diff --git a/.github/workflows/nightly-build-1x.yaml b/.github/workflows/nightly-build-1x.yaml new file mode 100644 index 00000000..df4fa153 --- /dev/null +++ b/.github/workflows/nightly-build-1x.yaml @@ -0,0 +1,197 @@ +name: "Nightly build (main layout)" + +on: + workflow_call: + inputs: + branch: + required: true + type: string + s3_bucket: + required: true + type: string + s3_prefix: + required: true + type: string + aws_region: + required: true + type: string + +env: + S3_BUCKET: ${{ inputs.s3_bucket }} + S3_PREFIX: ${{ inputs.s3_prefix }} + AWS_DEFAULT_REGION: ${{ inputs.aws_region }} + +jobs: + build-linux: + env: + CARGO_TERM_COLOR: always + # sccache + SCCACHE_GHA_ENABLED: "true" + RUSTC_WRAPPER: "sccache" + runs-on: + - self-hosted + - Linux + - ${{ matrix.architecture }} + strategy: + fail-fast: false + matrix: + architecture: [ARM64, X64] + include: + - architecture: ARM64 + deb_arch: arm64 + binary_arch: aarch64 + - architecture: X64 + deb_arch: amd64 + binary_arch: x86_64 + steps: + - uses: actions/checkout@v6 + with: + ref: ${{ inputs.branch }} + submodules: recursive + + - name: Install NodeJS + uses: actions/setup-node@v6 + with: + node-version: 26 + + - name: Install pnpm + uses: pnpm/action-setup@v6 + with: + cache: true + version: 11 + run_install: false + + - name: Get pnpm store directory + shell: bash + run: | + echo "STORE_PATH=$(pnpm store path --silent)" >> ${GITHUB_ENV} + + # Change to '--frozen-lockfile' once this gets fixed: + # https://github.com/pnpm/action-setup/issues/40 + - name: Install Node dependencies + run: pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + + - name: Run sccache-cache + uses: mozilla-actions/sccache-action@v0.0.10 + + - name: Install Linux dependencies + run: | + sudo apt-get update + sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm awscli jq + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + BRANCH="${{ inputs.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} + + - name: Build packages + uses: tauri-apps/tauri-action@v0 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + args: "--bundles deb,rpm" + + - name: Upload DEB and RPM to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + run: | + NAME="defguard-client-${{ matrix.binary_arch }}-${SHA}" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.deb" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/rpm/defguard-client-${VERSION}-1.${{ matrix.binary_arch }}.rpm" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.rpm" + + build-macos-pkg: + env: + CARGO_TERM_COLOR: always + # sccache + SCCACHE_GHA_ENABLED: "true" + RUSTC_WRAPPER: "sccache" + APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)" + APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)" + APPLE_PROVIDER_SHORT_NAME: "82GZ7KN29J" + APPLE_ID: "kamil@defguard.net" + APPLE_TEAM_ID: "82GZ7KN29J" + runs-on: + - self-hosted + - macOS + - native + steps: + - uses: actions/checkout@v6 + with: + ref: ${{ inputs.branch }} + submodules: recursive + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + BRANCH="${{ inputs.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} + + - name: Install NodeJS + uses: actions/setup-node@v6 + with: + node-version: 26 + + - name: Install pnpm + uses: pnpm/action-setup@v6 + with: + cache: true + version: 11 + + # Change to '--frozen-lockfile' once this gets fixed: + # https://github.com/pnpm/action-setup/issues/40 + - name: Install Node dependencies + run: pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + with: + targets: aarch64-apple-darwin,x86_64-apple-darwin + + - name: Run sccache-cache + uses: mozilla-actions/sccache-action@v0.0.10 + + - name: Set build number + run: | + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.conf.json + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj + + - name: Unlock keychain + run: security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain + + - name: Build app + uses: tauri-apps/tauri-action@v0 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + args: --target universal-apple-darwin + + - name: Build installation package + run: | + xcrun productbuild --keychain build.keychain \ + --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \ + --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \ + /Applications defguard-client.pkg + + - name: Upload PKG to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + run: | + export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}" + aws s3 cp --acl public-read