Centralize Tensamin packages modules and release automation

2026-10-04 19:19:56 +02:00 · 2026-10-04 19:19:56 +02:00 · 123205c97d
commit 123205c97d
parent 423ee32a37
28 changed files with 32292 additions and 10 deletions
--- a/.forgejo/workflows/canary.yml
+++ b/.forgejo/workflows/canary.yml
@ -0,0 +1,85 @@
+name: Canary release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: tensamin-central-releases
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: nixos
+    env:
+      NIX_CONFIG: experimental-features = nix-command flakes
+      FORGEJO_SERVER_URL: ${{ forgejo.server_url }}
+      FORGEJO_REPOSITORY: ${{ forgejo.repository }}
+      FORGEJO_RUN_ID: ${{ forgejo.run_id }}
+      RELEASE_CHANNEL: canary
+      RELEASE_TOKEN: ${{ secrets.TENSAMIN_RELEASE_TOKEN }}
+      FORGEJO_REGISTRY_USER: ${{ vars.FORGEJO_REGISTRY_USER }}
+      IOTA_RELEASE_SIGNING_KEY: ${{ secrets.IOTA_RELEASE_SIGNING_KEY }}
+      IOTA_RELEASE_PUBLIC_KEY: ${{ vars.IOTA_RELEASE_PUBLIC_KEY }}
+      IOTA_RELEASE_SIGNING_KEY_ID: ${{ vars.IOTA_RELEASE_SIGNING_KEY_ID || 'primary' }}
+      IOTA_BASE_VERSION: ${{ vars.IOTA_BASE_VERSION || '0.1.0' }}
+      TENSAMIN_SSH_KNOWN_HOSTS: ${{ vars.TENSAMIN_SSH_KNOWN_HOSTS }}
+      ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+      ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Bootstrap pinned tools and source credentials
+        uses: ./.forgejo/workflows/source-access
+        with:
+          source-key: ${{ secrets.TENSAMIN_SOURCE_SSH_KEY }}
+          known-hosts: ${{ vars.TENSAMIN_SSH_KNOWN_HOSTS }}
+      - name: Set immutable release identity
+        run: |
+          set -euo pipefail
+          printf 'RELEASE_SEQUENCE=%s\nRELEASE_TAG=canary-%s-%s\n' "$(date +%s)" "$(git rev-parse HEAD)" "$FORGEJO_RUN_ID" >> "$GITHUB_ENV"
+      - name: Check central release scripts
+        run: |
+          set -euo pipefail
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command shellcheck scripts/release-build.sh scripts/release-client.sh
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command ruff check scripts/release.py scripts/deploy-release.py
+      - name: Validate and build all central packages and client assets
+        run: |
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command bash scripts/release-build.sh "$RELEASE_CHANNEL" release-out
+      - name: Attempt aarch64 build with available builders
+        run: |
+          set -euo pipefail
+          if ! nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command bash scripts/release-build.sh "$RELEASE_CHANNEL" release-arm aarch64-linux > arm-build.log 2>&1; then
+            printf 'aarch64 unavailable. See the attached arm-build.log.\n' > release-out/aarch64-unavailable.txt
+            cp arm-build.log release-out/
+          else
+            cp release-arm/*linux-aarch64* release-out/
+            cp release-arm/*arm64* release-out/
+            cp release-arm/electron-release-metadata-aarch64.json release-out/
+          fi
+      - name: Sign manifests and validate installer bundles
+        run: |
+          set -euo pipefail
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py sign --channel "$RELEASE_CHANNEL" --tag "$RELEASE_TAG"
