From c20056f475eed81f96a0cc6588e5e069cf127009 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Tue, 4 Aug 2026 15:45:58 +0200 Subject: [PATCH 01/14] test "nightly" build --- .github/workflows/nightly.yaml | 282 +++++++++++++++++++++++++++++++++ 1 file changed, 282 insertions(+) create mode 100644 .github/workflows/nightly.yaml diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml new file mode 100644 index 00000000..b995f3bb --- /dev/null +++ b/.github/workflows/nightly.yaml @@ -0,0 +1,282 @@ +name: "Nightly builds" +on: + push: + branches: + - nightly-builds + +env: + SQLX_OFFLINE: "1" + # TODO: move to repository variables/secrets + S3_BUCKET: defguard-nightly + S3_PREFIX: defguard-client + AWS_DEFAULT_REGION: eu-central-1 + +jobs: + build-linux: + runs-on: + - self-hosted + - Linux + - ${{ matrix.architecture }} + strategy: + fail-fast: false + matrix: + architecture: [ARM64, X64] + include: + - architecture: ARM64 + deb_arch: arm64 + binary_arch: aarch64 + - architecture: X64 + deb_arch: amd64 + binary_arch: x86_64 + steps: + - uses: actions/checkout@v7 + with: + submodules: recursive + + - uses: actions/setup-node@v6 + with: + node-version-file: new-ui/.nvmrc + + - uses: pnpm/action-setup@v6 + with: + version: 11.11 + run_install: false + + - name: Get pnpm store directory + shell: bash + run: | + STORE_PATH=$(pnpm store path --silent) + mkdir -p "$STORE_PATH" + echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} + + - name: Restore pnpm store cache + uses: actions/cache@v5 + with: + path: ${{ env.STORE_PATH }} + key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- + + - name: Install Node dependencies for new UI + run: | + cd new-ui + pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + + - name: Install tauri-cli + run: cargo install tauri-cli --locked + + - name: Install Linux dependencies + run: | + sudo apt-get update + sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm awscli jq + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} + echo "BRANCH=${GITHUB_REF_NAME//\//-}" >> ${GITHUB_ENV} + + - name: Build new UI + run: | + cd new-ui + pnpm build + + - name: Build packages + uses: tauri-apps/tauri-action@v0.5.23 # .24 seems broken, TODO: update when fixed + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tauriScript: cargo tauri + args: "--bundles deb,rpm" + + - name: Upload DEB and RPM to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_APT }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_APT }} + run: | + NAME="defguard-client-${BRANCH}-${{ matrix.binary_arch }}-nightly" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${NAME}.deb" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/rpm/defguard-client-${VERSION}-1.${{ matrix.binary_arch }}.rpm" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${NAME}.rpm" + + build-macos-pkg: + runs-on: + - self-hosted + - macOS + - native + env: + SCCACHE_GHA_ENABLED: "true" + RUSTC_WRAPPER: "sccache" + APPLE_SIGNING_IDENTITY_INSTALLER: "Developer ID Installer: defguard sp. z o.o. (82GZ7KN29J)" + steps: + - uses: actions/checkout@v7 + with: + submodules: recursive + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} + echo "BRANCH=${GITHUB_REF_NAME//\//-}" >> ${GITHUB_ENV} + + - uses: actions/setup-node@v6 + with: + node-version-file: new-ui/.nvmrc + + - uses: pnpm/action-setup@v6 + with: + run_install: false + version: 11.11 + + - name: Get pnpm store directory + run: | + STORE_PATH=$(pnpm store path --silent) + mkdir -p "$STORE_PATH" + echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} + + - name: Restore pnpm store cache + uses: actions/cache@v5 + with: + path: ${{ env.STORE_PATH }} + key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- + + - name: Install Node dependencies for New UI + run: | + cd new-ui + pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + with: + targets: aarch64-apple-darwin,x86_64-apple-darwin + + - name: Install tauri-cli + run: cargo install tauri-cli --locked + + - name: Run sccache-cache + uses: mozilla-actions/sccache-action@v0.0.10 + + - name: Set build number + run: | + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/client-cli/Info.plist + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.macos.conf.json + + - name: Build new UI + run: | + cd new-ui + pnpm build + + - name: Unlock keychain + run: | + security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain + + - name: Build app + uses: tauri-apps/tauri-action@v1 + env: + APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} + APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} + APPLE_SIGNING_IDENTITY: "Developer ID Application: defguard sp. z o.o. (82GZ7KN29J)" + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tauriScript: cargo tauri + args: --config src-tauri/tauri.dmg.conf.json --target universal-apple-darwin --bundles app + + - name: Build and notarize installation package + run: | + xcrun productbuild --keychain build.keychain \ + --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \ + --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \ + /Applications defguard-client.pkg + xcrun notarytool submit defguard-client.pkg \ + --key-id ${{ secrets.APPLE_API_KEY }} \ + --issuer ${{ secrets.APPLE_API_ISSUER }} \ + --wait + xcrun stapler staple defguard-client.pkg + + - name: Upload PKG to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_APT }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_APT }} + run: | + aws s3 cp --acl public-read defguard-client.pkg \ + "s3://${S3_BUCKET}/${S3_PREFIX}/defguard-client-${BRANCH}-universal-nightly.pkg" + + build-windows-msi: + runs-on: + - self-hosted + - Windows + - X64 + env: + SCCACHE_GHA_ENABLED: "true" + RUSTC_WRAPPER: "sccache" + steps: + - uses: actions/checkout@v7 + with: + submodules: recursive + + - name: Write build version + shell: pwsh + run: | + $version = (Get-Content src-tauri/tauri.conf.json -Raw | ConvertFrom-Json).version + echo "Version: $version" + echo "VERSION=$version" >> $env:GITHUB_ENV + echo "DEFGUARD_CLIENT_BUILD_VERSION=$version-nightly" >> $env:GITHUB_ENV + echo "BRANCH=$($env:GITHUB_REF_NAME -replace '/','-')" >> $env:GITHUB_ENV + + - uses: actions/setup-node@v6 + with: + node-version-file: new-ui/.nvmrc + + - uses: pnpm/action-setup@v6 + with: + version: 11.11 + run_install: false + + - name: Install Node dependencies for new UI + run: | + cd new-ui + pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + + - name: Run sccache-cache + uses: mozilla-actions/sccache-action@v0.0.10 + + - name: Install tauri-cli + run: cargo install tauri-cli --locked + + - name: Build new UI + run: | + cd new-ui + pnpm build + + - name: Build MSI + uses: tauri-apps/tauri-action@v0.5.23 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tauriScript: cargo tauri + args: "--bundles msi" + + - name: Upload MSI to S3 + shell: pwsh + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_APT }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_APT }} + run: | + aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` + "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/defguard-client-${env:BRANCH}-x64-nightly.msi" From 5ed7c3331d75d507359d3b9c8831c992987ea752 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Tue, 4 Aug 2026 15:50:24 +0200 Subject: [PATCH 02/14] add index, fix jobs --- .github/workflows/nightly.yaml | 52 ++++++++++++++++++++++++++++++---- 1 file changed, 47 insertions(+), 5 deletions(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index b995f3bb..827b3726 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -4,6 +4,10 @@ on: branches: - nightly-builds +concurrency: + group: nightly-${{ github.ref }} + cancel-in-progress: true + env: SQLX_OFFLINE: "1" # TODO: move to repository variables/secrets @@ -162,12 +166,12 @@ jobs: with: targets: aarch64-apple-darwin,x86_64-apple-darwin - - name: Install tauri-cli - run: cargo install tauri-cli --locked - - name: Run sccache-cache uses: mozilla-actions/sccache-action@v0.0.10 + - name: Install tauri-cli + run: cargo install tauri-cli --locked + - name: Set build number run: | sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj @@ -222,13 +226,15 @@ jobs: env: SCCACHE_GHA_ENABLED: "true" RUSTC_WRAPPER: "sccache" + defaults: + run: + shell: powershell steps: - uses: actions/checkout@v7 with: submodules: recursive - name: Write build version - shell: pwsh run: | $version = (Get-Content src-tauri/tauri.conf.json -Raw | ConvertFrom-Json).version echo "Version: $version" @@ -273,10 +279,46 @@ jobs: args: "--bundles msi" - name: Upload MSI to S3 - shell: pwsh env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_APT }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_APT }} run: | aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/defguard-client-${env:BRANCH}-x64-nightly.msi" + + update-index: + needs: + - build-linux + - build-macos-pkg + - build-windows-msi + if: always() + runs-on: + - self-hosted + - Linux + - X64 + steps: + - name: Install awscli + run: | + sudo apt-get update + sudo apt-get install -y awscli + + - name: Generate and upload index.html + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_APT }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_APT }} + run: | + { + echo '' + echo '' + echo 'defguard-client nightly builds' + echo '

