Repository navigation
Point the website link at shadowfetch.com/downloads #275
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Native desktop | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| paths: ['native/**', 'vendor/**', 'scripts/fixtures/native-glib-variant.rs', 'scripts/fixtures/native-runtime-write-errors.c', 'src-tauri/**', 'ui/**', 'licenses/native/**', 'packaging/native-runtime/**', 'packaging/native-app-run.sh', 'packaging/llama.cpp/**', 'packaging/shadow-agent.desktop', 'tools/llama.cpp.pin', 'tools/glslc-flatpak.sh', 'scripts/build-llama.cpp.sh', 'scripts/*llama*.mjs', 'scripts/install-appimage.sh', 'scripts/install-release-state.sh', 'scripts/installer-auth-fixtures.mjs', 'scripts/test-install-auth.mjs', 'release/**', 'scripts/test-install-appimage.sh', 'scripts/test-clean-host-*.mjs', 'scripts/clean-host-*.mjs', 'scripts/clean-host-mcp-smoke.sh', 'scripts/fixtures/native-*.mjs', 'scripts/clean-host-runtime.Dockerfile', 'scripts/clean-host-gui-smoke.sh', 'scripts/*native*.mjs', 'scripts/publisher-fixtures.mjs', 'scripts/test-publisher-auth.mjs', 'scripts/native-packaging-env.sh', 'scripts/native-release-auth-lib.sh', 'scripts/verify-native-release.sh', 'scripts/check-secrets.mjs', 'scripts/test-check-secrets.mjs', 'scripts/native-mcp-peer/**', 'Cargo.toml', 'Cargo.lock', '.github/workflows/native.yml', '.github/workflows/release.yml'] | |
| permissions: | |
| contents: read | |
| jobs: | |
| verify: | |
| # x86_64 and aarch64 (GitHub's Arm runners) build and qualify natively. | |
| # The x86_64 leg keeps its historical artifact names (empty suffix). | |
| name: verify (${{ matrix.arch }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: x86_64 | |
| runner: ubuntu-24.04 | |
| appimage: amd64 | |
| deb: amd64 | |
| suffix: '' | |
| - arch: aarch64 | |
| runner: ubuntu-24.04-arm | |
| appimage: aarch64 | |
| deb: arm64 | |
| suffix: '-aarch64' | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 120 | |
| env: | |
| RUSTUP_TOOLCHAIN: '1.95.0' | |
| # Full debug info plus incremental objects exhaust the hosted runner's | |
| # disk before the integration binaries link. Keep line-number backtraces | |
| # and every test; these jobs do not reuse incremental build state. | |
| CARGO_PROFILE_DEV_DEBUG: line-tables-only | |
| CARGO_PROFILE_TEST_DEBUG: line-tables-only | |
| CARGO_INCREMENTAL: '0' | |
| SHADOWCODE_BUILD_JOBS: '4' | |
| # The Debian package must pass lintian (errors fail; warnings are reported). | |
| SHADOWCODE_REQUIRE_LINTIAN: '1' | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| cache-dependency-path: ui/package-lock.json | |
| - name: Native window dependencies | |
| run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev libayatana-appindicator3-dev libasound2-dev patchelf webkit2gtk-driver xvfb appstream dbus-daemon dbus-bin lintian desktop-file-utils xdg-utils | |
| - name: Test release staging and immutable retry behavior | |
| run: node --test scripts/test-native-release.mjs scripts/test-native-release-verification.mjs scripts/test-publisher-auth.mjs scripts/test-native-release-signing.mjs scripts/test-native-test-session.mjs scripts/test-clean-host-mcp-receipt.mjs scripts/test-clean-host-container.mjs scripts/test-native-app-run.mjs scripts/test-native-webkit-paths.mjs scripts/test-llama-build-inputs.mjs scripts/test-native-arch.mjs && node scripts/test-native-process-ownership.mjs | |
| - name: Verify publisher authentication and private release snapshots | |
| run: node --test scripts/test-native-release-auth.mjs scripts/test-check-secrets.mjs | |
| - name: Package version | |
| run: echo "VERSION=$(node -p "require('./src-tauri/tauri.conf.json').version")" >> "$GITHUB_ENV" | |
| - name: Managed llama.cpp build dependencies | |
| run: sudo apt-get install -y cmake ninja-build libssl-dev libvulkan-dev glslc spirv-headers gcc-14 g++-14 | |
| - run: npm --prefix ui ci && npm --prefix ui run build && npm --prefix ui test | |
| - name: Install pinned Rust toolchain | |
| run: rustup toolchain install 1.95.0 --profile minimal --component rustfmt --component clippy | |
| - name: Verify the exact GLib backport and optimized iterator behavior | |
| run: | | |
