Add manual Agent project ordering #293
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Desktop App PR Build | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| branches: [master] | |
| jobs: | |
| build-macos: | |
| runs-on: macos-26-xlarge | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| # Xcode 26.5 is temporarily exposed as a beta app on macos-26 runners: https://github.com/actions/runner-images/issues/14108 | |
| - name: Select Xcode 26.5 | |
| run: | | |
| set -euo pipefail | |
| for xcode_app in \ | |
| /Applications/Xcode_26.5.0.app \ | |
| /Applications/Xcode_26.5_beta_2.app \ | |
| /Applications/Xcode_26.5_beta.app | |
| do | |
| if [ -x "${xcode_app}/Contents/Developer/usr/bin/xcodebuild" ]; then | |
| sudo xcode-select -s "${xcode_app}/Contents/Developer" | |
| xcodebuild -version | |
| exit 0 | |
| fi | |
| done | |
| echo "Xcode 26.5 is not installed on this runner." >&2 | |
| ls -1 /Applications/Xcode*.app >&2 || true | |
| exit 1 | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22 | |
| with: | |
| github-token: "" | |
| - name: Cache sccache | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: ~/Library/Caches/Mozilla.sccache | |
| key: ${{ runner.os }}-sccache-macos-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-sccache-macos- | |
| ${{ runner.os }}-sccache- | |
| - name: Build Tauri App (macOS, unsigned) | |
| run: nix develop .#ci -c ./scripts/ci/desktop-pr.sh | |
| - name: Show sccache stats | |
| if: always() | |
| run: nix develop .#ci -c sccache --show-stats | |
| - name: Upload macOS PR Build | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 | |
| with: | |
| name: maple-macos-universal-pr | |
| path: | | |
| frontend/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg | |
| frontend/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app | |
| frontend/src-tauri/target/reproducibility/maple-macos-app.tar.gz | |
| frontend/src-tauri/target/reproducibility/desktop-pr-macos-*.sha256 | |
| retention-days: 5 | |
| build-linux: | |
| runs-on: ubuntu-latest-8-cores | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22 | |
| with: | |
| github-token: "" | |
| - name: Cache sccache | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: ~/.cache/sccache | |
| key: ${{ runner.os }}-sccache-linux-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-sccache-linux- | |
| ${{ runner.os }}-sccache- | |
| - name: Allow bubblewrap user namespaces | |
| run: | | |
| set -euo pipefail | |
| # Ubuntu 24.04 restricts unprivileged user namespaces by default; linuxdeploy/AppImage | |
| # packaging uses bubblewrap and otherwise fails with "bwrap: setting up uid map: Permission denied". | |
| if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then | |
| sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 | |
| fi | |
| if [ -e /proc/sys/kernel/unprivileged_userns_clone ]; then | |
| sudo sysctl -w kernel.unprivileged_userns_clone=1 | |
| fi | |
| - name: Build Tauri App (Linux, unsigned + fake updater signing) | |
| run: nix develop .#desktop-linux -c ./scripts/ci/desktop-pr.sh | |
| env: | |
| MAPLE_TAURI_FAKE_UPDATER_SIGNING: "1" | |
| - name: Show sccache stats | |
| if: always() | |
| run: nix develop .#desktop-linux -c sccache --show-stats | |
| - name: Upload Linux PR Builds | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 | |
| with: | |
| name: maple-linux-pr | |
| path: | | |
| frontend/src-tauri/target/release/bundle/appimage/*.AppImage | |
| frontend/src-tauri/target/release/bundle/appimage/*.AppImage.sig | |
| frontend/src-tauri/target/release/bundle/deb/*.deb | |
| frontend/src-tauri/target/release/bundle/deb/*.deb.sig | |
| frontend/src-tauri/target/release/bundle/rpm/*.rpm | |
| frontend/src-tauri/target/release/bundle/rpm/*.rpm.sig | |
| frontend/src-tauri/target/reproducibility/desktop-pr-linux-fake-updater.pub | |
| frontend/src-tauri/target/reproducibility/desktop-pr-linux-*.sha256 | |
| retention-days: 5 | |
| build-windows: | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 # was v1 | |
| with: | |
| bun-version: 1.3.5 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # was stable | |
| with: | |
| toolchain: 1.94.1 | |
| - name: Install sccache | |
| shell: bash | |
| run: | | |
| SCCACHE_VERSION=0.8.2 | |
| SCCACHE_SHA256="de5e9f66bb8a6bbdf0e28cb8a086a8d12699af796bf70bcd9dc40d80715bf9b8" | |
| SCCACHE_ARCHIVE="sccache-v${SCCACHE_VERSION}-x86_64-pc-windows-msvc.tar.gz" | |
| SCCACHE_URL="https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/${SCCACHE_ARCHIVE}" | |
| # Run download/verify/extract inside a subshell cd'd to RUNNER_TEMP so | |
| # the archive and target dir are referenced by relative names. MSYS2 tar | |
| # mangles Windows paths like D:\a when given absolute -C/-f arguments | |
| # (even with --force-local); relative paths sidestep that. | |
| ( | |
| cd "$RUNNER_TEMP" | |
| curl --fail --location --show-error --silent "$SCCACHE_URL" --output "$SCCACHE_ARCHIVE" | |
| echo "${SCCACHE_SHA256} ${SCCACHE_ARCHIVE}" | sha256sum --check - | |
| tar xzf "$SCCACHE_ARCHIVE" | |
| ) | |
| SCCACHE_BIN_DIR="$RUNNER_TEMP/sccache-v${SCCACHE_VERSION}-x86_64-pc-windows-msvc" | |
| echo "$SCCACHE_BIN_DIR" >> "$GITHUB_PATH" | |
| "$SCCACHE_BIN_DIR/sccache.exe" --version | |
| - name: Cache sccache | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: ~\AppData\Local\Mozilla\sccache | |
| key: ${{ runner.os }}-sccache-windows-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-sccache-windows- | |
| ${{ runner.os }}-sccache- | |
| - name: Build Tauri App (Windows, unsigned) | |
| shell: bash | |
| run: ./scripts/ci/desktop-windows-pr.sh | |
| - name: Show sccache stats | |
| run: sccache --show-stats | |
| - name: Upload Windows PR Build | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 | |
| with: | |
| name: maple-windows-x64-pr | |
| path: | | |
| frontend/src-tauri/target/release/bundle/nsis/*.exe | |
| frontend/src-tauri/target/release/maple.exe | |
| frontend/src-tauri/resources/windows/*.dll | |
| frontend/src-tauri/target/reproducibility/desktop-pr-windows-*.sha256 | |
| retention-days: 5 | |
| verify-windows-artifacts: | |
| needs: | |
| - build-windows | |
| runs-on: ubuntu-latest-8-cores | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22 | |
| with: | |
| github-token: "" | |
| - name: Download Windows artifacts | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4 | |
| with: | |
| name: maple-windows-x64-pr | |
| path: artifacts | |
| - name: Verify Windows artifact reproducibility proofs | |
| run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts windows |