defguard-client nightly builds

' + echo '' + aws s3 ls "s3://${S3_BUCKET}/${S3_PREFIX}/" --recursive \ + | grep -v '/$' \ + | sort -k4 \ + | awk '{printf "\n", $4, $4, $3/1048576, $1, $2}' + echo '
FileSizeLast modified (UTC)
%s%.1f MiB%s %s
' + } > index.html + cat index.html + aws s3 cp --acl public-read --content-type text/html \ + index.html "s3://${S3_BUCKET}/index.html" From 42bc2db7c5cf7c3ea46d364ea5afdd5e4eb89887 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Tue, 4 Aug 2026 16:23:56 +0200 Subject: [PATCH 03/14] test 2 --- .github/workflows/nightly.yaml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 827b3726..c54ec02a 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -119,7 +119,8 @@ jobs: env: SCCACHE_GHA_ENABLED: "true" RUSTC_WRAPPER: "sccache" - APPLE_SIGNING_IDENTITY_INSTALLER: "Developer ID Installer: defguard sp. z o.o. (82GZ7KN29J)" + APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)" + APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)" steps: - uses: actions/checkout@v7 with: @@ -140,7 +141,7 @@ jobs: - uses: pnpm/action-setup@v6 with: run_install: false - version: 11.11 + version: 11 - name: Get pnpm store directory run: | @@ -190,25 +191,19 @@ jobs: - name: Build app uses: tauri-apps/tauri-action@v1 env: - APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} - APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} - APPLE_SIGNING_IDENTITY: "Developer ID Application: defguard sp. z o.o. (82GZ7KN29J)" GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: tauriScript: cargo tauri - args: --config src-tauri/tauri.dmg.conf.json --target universal-apple-darwin --bundles app + args: --config src-tauri/tauri.app.conf.json --target universal-apple-darwin - - name: Build and notarize installation package + # Same as in build-macos.yaml, without the altool --upload-app that sends + # the build to App Store Connect - nightlies must not go there. + - name: Build installation package run: | xcrun productbuild --keychain build.keychain \ --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \ --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \ /Applications defguard-client.pkg - xcrun notarytool submit defguard-client.pkg \ - --key-id ${{ secrets.APPLE_API_KEY }} \ - --issuer ${{ secrets.APPLE_API_ISSUER }} \ - --wait - xcrun stapler staple defguard-client.pkg - name: Upload PKG to S3 env: @@ -270,6 +265,11 @@ jobs: cd new-ui pnpm build + # Sign-Binaries.ps1 (beforeBundleCommand) and the WiX fragments expect + # defguard-cli.exe and defguard-service.exe to already be in target/release + - name: Build service and CLI binaries + run: cargo build --release --manifest-path src-tauri/Cargo.toml -p defguard-cli -p defguard-client-service + - name: Build MSI uses: tauri-apps/tauri-action@v0.5.23 env: From 4778ad3263eb246a93cb7ae94f71a01b9bdf8a84 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Tue, 4 Aug 2026 16:27:14 +0200 Subject: [PATCH 04/14] remove concurrency for test --- .github/workflows/nightly.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index c54ec02a..9a8b9055 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -4,9 +4,9 @@ on: branches: - nightly-builds -concurrency: - group: nightly-${{ github.ref }} - cancel-in-progress: true +# concurrency: +# group: nightly-${{ github.ref }} +# cancel-in-progress: true env: SQLX_OFFLINE: "1" From 761ae0ac598ece8b9aedfb8f1c50a3bf571f4204 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 5 Aug 2026 11:27:46 +0200 Subject: [PATCH 05/14] change credentials --- .github/workflows/nightly.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 9a8b9055..fafd04e7 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -100,8 +100,8 @@ jobs: - name: Upload DEB and RPM to S3 env: - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_APT }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_APT }} + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} run: | NAME="defguard-client-${BRANCH}-${{ matrix.binary_arch }}-nightly" aws s3 cp --acl public-read \ @@ -207,8 +207,8 @@ jobs: - name: Upload PKG to S3 env: - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_APT }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_APT }} + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} run: | aws s3 cp --acl public-read defguard-client.pkg \ "s3://${S3_BUCKET}/${S3_PREFIX}/defguard-client-${BRANCH}-universal-nightly.pkg" @@ -280,8 +280,8 @@ jobs: - name: Upload MSI to S3 env: - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_APT }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_APT }} + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} run: | aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/defguard-client-${env:BRANCH}-x64-nightly.msi" @@ -304,8 +304,8 @@ jobs: - name: Generate and upload index.html env: - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_APT }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_APT }} + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} run: | { echo '' From ca0cc73d3dd0252eeaa759ed8f2fdf7b2bcea23b Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 5 Aug 2026 11:41:12 +0200 Subject: [PATCH 06/14] trigger job --- .github/workflows/nightly.