check-linux-egui.yml

name: Linux Core, egui and deb/rpm checks

# CI and independent manual Linux builds share this deb/rpm verification path.
# No standalone push trigger: a Linux PR must show one combined Linux check.
on:
  workflow_call:
    inputs:
      # 'none' skips a change set that is only prose (see
      # scripts/ci-changed-areas.sh): the callers that must always build the
      # packages, including accepted tag builds, leave the default in place.
      scope:
        required: false
        type: string
        default: full
      # The tag whose commit is being packaged. Set by the release entry point so
      # the version assertion and the GitHub Release linkage cannot be skipped by
      # dispatching the workflow on a branch instead.
      release_tag:
        required: false
        type: string
        default: ''
      # Attach the verified packages to that Release. Linux used to be
      # administrator-attached only; the packages now ship in the same Release as
      # the desktop and Android assets.
      publish:
        required: false
        type: boolean
        default: false
      checkout_ref:
        required: false
        type: string
        default: ''

# No `permissions:` here on purpose: a reusable workflow inherits its caller's
# grant, and the release caller needs `contents: write` for `gh release upload`
# while CI keeps `contents: read`. Asking for more than the caller grants is
# rejected before the run starts (`startup_failure`, zero jobs); asking for less
# silently breaks the upload.

concurrency:
  group: linux-egui-build-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test-linux-egui:
    # Run in parallel with packaging: the tests used
    # to serialise ~8 minutes in front of the ~7 minute release build, making this
    # workflow the critical path of the whole CI run.
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      CARGO_PROFILE_DEV_DEBUG: 0
      CARGO_PROFILE_TEST_DEBUG: 0
      CARGO_TARGET_DIR: ${{ github.workspace }}/openless-all/app/target
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: false
          ref: ${{ inputs.checkout_ref || github.ref }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
        if: inputs.scope != 'none'
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
        if: inputs.scope != 'none'

      - name: Install native build and test dependencies
        if: inputs.scope != 'none'
        # Same list as the packaging job: the fcitx5 plugin build and the
        # `pwsh` contract scripts both live here now.
        run: |
          sudo add-apt-repository -y universe || true
          sudo apt-get update
          sudo apt-get install -y \
            appstream build-essential cmake cpio desktop-file-utils \
            fcitx5-modules-dev file libasound2-dev libdbus-1-dev \
            libfcitx5config-dev libfcitx5core-dev libfcitx5utils-dev \
            liblzma-dev libpipewire-0.3-dev libpulse-dev libssl-dev \
            libwayland-dev libx11-dev libxkbcommon-dev pkg-config ripgrep rpm

      - uses: swatinem/rust-cache@v2
        if: inputs.scope != 'none'
        with:
          # Test and release profiles are produced independently; each needs its own cache.
          shared-key: test-linux-egui
          workspaces: |
            openless-all/app -> target
            openless-all/app/src-tauri/backend-tests -> ../../target
          cache-on-failure: true
          save-if: ${{ github.ref == 'refs/heads/beta' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}

      - name: Build and test fcitx5 plugin
        if: inputs.scope != 'none'
        working-directory: openless-all/app/scripts/linux-fcitx5-plugin
        run: |
          cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr
          cmake --build build --parallel
          ctest --test-dir build --output-on-failure
          test -s build/libopenless.so
          test -s build/openless.conf

      - name: Test Core, Linux host, and platform boundaries
        if: inputs.scope != 'none'
        working-directory: openless-all/app
        run: |
          set -euo pipefail
          cargo test --locked -p openless-core
          # Named re-run of the hotkey edge gate that used to be a standalone
          # script spawning its own `cargo test`: the binary is already built by
          # the line above, so this is free, and a rename now fails loudly here
          # instead of silently dropping the gate.
          cargo test --locked -p openless-core --lib \
            api::tests::shared_hotkey_edges_own_hold_auto_and_combo_abort_semantics -- --exact \
            | tee "$RUNNER_TEMP/openless-hotkey-edge.log"
          grep -Fq 'test api::tests::shared_hotkey_edges_own_hold_auto_and_combo_abort_semantics ... ok' \
            "$RUNNER_TEMP/openless-hotkey-edge.log"
          cargo test --locked -p openless-harmony-host
          cargo clippy --locked -p openless-core --all-targets -- -D warnings
          cargo test --locked -p openless-linux-egui --all-targets
          cargo clippy --locked -p openless-linux-egui --all-targets -- -D warnings
          node scripts/linux-egui-tauri-free-contract.test.mjs
          node scripts/linux-egui-release-contract.test.mjs
          node scripts/ci-changed-areas.test.mjs
          node scripts/ci-cache-usage.test.mjs
          node scripts/ci-cache-sharing.test.mjs
          node scripts/harmony-release-contract.test.mjs
          node scripts/tauri-linux-free-contract.test.mjs
          pwsh -NoProfile -File ./scripts/check-core-deps.ps1
          pwsh -NoProfile -File ./scripts/check-core-deps.ps1 openless-linux-egui
          pwsh -NoProfile -File ./scripts/check-core-secret-surface.ps1
          pwsh -NoProfile -File ./scripts/check-core-test-isolation.ps1
          pwsh -NoProfile -File ./scripts/check-core-runtime-seam.ps1
          pwsh -NoProfile -File ./scripts/check-linux-public-surface.ps1

