Ship the Moshpit Root CA: fetched on install and upgrade, trusted by … #141
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: ['v*'] | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version to release (e.g. 0.1.0)' | |
| required: true | |
| permissions: | |
| contents: write | |
| jobs: | |
| # 1) Create the GitHub Release (draft) up front so each per-platform build job | |
| # uploads straight to it via the Releases API (pattern from pairux.com). | |
| create-release: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| tag: ${{ steps.v.outputs.tag }} | |
| version: ${{ steps.v.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - id: v | |
| run: | | |
| if [ -n "${{ github.event.inputs.version }}" ]; then V="${{ github.event.inputs.version }}"; else V="${GITHUB_REF_NAME#v}"; fi | |
| echo "version=$V" >> "$GITHUB_OUTPUT" | |
| echo "tag=v$V" >> "$GITHUB_OUTPUT" | |
| - name: Create draft release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| TAG="${{ steps.v.outputs.tag }}" | |
| if gh release view "$TAG" >/dev/null 2>&1; then | |
| gh release edit "$TAG" --draft | |
| else | |
| gh release create "$TAG" --draft --title "TronBrowser $TAG" --generate-notes | |
| fi | |
| # 2) Build each platform's artifacts on its own runner and upload them. | |
| build: | |
| needs: create-release | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - { os: ubuntu-latest, platform: linux } | |
| - { os: macos-latest, platform: macos } | |
| - { os: windows-latest, platform: windows } | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| # Runners ship Node preinstalled; these steps only run scripts + packaging, | |
| # so we skip setup-node (its packageManager:pnpm detection causes cache noise). | |
| - name: Sync version | |
| run: node scripts/set-version.mjs "${{ needs.create-release.outputs.version }}" | |
| # The automation runtime (tron snapshot/analyze/run/mcp/automate) is the | |
| # compiled browser-core, agent-runtime and sdk packages, which | |
| # build-release.sh stages only when it can build them. That takes pnpm and | |
| # the workspace's dev dependencies; without this step the stage is skipped | |
| # with a one-line note and every release ships without `sdk/`. | |
| # Same setup ci.yml uses. Not corepack: `corepack enable` symlinks into | |
| # /usr/local/bin, which the ubuntu runner user cannot write (EACCES), while | |
| # the macOS runner can, so the linux build failed and macOS passed. | |
| - uses: pnpm/action-setup@v6 | |
| if: matrix.platform != 'windows' | |
| - uses: actions/setup-node@v5 | |
| if: matrix.platform != 'windows' | |
| with: | |
| node-version-file: .nvmrc | |
| - name: Install workspace (for the automation runtime) | |
| if: matrix.platform != 'windows' | |
| run: pnpm install --frozen-lockfile --filter @tronbrowser/sdk... | |
| - name: Package (linux/macos) | |
| if: matrix.platform != 'windows' | |
| run: bash apps/desktop/scripts/build-release.sh "v${{ needs.create-release.outputs.version }}" ${{ matrix.platform }} | |
| - name: Check the automation runtime is in the archive | |
| if: matrix.platform != 'windows' | |
| run: | | |
| if [ "${{ matrix.platform }}" = linux ]; then list="tar -tzf dist/tronbrowser-linux-x64.tar.gz"; else list="unzip -Z1 dist/tronbrowser-macos.zip"; fi | |
| $list | grep -q 'sdk/automate-bin.js' \ | |
| || { echo "::error::release archive has no sdk/automate-bin.js (automation runtime was not staged)"; exit 1; } | |
| - name: Package (linux deb + rpm + AppImage) | |
| if: matrix.platform == 'linux' | |
| run: | | |
| curl -sSfL "https://github.com/goreleaser/nfpm/releases/download/v2.41.0/nfpm_2.41.0_amd64.deb" -o /tmp/nfpm.deb | |
| sudo dpkg -i /tmp/nfpm.deb | |
| sudo apt-get update -qq && sudo apt-get install -y -qq librsvg2-bin | |
| # deb + rpm for amd64 AND arm64 (arm64 = Librem 5 / PinePhone / postmarketOS) | |
| bash distribution/deb-rpm/build.sh "v${{ needs.create-release.outputs.version }}" | |
| bash distribution/appimage/build.sh "v${{ needs.create-release.outputs.version }}" | |
| - name: Package (Ubuntu Touch click) | |
| if: matrix.platform == 'linux' | |
| continue-on-error: true # non-fatal: never block a release on the UT click | |
| run: | | |
| pip install --user clickable-ut || true | |
| export PATH="$HOME/.local/bin:$PATH" | |
| bash distribution/ubuntu-touch/build.sh "v${{ needs.create-release.outputs.version }}" arm64 || true | |
| - name: Package (windows) | |
| if: matrix.platform == 'windows' | |
| shell: pwsh | |
| run: | | |
| $stage = "dist/stage/tronbrowser" | |
| New-Item -ItemType Directory -Force -Path "$stage/extensions" | Out-Null | |
| Copy-Item apps/desktop/launcher/tronbrowser "$stage/tronbrowser" | |
| Copy-Item apps/desktop/launcher/tronbrowser.cmd "$stage/tronbrowser.cmd" | |
| Copy-Item -Recurse apps/desktop/extensions/ai-sidebar "$stage/extensions/ai-sidebar" | |
| # Same wholesale-copy problem build-release.sh has: the vitest files | |
| # next to the extension sources ride along into the zip. Chrome never | |
| # loads them, and they import vitest, which cannot resolve from an | |
| # unbundled extension. Drop them. | |
| Get-ChildItem "$stage/extensions/ai-sidebar" -Filter *.test.js -Recurse | Remove-Item -Force | |
| Copy-Item LICENSE "$stage/LICENSE" | |
| "v${{ needs.create-release.outputs.version }}" | Out-File -Encoding ascii "$stage/VERSION" | |
| New-Item -ItemType Directory -Force -Path dist | Out-Null | |
| Compress-Archive -Path "dist/stage/tronbrowser" -DestinationPath "dist/tronbrowser-win-x64.zip" -Force | |
| - name: Upload to release | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| shopt -s nullglob | |
| assets=(dist/tronbrowser-*.tar.gz dist/tronbrowser-*.zip dist/*.deb dist/*.rpm dist/*.AppImage dist/*.click) | |
| gh release upload "${{ needs.create-release.outputs.tag }}" "${assets[@]}" --clobber | |
| # 3) Publish (un-draft) once every platform has uploaded. | |
| publish: | |
| needs: [create-release, build] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Un-draft the release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: gh release edit "${{ needs.create-release.outputs.tag }}" --draft=false --repo "${{ github.repository }}" |