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index fafd04e7..bf3ab63a 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -10,7 +10,6 @@ on: env: SQLX_OFFLINE: "1" - # TODO: move to repository variables/secrets S3_BUCKET: defguard-nightly S3_PREFIX: defguard-client AWS_DEFAULT_REGION: eu-central-1 From 1099847cb7772189f8d68ac9c0a8e0fde60067ab Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 5 Aug 2026 12:24:23 +0200 Subject: [PATCH 07/14] trigger macos build --- .github/workflows/nightly.yaml | 149 ++++++++++++++++----------------- 1 file changed, 73 insertions(+), 76 deletions(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index bf3ab63a..0b910277 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -195,8 +195,6 @@ jobs: tauriScript: cargo tauri args: --config src-tauri/tauri.app.conf.json --target universal-apple-darwin - # Same as in build-macos.yaml, without the altool --upload-app that sends - # the build to App Store Connect - nightlies must not go there. - name: Build installation package run: | xcrun productbuild --keychain build.keychain \ @@ -209,87 +207,86 @@ jobs: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} run: | + export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}" aws s3 cp --acl public-read defguard-client.pkg \ "s3://${S3_BUCKET}/${S3_PREFIX}/defguard-client-${BRANCH}-universal-nightly.pkg" - build-windows-msi: - runs-on: - - self-hosted - - Windows - - X64 - env: - SCCACHE_GHA_ENABLED: "true" - RUSTC_WRAPPER: "sccache" - defaults: - run: - shell: powershell - steps: - - uses: actions/checkout@v7 - with: - submodules: recursive - - - name: Write build version - run: | - $version = (Get-Content src-tauri/tauri.conf.json -Raw | ConvertFrom-Json).version - echo "Version: $version" - echo "VERSION=$version" >> $env:GITHUB_ENV - echo "DEFGUARD_CLIENT_BUILD_VERSION=$version-nightly" >> $env:GITHUB_ENV - echo "BRANCH=$($env:GITHUB_REF_NAME -replace '/','-')" >> $env:GITHUB_ENV - - - uses: actions/setup-node@v6 - with: - node-version-file: new-ui/.nvmrc - - - uses: pnpm/action-setup@v6 - with: - version: 11.11 - run_install: false - - - name: Install Node dependencies for new UI - run: | - cd new-ui - pnpm install --no-frozen-lockfile - - - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable - - - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 - - - name: Install tauri-cli - run: cargo install tauri-cli --locked - - - name: Build new UI - run: | - cd new-ui - pnpm build - - # Sign-Binaries.ps1 (beforeBundleCommand) and the WiX fragments expect - # defguard-cli.exe and defguard-service.exe to already be in target/release - - name: Build service and CLI binaries - run: cargo build --release --manifest-path src-tauri/Cargo.toml -p defguard-cli -p defguard-client-service - - - name: Build MSI - uses: tauri-apps/tauri-action@v0.5.23 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tauriScript: cargo tauri - args: "--bundles msi" - - - name: Upload MSI to S3 - env: - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} - run: | - aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` - "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/defguard-client-${env:BRANCH}-x64-nightly.msi" + # build-windows-msi: + # runs-on: + # - self-hosted + # - Windows + # - X64 + # env: + # SCCACHE_GHA_ENABLED: "true" + # RUSTC_WRAPPER: "sccache" + # defaults: + # run: + # shell: powershell + # steps: + # - uses: actions/checkout@v7 + # with: + # submodules: recursive + + # - name: Write build version + # run: | + # $version = (Get-Content src-tauri/tauri.conf.json -Raw | ConvertFrom-Json).version + # echo "Version: $version" + # echo "VERSION=$version" >> $env:GITHUB_ENV + # echo "DEFGUARD_CLIENT_BUILD_VERSION=$version-nightly" >> $env:GITHUB_ENV + # echo "BRANCH=$($env:GITHUB_REF_NAME -replace '/','-')" >> $env:GITHUB_ENV + + # - uses: actions/setup-node@v6 + # with: + # node-version-file: new-ui/.nvmrc + + # - uses: pnpm/action-setup@v6 + # with: + # version: 11.11 + # run_install: false + + # - name: Install Node dependencies for new UI + # run: | + # cd new-ui + # pnpm install --no-frozen-lockfile + + # - name: Install Rust stable + # uses: dtolnay/rust-toolchain@stable + + # - name: Run sccache-cache + # uses: mozilla-actions/sccache-action@v0.0.10 + + # - name: Install tauri-cli + # run: cargo install tauri-cli --locked + + # - name: Build new UI + # run: | + # cd new-ui + # pnpm build + + # - name: Build service and CLI binaries + # run: cargo build --release --manifest-path src-tauri/Cargo.toml -p defguard-cli -p defguard-client-service + + # - name: Build MSI + # uses: tauri-apps/tauri-action@v0.5.23 + # env: + # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # with: + # tauriScript: cargo tauri + # args: "--bundles msi" + + # - name: Upload MSI to S3 + # env: + # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + # run: | + # aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` + # "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/defguard-client-${env:BRANCH}-x64-nightly.msi" update-index: needs: - build-linux - build-macos-pkg - - build-windows-msi + # - build-windows-msi if: always() runs-on: - self-hosted @@ -311,7 +308,7 @@ jobs: echo '' echo 'defguard-client nightly builds' echo '