| rustfmt +1.95.0 --check --edition 2021 scripts/fixtures/native-glib-variant.rs | |
| node --test --test-reporter=tap scripts/test-native-glib-backport.mjs | |
| node scripts/test-native-glib-variant.mjs | |
| - run: cargo +1.95.0 fmt --all --check | |
| - run: cargo +1.95.0 clippy --workspace --all-targets --locked -- -D warnings | |
| - run: cargo +1.95.0 build -p shadowcode-desktop --locked | |
| - run: cargo +1.95.0 test --workspace --locked -- --skip worktrees::cleanup::tests::actual_built_project_cleanup_is_bounded_and_completes | |
| - name: Qualify cleanup over actual built UI dependencies and output | |
| run: node scripts/native-release-verification.mjs run built-project-cleanup | |
| - name: Preserve built-project cleanup diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: built-project-cleanup-diagnostics${{ matrix.suffix }} | |
| path: artifacts/built-project-cleanup | |
| - name: Exercise the native CLI without a display | |
| run: node scripts/test-native-cli.mjs | |
| - name: Stress repeated native tasks, cancellation, output and cleanup | |
| run: node scripts/test-native-stress.mjs | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: always() | |
| with: | |
| name: native-stress-diagnostics${{ matrix.suffix }} | |
| path: artifacts/native-stress | |
| - name: Exercise the native terminal through a real PTY | |
| run: node scripts/test-native-tui.mjs | |
| - name: Exercise the native MCP server without a display | |
| run: node scripts/test-native-mcp-server.mjs | |
| - name: Exercise the authenticated native MCP HTTP server | |
| run: SHADOW_MCP_TRANSPORT=http node scripts/test-native-mcp-server.mjs | |
| - name: Install independent MCP test clients | |
| run: npm --prefix scripts/native-mcp-peer ci --ignore-scripts --no-audit --no-fund | |
| - name: Verify MCP interoperability with official TypeScript clients | |
| run: node scripts/test-native-mcp-peer.mjs | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: always() | |
| with: | |
| name: native-mcp-server-diagnostics${{ matrix.suffix }} | |
| path: | | |
| artifacts/native-mcp-server* | |
| artifacts/native-mcp-peer | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: always() | |
| with: | |
| name: native-cli-diagnostics${{ matrix.suffix }} | |
| path: | | |
| artifacts/native-cli | |
| artifacts/native-tui | |
| - run: cargo +1.95.0 install tauri-driver --version 2.0.6 --locked | |
| - name: Exercise the native window | |
| run: node scripts/run-native-x11.mjs node scripts/test-native-desktop.mjs | |
| - name: Exercise the embedded Markdown worker under the native security policy | |
| run: node scripts/run-native-x11.mjs node scripts/test-native-markdown.mjs | |
| - name: Qualify 100 sequential tasks through the native window | |
| run: node scripts/native-release-verification.mjs run native-endurance | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: always() | |
| with: | |
| name: native-window-diagnostics${{ matrix.suffix }} | |
| path: | | |
| artifacts/native | |
| artifacts/native-markdown | |
| artifacts/native-endurance | |
| artifacts/native-x11 | |
| - run: cargo +1.95.0 build --release -p shadowcode-core --examples --locked | |
| - name: Check pinned-source failures and mirror recovery | |
| run: node --test scripts/test-native-source-fetch.mjs | |
| - name: Packaging PATH ignores host node hijacks; Debian package checks | |
| run: node --test scripts/test-native-packaging-env.mjs scripts/test-native-deb.mjs | |
| - name: Restore the managed llama.cpp build | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 | |
| with: | |
| path: | | |
| tools/llama.cpp | |
| tools/spirv-headers | |
| tools/spirv-headers-prefix | |
| key: llama-cpp-${{ runner.os }}${{ matrix.suffix }}-${{ hashFiles('tools/llama.cpp.pin', 'scripts/build-llama.cpp.sh') }} | |
| - name: Build the managed llama.cpp runtime (Vulkan + all CPU variants) | |
| run: bash scripts/build-llama.cpp.sh --no-user-install | |
| - name: Check the managed runtime packaging steps | |
| run: node --test scripts/test-llama-runtime.mjs scripts/test-native-desktop-metadata.mjs | |
| - name: Build native development packages with dependency notices | |
| run: node scripts/build-native.mjs | |
