VoiceStudio/.github/workflows/snap-store.yml at main · debpalash/VoiceStudio · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
name: Snap Store package rehearsal

# Build-only until the owner reserves the Snap name and supplies scoped store
# credentials. This workflow cannot upload or release a store revision.
on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: snap-store-rehearsal-${{ github.ref }}
  cancel-in-progress: true

jobs:
  package:
    runs-on: ubuntu-24.04
    timeout-minutes: 75
    env:
      VOICESTUDIO_DISTRIBUTION: snap-store
      VOICESTUDIO_RUST_TARGET: x86_64-unknown-linux-gnu
      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '22'
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: '1.4.2'
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          targets: x86_64-unknown-linux-gnu
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          workspaces: native/desktop-bridge -> target
          key: electron-snap-x86_64-unknown-linux-gnu
      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
        with:
          version: '0.12.13'
          enable-cache: false
      - name: Install native build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libasound2-dev libxdo-dev libxtst-dev libx11-dev libxkbcommon-dev libwayland-dev libssl-dev pkg-config squashfs-tools
      - name: Bundle pinned uv
        run: |
          node --input-type=module <<'NODE'
          import { execFileSync } from 'node:child_process';
          import { chmodSync, copyFileSync, mkdirSync } from 'node:fs';
          import { join } from 'node:path';
          const source = execFileSync('which', ['uv'], { encoding: 'utf8' }).trim();
          const dir = 'electron/build/uv';
          mkdirSync(dir, { recursive: true });
          const destination = join(dir, 'uv-x86_64-unknown-linux-gnu');
          copyFileSync(source, destination);
          chmodSync(destination, 0o755);
          NODE
      - name: Install locked dependencies
        run: bun install --frozen-lockfile
      - name: Validate Snap policy and Electron
        run: |
          node scripts/validate_store_foundation.mjs --distribution=snap-store
          bun run --cwd electron typecheck
          bun run --cwd electron test
          bun run --cwd electron build
          bun run --cwd electron build:web
          node electron/tests/packaging-contract.mjs
      - name: Package without publishing
        working-directory: electron
        run: |
          bun x electron-builder --config electron-builder.config.mjs --linux snap --x64 --publish never
          node tests/packaging-contract.mjs --artifact
          node ../scripts/verify_snap_artifact.mjs
          node ../scripts/create_store_artifact_manifest.mjs --distribution=snap-store --platform=linux --arch=x64
          node ../scripts/create_snap_store_assets.mjs
          node --input-type=module <<'NODE'
          import { readdirSync, readFileSync } from 'node:fs';
          const files = readdirSync('release');
          const snaps = files.filter((name) => name.endsWith('.snap'));
          if (snaps.length !== 1) throw new Error(`Expected one Snap artifact, found: ${snaps}`);
          if (files.some((name) => /^electron-.*\.yml$/.test(name))) {
            throw new Error('A store-owned Snap must not emit application updater metadata');
          }
          const manifest = JSON.parse(
            readFileSync('release/store-artifact-manifest-linux-x64.json', 'utf8'),
          );
          if (manifest.distribution.target !== 'snap-store') throw new Error('Wrong distribution');
          if (manifest.distribution.applicationUpdates !== 'store') throw new Error('Wrong updater');
          if (!manifest.artifacts.some((artifact) => artifact.file === snaps[0])) {
            throw new Error('Snap artifact is missing from the provenance manifest');
          }
          NODE
      - name: Save Snap and provenance for review
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: snap-store-rehearsal-linux-x64
          retention-days: 14
          if-no-files-found: error
          path: |
            electron/release/*.snap
            electron/release/VoiceStudio-Electron-*-snap-verification.json
            electron/release/store-artifact-manifest-linux-x64.json
            electron/release/snap-store-assets/