defguard-client nightly builds

' - echo '' + echo '
FileSizeLast modified (UTC)
' aws s3 ls "s3://${S3_BUCKET}/${S3_PREFIX}/" --recursive \ | grep -v '/$' \ | sort -k4 \ From 5fad31a70c1cfc527d3cc4d30243cb6bb1c7bc2b Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 5 Aug 2026 16:04:43 +0200 Subject: [PATCH 08/14] test workflow --- .github/workflows/nightly.yaml | 83 ++++++++++++++++++++++++++-------- 1 file changed, 63 insertions(+), 20 deletions(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 0b910277..ad99296b 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -3,19 +3,34 @@ on: push: branches: - nightly-builds - -# concurrency: -# group: nightly-${{ github.ref }} -# cancel-in-progress: true + schedule: + - cron: "0 23 * * *" + workflow_dispatch: env: SQLX_OFFLINE: "1" - S3_BUCKET: defguard-nightly + S3_BUCKET: nightly.defguard.net S3_PREFIX: defguard-client AWS_DEFAULT_REGION: eu-central-1 jobs: + prepare: + runs-on: + - self-hosted + - Linux + - X64 + outputs: + branches: ${{ steps.set.outputs.branches }} + stamp: ${{ steps.set.outputs.stamp }} + steps: + - name: Set branches and timestamp + id: set + run: | + echo 'branches=["release/2.1"]' >> ${GITHUB_OUTPUT} + echo "stamp=$(date -u +%H-%M_%d-%m-%Y)" >> ${GITHUB_OUTPUT} + build-linux: + needs: prepare runs-on: - self-hosted - Linux @@ -23,6 +38,7 @@ jobs: strategy: fail-fast: false matrix: + branch: ${{ fromJSON(needs.prepare.outputs.branches) }} architecture: [ARM64, X64] include: - architecture: ARM64 @@ -34,6 +50,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + ref: ${{ matrix.branch }} submodules: recursive - uses: actions/setup-node@v6 @@ -82,7 +99,8 @@ jobs: echo Version: $VERSION echo "VERSION=$VERSION" >> ${GITHUB_ENV} echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} - echo "BRANCH=${GITHUB_REF_NAME//\//-}" >> ${GITHUB_ENV} + BRANCH="${{ matrix.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} - name: Build new UI run: | @@ -101,20 +119,26 @@ jobs: env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + STAMP: ${{ needs.prepare.outputs.stamp }} run: | - NAME="defguard-client-${BRANCH}-${{ matrix.binary_arch }}-nightly" + NAME="defguard-client-${{ matrix.binary_arch }}-${STAMP}" aws s3 cp --acl public-read \ "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \ - "s3://${S3_BUCKET}/${S3_PREFIX}/${NAME}.deb" + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.deb" aws s3 cp --acl public-read \ "src-tauri/target/release/bundle/rpm/defguard-client-${VERSION}-1.${{ matrix.binary_arch }}.rpm" \ - "s3://${S3_BUCKET}/${S3_PREFIX}/${NAME}.rpm" + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.rpm" build-macos-pkg: + needs: prepare runs-on: - self-hosted - macOS - native + strategy: + fail-fast: false + matrix: + branch: ${{ fromJSON(needs.prepare.outputs.branches) }} env: SCCACHE_GHA_ENABLED: "true" RUSTC_WRAPPER: "sccache" @@ -123,6 +147,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + ref: ${{ matrix.branch }} submodules: recursive - name: Write build version @@ -131,7 +156,8 @@ jobs: echo Version: $VERSION echo "VERSION=$VERSION" >> ${GITHUB_ENV} echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} - echo "BRANCH=${GITHUB_REF_NAME//\//-}" >> ${GITHUB_ENV} + BRANCH="${{ matrix.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} - uses: actions/setup-node@v6 with: @@ -206,16 +232,22 @@ jobs: env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + STAMP: ${{ needs.prepare.outputs.stamp }} run: | export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}" aws s3 cp --acl public-read defguard-client.pkg \ - "s3://${S3_BUCKET}/${S3_PREFIX}/defguard-client-${BRANCH}-universal-nightly.pkg" + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${STAMP}.pkg" # build-windows-msi: + # needs: prepare # runs-on: # - self-hosted # - Windows # - X64 + # strategy: + # fail-fast: false + # matrix: + # branch: ${{ fromJSON(needs.prepare.outputs.branches) }} # env: # SCCACHE_GHA_ENABLED: "true" # RUSTC_WRAPPER: "sccache" @@ -225,6 +257,7 @@ jobs: # steps: # - uses: actions/checkout@v7 # with: + # ref: ${{ matrix.branch }} # submodules: recursive # - name: Write build version @@ -233,7 +266,7 @@ jobs: # echo "Version: $version" # echo "VERSION=$version" >> $env:GITHUB_ENV # echo "DEFGUARD_CLIENT_BUILD_VERSION=$version-nightly" >> $env:GITHUB_ENV - # echo "BRANCH=$($env:GITHUB_REF_NAME -replace '/','-')" >> $env:GITHUB_ENV + # echo "BRANCH=$('${{ matrix.branch }}' -replace '/','-')" >> $env:GITHUB_ENV # - uses: actions/setup-node@v6 # with: @@ -278,9 +311,10 @@ jobs: # env: # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + # STAMP: ${{ needs.prepare.outputs.stamp }} # run: | # aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` - # "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/defguard-client-${env:BRANCH}-x64-nightly.msi" + # "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/${env:BRANCH}/defguard-client-x64-${env:STAMP}.msi" update-index: needs: @@ -296,24 +330,33 @@ jobs: - name: Install awscli run: | sudo apt-get update - sudo apt-get install -y awscli + sudo apt-get install -y awscli jq - name: Generate and upload index.html env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} run: | + aws s3api list-objects-v2 \ + --bucket "${S3_BUCKET}" \ + --prefix "${S3_PREFIX}/" \ + --query 'Contents[?Size > `0`].{key: Key, size: Size, modified: LastModified}' \ + --output json > objects.json + { echo '' echo '' echo 'defguard-client nightly builds' echo '

defguard-client nightly builds

' - echo '
FileSizeUploaded on (UTC)
' - aws s3 ls "s3://${S3_BUCKET}/${S3_PREFIX}/" --recursive \ - | grep -v '/$' \ - | sort -k4 \ - | awk '{printf "\n", $4, $4, $3/1048576, $1, $2}' - echo '
FileSizeUploaded on (UTC)
%s%.1f MiB%s %s
' + jq -r ' + (. // []) + | group_by(.key | split("/")[1])[] + | sort_by(.modified) | reverse + | "

\(.[0].key | split("/")[1])

