    # Single project version: a `vX.Y.Z` tag is THE release for every platform (see
    # docs-site channels.md). The old version-shadow (a client tag shipping a host package
    # that outranked rolling builds) is now structurally impossible — main publishes to the
    # `canary` apt distribution, tags to `stable`, so the two never share a version line.
    tags: ['v*']
  workflow_dispatch:

env:
  REGISTRY: git.unom.io
  OWNER: unom
  COMPONENT: main

jobs:
  build-publish:
    runs-on: ubuntu-24.04
    container:
      image: git.unom.io/unom/punktfunk-rust-ci:latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4

      - name: Version + channel
        # vX.Y.Z tag -> X.Y.Z, published to the `stable` apt distribution (a real release).
        # A main push -> <next-minor>~ciN.g<sha>, published to the `canary` distribution: the '~' sorts
        # below the eventual tag, it climbs monotonically by run number, and the canary base is
        # derived one minor AHEAD of the latest stable tag (scripts/ci/pf-version.sh) so a
        # stable->canary box re-point still moves forward (see channels.md). Computed BEFORE the build so it's stamped into the binary
        # (PUNKTFUNK_BUILD_VERSION -> build.rs -> --version).
        run: |
          eval "$(bash scripts/ci/pf-version.sh)"   # -> PF_BASE (one minor ahead of the latest stable tag)
          SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
          case "$GITHUB_REF" in
            refs/tags/v*) V="${GITHUB_REF_NAME#v}"; DIST=stable ;;
            *)            V="${PF_BASE}~ci${GITHUB_RUN_NUMBER}.g${SHORT}"; DIST=canary ;;
          esac
          echo "VERSION=$V" >> "$GITHUB_ENV"
          echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
          echo "package version $V -> apt distribution '$DIST'"

      # dpkg-shlibdeps (Depends resolution) + dpkg-deb live in dpkg-dev. The client's link
      # deps are also baked into the rust-ci image, but this job runs against the image
      # from the PREVIOUS push (docker.yml bootstrap note) — keep it green across image
      # changes; a no-op once the image has them.
      - name: dpkg-dev + client link deps
        run: |
          apt-get update
          # python3 is used by scripts/ci/gitea-release.sh for the stable-tag release attach.
          # libvulkan-dev: /usr/include/vulkan/vulkan.h for the client's pf-ffvk bindgen
          # (FFmpeg's hwcontext_vulkan.h includes it).
          apt-get install -y --no-install-recommends dpkg-dev python3 \
            libgtk-4-dev libadwaita-1-dev libsdl3-dev libvulkan-dev

      # Share ci.yml's cache keys so the release build reuses its registry + target artifacts.
      - name: Cache keys
        run: echo "rustc=$(rustc --version | cut -d' ' -f2)" >> "$GITHUB_ENV"
      - uses: actions/cache@v4
        with:
          path: |
            /usr/local/cargo/registry
            /usr/local/cargo/git
          key: cargo-home-${{ hashFiles('Cargo.lock') }}
          restore-keys: cargo-home-
      - uses: actions/cache@v4
        with:
          path: target
          # -v3-: bypass a target cache poisoned by a disk-full build (see ci.yml). Shares the
          # key with ci.yml so the release build reuses its clean artifacts.
          key: cargo-target-v3-${{ env.rustc }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: cargo-target-v3-${{ env.rustc }}-

      - name: Build release clients
        env:
          PUNKTFUNK_BUILD_VERSION: ${{ env.VERSION }}   # stamped into the binaries (build.rs)
        run: |
          git config --global --add safe.directory "$PWD"
          # punktfunk-client-session is the Vulkan/Skia streamer the shell execs for a connect —
          # both client binaries must ship (build-client-deb.sh installs both). The HOST is built
          # separately in the build-publish-host job (Ubuntu 24.04 image + bundled FFmpeg 8).
          cargo build --release --locked -p punktfunk-client-linux -p punktfunk-client-session

