Nightly builds

.github/workflows/nightly-build-1x.yaml

@@ -0,0 +1,197 @@
+name: "Nightly build (main layout)"
+
+on:
+  workflow_call:
+    inputs:
+      branch:
+        required: true
+        type: string
+      s3_bucket:
+        required: true
+        type: string
+      s3_prefix:
+        required: true
+        type: string
+      aws_region:
+        required: true
+        type: string
+
+env:
+  S3_BUCKET: ${{ inputs.s3_bucket }}
+  S3_PREFIX: ${{ inputs.s3_prefix }}
+  AWS_DEFAULT_REGION: ${{ inputs.aws_region }}
+
+jobs:
+  build-linux:
+    env:
+      CARGO_TERM_COLOR: always
+      # sccache
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: "sccache"
+    runs-on:
+      - self-hosted
+      - Linux
+      - ${{ matrix.architecture }}
+    strategy:
+      fail-fast: false
+      matrix:
+        architecture: [ARM64, X64]
+        include:
+          - architecture: ARM64
+            deb_arch: arm64
+            binary_arch: aarch64
+          - architecture: X64
+            deb_arch: amd64
+            binary_arch: x86_64
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.branch }}
+          submodules: recursive
+
+      - name: Install NodeJS
+        uses: actions/setup-node@v6
+        with:
+          node-version: 26
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          cache: true
+          version: 11
+          run_install: false
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> ${GITHUB_ENV}
+
+      # Change to '--frozen-lockfile' once this gets fixed:
+      # https://github.com/pnpm/action-setup/issues/40
+      - name: Install Node dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@v0.0.10
+
+      - name: Install Linux dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm awscli jq
+
+      - name: Write build version
+        run: |
+          VERSION=$(jq -r .version src-tauri/tauri.conf.json)
+          echo Version: $VERSION
+          echo "VERSION=$VERSION" >> ${GITHUB_ENV}
+          BRANCH="${{ inputs.branch }}"
+          echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV}
+          echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV}
+
+      - name: Build packages
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          args: "--bundles deb,rpm"
+
+      - name: Upload DEB and RPM to S3
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }}
+        run: |
+          NAME="defguard-client-${{ matrix.binary_arch }}-${SHA}"
+          aws s3 cp --acl public-read \
+            "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \
+            "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.deb"
+          aws s3 cp --acl public-read \
+            "src-tauri/target/release/bundle/rpm/defguard-client-${VERSION}-1.${{ matrix.binary_arch }}.rpm" \
+            "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.rpm"
+
+  build-macos-pkg:
+    env:
+      CARGO_TERM_COLOR: always
+      # sccache
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: "sccache"
+      APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)"
+      APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)"
+      APPLE_PROVIDER_SHORT_NAME: "82GZ7KN29J"
+      APPLE_ID: "kamil@defguard.net"
+      APPLE_TEAM_ID: "82GZ7KN29J"
+    runs-on:
+      - self-hosted
+      - macOS
+      - native
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.branch }}
+          submodules: recursive
+
+      - name: Write build version
+        run: |
+          VERSION=$(jq -r .version src-tauri/tauri.conf.json)
+          echo Version: $VERSION
+          echo "VERSION=$VERSION" >> ${GITHUB_ENV}
+          BRANCH="${{ inputs.branch }}"
+          echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV}
+          echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV}
+
+      - name: Install NodeJS
+        uses: actions/setup-node@v6
+        with:
+          node-version: 26
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          cache: true
+          version: 11
+
+      # Change to '--frozen-lockfile' once this gets fixed:
+      # https://github.com/pnpm/action-setup/issues/40
+      - name: Install Node dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-darwin,x86_64-apple-darwin
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@v0.0.10
+
+      - name: Set build number
+        run: |
+          sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.conf.json
+          sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj
+
+      - name: Unlock keychain
+        run: security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain
+
+      - name: Build app
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          args: --target universal-apple-darwin
+
+      - name: Build installation package
+        run: |
+          xcrun productbuild --keychain build.keychain \
+            --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \
+            --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \
+            /Applications defguard-client.pkg
+
+      - name: Upload PKG to S3
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }}
+        run: |
+          export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}"
+          aws s3 cp --acl public-read defguard-client.pkg \
+            "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${SHA}.pkg"