", + "", + (.[] | ""), + "
FileSizeUploaded on (UTC)
\(.key | split("/")[2])\((.size / 104857.6 | round) / 10) MiB\(.modified)
" + ' objects.json } > index.html cat index.html aws s3 cp --acl public-read --content-type text/html \ From a4023c9c9e87dea62fe0f622f41e4423f4ef773f Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Wed, 5 Aug 2026 16:55:54 +0200 Subject: [PATCH 09/14] beautiful list --- .github/workflows/nightly.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index ad99296b..4ba57734 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -347,6 +347,7 @@ jobs: echo '' echo '' echo 'defguard-client nightly builds' + echo '' echo '

defguard-client nightly builds

' jq -r ' (. // []) From f467681366d13ca498088550b6cf2ad8622a2e3e Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:31:23 +0200 Subject: [PATCH 10/14] add sha in name --- .github/workflows/nightly.yaml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 4ba57734..28d61841 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -8,6 +8,7 @@ on: workflow_dispatch: env: + NIGHTLY_BRANCHES: '["release/2.1"]' SQLX_OFFLINE: "1" S3_BUCKET: nightly.defguard.net S3_PREFIX: defguard-client @@ -21,13 +22,10 @@ jobs: - X64 outputs: branches: ${{ steps.set.outputs.branches }} - stamp: ${{ steps.set.outputs.stamp }} steps: - - name: Set branches and timestamp + - name: Set branches id: set - run: | - echo 'branches=["release/2.1"]' >> ${GITHUB_OUTPUT} - echo "stamp=$(date -u +%H-%M_%d-%m-%Y)" >> ${GITHUB_OUTPUT} + run: echo "branches=${NIGHTLY_BRANCHES}" >> ${GITHUB_OUTPUT} build-linux: needs: prepare @@ -101,6 +99,7 @@ jobs: echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} BRANCH="${{ matrix.branch }}" echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} - name: Build new UI run: | @@ -119,9 +118,8 @@ jobs: env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} - STAMP: ${{ needs.prepare.outputs.stamp }} run: | - NAME="defguard-client-${{ matrix.binary_arch }}-${STAMP}" + NAME="defguard-client-${{ matrix.binary_arch }}-${SHA}" aws s3 cp --acl public-read \ "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \ "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.deb" @@ -158,6 +156,7 @@ jobs: echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} BRANCH="${{ matrix.branch }}" echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} - uses: actions/setup-node@v6 with: @@ -232,11 +231,10 @@ jobs: env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} - STAMP: ${{ needs.prepare.outputs.stamp }} run: | export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}" aws s3 cp --acl public-read defguard-client.pkg \ - "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${STAMP}.pkg" + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${SHA}.pkg" # build-windows-msi: # needs: prepare @@ -267,6 +265,7 @@ jobs: # echo "VERSION=$version" >> $env:GITHUB_ENV # echo "DEFGUARD_CLIENT_BUILD_VERSION=$version-nightly" >> $env:GITHUB_ENV # echo "BRANCH=$('${{ matrix.branch }}' -replace '/','-')" >> $env:GITHUB_ENV + # echo "SHA=$(git rev-parse --short HEAD)" >> $env:GITHUB_ENV # - uses: actions/setup-node@v6 # with: @@ -311,10 +310,9 @@ jobs: # env: # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} - # STAMP: ${{ needs.prepare.outputs.stamp }} # run: | # aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` - # "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/${env:BRANCH}/defguard-client-x64-${env:STAMP}.msi" + # "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/${env:BRANCH}/defguard-client-x64-${env:SHA}.msi" update-index: needs: @@ -351,8 +349,10 @@ jobs: echo '

defguard-client nightly builds

' jq -r ' (. // []) - | group_by(.key | split("/")[1])[] - | sort_by(.modified) | reverse + | group_by(.key | split("/")[1]) + | map(sort_by(.modified) | reverse) + | sort_by(.[0].modified) | reverse + | .[] | "

\(.[0].key | split("/")[1])

