release-linux.yml

name: Release (Linux)

on:
  workflow_call:
    inputs:
      version:
        required: true
        type: string
  workflow_dispatch:
    inputs:
      version:
        description: "Version to use (e.g. 2.1.0). Defaults to 2.0.0-dev"
        required: false
        default: "2.0.0-dev"

permissions:
  contents: read

jobs:
  build-linux:
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    name: Build Linux (AppImage, deb, rpm)

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.ref_name }}

      - name: Resolve version
        id: get_version
        run: |
          VERSION="${{ inputs.version }}"

          IS_PRERELEASE="false"
          if [[ "$VERSION" == *-* ]]; then
            IS_PRERELEASE="true"
          fi

          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
          echo "IS_PRERELEASE=$IS_PRERELEASE" >> "$GITHUB_OUTPUT"
          echo "Version: $VERSION  PreRelease: $IS_PRERELEASE"

      - uses: subosito/flutter-action@v2
        with:
          channel: stable
          cache: true

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: ~/.pub-cache
          key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.yaml') }}
          restore-keys: ${{ runner.os }}-pub-

      - name: Install Linux build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            clang \
            cmake \
            desktop-file-utils \
            libayatana-appindicator3-dev \
            libfuse2 \
            libgtk-3-dev \
            libkeybinder-3.0-dev \
            liblzma-dev \
            libx11-dev \
            libxtst-dev \
            lld-14 \
            ninja-build \
            patchelf \
            pkg-config \
            rpm

      - name: Verify Linux toolchain preflight
        run: |
          set -euo pipefail
          test -x /usr/lib/llvm-14/bin/ld.lld || test -x /usr/bin/ld.lld-14 || test -x /usr/bin/ld.lld
          pkg-config --modversion gtk+-3.0
          pkg-config --modversion keybinder-3.0
          pkg-config --modversion ayatana-appindicator3-0.1
          pkg-config --modversion x11
          pkg-config --modversion xtst

      - name: Install Fastforge
        run: dart pub global activate fastforge

      - name: Install appimagetool
        run: |
          wget -qO /usr/local/bin/appimagetool \
            "https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage"
          chmod +x /usr/local/bin/appimagetool

      - name: Install Melos
        run: dart pub global activate melos

      - name: Get dependencies
        run: melos bootstrap

      - name: Update pubspec version from tag
        run: |
          VERSION="${{ steps.get_version.outputs.VERSION }}"
          sed -i "s/^version:.*/version: $VERSION/" app/pubspec.yaml
          echo "Updated pubspec.yaml version to: $VERSION"

      - name: Package AppImage
        env:
          APPIMAGE_EXTRACT_AND_RUN: "1"
        run: |
          cd app
          fastforge package \
            --platform linux \
            --targets appimage \
            --build-dart-define "APP_VERSION=${{ steps.get_version.outputs.VERSION }}"

      - name: Rename AppImage
        run: |
          VERSION="${{ steps.get_version.outputs.VERSION }}"
          APPIMAGE=$(find app/dist app/build -type f -name "*.AppImage" 2>/dev/null | head -n 1)
          if [[ -z "$APPIMAGE" ]]; then
            echo "::error::No AppImage generated"
            exit 1
          fi
          mkdir -p app/dist
          DEST="app/dist/CopyPaste_${VERSION}_x86_64.AppImage"
          mv "$APPIMAGE" "$DEST"
          chmod +x "$DEST"
          echo "Renamed to: $(basename "$DEST")"

      - name: Repack AppImage with AppImageUpdate metadata
        if: env.STORE_BUILD != 'true'
        env:
          APPIMAGE_EXTRACT_AND_RUN: "1"
        run: |
          set -euo pipefail
          VERSION="${{ steps.get_version.outputs.VERSION }}"
          APPIMAGE="$GITHUB_WORKSPACE/app/dist/CopyPaste_${VERSION}_x86_64.AppImage"
          BASENAME="$(basename "$APPIMAGE")"
          WORK="$(mktemp -d)"
          (cd "$WORK" && "$APPIMAGE" --appimage-extract >/dev/null)
          UPDATE_INFO="gh-releases-zsync|rgdevment|CopyPaste|latest|CopyPaste_*_x86_64.AppImage.zsync"
          (
            cd "$WORK"
            ARCH=x86_64 appimagetool \
              --updateinformation "$UPDATE_INFO" \
              squashfs-root \
              "$BASENAME"
          )
          mv "$WORK/$BASENAME" "$APPIMAGE"
          mv "$WORK/${BASENAME}.zsync" "$GITHUB_WORKSPACE/app/dist/${BASENAME}.zsync"
          chmod +x "$APPIMAGE"
          echo "Embedded update info: $UPDATE_INFO"
          ls -la "$GITHUB_WORKSPACE/app/dist/${BASENAME}.zsync"