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py provenance --channel "$RELEASE_CHANNEL" --tag "$RELEASE_TAG"
+      - name: Preserve combined build artifacts
+        uses: https://data.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: combined-release
+          path: release-out/
+      - name: Stage and verify draft attachments
+        run: |
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py stage --channel "$RELEASE_CHANNEL" --tag "$RELEASE_TAG"
+      - name: Publish canary and update channel pointers
+        run: |
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py publish --channel canary --tag "$RELEASE_TAG"
+      - name: Remove source credentials
+        if: always()
+        run: |
+          if [[ -n ${SSH_AGENT_PID:-} ]]; then kill "$SSH_AGENT_PID"; fi
+          rm -rf "$RUNNER_TEMP/tensamin-source"
--- a/.forgejo/workflows/metadata.yml
+++ b/.forgejo/workflows/metadata.yml
@ -0,0 +1,47 @@
+name: Refresh signed metadata
+
+on:
+  schedule:
+    - cron: '17 4 * * *'
+
+concurrency:
+  group: tensamin-central-releases
+  cancel-in-progress: false
+
+jobs:
+  refresh:
+    runs-on: nixos
+    env:
+      NIX_CONFIG: experimental-features = nix-command flakes
+      FORGEJO_SERVER_URL: ${{ forgejo.server_url }}
+      FORGEJO_REPOSITORY: ${{ forgejo.repository }}
+      FORGEJO_RUN_ID: ${{ forgejo.run_id }}
+      RELEASE_TOKEN: ${{ secrets.TENSAMIN_RELEASE_TOKEN }}
+      IOTA_RELEASE_SIGNING_KEY: ${{ secrets.IOTA_RELEASE_SIGNING_KEY }}
+      IOTA_RELEASE_PUBLIC_KEY: ${{ vars.IOTA_RELEASE_PUBLIC_KEY }}
+      IOTA_RELEASE_SIGNING_KEY_ID: ${{ vars.IOTA_RELEASE_SIGNING_KEY_ID || 'primary' }}
+      IOTA_BASE_VERSION: ${{ vars.IOTA_BASE_VERSION || '0.1.0' }}
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Bootstrap pinned tools and source credentials
+        uses: ./.forgejo/workflows/source-access
+        with:
+          source-key: ${{ secrets.TENSAMIN_SOURCE_SSH_KEY }}
+          known-hosts: ${{ vars.TENSAMIN_SSH_KNOWN_HOSTS }}
+      - name: Refresh signed metadata
+        run: |
+          set -euo pipefail
+          root=$PWD
+          revision=$(git rev-parse HEAD)
+          for channel in stable canary; do
+            git checkout --detach "$revision"
+            nix develop --impure --expr "import $root/scripts/release-env.nix { root = builtins.toPath \"$root\"; }" --command python3 scripts/release.py refresh --channel "$channel" --directory "$RUNNER_TEMP/refresh-$FORGEJO_RUN_ID-$channel"
+          done
+      - name: Remove source credentials
+        if: always()
+        run: |
+          if [[ -n ${SSH_AGENT_PID:-} ]]; then kill "$SSH_AGENT_PID"; fi
+          rm -rf "$RUNNER_TEMP/tensamin-source"
--- a/.forgejo/workflows/source-access/action.yml
+++ b/.forgejo/workflows/source-access/action.yml
@ -0,0 +1,49 @@
+name: Pinned source access
+description: Bootstrap public pinned tools before preparing private Nix source access
+inputs:
+  source-key:
+    description: SSH key with read access to locked sources
+    required: true
+  known-hosts:
+    description: Verified SSH host keys
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Bootstrap tools from the public nixpkgs lock
+      shell: bash
+      run: |
+        set -euo pipefail
+        # Nix interpolation must remain literal for the evaluator.