", "", (.[] | ""), From 2a7bac14976df6846781a2ac5da2336d4bbe5ffd Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Thu, 6 Aug 2026 14:10:17 +0200 Subject: [PATCH 11/14] two separate jobs for main/release2.1 --- .github/workflows/nightly-build-1x.yaml | 194 ++++++++++++++ .github/workflows/nightly-build-2x.yaml | 299 ++++++++++++++++++++++ .github/workflows/nightly.yaml | 322 ++---------------------- 3 files changed, 512 insertions(+), 303 deletions(-) create mode 100644 .github/workflows/nightly-build-1x.yaml create mode 100644 .github/workflows/nightly-build-2x.yaml diff --git a/.github/workflows/nightly-build-1x.yaml b/.github/workflows/nightly-build-1x.yaml new file mode 100644 index 00000000..aa7e68f2 --- /dev/null +++ b/.github/workflows/nightly-build-1x.yaml @@ -0,0 +1,194 @@ +name: "Nightly build (main layout)" + +on: + workflow_call: + inputs: + branch: + required: true + type: string + s3_bucket: + required: true + type: string + s3_prefix: + required: true + type: string + aws_region: + required: true + type: string + +env: + S3_BUCKET: ${{ inputs.s3_bucket }} + S3_PREFIX: ${{ inputs.s3_prefix }} + AWS_DEFAULT_REGION: ${{ inputs.aws_region }} + +jobs: + build-linux: + env: + CARGO_TERM_COLOR: always + # sccache + SCCACHE_GHA_ENABLED: "true" + RUSTC_WRAPPER: "sccache" + runs-on: + - self-hosted + - Linux + - ${{ matrix.architecture }} + strategy: + fail-fast: false + matrix: + architecture: [ARM64, X64] + include: + - architecture: ARM64 + deb_arch: arm64 + binary_arch: aarch64 + - architecture: X64 + deb_arch: amd64 + binary_arch: x86_64 + steps: + - uses: actions/checkout@v6 + with: + ref: ${{ inputs.branch }} + submodules: recursive + + - name: Install NodeJS + uses: actions/setup-node@v6 + with: + node-version: 26 + + - name: Install pnpm + uses: pnpm/action-setup@v6 + with: + cache: true + version: 11 + run_install: false + + - name: Get pnpm store directory + shell: bash + run: | + echo "STORE_PATH=$(pnpm store path --silent)" >> ${GITHUB_ENV} + + # Change to '--frozen-lockfile' once this gets fixed: + # https://github.com/pnpm/action-setup/issues/40 + - name: Install Node dependencies + run: pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + + - name: Run sccache-cache + uses: mozilla-actions/sccache-action@v0.0.10 + + - name: Install Linux dependencies + run: | + sudo apt-get update + sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm awscli jq + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + BRANCH="${{ inputs.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} + + - name: Build packages + uses: tauri-apps/tauri-action@v0 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + args: "--bundles deb,rpm" + + - name: Upload DEB and RPM to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + run: | + NAME="defguard-client-${{ matrix.binary_arch }}-${SHA}" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.deb" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/rpm/defguard-client-${VERSION}-1.${{ matrix.binary_arch }}.rpm" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.rpm" + + build-macos-pkg: + env: + CARGO_TERM_COLOR: always + # sccache + SCCACHE_GHA_ENABLED: "true" + RUSTC_WRAPPER: "sccache" + APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)" + APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)" + APPLE_PROVIDER_SHORT_NAME: "82GZ7KN29J" + APPLE_ID: "kamil@defguard.net" + APPLE_TEAM_ID: "82GZ7KN29J" + runs-on: + - self-hosted + - macOS + steps: + - uses: actions/checkout@v6 + with: + ref: ${{ inputs.branch }} + submodules: recursive + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + BRANCH="${{ inputs.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} + + - name: Install NodeJS + uses: actions/setup-node@v6 + with: + node-version: 26 + + - name: Install pnpm + uses: pnpm/action-setup@v6 + with: + cache: true + version: 11 + + # Change to '--frozen-lockfile' once this gets fixed: + # https://github.com/pnpm/action-setup/issues/40 + - name: Install Node dependencies + run: pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + with: + targets: aarch64-apple-darwin,x86_64-apple-darwin + + - name: Run sccache-cache + uses: mozilla-actions/sccache-action@v0.0.10 + + - name: Set build number + run: | + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.conf.json + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj + + - name: Unlock keychain + run: security -v unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" login.keychain + + - name: Build app + uses: tauri-apps/tauri-action@v0 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + args: --target universal-apple-darwin + + - name: Build installation package + run: | + security -v unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" login.keychain + xcrun productbuild --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" /Applications defguard-client.pkg + + - name: Upload PKG to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + run: | + export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}" + aws s3 cp --acl public-read defguard-client.pkg \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${SHA}.pkg" diff --git a/.github/workflows/nightly-build-2x.yaml b/.github/workflows/nightly-build-2x.yaml new file mode 100644 index 00000000..5d9778cd --- /dev/null +++ b/.github/workflows/nightly-build-2x.yaml @@ -0,0 +1,299 @@ +name: "Nightly build (new-ui layout)" + +on: + workflow_call: + inputs: + branch: + required: true + type: string + s3_bucket: + required: true + type: string + s3_prefix: + required: true + type: string + aws_region: + required: true + type: string + +env: + SQLX_OFFLINE: "1" + S3_BUCKET: ${{ inputs.s3_bucket }} + S3_PREFIX: ${{ inputs.s3_prefix }} + AWS_DEFAULT_REGION: ${{ inputs.aws_region }} + +jobs: + build-linux: + runs-on: + - self-hosted + - Linux + - ${{ matrix.architecture }} + strategy: + fail-fast: false + matrix: + architecture: [ARM64, X64] + include: + - architecture: ARM64 + deb_arch: arm64 + binary_arch: aarch64 + - architecture: X64 + deb_arch: amd64 + binary_arch: x86_64 + steps: + - uses: actions/checkout@v7 + with: + ref: ${{ inputs.branch }} + submodules: recursive + + - uses: actions/setup-node@v6 + with: + node-version-file: new-ui/.nvmrc + + - uses: pnpm/action-setup@v6 + with: + version: 11.11 + run_install: false + + - name: Get pnpm store directory + shell: bash + run: | + STORE_PATH=$(pnpm store path --silent) + mkdir -p "$STORE_PATH" + echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} + + - name: Restore pnpm store cache + uses: actions/cache@v5 + with: + path: ${{ env.STORE_PATH }} + key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- + + - name: Install Node dependencies for new UI + run: | + cd new-ui + pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + + - name: Install tauri-cli + run: cargo install tauri-cli --locked + + - name: Install Linux dependencies + run: | + sudo apt-get update + sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm awscli jq + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} + BRANCH="${{ inputs.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} + + - name: Build new UI + run: | + cd new-ui + pnpm build + + - name: Build packages + uses: tauri-apps/tauri-action@v0.5.23 # .24 seems broken, TODO: update when fixed + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tauriScript: cargo tauri + args: "--bundles deb,rpm" + + - name: Upload DEB and RPM to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + run: | + NAME="defguard-client-${{ matrix.binary_arch }}-${SHA}" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.deb" + aws s3 cp --acl public-read \ + "src-tauri/target/release/bundle/rpm/defguard-client-${VERSION}-1.