      - name: Package deb
        run: |
          cd app
          fastforge package \
            --platform linux \
            --targets deb \
            --build-dart-define "APP_VERSION=${{ steps.get_version.outputs.VERSION }}" \
            --skip-clean

      - name: Rename deb
        run: |
          VERSION="${{ steps.get_version.outputs.VERSION }}"
          DEB=$(find app/dist app/build -type f -name "*.deb" 2>/dev/null | head -n 1)
          if [[ -z "$DEB" ]]; then
            echo "::error::No deb package generated"
            exit 1
          fi
          mkdir -p app/dist
          DEST="app/dist/CopyPaste_${VERSION}_amd64.deb"
          mv "$DEB" "$DEST"
          echo "Renamed to: $(basename "$DEST")"

      - name: Normalize version for RPM
        id: rpm_version
        run: |
          VERSION="${{ steps.get_version.outputs.VERSION }}"
          RPM_VERSION="${VERSION%%-*}"
          echo "RPM_VERSION=$RPM_VERSION" >> "$GITHUB_OUTPUT"
          echo "RPM version (normalized): $RPM_VERSION"

      - name: Package rpm
        run: |
          RPM_VERSION="${{ steps.rpm_version.outputs.RPM_VERSION }}"
          cd app
          sed -i "s/^version:.*/version: $RPM_VERSION/" pubspec.yaml
          fastforge package \
            --platform linux \
            --targets rpm \
            --build-dart-define "APP_VERSION=${{ steps.get_version.outputs.VERSION }}" \
            --skip-clean
          VERSION="${{ steps.get_version.outputs.VERSION }}"
          sed -i "s/^version:.*/version: $VERSION/" pubspec.yaml

      - name: Rename rpm
        run: |
          VERSION="${{ steps.get_version.outputs.VERSION }}"
          RPM=$(find app/dist app/build -type f -name "*.rpm" 2>/dev/null | head -n 1)
          if [[ -z "$RPM" ]]; then
            echo "::error::No rpm package generated"
            exit 1
          fi
          mkdir -p app/dist
          DEST="app/dist/CopyPaste_${VERSION}_x86_64.rpm"
          mv "$RPM" "$DEST"
          echo "Renamed to: $(basename "$DEST")"

      - name: Validate bundled .desktop file
        run: |
          set -euo pipefail
          VERSION="${{ steps.get_version.outputs.VERSION }}"
          APPIMAGE="app/dist/CopyPaste_${VERSION}_x86_64.AppImage"
          WORKDIR="$(mktemp -d)"
          (cd "$WORKDIR" && "$GITHUB_WORKSPACE/$APPIMAGE" --appimage-extract '*.desktop' >/dev/null)
          DESKTOP=$(find "$WORKDIR/squashfs-root" -maxdepth 2 -name '*.desktop' | head -n 1)
          if [[ -z "$DESKTOP" ]]; then
            echo "::error::No .desktop file inside AppImage"
            exit 1
          fi
          desktop-file-validate "$DESKTOP"
          echo "✓ desktop-file-validate passed"

      - name: Build portable tarball for OBS
        run: |
          set -euo pipefail
          VERSION="${{ steps.get_version.outputs.VERSION }}"
          BUNDLE="app/build/linux/x64/release/bundle"
          if [[ ! -d "$BUNDLE" ]]; then
            echo "::error::Flutter bundle not found at $BUNDLE"
            exit 1
          fi
          STAGE="$(mktemp -d)/CopyPaste-${VERSION}-linux-x64"
          mkdir -p "$STAGE/bundle" "$STAGE/packaging"
          cp -a "$BUNDLE"/. "$STAGE/bundle/"
          cp LICENSE "$STAGE/LICENSE"
          cp app/assets/icons/icon_app_256.png "$STAGE/packaging/icon_app_256.png"
          APPIMAGE="$GITHUB_WORKSPACE/app/dist/CopyPaste_${VERSION}_x86_64.AppImage"
          EXTRACT="$(mktemp -d)"
          (cd "$EXTRACT" && "$APPIMAGE" --appimage-extract '*.desktop' >/dev/null)
          DESKTOP=$(find "$EXTRACT/squashfs-root" -maxdepth 2 -name '*.desktop' | head -n 1)
          cp "$DESKTOP" "$STAGE/packaging/com.rgdevment.copypaste.desktop"
          tar -czf "app/dist/CopyPaste-${VERSION}-linux-x64.tar.gz" \
            -C "$(dirname "$STAGE")" "$(basename "$STAGE")"
          ls -la "app/dist/CopyPaste-${VERSION}-linux-x64.tar.gz"

      - name: Compute SHA-256 checksums
        run: |
          cd app/dist
          sha256sum *.AppImage *.AppImage.zsync *.deb *.rpm *.tar.gz > SHA256SUMS 2>/dev/null || \
            sha256sum *.AppImage *.deb *.rpm *.tar.gz > SHA256SUMS
          cat SHA256SUMS

