linux-build.yml

name: Linux Build

on:
  push:
    branches:
      - Testing
      - testing
  pull_request:
    branches:
      - Testing
      - testing
  workflow_dispatch:
    inputs:
      ref:
        description: Git ref to build and scan
        required: false
        type: string
        default: ''
  workflow_call:
    inputs:
      ref:
        description: Git ref to build
        required: false
        type: string
        default: ''
    outputs:
      hash:
        description: SHA256 hash of the AppImage
        value: ${{ jobs.build-linux.outputs.hash }}
      vt_url:
        description: VirusTotal URL for the AppImage
        value: ${{ jobs.build-linux.outputs.vt_url }}
      artifact_name:
        description: Name of the produced artifact
        value: ${{ jobs.build-linux.outputs.artifact_name }}

permissions:
  contents: read

jobs:
  build-linux:
    name: Build Linux Electron AppImage
    runs-on: ubuntu-latest
    outputs:
      hash: ${{ steps.compute_hash.outputs.hash }}
      vt_url: ${{ steps.compute_hash.outputs.vt_url }}
      artifact_name: PatchOpsIII-linux
    defaults:
      run:
        shell: bash
        working-directory: .
    env:
      BUN_VERSION: "1.3.13"
      ELECTRON_VERSION: "31.7.7"
      ELECTRON_BUILDER_VERSION: "26.8.1"
      PYTHON_VERSION: "3.12"
      APPIMAGE_PATH: dist/packages/PatchOpsIII.AppImage
      ZSYNC_PATH: dist/packages/PatchOpsIII.AppImage.zsync
      CSC_IDENTITY_AUTO_DISCOVERY: "false"
      VT_API_KEY: ${{ secrets.VT_API_KEY }}
      VT_CLI_ARCHIVE: vt-cli.zip
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref != '' && inputs.ref || github.ref }}
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: requirements.txt
      - name: Cache Bun install cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: linux-bun-${{ runner.arch }}-${{ env.BUN_VERSION }}-${{ hashFiles('bun.lock', 'package.json') }}
          restore-keys: |
            linux-bun-${{ runner.arch }}-${{ env.BUN_VERSION }}-
      - name: Cache Electron downloads
        uses: actions/cache@v4
        with:
          path: ~/.cache/electron
          key: linux-electron-${{ runner.arch }}-${{ env.ELECTRON_VERSION }}
          restore-keys: |
            linux-electron-${{ runner.arch }}-
      - name: Cache electron-builder downloads
        uses: actions/cache@v4
        with:
          path: ~/.cache/electron-builder
          key: linux-electron-builder-${{ runner.arch }}-${{ env.ELECTRON_BUILDER_VERSION }}-${{ env.ELECTRON_VERSION }}
          restore-keys: |
            linux-electron-builder-${{ runner.arch }}-${{ env.ELECTRON_BUILDER_VERSION }}-
            linux-electron-builder-${{ runner.arch }}-
      - name: Cache Python virtual environment
        uses: actions/cache@v4
        with:
          path: .venv
          key: linux-venv-${{ runner.arch }}-${{ env.PYTHON_VERSION }}-${{ hashFiles('requirements.txt') }}
          restore-keys: |
            linux-venv-${{ runner.arch }}-${{ env.PYTHON_VERSION }}-
      - name: Install Linux packaging prerequisites
        run: |
          sudo apt-get update
          sudo apt-get install -y binutils unzip zsync
      - name: Install Python backend dependencies
        run: |
          python -m venv .venv
          .venv/bin/python -m pip install -U pip
          .venv/bin/python -m pip install -r requirements.txt
          .venv/bin/python -m pip install -U pyinstaller
      - name: Install Electron dependencies
        run: bun install --frozen-lockfile
      - name: Build Electron AppImage
        run: bun run dist:linux
      - name: Generate AppImage zsync metadata
        run: |
          if [ ! -f "$APPIMAGE_PATH" ]; then
            find dist -maxdepth 4 -type f -print
            echo "$APPIMAGE_PATH was not produced" >&2
            exit 1
          fi
          chmod +x "$APPIMAGE_PATH"
          appimage_name="$(basename "$APPIMAGE_PATH")"
          appimage_dir="$(dirname "$APPIMAGE_PATH")"
          (
            cd "$appimage_dir"
            zsyncmake -u "$appimage_name" -o "$appimage_name.zsync" "$appimage_name"
          )
      - name: Compute AppImage hash
        id: compute_hash
        run: |
          hash=$(sha256sum "$APPIMAGE_PATH" | cut -d ' ' -f1)
          printf "%s\n" "$hash" > "dist/packages/hash.log"
          vt_url="https://www.virustotal.com/gui/file/$hash"
          printf "hash=%s\n" "$hash" >> "$GITHUB_OUTPUT"
          printf "vt_url=%s\n" "$vt_url" >> "$GITHUB_OUTPUT"
      - name: Determine VirusTotal CLI release
        id: vt_release
        if: ${{ env.VT_API_KEY != '' }}
        run: |
          set -euo pipefail
          python <<'PY'
          import json
          import os
          import urllib.request

          url = "https://api.github.com/repos/VirusTotal/vt-cli/releases/latest"
          with urllib.request.urlopen(url) as response:
              data = json.load(response)

          tag = data.get("tag_name")
          if not tag:
              raise SystemExit("Release tag missing from VirusTotal CLI metadata")

          try:
              asset_url = next(
                  asset["browser_download_url"]
                  for asset in data["assets"]
                  if asset["name"] == "Linux64.zip"
              )
          except StopIteration as exc:
              raise SystemExit("Linux64.zip asset not found in VirusTotal CLI release metadata") from exc

          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as handle:
              handle.write(f"tag={tag}\n")
              handle.write(f"url={asset_url}\n")
          PY
      - name: Cache VirusTotal CLI
        id: cache-vt
        if: ${{ env.VT_API_KEY != '' }}
        uses: actions/cache@v4
        with:
          path: |
            vt
            ${{ env.VT_CLI_ARCHIVE }}
          key: vt-${{ runner.os }}-${{ steps.vt_release.outputs.tag }}
      - name: Download VirusTotal CLI
        if: ${{ env.VT_API_KEY != '' && steps.cache-vt.outputs.cache-hit != 'true' }}
        run: |
          set -euo pipefail
          curl -sSL "${{ steps.vt_release.outputs.url }}" -o "$VT_CLI_ARCHIVE"
          unzip -q -o "$VT_CLI_ARCHIVE"
      - name: Ensure VirusTotal CLI executable
        if: ${{ env.VT_API_KEY != '' }}
        run: |
          if [ ! -f vt ]; then
            echo 'VirusTotal CLI binary not found' >&2
            exit 1
          fi
          chmod +x vt
      - name: VirusTotal scan
        if: ${{ env.VT_API_KEY != '' }}
        run: ./vt scan file "$APPIMAGE_PATH" --apikey "$VT_API_KEY"
      - name: Upload Linux artifact
        uses: actions/upload-artifact@v4
        with:
          name: PatchOpsIII-linux
          path: |
            dist/packages/PatchOpsIII.AppImage
            dist/packages/PatchOpsIII.AppImage.zsync
            dist/packages/hash.log
          if-no-files-found: error