+        # shellcheck disable=SC2016
+        tools=$(nix build --impure --no-link --print-out-paths --expr '
+          let
+            lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+            source = builtins.fetchTree lock.nodes.${lock.nodes.root.inputs.nixpkgs}.locked;
+            pkgs = import source { system = builtins.currentSystem; };
+          in pkgs.buildEnv {
+            name = "release-bootstrap";
+            paths = with pkgs; [ git openssh python3 bash coreutils ];
+          }')
+        printf '%s/bin\n' "$tools" >> "$GITHUB_PATH"
+    - name: Prepare SSH and checkout fetch credentials
+      shell: bash
+      env:
+        SOURCE_KEY: ${{ inputs.source-key }}
+        KNOWN_HOSTS: ${{ inputs.known-hosts }}
+      run: |
+        set -euo pipefail
+        umask 077
+        home="$RUNNER_TEMP/tensamin-source"
+        mkdir -p "$home/.ssh"
+        printf '%s\n' "$SOURCE_KEY" > "$home/.ssh/key"
+        printf '%s\n' "$KNOWN_HOSTS" > "$home/.ssh/known_hosts"
+        printf 'Host *\n  IdentityFile "%s/.ssh/key"\n  IdentitiesOnly yes\n  StrictHostKeyChecking yes\n  UserKnownHostsFile "%s/.ssh/known_hosts"\n  BatchMode yes\n' "$home" "$home" > "$home/.ssh/config"
+        # An agent also supports Nix versions using libgit2 instead of Git's SSH command.
+        eval "$(ssh-agent -s)"
+        ssh-add "$home/.ssh/key"
+        # The askpass process reads the token when Git invokes it.
+        # shellcheck disable=SC2016
+        printf '#!/bin/sh\ncase "$1" in *Username*) printf "%%s\\n" token;; *) printf "%%s\\n" "$RELEASE_TOKEN";; esac\n' > "$home/askpass"
+        chmod 700 "$home/askpass"
+        printf 'HOME=%s\nGIT_SSH_COMMAND=ssh -F "%s/.ssh/config"\nGIT_ASKPASS=%s/askpass\nGIT_TERMINAL_PROMPT=0\nSSH_AUTH_SOCK=%s\nSSH_AGENT_PID=%s\n' "$home" "$home" "$home" "$SSH_AUTH_SOCK" "$SSH_AGENT_PID" >> "$GITHUB_ENV"
--- a/.forgejo/workflows/stable.yml
+++ b/.forgejo/workflows/stable.yml
@ -0,0 +1,100 @@
+name: Stable release
+
+on:
+  workflow_dispatch:
+    inputs:
+      canary_tag:
+        description: Successful immutable canary tag to promote
+        type: string
+        required: true
+
+concurrency:
+  group: tensamin-central-releases
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: nixos
+    env:
+      NIX_CONFIG: experimental-features = nix-command flakes
+      FORGEJO_SERVER_URL: ${{ forgejo.server_url }}
+      FORGEJO_REPOSITORY: ${{ forgejo.repository }}
+      FORGEJO_RUN_ID: ${{ forgejo.run_id }}
+      RELEASE_CHANNEL: stable
+      RELEASE_TOKEN: ${{ secrets.TENSAMIN_RELEASE_TOKEN }}
+      FORGEJO_REGISTRY_USER: ${{ vars.FORGEJO_REGISTRY_USER }}
+      IOTA_RELEASE_SIGNING_KEY: ${{ secrets.IOTA_RELEASE_SIGNING_KEY }}
+      IOTA_RELEASE_PUBLIC_KEY: ${{ vars.IOTA_RELEASE_PUBLIC_KEY }}
+      IOTA_RELEASE_SIGNING_KEY_ID: ${{ vars.IOTA_RELEASE_SIGNING_KEY_ID || 'primary' }}
+      IOTA_BASE_VERSION: ${{ vars.IOTA_BASE_VERSION || '0.1.0' }}
+      NIXOS_FLAKE_REPOSITORY: ${{ vars.NIXOS_FLAKE_REPOSITORY }}
+      NIXOS_FLAKE_BRANCH: ${{ vars.NIXOS_FLAKE_BRANCH || 'main' }}
+      NIXOS_FLAKE_WRITE_TOKEN: ${{ secrets.NIXOS_FLAKE_WRITE_TOKEN }}
+      TENSAMIN_PROD_DEPLOY_SSH_KEY: ${{ secrets.TENSAMIN_PROD_DEPLOY_SSH_KEY }}
+      TENSAMIN_PROD_DEPLOY_HOST: ${{ vars.TENSAMIN_PROD_DEPLOY_HOST }}
+      TENSAMIN_PROD_DEPLOY_PORT: ${{ vars.TENSAMIN_PROD_DEPLOY_PORT || '22' }}
