chore(release): bump version to 2.25.7 #109
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| pages: write | |
| id-token: write | |
| env: | |
| # Optional repo secret RELEASE_TOKEN (classic PAT with repo/contents write). | |
| # Falls back to the automatic GITHUB_TOKEN — same pattern as Typepad. | |
| RELEASE_GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }} | |
| jobs: | |
| create-release: | |
| name: Create draft release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| outputs: | |
| release_id: ${{ steps.release.outputs.id }} | |
| tag: ${{ steps.meta.outputs.tag }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Resolve release tag | |
| id: meta | |
| run: | | |
| if [ "${{ github.ref_type }}" = "tag" ]; then | |
| echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT" | |
| else | |
| VERSION=$(node -p "require('./package.json').version") | |
| echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Ensure draft release | |
| id: release | |
| env: | |
| GH_TOKEN: ${{ env.RELEASE_GITHUB_TOKEN }} | |
| run: | | |
| TAG="${{ steps.meta.outputs.tag }}" | |
| if gh release view "$TAG" >/dev/null 2>&1; then | |
| echo "Using existing release $TAG" | |
| else | |
| gh release create "$TAG" \ | |
| --draft \ | |
| --title "Zync $TAG" \ | |
| --notes "See the assets to download this version and install." | |
| fi | |
| ID=$(gh release view "$TAG" --json databaseId --jq .databaseId) | |
| echo "id=$ID" >> "$GITHUB_OUTPUT" | |
| release: | |
| name: Build (${{ matrix.platform }}) | |
| needs: create-release | |
| permissions: | |
| contents: write | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 1 | |
| matrix: | |
| platform: [ubuntu-22.04, windows-latest, macos-latest] | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install dependencies (Ubuntu) | |
| if: matrix.platform == 'ubuntu-22.04' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev | |
| - name: Rust setup | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }} | |
| - name: Node.js setup | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| cache-dependency-path: 'package-lock.json' | |
| - name: Install frontend dependencies | |
| run: npm ci --legacy-peer-deps | |
| - name: Build the app | |
| uses: tauri-apps/tauri-action@v0 | |
| env: | |
| GITHUB_TOKEN: ${{ env.RELEASE_GITHUB_TOKEN }} | |
| GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }} | |
| GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| with: | |
| releaseId: ${{ needs.create-release.outputs.release_id }} | |
| tagName: ${{ needs.create-release.outputs.tag }} | |
| releaseName: "Zync ${{ needs.create-release.outputs.tag }}" | |
| releaseBody: "See the assets to download this version and install." | |
| releaseDraft: true | |
| prerelease: false | |
| # AppImage from ubuntu-22.04 bundles libwayland-* which breaks newer Mesa | |
| # (Arch/Manjaro Wayland → EGL_BAD_PARAMETER). Strip, repack, re-sign, refresh latest.json. | |
| fix-appimage: | |
| name: Fix AppImage Wayland libs | |
| needs: [create-release, release] | |
| # Still run if a later matrix leg failed — Linux artifacts are usually already uploaded. | |
| if: ${{ always() && needs.create-release.result == 'success' && needs.release.result != 'cancelled' }} | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Resolve version | |
| id: meta | |
| run: | | |
| TAG="${{ needs.create-release.outputs.tag }}" | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "version=${TAG#v}" >> "$GITHUB_OUTPUT" | |
| - name: Download AppImage + latest.json | |
| env: | |
| GH_TOKEN: ${{ env.RELEASE_GITHUB_TOKEN }} | |
| run: | | |
| mkdir -p /tmp/appimage-fix | |
| cd /tmp/appimage-fix | |
| gh release download "${{ steps.meta.outputs.tag }}" \ | |
| -p "zync_${{ steps.meta.outputs.version }}_amd64.AppImage" \ | |
| -p "latest.json" \ | |
| -R "${{ github.repository }}" | |
| - name: Strip bundled Wayland libs and repack | |
| run: | | |
| chmod +x scripts/ci/fix-appimage-wayland.sh | |
| scripts/ci/fix-appimage-wayland.sh \ | |
| "/tmp/appimage-fix/zync_${{ steps.meta.outputs.version }}_amd64.AppImage" \ | |
| "/tmp/appimage-fix/zync_${{ steps.meta.outputs.version }}_amd64.AppImage" | |
| - name: Re-sign AppImage for updater | |
| env: | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| run: | | |
| npx --yes @tauri-apps/cli@2 signer sign \ | |
| "/tmp/appimage-fix/zync_${{ steps.meta.outputs.version }}_amd64.AppImage" | |
| - name: Patch latest.json AppImage signatures | |
| run: | | |
| chmod +x scripts/ci/update-latest-json-appimage-sig.sh | |
| scripts/ci/update-latest-json-appimage-sig.sh \ | |
| /tmp/appimage-fix/latest.json \ | |
| "/tmp/appimage-fix/zync_${{ steps.meta.outputs.version }}_amd64.AppImage.sig" | |
| - name: Upload fixed AppImage assets | |
| env: | |
| GH_TOKEN: ${{ env.RELEASE_GITHUB_TOKEN }} | |
| run: | | |
| cd /tmp/appimage-fix | |
| gh release upload "${{ steps.meta.outputs.tag }}" \ | |
