Lucas RayanandClaude Sonnet 5
76e4466652
Replaces the signed tauri-plugin-updater (latest.json manifest, minisign key pair) with the same simple mechanism Sabiá already uses: query the Gitea Releases API directly, download the matching platform archive, verify its SHA-256 checksum, and swap the binary in place. The CI job that built the old latest.json manifest is removed in the next commit, alongside an unrelated runner-routing change to the same workflow file. - New guara-core::update module (check/apply), ported from sabia-core::update and adapted to Guará's own release asset naming (guara-<tag>-<platform>.tar.gz, matching scripts/package-cli.sh). - New Engine::update_check / Engine::update_apply, wired into the RPC service for the browser UI. - New CLI subcommand: "guara update" (check) and "guara update --apply" (download, verify, replace), mirroring "sabia update". - GUI: replaced the Tauri plugin-updater flow (download_and_install, update-progress events, in-app restart) with a call to the new update_check/update_apply commands. The desktop app can no longer self-install in one click — it now points the user to the Releases page, same as Sabiá's desktop app already does. - Removed tauri-plugin-updater, createUpdaterArtifacts and the updater.pubkey config, the signing-key loading in build-gui.sh, the CI step testing the old latest.json generator, and the now-unused make-latest-json.py/test_make_latest_json.py scripts. - Documented the break for existing installs in CHANGELOG.md / CHANGELOG.pt-BR.md: versions up to 1.3.2 won't find this release automatically and need one manual download. Trade-off accepted knowingly: SHA-256 verifies integrity against Gitea's own API but, unlike the retired signed mechanism, does not protect against a compromised Gitea server independently of it. This is Lucas's own self-hosted instance, not a third-party mirror. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
112 lines
4.4 KiB
YAML
112 lines
4.4 KiB
YAML
name: CI
|
|
|
|
on:
|
|
# Documentation-only or local agent state changes do not trigger CI jobs.
|
|
push:
|
|
branches: [main]
|
|
paths-ignore: ['**.md', 'docs/**', 'LICENSE*', '.gitignore', '.githooks/**', '.wolf/**', '.claude/**', '.opencode/**', '.codex/**', '.cursor/**', '.superpowers/**', '.superset/**', '.gitea/ISSUE_TEMPLATE/**', 'scripts/release-notes.sh', 'scripts/release-upload.sh', '.gitea/workflows/release.yml']
|
|
pull_request:
|
|
paths-ignore: ['**.md', 'docs/**', 'LICENSE*', '.gitignore', '.githooks/**', '.wolf/**', '.claude/**', '.opencode/**', '.codex/**', '.cursor/**', '.superpowers/**', '.superset/**', '.gitea/ISSUE_TEMPLATE/**', 'scripts/release-notes.sh', 'scripts/release-upload.sh', '.gitea/workflows/release.yml']
|
|
|
|
concurrency:
|
|
group: ci-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
RUSTFLAGS: -D warnings
|
|
# The runner persists /opt/hostedtoolcache across jobs: rustup toolchains,
|
|
# cargo registry, npm/apt caches, and target directories live there so nothing
|
|
# is re-downloaded or rebuilt from scratch on every run. Each job uses its own
|
|
# target directory so differing RUSTFLAGS do not invalidate another job's cache.
|
|
CARGO_HOME: /opt/hostedtoolcache/cargo
|
|
RUSTUP_HOME: /opt/hostedtoolcache/rustup
|
|
NPM_CONFIG_CACHE: /opt/hostedtoolcache/npm-cache
|
|
|
|
jobs:
|
|
lint:
|
|
name: Format and clippy
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-lint
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: rustfmt, clippy
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 22
|
|
- name: UI translation coverage
|
|
run: node scripts/check-ui-i18n.mjs
|
|
- run: cargo fmt --all -- --check
|
|
- run: cargo clippy --workspace --all-targets
|
|
|
|
# Linux-only runner (ARM64).
|
|
test:
|
|
name: Tests (Linux)
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-test
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- name: Test image tools (Linux)
|
|
if: runner.os == 'Linux'
|
|
timeout-minutes: 25
|
|
run: scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/guara-tools mtools dosfstools exfatprogs ntfs-3g e2fsprogs xfsprogs imagemagick zip
|
|
- name: Reference disk images (BitLocker, FileVault 2, dfvfs, AFF4)
|
|
shell: bash
|
|
run: |
|
|
mkdir -p /opt/hostedtoolcache/guara-testdata target
|
|
ln -sfn /opt/hostedtoolcache/guara-testdata target/testdata
|
|
scripts/fetch-testdata.sh
|
|
# Mounts an image via loop device (mount -o loop), which requires a
|
|
# privileged container. Unprivileged runners skip this step cleanly.
|
|
- name: Real XFS deletion fixture (Linux)
|
|
if: runner.os == 'Linux'
|
|
continue-on-error: true
|
|
run: |
|
|
if [ ! -f target/testdata/xfs-real-delete/disk.img ]; then
|
|
sudo scripts/make-xfs-real-deletion.sh
|
|
fi
|
|
- name: Run tests
|
|
shell: bash
|
|
run: |
|
|
if [ "${RUNNER_OS}" = "Linux" ]; then export GUARA_REQUIRE_FIXTURES=1; fi
|
|
cargo test --workspace
|
|
|
|
audit:
|
|
name: Dependency audit
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
# rustsec/audit-check depends on GitHub's checks API. cargo-audit itself
|
|
# needs nothing but the advisory database, and installing it once into the
|
|
# persistent CARGO_HOME makes every later run skip compilation.
|
|
- name: cargo audit
|
|
run: |
|
|
command -v cargo-audit >/dev/null || cargo install cargo-audit --locked
|
|
cargo audit
|
|
|
|
gui:
|
|
name: Check desktop app (Linux)
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-gui
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 22
|
|
- name: Tauri system dependencies
|
|
timeout-minutes: 25
|
|
run: scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-native libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
|
|
- name: Generate icons
|
|
run: npx --yes @tauri-apps/cli@2 icon apps/gui/src-tauri/icons/source.png -o apps/gui/src-tauri/icons
|
|
- run: cargo check --manifest-path apps/gui/src-tauri/Cargo.toml
|
|
env:
|
|
RUSTFLAGS: ""
|