+      TENSAMIN_PROD_DEPLOY_JUMP_HOST: ${{ vars.TENSAMIN_PROD_DEPLOY_JUMP_HOST }}
+      TENSAMIN_PROD_DEPLOY_JUMP_PORT: ${{ vars.TENSAMIN_PROD_DEPLOY_JUMP_PORT || '7930' }}
+      TENSAMIN_SSH_KNOWN_HOSTS: ${{ vars.TENSAMIN_SSH_KNOWN_HOSTS }}
+      ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+      ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Bootstrap pinned tools and source credentials
+        uses: ./.forgejo/workflows/source-access
+        with:
+          source-key: ${{ secrets.TENSAMIN_SOURCE_SSH_KEY }}
+          known-hosts: ${{ vars.TENSAMIN_SSH_KNOWN_HOSTS }}
+      - name: Select successful canary for stable
+        env:
+          CANARY_TAG: ${{ inputs.canary_tag }}
+        run: python3 scripts/release.py select --tag "$CANARY_TAG"
+      - name: Set immutable release identity
+        run: |
+          set -euo pipefail
+          printf 'RELEASE_SEQUENCE=%s\nRELEASE_TAG=stable-%s-%s\n' "$(date +%s)" "$(git rev-parse HEAD)" "$FORGEJO_RUN_ID" >> "$GITHUB_ENV"
+      - name: Check central release scripts
+        run: |
+          set -euo pipefail
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command shellcheck scripts/release-build.sh scripts/release-client.sh
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command ruff check scripts/release.py scripts/deploy-release.py
+      - name: Validate and build all central packages and client assets
+        run: |
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command bash scripts/release-build.sh "$RELEASE_CHANNEL" release-out
+      - name: Attempt aarch64 build with available builders
+        run: |
+          set -euo pipefail
+          if ! nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command bash scripts/release-build.sh "$RELEASE_CHANNEL" release-arm aarch64-linux > arm-build.log 2>&1; then
+            printf 'aarch64 unavailable. See the attached arm-build.log.\n' > release-out/aarch64-unavailable.txt
+            cp arm-build.log release-out/
+          else
+            cp release-arm/*linux-aarch64* release-out/
+            cp release-arm/*arm64* release-out/
+            cp release-arm/electron-release-metadata-aarch64.json release-out/
+          fi
+      - name: Sign manifests and validate installer bundles
+        run: |
+          set -euo pipefail
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py sign --channel "$RELEASE_CHANNEL" --tag "$RELEASE_TAG"
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py provenance --channel "$RELEASE_CHANNEL" --tag "$RELEASE_TAG"
+      - name: Preserve combined build artifacts
+        uses: https://data.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: combined-release
+          path: release-out/
+      - name: Stage and verify draft attachments
+        run: |
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/release.py stage --channel "$RELEASE_CHANNEL" --tag "$RELEASE_TAG"
+      - name: Commit infrastructure lock, deploy, check health and publish stable
+        run: |
+          nix develop --impure --expr "import $PWD/scripts/release-env.nix { root = builtins.toPath \"$PWD\"; }" --command python3 scripts/deploy-release.py
+      - name: Remove source credentials
+        if: always()
+        run: |
+          if [[ -n ${SSH_AGENT_PID:-} ]]; then kill "$SSH_AGENT_PID"; fi
+          rm -rf "$RUNNER_TEMP/tensamin-source"