| "zync_${{ steps.meta.outputs.version }}_amd64.AppImage" \ | |
| "zync_${{ steps.meta.outputs.version }}_amd64.AppImage.sig" \ | |
| latest.json \ | |
| -R "${{ github.repository }}" \ | |
| --clobber | |
| arch-pkg: | |
| name: Build Arch .pkg.tar.zst | |
| needs: [create-release, release] | |
| if: ${{ always() && needs.create-release.result == 'success' && needs.release.result != 'cancelled' }} | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # Same pattern as apt-repo: authenticated gh download (draft assets are not public). | |
| - name: Download .deb from release | |
| env: | |
| GH_TOKEN: ${{ env.RELEASE_GITHUB_TOKEN }} | |
| run: | | |
| mkdir -p /tmp/archdebs | |
| gh release download "${{ needs.create-release.outputs.tag }}" \ | |
| -p "*.deb" \ | |
| -D /tmp/archdebs/ | |
| ls -la /tmp/archdebs | |
| - name: Build package from release .deb | |
| env: | |
| GH_TOKEN: ${{ env.RELEASE_GITHUB_TOKEN }} | |
| run: | | |
| chmod +x scripts/ci/build-arch-pkg.sh | |
| scripts/ci/build-arch-pkg.sh \ | |
| "${{ needs.create-release.outputs.tag }}" \ | |
| "$PWD/arch-dist" \ | |
| /tmp/archdebs | |
| - name: Upload Arch package to release | |
| env: | |
| GH_TOKEN: ${{ env.RELEASE_GITHUB_TOKEN }} | |
| run: | | |
| gh release upload "${{ needs.create-release.outputs.tag }}" \ | |
| arch-dist/*.pkg.tar.zst \ | |
| -R "${{ github.repository }}" \ | |
| --clobber | |
| apt-repo: | |
| needs: [create-release, release] | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: write | |
| pages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout gh-pages branch | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: gh-pages | |
| fetch-depth: 0 | |
| - name: Install reprepro & gnupg | |
| run: sudo apt-get install -y reprepro gnupg | |
| - name: Import GPG private key | |
| run: | | |
| echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import | |
| - name: Resolve version | |
| id: version | |
| run: | | |
| TAG="${{ needs.create-release.outputs.tag }}" | |
| echo "VERSION=${TAG#v}" >> "$GITHUB_OUTPUT" | |
| - name: Download .deb from release | |
| env: | |
| GH_TOKEN: ${{ env.RELEASE_GITHUB_TOKEN }} | |
| run: | | |
| mkdir -p /tmp/debs | |
| gh release download ${{ needs.create-release.outputs.tag }} -p "*.deb" -D /tmp/debs/ | |
| - name: Setup reprepro config | |
| run: | | |
| mkdir -p conf | |
| cat > conf/distributions <<EOF | |
| Origin: Zync | |
| Label: Zync | |
| Codename: stable | |
| Architectures: amd64 | |
| Components: main | |
| Description: Zync SSH Client | |
| SignWith: releases@zync.thesudoer.in | |
| EOF | |
| cat > conf/options <<EOF | |
| ask-passphrase | |
| EOF | |
| cat > conf/uploaders <<EOF | |
| allow * by anyone | |
| EOF | |
| - name: Add .deb to repo | |
| run: reprepro -S utils -P optional includedeb stable /tmp/debs/*.deb | |
| - name: Export public GPG key | |
| run: gpg --armor --export releases@zync.thesudoer.in > key.gpg | |
| - name: Commit and push | |
| run: | | |
| git config user.name "github-actions" | |
| git config user.email "actions@github.com" | |
| git add . | |
| git commit -m "APT repo update: ${{ needs.create-release.outputs.tag }}" | |
| git push | |
| # Publishes signed packages to zync-sh/zync-arch (Pages + arch.zync.thesudoer.in). | |
| # Requires RELEASE_TOKEN (push to zync-arch) and GPG_PRIVATE_KEY (same APT packaging key). | |
| pacman-repo: | |
| name: Publish pacman repo (zync-arch) | |
| needs: [create-release, arch-pkg] | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout zync (CI scripts) | |
| uses: actions/checkout@v4 | |
| - name: Download Arch package from release | |
| env: | |
| GH_TOKEN: ${{ env.RELEASE_GITHUB_TOKEN }} | |
| run: | | |
| mkdir -p /tmp/archpkgs | |
| gh release download "${{ needs.create-release.outputs.tag }}" \ | |
| -p "*.pkg.tar.zst" \ | |
| -D /tmp/archpkgs \ | |
| -R "${{ github.repository }}" | |
| ls -la /tmp/archpkgs | |
| - name: Checkout zync-arch gh-pages | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: zync-sh/zync-arch | |
| ref: gh-pages | |
| fetch-depth: 0 | |
| token: ${{ secrets.RELEASE_TOKEN }} | |
| path: zync-arch-pages | |
| - name: Import packaging GPG key | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update | |
| sudo apt-get install -y gnupg | |
| echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import | |
| gpg --list-secret-keys --keyid-format LONG | |
| - name: Sign packages and rebuild pacman DB | |
| run: | | |
| chmod +x scripts/ci/publish-arch-repo.sh | |
| scripts/ci/publish-arch-repo.sh "$PWD/zync-arch-pages" /tmp/archpkgs | |
| - name: Commit and push to zync-arch | |
| working-directory: zync-arch-pages | |
| run: | | |
| git config user.name "github-actions" | |
| git config user.email "actions@github.com" | |
| git add CNAME key.gpg x86_64 | |
| if git diff --staged --quiet; then | |
| echo "No pacman repo changes" | |
| else | |
| git commit -m "Pacman repo update: ${{ needs.create-release.outputs.tag }}" | |
| git push | |
| fi |