      - name: Test remote input TLS identity and Unix key permissions
        if: inputs.scope != 'none'
        working-directory: openless-all/app
        run: cargo test --locked --manifest-path src-tauri/backend-tests/Cargo.toml --test remote_tls

  build-linux-egui:
    # PipeWire/libspa in this host needs 24.04. Packages target glibc >= 2.39.
    runs-on: ubuntu-24.04
    # A cold dependency tree costs ~18 minutes; anything past this is a hang.
    timeout-minutes: 90
    env:
      RELEASE_TAG: ${{ inputs.release_tag || (github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v') && endsWith(github.ref, '-tauri') && github.ref_name || '') }}
      # Debug info dominates both compile time and cache size for this host, and
      # the gate below never reads it. The Linux job keeps its own cache so a
      # red run still starts warm.
      CARGO_PROFILE_DEV_DEBUG: 0
      CARGO_PROFILE_TEST_DEBUG: 0
      # The standalone TLS contract otherwise recompiles common dependencies in
      # src-tauri/backend-tests/target, outside the host's restored cache.
      CARGO_TARGET_DIR: ${{ github.workspace }}/openless-all/app/target
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: false
          ref: ${{ inputs.checkout_ref || github.ref }}

      - name: Install native build and packaging dependencies
        if: inputs.scope != 'none'
        run: |
          sudo add-apt-repository -y universe || true
          sudo apt-get update
          sudo apt-get install -y \
            appstream build-essential cmake cpio desktop-file-utils \
            fcitx5-modules-dev file libasound2-dev libdbus-1-dev \
            libfcitx5config-dev libfcitx5core-dev libfcitx5utils-dev \
            liblzma-dev libpipewire-0.3-dev libpulse-dev libssl-dev \
            libwayland-dev libx11-dev libxkbcommon-dev pkg-config ripgrep rpm

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
        if: inputs.scope != 'none'

      - uses: actions/setup-node@v4
        with:
          node-version: '22'
        if: inputs.scope != 'none'

      - name: Resolve package version and validate release tag
        id: version
        working-directory: openless-all/app
        env:
          VERSION_TAG: ${{ env.RELEASE_TAG }}
        run: |
          set -euo pipefail
          VERSION=$(node -p "require('./package.json').version")
          if [ -n "$VERSION_TAG" ]; then
            TAG_VERSION=${VERSION_TAG#v}
            TAG_VERSION=${TAG_VERSION%-tauri}
            if [ "${VERSION%%+*}" != "$TAG_VERSION" ]; then
              echo "::error::tag $VERSION_TAG does not match package.json version $VERSION"
              exit 1
            fi
          fi
          # Linux packages use the same explicitly incremented -N revision as
          # earlier Beta.2-78/-79 builds. Keep it separate from the Tauri tag.
          REVISION=$(< linux-egui/package-revision)
          [[ "$REVISION" =~ ^[1-9][0-9]*$ ]]
          echo "version=${VERSION%%+*}-$REVISION" >> "$GITHUB_OUTPUT"

      - uses: swatinem/rust-cache@v2
        if: inputs.scope != 'none'
        with:
          # Keep the release cache shared with tag builds, separate from test profiles.
          shared-key: build-linux-egui
          workspaces: |
            openless-all/app -> target
            openless-all/app/src-tauri/backend-tests -> ../../target
          # Failed beta checks can still warm the shared tree. PRs never write
          # their own copy, even when tests fail or dependencies change.
          cache-on-failure: true
          save-if: ${{ github.ref == 'refs/heads/beta' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}

      - name: Build the fcitx5 plugin for packaging
        if: inputs.scope != 'none'
        # The package installs `libopenless.so` + `openless.conf`, so the
        # packaging job needs the artifact. The assertions and `ctest` run in the
        # parallel `test-linux-egui` job; this is the build only.
        working-directory: openless-all/app/scripts/linux-fcitx5-plugin
        run: |
          cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr
          cmake --build build --parallel

      - name: Validate Linux desktop metadata
        if: inputs.scope != 'none'
        run: |
          desktop-file-validate openless-all/app/linux-egui/packaging/openless.desktop
          appstreamcli validate --no-net openless-all/app/linux-egui/packaging/top.openless.OpenLess.metainfo.xml

      - name: Build Linux egui host
        if: inputs.scope != 'none'
        working-directory: openless-all/app
        run: cargo build --locked --release -p openless-linux-egui