${{ matrix.binary_arch }}.rpm" \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.rpm" + + build-macos-pkg: + runs-on: + - self-hosted + - macOS + - native + env: + SCCACHE_GHA_ENABLED: "true" + RUSTC_WRAPPER: "sccache" + APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)" + APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)" + steps: + - uses: actions/checkout@v7 + with: + ref: ${{ inputs.branch }} + submodules: recursive + + - name: Write build version + run: | + VERSION=$(jq -r .version src-tauri/tauri.conf.json) + echo Version: $VERSION + echo "VERSION=$VERSION" >> ${GITHUB_ENV} + echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} + BRANCH="${{ inputs.branch }}" + echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} + echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} + + - uses: actions/setup-node@v6 + with: + node-version-file: new-ui/.nvmrc + + - uses: pnpm/action-setup@v6 + with: + run_install: false + version: 11 + + - name: Get pnpm store directory + run: | + STORE_PATH=$(pnpm store path --silent) + mkdir -p "$STORE_PATH" + echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} + + - name: Restore pnpm store cache + uses: actions/cache@v5 + with: + path: ${{ env.STORE_PATH }} + key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} + restore-keys: | + pnpm-store-${{ runner.os }}- + + - name: Install Node dependencies for New UI + run: | + cd new-ui + pnpm install --no-frozen-lockfile + + - name: Install Rust stable + uses: dtolnay/rust-toolchain@stable + with: + targets: aarch64-apple-darwin,x86_64-apple-darwin + + - name: Run sccache-cache + uses: mozilla-actions/sccache-action@v0.0.10 + + - name: Install tauri-cli + run: cargo install tauri-cli --locked + + - name: Set build number + run: | + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/client-cli/Info.plist + sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.macos.conf.json + + - name: Build new UI + run: | + cd new-ui + pnpm build + + - name: Unlock keychain + run: | + security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain + + - name: Build app + uses: tauri-apps/tauri-action@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tauriScript: cargo tauri + args: --config src-tauri/tauri.app.conf.json --target universal-apple-darwin + + - name: Build installation package + run: | + xcrun productbuild --keychain build.keychain \ + --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \ + --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \ + /Applications defguard-client.pkg + + - name: Upload PKG to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + run: | + export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}" + aws s3 cp --acl public-read defguard-client.pkg \ + "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${SHA}.pkg" + + # build-windows-msi: + # runs-on: + # - self-hosted + # - Windows + # - X64 + # env: + # SCCACHE_GHA_ENABLED: "true" + # RUSTC_WRAPPER: "sccache" + # defaults: + # run: + # shell: powershell + # steps: + # - uses: actions/checkout@v7 + # with: + # ref: ${{ inputs.branch }} + # submodules: recursive + + # - name: Write build version + # run: | + # $version = (Get-Content src-tauri/tauri.conf.json -Raw | ConvertFrom-Json).version + # echo "Version: $version" + # echo "VERSION=$version" >> $env:GITHUB_ENV + # echo "DEFGUARD_CLIENT_BUILD_VERSION=$version-nightly" >> $env:GITHUB_ENV + # echo "BRANCH=$('${{ inputs.branch }}' -replace '/','-')" >> $env:GITHUB_ENV + # echo "SHA=$(git rev-parse --short HEAD)" >> $env:GITHUB_ENV + + # - uses: actions/setup-node@v6 + # with: + # node-version-file: new-ui/.nvmrc + + # - uses: pnpm/action-setup@v6 + # with: + # version: 11.11 + # run_install: false + + # - name: Install Node dependencies for new UI + # run: | + # cd new-ui + # pnpm install --no-frozen-lockfile + + # - name: Install Rust stable + # uses: dtolnay/rust-toolchain@stable + + # - name: Run sccache-cache + # uses: mozilla-actions/sccache-action@v0.0.10 + + # - name: Install tauri-cli + # run: cargo install tauri-cli --locked + + # - name: Build new UI + # run: | + # cd new-ui + # pnpm build + + # - name: Build service and CLI binaries + # run: cargo build --release --manifest-path src-tauri/Cargo.toml -p defguard-cli -p defguard-client-service + + # - name: Build MSI + # uses: tauri-apps/tauri-action@v0.5.23 + # env: + # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # with: + # tauriScript: cargo tauri + # args: "--bundles msi" + + # - name: Upload MSI to S3 + # env: + # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} + # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} + # run: | + # aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` + # "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/${env:BRANCH}/defguard-client-x64-${env:SHA}.msi" diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 28d61841..1bfe886f 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -8,317 +8,33 @@ on: workflow_dispatch: env: - NIGHTLY_BRANCHES: '["release/2.1"]' - SQLX_OFFLINE: "1" S3_BUCKET: nightly.defguard.net S3_PREFIX: defguard-client AWS_DEFAULT_REGION: eu-central-1 jobs: - prepare: - runs-on: - - self-hosted - - Linux - - X64 - outputs: - branches: ${{ steps.set.outputs.branches }} - steps: - - name: Set branches - id: set - run: echo "branches=${NIGHTLY_BRANCHES}" >> ${GITHUB_OUTPUT} - - build-linux: - needs: prepare - runs-on: - - self-hosted - - Linux - - ${{ matrix.architecture }} - strategy: - fail-fast: false - matrix: - branch: ${{ fromJSON(needs.prepare.outputs.branches) }} - architecture: [ARM64, X64] - include: - - architecture: ARM64 - deb_arch: arm64 - binary_arch: aarch64 - - architecture: X64 - deb_arch: amd64 - binary_arch: x86_64 - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ matrix.branch }} - submodules: recursive - - - uses: actions/setup-node@v6 - with: - node-version-file: new-ui/.nvmrc - - - uses: pnpm/action-setup@v6 - with: - version: 11.11 - run_install: false - - - name: Get pnpm store directory - shell: bash - run: | - STORE_PATH=$(pnpm store path --silent) - mkdir -p "$STORE_PATH" - echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} - - - name: Restore pnpm store cache - uses: actions/cache@v5 - with: - path: ${{ env.STORE_PATH }} - key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} - restore-keys: | - pnpm-store-${{ runner.os }}- - - - name: Install Node dependencies for new UI - run: | - cd new-ui - pnpm install --no-frozen-lockfile - - - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable - - - name: Install tauri-cli - run: cargo install tauri-cli --locked - - - name: Install Linux dependencies - run: | - sudo apt-get update - sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm awscli jq - - - name: Write build version - run: | - VERSION=$(jq -r .version src-tauri/tauri.conf.json) - echo Version: $VERSION - echo "VERSION=$VERSION" >> ${GITHUB_ENV} - echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} - BRANCH="${{ matrix.branch }}" - echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} - echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} - - - name: Build new UI - run: | - cd new-ui - pnpm build - - - name: Build packages - uses: tauri-apps/tauri-action@v0.5.23 # .24 seems broken, TODO: update when fixed - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tauriScript: cargo tauri - args: "--bundles deb,rpm" - - - name: Upload DEB and RPM to S3 - env: - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} - run: | - NAME="defguard-client-${{ matrix.binary_arch }}-${SHA}" - aws s3 cp --acl public-read \ - "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \ - "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.deb" - aws s3 cp --acl public-read \ - "src-tauri/target/release/bundle/rpm/defguard-client-${VERSION}-1.