      - name: Build + smoke-boot web console (bun preset)
        # Gate the .deb on a real bun boot: the punktfunk-web .deb runs the Nitro `bun` preset
        # (our Bun.serve TLS entry), so prove the build IS a bun bundle and serves /login.
        # No TLS env here, so the custom entry binds plain HTTP — the smoke curl stays simple.
        run: |
          # bun builds AND runs the console. Baked into the rust-ci image; bootstrap here too so the
          # job stays green against the PREVIOUS image (docker.yml bootstrap lag).
          command -v bun >/dev/null || {
            apt-get install -y --no-install-recommends unzip
            curl -fsSL https://bun.sh/install | bash
          }
          export PATH="$HOME/.bun/bin:$PATH"
          cd web
          bun install --frozen-lockfile
          bun run build
          if ! grep -q 'Bun\.serve' .output/server/index.mjs; then
            echo "ERROR: web build is not a bun bundle — need the 'bun' preset + custom entry"; exit 1
          fi
          PORT=3009 HOST=127.0.0.1 PUNKTFUNK_UI_PASSWORD=ci bun .output/server/index.mjs &
          NP=$!; sleep 3
          code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3009/login || echo 000)
          kill "$NP" 2>/dev/null || true
          echo "web console smoke: /login -> $code"
          [ "$code" = 200 ] || { echo "ERROR: web console failed to boot under bun"; exit 1; }

      - name: Build .debs
        run: |
          export PATH="$HOME/.bun/bin:$PATH"
          # host .deb is built in build-publish-host (Ubuntu 24.04 image); this job ships the rest.
          VERSION="$VERSION" bash packaging/debian/build-client-deb.sh
          # Reuse CI's bun for the vendored runtime (matches the amd64 runner) instead of downloading.
          VERSION="$VERSION" BUN_BIN="$(command -v bun || true)" bash packaging/debian/build-web-deb.sh
          # The plugin/script runner (bun-bundled Effect SDK) — same vendored-bun mechanics.
          VERSION="$VERSION" BUN_BIN="$(command -v bun || true)" bash packaging/debian/build-scripting-deb.sh

      - name: Publish to the Gitea apt registry
        env:
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          for DEB in dist/*.deb; do
            echo "uploading $DEB"
            # A re-tagged release re-fires this workflow and the apt registry 409s on duplicate
            # package versions — delete any prior copy of this exact name/version/arch first
            # (404 on the first publish is fine).
            NAME=$(dpkg-deb -f "$DEB" Package)
            VER=$(dpkg-deb -f "$DEB" Version)
            ARCH=$(dpkg-deb -f "$DEB" Architecture)
            curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
              "https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/$NAME/$VER/$ARCH" || true
            # PAT owner (enricobuehler), not the push actor — matches docker.yml's registry login.
            curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
              "https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
          done
          echo "published to $OWNER/debian $DISTRIBUTION/$COMPONENT"

      # On a real release, also attach the .debs to the unified Gitea Release so they're on the
      # downloads page next to every other platform's artifact (canary builds live in the apt
      # `canary` distribution above — no release page for those).
      - name: Attach .debs to the Gitea release (stable tags only)
        if: startsWith(gitea.ref, 'refs/tags/v')
        env:
          GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          . scripts/ci/gitea-release.sh
          RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
          for DEB in dist/*.deb; do
            upsert_asset "$RID" "$DEB"
          done

  # ---------------------------------------------------------------------------------------------
  # The HOST .deb — built on Ubuntu 24.04 (noble) with a from-source FFmpeg 8 BUNDLED, so it installs
  # on Ubuntu 24.04 LTS through 26.04 (see the file header + packaging/debian/README.md). Runs in
  # parallel with build-publish and publishes to the SAME distribution/component; the version step is
  # byte-identical so host and clients share a version line.
  build-publish-host:
    runs-on: ubuntu-24.04
    container:
      image: git.unom.io/unom/punktfunk-rust-ci-noble:latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4