| - name: Inspect both packages | |
| run: node scripts/check-native-package.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_${{ matrix.appimage }}.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_${{ matrix.deb }}.deb" | |
| - name: Build runtime-only clean-host qualification image | |
| run: docker build --build-arg TARGETARCH="$(dpkg --print-architecture)" -f scripts/clean-host-runtime.Dockerfile -t shadowcode-clean-runtime:ci scripts | |
| - name: Install and first-launch both packages in an offline clean host | |
| run: node scripts/test-clean-host-packages.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_${{ matrix.appimage }}.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_${{ matrix.deb }}.deb" artifacts/native-package/SHA256SUMS | |
| - name: Reject AppImage extraction writes that fail | |
| run: node scripts/test-native-runtime-write-errors.mjs | |
| - name: Rebuild the shipped runtime sources without network access | |
| run: node scripts/test-native-runtime-sources.mjs | |
| - name: Exercise concurrent AppImage extraction and shutdown | |
| run: node scripts/test-native-runtime.mjs | |
| - name: Verify installer runtime swap and checksum refusal | |
| run: | | |
| node --test --test-reporter=tap scripts/test-install-auth.mjs | |
| bash scripts/test-install-appimage.sh | |
| - name: Exercise the packaged CLI without a display | |
| env: | |
| SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage | |
| SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]' | |
| SHADOW_CLI_ARTIFACTS: artifacts/native-package/cli | |
| run: node scripts/test-native-cli.mjs | |
| - name: Exercise the packaged native terminal | |
| env: | |
| SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage | |
| SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]' | |
| SHADOW_TUI_ARTIFACTS: artifacts/native-package/tui | |
| run: node scripts/test-native-tui.mjs | |
| - name: Exercise the packaged native window | |
| env: | |
| SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage | |
| SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run","ui"]' | |
| SHADOW_NATIVE_DEFAULT_PROFILE: '1' | |
| SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/window | |
| run: node scripts/run-native-x11.mjs node scripts/test-native-desktop.mjs | |
| - name: Exercise the packaged Markdown worker under its native security policy | |
| env: | |
| SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage | |
| SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run"]' | |
| SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/markdown | |
| run: node scripts/run-native-x11.mjs node scripts/test-native-markdown.mjs | |
| - name: Exercise the packaged native MCP server | |
| env: | |
| SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage | |
| SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]' | |
| SHADOW_MCP_ARTIFACTS: artifacts/native-package/mcp-server | |
| run: node scripts/test-native-mcp-server.mjs | |
| - name: Exercise the packaged native MCP HTTP server | |
| env: | |
| SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage | |
| SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]' | |
| SHADOW_MCP_ARTIFACTS: artifacts/native-package/mcp-server-http | |
| SHADOW_MCP_TRANSPORT: http | |
| run: node scripts/test-native-mcp-server.mjs | |
| - name: Verify packaged MCP interoperability with official TypeScript clients | |
| env: | |
| SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage | |
| SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]' | |
| SHADOW_MCP_PEER_ARTIFACTS: artifacts/native-package/mcp-peer | |
| run: node scripts/test-native-mcp-peer.mjs | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: always() | |
| with: | |
| name: native-package-diagnostics${{ matrix.suffix }} | |
| path: | | |
| artifacts/native-package | |
| artifacts/native-x11 | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: native-linux-development${{ matrix.suffix }} | |
| retention-days: 14 | |
| path: | | |
| target/release/bundle/appimage/*.AppImage | |
| target/release/bundle/appimage/*runtime-sources.tar.gz | |
| target/release/bundle/deb/*.deb | |
| artifacts/native-package/SHA256SUMS |