${{ matrix.binary_arch }}.rpm" \ - "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.rpm" - - build-macos-pkg: - needs: prepare - runs-on: - - self-hosted - - macOS - - native - strategy: - fail-fast: false - matrix: - branch: ${{ fromJSON(needs.prepare.outputs.branches) }} - env: - SCCACHE_GHA_ENABLED: "true" - RUSTC_WRAPPER: "sccache" - APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)" - APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)" - steps: - - uses: actions/checkout@v7 - with: - ref: ${{ matrix.branch }} - submodules: recursive - - - name: Write build version - run: | - VERSION=$(jq -r .version src-tauri/tauri.conf.json) - echo Version: $VERSION - echo "VERSION=$VERSION" >> ${GITHUB_ENV} - echo "DEFGUARD_CLIENT_BUILD_VERSION=${VERSION}-nightly" >> ${GITHUB_ENV} - BRANCH="${{ matrix.branch }}" - echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV} - echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV} - - - uses: actions/setup-node@v6 - with: - node-version-file: new-ui/.nvmrc - - - uses: pnpm/action-setup@v6 - with: - run_install: false - version: 11 - - - name: Get pnpm store directory - run: | - STORE_PATH=$(pnpm store path --silent) - mkdir -p "$STORE_PATH" - echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} - - - name: Restore pnpm store cache - uses: actions/cache@v5 - with: - path: ${{ env.STORE_PATH }} - key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} - restore-keys: | - pnpm-store-${{ runner.os }}- - - - name: Install Node dependencies for New UI - run: | - cd new-ui - pnpm install --no-frozen-lockfile - - - name: Install Rust stable - uses: dtolnay/rust-toolchain@stable - with: - targets: aarch64-apple-darwin,x86_64-apple-darwin - - - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.10 - - - name: Install tauri-cli - run: cargo install tauri-cli --locked - - - name: Set build number - run: | - sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj - sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/client-cli/Info.plist - sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.macos.conf.json - - - name: Build new UI - run: | - cd new-ui - pnpm build - - - name: Unlock keychain - run: | - security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain - - - name: Build app - uses: tauri-apps/tauri-action@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tauriScript: cargo tauri - args: --config src-tauri/tauri.app.conf.json --target universal-apple-darwin - - - name: Build installation package - run: | - xcrun productbuild --keychain build.keychain \ - --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \ - --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \ - /Applications defguard-client.pkg - - - name: Upload PKG to S3 - env: - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} - run: | - export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}" - aws s3 cp --acl public-read defguard-client.pkg \ - "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${SHA}.pkg" - - # build-windows-msi: - # needs: prepare - # runs-on: - # - self-hosted - # - Windows - # - X64 - # strategy: - # fail-fast: false - # matrix: - # branch: ${{ fromJSON(needs.prepare.outputs.branches) }} - # env: - # SCCACHE_GHA_ENABLED: "true" - # RUSTC_WRAPPER: "sccache" - # defaults: - # run: - # shell: powershell - # steps: - # - uses: actions/checkout@v7 - # with: - # ref: ${{ matrix.branch }} - # submodules: recursive - - # - name: Write build version - # run: | - # $version = (Get-Content src-tauri/tauri.conf.json -Raw | ConvertFrom-Json).version - # echo "Version: $version" - # echo "VERSION=$version" >> $env:GITHUB_ENV - # echo "DEFGUARD_CLIENT_BUILD_VERSION=$version-nightly" >> $env:GITHUB_ENV - # echo "BRANCH=$('${{ matrix.branch }}' -replace '/','-')" >> $env:GITHUB_ENV - # echo "SHA=$(git rev-parse --short HEAD)" >> $env:GITHUB_ENV - - # - uses: actions/setup-node@v6 - # with: - # node-version-file: new-ui/.nvmrc - - # - uses: pnpm/action-setup@v6 - # with: - # version: 11.11 - # run_install: false - - # - name: Install Node dependencies for new UI - # run: | - # cd new-ui - # pnpm install --no-frozen-lockfile - - # - name: Install Rust stable - # uses: dtolnay/rust-toolchain@stable - - # - name: Run sccache-cache - # uses: mozilla-actions/sccache-action@v0.0.10 - - # - name: Install tauri-cli - # run: cargo install tauri-cli --locked - - # - name: Build new UI - # run: | - # cd new-ui - # pnpm build - - # - name: Build service and CLI binaries - # run: cargo build --release --manifest-path src-tauri/Cargo.toml -p defguard-cli -p defguard-client-service - - # - name: Build MSI - # uses: tauri-apps/tauri-action@v0.5.23 - # env: - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # with: - # tauriScript: cargo tauri - # args: "--bundles msi" - - # - name: Upload MSI to S3 - # env: - # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }} - # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }} - # run: | - # aws s3 cp --acl public-read "src-tauri/target/release/bundle/msi/Defguard_${env:VERSION}_x64_en-US.msi" ` - # "s3://${env:S3_BUCKET}/${env:S3_PREFIX}/${env:BRANCH}/defguard-client-x64-${env:SHA}.msi" + release-2-1: + uses: ./.github/workflows/nightly-build-2x.yaml + with: + branch: release/2.1 + s3_bucket: nightly.defguard.net + s3_prefix: defguard-client + aws_region: eu-central-1 + secrets: inherit + + main: + uses: ./.github/workflows/nightly-build-1x.yaml + with: + branch: main + s3_bucket: nightly.defguard.net + s3_prefix: defguard-client + aws_region: eu-central-1 + secrets: inherit update-index: needs: - - build-linux - - build-macos-pkg - # - build-windows-msi + - release-2-1 + - main if: always() runs-on: - self-hosted From 7220cbe78b92d5a75908f566e7539c6103ac4359 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Thu, 6 Aug 2026 14:19:34 +0200 Subject: [PATCH 12/14] adjust pkg on main --- .github/workflows/nightly-build-1x.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/nightly-build-1x.yaml b/.github/workflows/nightly-build-1x.yaml index aa7e68f2..df4fa153 100644 --- a/.github/workflows/nightly-build-1x.yaml +++ b/.github/workflows/nightly-build-1x.yaml @@ -125,6 +125,7 @@ jobs: runs-on: - self-hosted - macOS + - native steps: - uses: actions/checkout@v6 with: @@ -170,7 +171,7 @@ jobs: sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj - name: Unlock keychain - run: security -v unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" login.keychain + run: security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain - name: Build app uses: tauri-apps/tauri-action@v0 @@ -181,8 +182,10 @@ jobs: - name: Build installation package run: | - security -v unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" login.keychain - xcrun productbuild --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" /Applications defguard-client.pkg + xcrun productbuild --keychain build.keychain \ + --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \ + --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \ + /Applications defguard-client.pkg - name: Upload PKG to S3 env: From b06e9642e7d0f20d7df32a541d6a1a817d95036d Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Thu, 6 Aug 2026 14:24:52 +0200 Subject: [PATCH 13/14] run sequentially --- .github/workflows/nightly.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 1bfe886f..553f5d63 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -23,6 +23,8 @@ jobs: secrets: inherit main: + needs: release-2-1 + if: always() uses: ./.github/workflows/nightly-build-1x.yaml with: branch: main From df6169e383431b143e1387b3d74dde2cb8bf44a2 Mon Sep 17 00:00:00 2001 From: Kuba <78603704+jakub-tldr@users.noreply.github.com> Date: Thu, 6 Aug 2026 15:15:47 +0200 Subject: [PATCH 14/14] set date format, remove trigger --- .github/workflows/nightly.yaml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 553f5d63..b0d31dbf 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -1,8 +1,5 @@ name: "Nightly builds" on: - push: - branches: - - nightly-builds schedule: - cron: "0 23 * * *" workflow_dispatch: @@ -73,7 +70,7 @@ jobs: | .[] | "

\(.[0].key | split("/")[1])

", "
FileSizeUploaded on (UTC)
\(.key | split("/")[2])\((.size / 104857.6 | round) / 10) MiB\(.modified)
", - (.[] | ""), + (.[] | ""), "
FileSizeUploaded on (UTC)
\(.key | split("/")[2])\((.size / 104857.6 | round) / 10) MiB\(.modified)
\(.key | split("/")[2])\((.size / 104857.6 | round) / 10) MiB\(.modified[0:10]) \(.modified[11:16])
" ' objects.json } > index.html