      - name: Version + channel
        run: |
          git config --global --add safe.directory "$PWD"
          eval "$(bash scripts/ci/pf-version.sh)"   # -> PF_BASE (one minor ahead of the latest stable tag)
          SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
          case "$GITHUB_REF" in
            refs/tags/v*) V="${GITHUB_REF_NAME#v}"; DIST=stable ;;
            *)            V="${PF_BASE}~ci${GITHUB_RUN_NUMBER}.g${SHORT}"; DIST=canary ;;
          esac
          echo "VERSION=$V" >> "$GITHUB_ENV"
          echo "DISTRIBUTION=$DIST" >> "$GITHUB_ENV"
          echo "host package version $V -> apt distribution '$DIST'"

      # dpkg-shlibdeps/dpkg-deb + patchelf are baked into rust-ci-noble; python3 is for the
      # release-attach helper. Re-install defensively so the job stays green against the PREVIOUS
      # image on the same push (docker.yml bootstrap lag) — a no-op once the image ships them.
      - name: dpkg-dev + patchelf + python3
        run: |
          apt-get update
          apt-get install -y --no-install-recommends dpkg-dev patchelf python3

      - name: Cache keys
        run: echo "rustc=$(rustc --version | cut -d' ' -f2)" >> "$GITHUB_ENV"
      - uses: actions/cache@v4
        with:
          path: |
            /usr/local/cargo/registry
            /usr/local/cargo/git
          key: cargo-home-${{ hashFiles('Cargo.lock') }}
          restore-keys: cargo-home-
      - uses: actions/cache@v4
        with:
          path: target
          # Own key: this target dir is built against 24.04's glibc/toolchain and must NOT share
          # ci.yml's 26.04 target cache (mixing would poison both).
          key: cargo-target-noble-v1-${{ env.rustc }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: cargo-target-noble-v1-${{ env.rustc }}-

      - name: Build release host
        env:
          PUNKTFUNK_BUILD_VERSION: ${{ env.VERSION }}   # stamped into the binary (build.rs)
        run: |
          git config --global --add safe.directory "$PWD"
          # Same features the old combined build used: --nvenc (direct-SDK NVENC, real RFI on NVIDIA;
          # NVENC/CUDA is dlopen'd — no link dep, so this image needs no libcuda stub) + --vulkan-encode
          # (raw VK_KHR_video_encode_h265 on AMD/Intel, pure ash). punktfunk-tray also ships in the host
          # .deb (build-deb.sh builds+installs it). ffmpeg-sys-next links the image's bundled FFmpeg 8
          # via PKG_CONFIG_PATH (set in rust-ci-noble).
          cargo build --release --locked --features punktfunk-host/nvenc,punktfunk-host/vulkan-encode \
            -p punktfunk-host -p punktfunk-tray

      - name: Build host .deb (FFmpeg bundled)
        # BUNDLE_FFMPEG=1 copies the image's /opt/ffmpeg libav* into the package and repoints the
        # binary's rpath, so there is no `Depends: libavcodec62` to block install on 24.04. FFMPEG_PREFIX
        # defaults to /opt/ffmpeg (the image's ENV also sets it).
        run: |
          VERSION="$VERSION" BUNDLE_FFMPEG=1 bash packaging/debian/build-deb.sh

      - name: Publish to the Gitea apt registry
        env:
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          for DEB in dist/*.deb; do
            echo "uploading $DEB"
            NAME=$(dpkg-deb -f "$DEB" Package)
            VER=$(dpkg-deb -f "$DEB" Version)
            ARCH=$(dpkg-deb -f "$DEB" Architecture)
            curl -fsS -o /dev/null --user "enricobuehler:$TOKEN" -X DELETE \
              "https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/$NAME/$VER/$ARCH" || true
            curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
              "https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
          done
          echo "published host to $OWNER/debian $DISTRIBUTION/$COMPONENT"

      - name: Attach the host .deb to the Gitea release (stable tags only)
        if: startsWith(gitea.ref, 'refs/tags/v')
        env:
          GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          . scripts/ci/gitea-release.sh
          RID=$(ensure_release "$GITHUB_REF_NAME" "$GITHUB_REF_NAME" auto)
          for DEB in dist/*.deb; do
            upsert_asset "$RID" "$DEB"
          done