Swadhin Biswas Ci/improve release notes (#41) · 8/28/2026
04d550f
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
name: CI/CD Pipeline
on:
push:
branches: [main, develop]
tags: ["v*"]
pull_request:
branches: [main, develop]
env:
CARGO_TERM_COLOR: always
RUST_BACKTRACE: 1
jobs:
frontend-lint:
name: Frontend Check & Build
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v7
- uses: oven-sh/setup-bun@v2
with:
bun-version: latest
no-cache: true
- run: bun install --frozen-lockfile
- run: bun run typecheck
- run: bun run format:check
- run: bunx eslint src --ext ts,tsx --report-unused-disable-directives --max-warnings 0
- run: bun run build
- uses: actions/upload-artifact@v4
with:
name: dist
path: dist/
retention-days: 7
rust-check:
name: Rust Check & Test
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
components: clippy, rustfmt
- uses: Swatinem/rust-cache@v2
with:
workspaces: src-tauri
- name: Install system dependencies
run: |
sudo apt-get update
sudo apt-get install -y \
libwebkit2gtk-4.1-dev \
build-essential \
libssl-dev \
libgtk-3-dev \
libayatana-appindicator3-dev \
librsvg2-dev \
libxdo-dev \
libsoup-3.0-dev \
libjavascriptcoregtk-4.1-dev \
libgdk-pixbuf-2.0-dev \
libpango1.0-dev \
libatk1.0-dev \
libcairo2-dev
- name: Check Rust formatting
working-directory: src-tauri
run: cargo fmt --all -- --check
- run: mkdir -p dist
- name: Run Clippy
working-directory: src-tauri
run: cargo clippy -- -D warnings
- name: Run tests
working-directory: src-tauri
run: cargo test --all
- name: Cargo check
working-directory: src-tauri
run: cargo check --all-targets
build-tauri:
name: Build Tauri App
runs-on: ubuntu-22.04
needs: [frontend-lint, rust-check]
steps:
- uses: actions/checkout@v7
- uses: oven-sh/setup-bun@v2
with:
bun-version: latest
no-cache: true
- uses: dtolnay/rust-toolchain@stable
- name: Install system deps
run: |
sudo apt-get update
sudo apt-get install -y \
libwebkit2gtk-4.1-dev \
build-essential \
libssl-dev \
libgtk-3-dev \
libayatana-appindicator3-dev \
librsvg2-dev \
libxdo-dev \
libsoup-3.0-dev \
libjavascriptcoregtk-4.1-dev \
libgdk-pixbuf-2.0-dev \
libpango1.0-dev \
libatk1.0-dev \
libcairo2-dev
- name: Install dependencies
run: bun install --frozen-lockfile
- name: Build frontend
run: bun run build
- name: Build Tauri
run: bun run tauri build
env:
NO_STRIP: 1
APPIMAGE_EXTRACT_AND_RUN: 1
- name: Install fpm
run: |
sudo apt-get install -y ruby ruby-dev rpm
sudo gem install --no-document fpm
export PATH="$(gem env | grep 'EXECUTABLE DIRECTORY' | awk '{print $4}'):$PATH"
fpm --version
- name: Build RPM package
run: |
export PATH="$(gem env | grep 'EXECUTABLE DIRECTORY' | awk '{print $4}'):$PATH"
./scripts/build-rpm.sh
- name: Upload artifacts
uses: actions/upload-artifact@v4
with:
name: linuxy
path: |
src-tauri/target/release/bundle/deb/*.deb
src-tauri/target/release/bundle/rpm/*.rpm
src-tauri/target/release/bundle/appimage/*.AppImage
retention-days: 7
security-audit:
name: Security Audit
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- run: cargo install cargo-audit
- run: mkdir -p dist
- working-directory: src-tauri
run: cargo audit
- uses: oven-sh/setup-bun@v2
with:
bun-version: latest
no-cache: true
- run: bun install --frozen-lockfile
- run: bun audit
verify-csp:
name: Verify CSP Configuration
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v7
- run: |
CSP=$(grep -o '"csp": *"[^"]*"' src-tauri/tauri.conf.json | sed 's/"csp": "//' | sed 's/"//')
echo "Checking CSP: $CSP"
if ! echo "$CSP" | grep -q "appimage.github.io"; then
echo "ERROR: appimage.github.io not in CSP"; exit 1
fi
if ! echo "$CSP" | grep -q "api.github.com"; then
echo "ERROR: api.github.com not in CSP"; exit 1
fi
if ! echo "$CSP" | grep -q "avatars.githubusercontent.com"; then
echo "ERROR: avatars.githubusercontent.com not in CSP"; exit 1
fi
echo "CSP verification passed!"
integration-test:
name: Integration Tests (Linux)
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: oven-sh/setup-bun@v2
with:
bun-version: latest
no-cache: true
- name: Install system deps
run: |
sudo apt-get update
sudo apt-get install -y \
libwebkit2gtk-4.1-dev \
build-essential \
libssl-dev \
libgtk-3-dev \
libayatana-appindicator3-dev \
librsvg2-dev \
libxdo-dev \
libsoup-3.0-dev \
libjavascriptcoregtk-4.1-dev \
libgdk-pixbuf-2.0-dev \
libpango1.0-dev \
libatk1.0-dev \
libcairo2-dev \
firejail
- run: bun install --frozen-lockfile
- run: bun run build
- run: bun run tauri build
- name: Install fpm
run: |
sudo apt-get install -y ruby ruby-dev rpm
sudo gem install --no-document fpm
- name: Build RPM
run: |
export PATH="$(gem env | grep 'EXECUTABLE DIRECTORY' | awk '{print $4}'):$PATH"
./scripts/build-rpm.sh
- name: Verify outputs
run: |
ls -la src-tauri/target/release/linuxy
file src-tauri/target/release/linuxy
ls -la src-tauri/target/release/bundle/
for pattern in \
"src-tauri/target/release/bundle/deb/*.deb" \
"src-tauri/target/release/bundle/rpm/*.rpm"; do
if compgen -G "$pattern" > /dev/null; then
echo "$pattern: OK"
else
echo "::error::Missing bundle file: $pattern" && exit 1
fi
done