      - name: Publish deb to Cloudsmith
        if: github.event_name == 'push'
        env:
          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
        run: |
          pip install cloudsmith-cli
          cloudsmith push deb rgdevment/copypaste/any-distro/any-version \
            app/dist/CopyPaste_${{ steps.get_version.outputs.VERSION }}_amd64.deb --republish

      - name: Publish rpm to Cloudsmith
        if: github.event_name == 'push'
        env:
          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
        run: |
          cloudsmith push rpm rgdevment/copypaste/any-distro/any-version \
            app/dist/CopyPaste_${{ steps.get_version.outputs.VERSION }}_x86_64.rpm --republish

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: release-linux
          path: |
            app/dist/*.AppImage
            app/dist/*.AppImage.zsync
            app/dist/*.deb
            app/dist/*.rpm
            app/dist/*.tar.gz
            app/dist/SHA256SUMS
          retention-days: 5

  publish-obs:
    runs-on: ubuntu-22.04
    needs: build-linux
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    timeout-minutes: 15
    name: Publish to OpenSUSE Build Service

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.ref_name }}

      - name: Download Linux artifacts
        uses: actions/download-artifact@v6
        with:
          name: release-linux
          path: linux-artifacts

      - name: Resolve version
        id: get_version
        run: |
          VERSION="${{ inputs.version }}"
          DATE_RFC="$(date -R)"
          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
          echo "DATE_RFC=$DATE_RFC" >> "$GITHUB_OUTPUT"

      - name: Install osc
        run: |
          sudo apt-get update
          sudo apt-get install -y osc

      - name: Configure osc credentials
        env:
          OBS_USERNAME: ${{ secrets.OBS_USERNAME }}
          OBS_PASSWORD: ${{ secrets.OBS_PASSWORD }}
        run: |
          if [[ -z "$OBS_USERNAME" || -z "$OBS_PASSWORD" ]]; then
            echo "::warning::OBS credentials missing — skipping OBS publish"
            echo "SKIP=true" >> "$GITHUB_ENV"
            exit 0
          fi
          mkdir -p ~/.config/osc
          cat > ~/.config/osc/oscrc <<EOF
          [general]
          apiurl = https://api.opensuse.org
          [https://api.opensuse.org]
          user = $OBS_USERNAME
          pass = $OBS_PASSWORD
          EOF
          chmod 600 ~/.config/osc/oscrc

      - name: Render and submit package to OBS
        if: env.SKIP != 'true'
        env:
          VERSION: ${{ steps.get_version.outputs.VERSION }}
          DATE_RFC: ${{ steps.get_version.outputs.DATE_RFC }}
        run: |
          set -euo pipefail
          WORK="$(mktemp -d)"
          cd "$WORK"
          osc checkout home:rgdevment copypaste
          OBS_DIR="home:rgdevment/copypaste"
          rm -f "$OBS_DIR"/_service "$OBS_DIR"/copypaste.spec "$OBS_DIR"/copypaste.dsc "$OBS_DIR"/copypaste-rpmlintrc "$OBS_DIR"/debian.* "$OBS_DIR"/CopyPaste-*.tar.gz 2>/dev/null || true
          STAGE="$(mktemp -d)"
          cp -a "$GITHUB_WORKSPACE/packaging/obs/." "$STAGE/"
          find "$STAGE" -type f \( -name '*.spec' -o -name '*.dsc' -o -name 'rules' -o -name 'control' -o -name 'changelog' -o -name 'compat' -o -name 'copyright' -o -name 'format' \) \
            -exec sed -i 's/\r$//' {} +
          find "$STAGE" -type f \( -name '*.spec' -o -name '*.dsc' -o -name 'changelog' \) \
            -exec sed -i "s/@VERSION@/$VERSION/g; s/Thu, 23 Apr 2026 00:00:00 +0000/$DATE_RFC/g" {} +
          TARBALL="CopyPaste-${VERSION}-linux-x64.tar.gz"
          if [[ ! -f "$GITHUB_WORKSPACE/linux-artifacts/$TARBALL" ]]; then
            echo "::error::Tarball not found in artifacts: $TARBALL"
            ls -la "$GITHUB_WORKSPACE/linux-artifacts/" || true
            exit 1
          fi
          cp "$GITHUB_WORKSPACE/linux-artifacts/$TARBALL" "$STAGE/$TARBALL"
          cp "$STAGE/copypaste.spec" "$OBS_DIR/copypaste.spec"
          cp "$STAGE/copypaste.dsc" "$OBS_DIR/copypaste.dsc"
          cp "$STAGE/copypaste-rpmlintrc" "$OBS_DIR/copypaste-rpmlintrc"
          cp "$STAGE/$TARBALL" "$OBS_DIR/$TARBALL"
          tar --force-local -C "$STAGE" -cJf "$OBS_DIR/debian.tar.xz" debian
          cd "$OBS_DIR"
          osc addremove
          osc commit -m "Release v$VERSION (automated from GitHub Actions)"