      - name: Package deb and rpm without Tauri
        if: inputs.scope != 'none'
        working-directory: openless-all/app
        env:
          OPENLESS_LINUX_VERSION: ${{ steps.version.outputs.version }}
          OPENLESS_LINUX_ARCH: x86_64
        run: |
          # CI runners are disposable. Ignore old outputs restored by a cache.
          rm -f target/linux-egui-packages/*.deb target/linux-egui-packages/*.rpm \
            target/linux-egui-packages/SHA256SUMS
          bash scripts/package-linux-egui.sh

      - name: Generate checksums and verify distributable packages
        if: inputs.scope != 'none'
        working-directory: openless-all/app
        run: |
          set -euo pipefail
          OUTPUT=target/linux-egui-packages
          ( cd "$OUTPUT" && sha256sum ./*.deb ./*.rpm > SHA256SUMS )
          # Release attachment name: the desktop and Android assets carry their own
          # SHA256SUMS, so the Linux one is published under a distinct name.
          cp "$OUTPUT/SHA256SUMS" "$OUTPUT/SHA256SUMS-linux"
          bash scripts/verify-linux-egui-packages.sh

      - name: Stage direct download aliases
        if: inputs.scope != 'none' && (github.event_name != 'push' || env.RELEASE_TAG != '')
        shell: bash
        run: |
          set -euo pipefail
          output=openless-all/app/target/linux-egui-packages
          alias_dir="$RUNNER_TEMP/openless-linux-egui-direct-download"
          rm -rf "$alias_dir"
          mkdir -p "$alias_dir"
          debs=("$output"/OpenLess-Linux-egui-*.deb)
          rpms=("$output"/OpenLess-Linux-egui-*.rpm)
          test "${#debs[@]}" -eq 1
          test "${#rpms[@]}" -eq 1
          cp "${debs[0]}" "$alias_dir/OpenLess_linux_x86_64.deb"
          cp "${rpms[0]}" "$alias_dir/OpenLess_linux_x86_64.rpm"

      - name: Upload verified Linux packages as workflow artifacts
        # Push builds keep the release path warm but do not publish artifacts;
        # the tag release and pull request runs are the consumers.
        if: inputs.scope != 'none' && (github.event_name != 'push' || env.RELEASE_TAG != '')
        uses: actions/upload-artifact@v7
        with:
          name: openless-linux-egui-x86_64
          path: openless-all/app/target/linux-egui-packages/*
          if-no-files-found: error

      - name: Upload direct download aliases
        if: inputs.scope != 'none' && (github.event_name != 'push' || env.RELEASE_TAG != '')
        uses: actions/upload-artifact@v7
        with:
          name: openless-linux-egui-direct-download
          path: ${{ runner.temp }}/openless-linux-egui-direct-download/*
          if-no-files-found: error

  publish-linux-egui:
    needs: [test-linux-egui, build-linux-egui]
    if: inputs.scope != 'none' && inputs.publish && inputs.release_tag != ''
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    env:
      GH_REPO: ${{ github.repository }}
      GH_TOKEN: ${{ github.token }}
      RELEASE_TAG: ${{ inputs.release_tag }}
    steps:
      - name: Download verified Linux packages
        uses: actions/download-artifact@v8
        with:
          name: openless-linux-egui-x86_64
          path: ${{ runner.temp }}/openless-linux-egui-packages
      - name: Download direct download aliases
        uses: actions/download-artifact@v8
        with:
          name: openless-linux-egui-direct-download
          path: ${{ runner.temp }}/openless-linux-egui-direct-download
      - name: Attach Linux packages to the GitHub Release
        run: |
          set -euo pipefail
          output="$RUNNER_TEMP/openless-linux-egui-packages"
          alias_dir="$RUNNER_TEMP/openless-linux-egui-direct-download"
          for file in "$output"/OpenLess-Linux-egui-*.deb "$output"/OpenLess-Linux-egui-*.rpm \
              "$output/SHA256SUMS-linux" "$alias_dir/OpenLess_linux_x86_64.deb" \
              "$alias_dir/OpenLess_linux_x86_64.rpm"; do
            [ -s "$file" ] || { echo "::error::missing Linux release asset $file"; exit 1; }
          done
          # The desktop workflow creates the Release; wait without racing its creation.
          for attempt in $(seq 1 40); do
            if gh release view "$RELEASE_TAG" --json isDraft > /dev/null 2>&1; then
              break
            fi
            if [ "$attempt" = 40 ]; then
              echo "::error::release $RELEASE_TAG was not created by the desktop workflow"
              exit 1
            fi
            sleep 15
          done
          gh release upload "$RELEASE_TAG" \
            "$output"/OpenLess-Linux-egui-*.deb \
            "$output"/OpenLess-Linux-egui-*.rpm \
            "$output/SHA256SUMS-linux" \
            "$alias_dir/OpenLess_linux_x86_64.deb" \
            "$alias_dir/OpenLess_linux_x86_64.rpm" \
            --clobber
          echo "attached Linux assets to $RELEASE_TAG"