defguard-client.pkg \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${SHA}.pkg" diff --git a/.github/workflows/nightly-build-2x.yaml b/.github/workflows/nightly-build-2x.yaml new file mode 100644 index 00000000..5d9778cd --- /dev/null +++ b/.github/workflows/nightly-build-2x.yaml @@ -0,0 +1,299 @@ +name: "Nightly build (new-ui layout)" + +on: + workflow_call: + inputs: + branch: + required: true + type: string + s3_bucket: + required: true + type: string + s3_prefix: + required: true + type: string + aws_region: + required: true + type: string + +env: + SQLX_OFFLINE: "1" + S3_BUCKET: ${{ inputs.s3_bucket }} + S3_PREFIX: ${{ inputs.s3_prefix }} + AWS_DEFAULT_REGION: ${{ inputs.aws_region }} + +jobs: + build-linux: + runs-on: + - self-hosted + - Linux + - ${{ matrix.architecture }} + strategy: + fail-fast: false + matrix: + architecture: [ARM64, X64] + include: + - architecture: ARM64 + deb_arch: arm64 + binary_arch: aarch64 + - architecture: X64 + deb_arch: amd64 + binary_arch: x86_64 + steps: + - uses: actions/checkout@v7 + with: + ref: ${{ inputs.branch }} + submodules: recursive + + - uses: actions/setup-node@v6 + with: + node-version-file: new-ui/.nvmrc + + - uses: pnpm/action-setup@v6 + with: + version: 11.11 + run_install: false + + - name: Get pnpm store directory + shell: bash + run: | + STORE_PATH=$(pnpm store path --silent) + mkdir -p "$STORE_PATH" + echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} + + - name: Restore pnpm store cache + uses: actions/cache@v5 + with: + path: ${{ env.STORE_PATH }} + key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- + + - name: Install Node dependencies for new UI + run: | + cd new-ui + pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + + - name: Install tauri-cli + run: cargo install tauri-cli --locked + + - name: Install Linux dependencies + run: | + sudo apt-get update + sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm awscli jq + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} + BRANCH="${{ inputs.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} + + - name: Build new UI + run: | + cd new-ui + pnpm build + + - name: Build packages + uses: tauri-apps/tauri-action@v0.5.23 # .24 seems broken, TODO: update when fixed + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tauriScript: cargo tauri + args: "--bundles deb,rpm" + + - name: Upload DEB and RPM to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + run: | + NAME="defguard-client-${{ matrix.binary_arch }}-${SHA}" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.deb" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/rpm/defguard-client-${VERSION}-1.${{ matrix.binary_arch }}.rpm" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.rpm" + + build-macos-pkg: + runs-on: + - self-hosted + - macOS + - native + env: + SCCACHE_GHA_ENABLED: "true" + RUSTC_WRAPPER: "sccache" + APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)" + APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)" + steps: + - uses: actions/checkout@v7 + with: + ref: ${{ inputs.branch }} + submodules: recursive + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} + BRANCH="${{ inputs.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} + + - uses: actions/setup-node@v6 + with: + node-version-file: new-ui/.nvmrc + + - uses: pnpm/action-setup@v6 + with: + run_install: false + version: 11 + + - name: Get pnpm store directory + run: | + STORE_PATH=$(pnpm store path --silent) + mkdir -p "$STORE_PATH" + echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} + + - name: Restore pnpm store cache + uses: actions/cache@v5 + with: + path: ${{ env.STORE_PATH }} + key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- + + - name: Install Node dependencies for New UI + run: | + cd new-ui + pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + with: + targets: aarch64-apple-darwin,x86_64-apple-darwin + + - name: Run sccache-cache + uses: mozilla-actions/sccache-action@v0.0.10 + + - name: Install tauri-cli + run: cargo install tauri-cli --locked + + - name: Set build number + run: | + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/client-cli/Info.plist + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.macos.conf.json + + - name: Build new UI + run: | + cd new-ui + pnpm build + + - name: Unlock keychain + run: | + security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain + + - name: Build app + uses: tauri-apps/tauri-action@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tauriScript: cargo tauri + args: --config src-tauri/tauri.app.conf.json --target universal-apple-darwin + + - name: Build installation package + run: | + xcrun productbuild --keychain build.keychain \ + --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \ + --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \ + /Applications defguard-client.pkg + + - name: Upload PKG to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + run: | + export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}" + aws s3 cp --acl public-read defguard-client.pkg \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${SHA}.pkg" + + # build-windows-msi: + # runs-on: + # - self-hosted + # - Windows + # - X64 + # env: + # SCCACHE_GHA_ENABLED: "true" + # RUSTC_WRAPPER: "sccache" + # defaults: + # run: + # shell: powershell + # steps: + # - uses: actions/checkout@v7 + # with: + # ref: ${{ inputs.branch }} + # submodules: recursive + + # - name: Write build version + # run: | + # $version = (Get-Content src-tauri/tauri.conf.json -Raw | ConvertFrom-Json).version + # echo "Version: $version" + # echo "VERSION=$version" >> $env:GITHUB_ENV + # echo "DEFGUARD_CLIENT_BUILD_VERSION=$version-nightly" >> $env:GITHUB_ENV + # echo "BRANCH=$('${{ inputs.branch }}' -replace '/','-')" >> $env:GITHUB_ENV + # echo "SHA=$(git rev-parse --short HEAD)" >> $env:GITHUB_ENV + + # - uses: actions/setup-node@v6 + # with: + # node-version-file: new-ui/.nvmrc + + # - uses: pnpm/action-setup@v6 + # with: + # version: 11.11 + # run_install: false + + # - name: Install Node dependencies for new UI + # run: | + # cd new-ui + # pnpm install --no-frozen-lockfile + + # - name: Install Rust stable + # uses: dtolnay/rust-toolchain@stable + + # - name: Run sccache-cache + # uses: mozilla-actions/sccache-action@v0.0.10 + + # - name: Install tauri-cli + # run: cargo install tauri-cli --locked + + # - name: Build new UI + # run: | + # cd new-ui + # pnpm build + + # - name: Build service and CLI binaries + # run: cargo build --release --manifest-path src-tauri/Cargo.toml -p defguard-cli -p defguard-client-service + + # - name: Build MSI + # uses: tauri-apps/tauri-action@v0.5.23 + # env: + # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # with: + # tauriScript: cargo tauri + # args: "--bundles msi" + + # - name: Upload MSI to S3 + # env: + # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + # run: | + # aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` + # "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/${env:BRANCH}/defguard-client-x64-${env:SHA}.msi" diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml new file mode 100644 index 00000000..b0d31dbf --- /dev/null +++ b/.github/workflows/nightly.yaml @@ -0,0 +1,79 @@ +name: "Nightly builds" +on: + schedule: + - cron: "0 23 * * *" + workflow_dispatch: + +env: + S3_BUCKET: nightly.defguard.net + S3_PREFIX: defguard-client + AWS_DEFAULT_REGION: eu-central-1 + +jobs: + release-2-1: + uses: ./.github/workflows/nightly-build-2x.yaml + with: + branch: release/2.1 + s3_bucket: nightly.defguard.net + s3_prefix: defguard-client + aws_region: eu-central-1 + secrets: inherit + + main: + needs: release-2-1 + if: always() + uses: ./.github/workflows/nightly-build-1x.yaml + with: + branch: main + s3_bucket: nightly.defguard.net + s3_prefix: defguard-client + aws_region: eu-central-1 + secrets: inherit + + update-index: + needs: + - release-2-1 + - main + if: always() + runs-on: + - self-hosted + - Linux + - X64 + steps: + - name: Install awscli + run: | + sudo apt-get update + sudo apt-get install -y awscli jq + + - name: Generate and upload index.html + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + run: | + aws s3api list-objects-v2 \ + --bucket "${S3_BUCKET}" \ + --prefix "${S3_PREFIX}/" \ + --query 'Contents[?Size > `0`].{key: Key, size: Size, modified: LastModified}' \ + --output json > objects.json + + { + echo '' + echo '' + echo 'defguard-client nightly builds' + echo '' + echo '

defguard-client nightly builds

' + jq -r ' + (. // []) + | group_by(.key | split("/")[1]) + | map(sort_by(.modified) | reverse) + | sort_by(.[0].modified) | reverse + | .[] + | "

\(.[0].key | split("/")[1])

", + "", + (.[] | ""), + "
FileSizeUploaded on (UTC)
\(.key | split("/")[2])\((.size / 104857.6 | round) / 10) MiB\(.modified[0:10]) \(.modified[11:16])
" + ' objects.json + } > index.html + cat index.html + aws s3 cp --acl public-read --content-type text/html \ + index.html "s3://${S3_BUCKET}/index.html"