Neon Overlord
f814c87c79
build / build (push) Failing after 2m6s
The build recipe existed only as a script in /tmp on a build host, which is precisely the state this node's rules exist to prevent -- the only copy of how the artifact is produced living on an ephemeral machine. It is now a workflow in the repository, so a release is reproducible from the repo alone. The workflow installs composer from the distribution before running make. Upstream's `make composer` falls back to piping getcomposer.org/installer into php when composer is absent; the job now fails loudly instead. Excludes .gitea from the release archive alongside .github. README rewritten to carry the whole rationale: the six link sites and what was wrong with each, the measured coverage of url/uri that justifies the fallback order, why upstream's local-link behaviour is deliberate rather than a bug, what was renamed and what was deliberately not, the two build caveats, and authorship. Assisted-by: Claude Code:claude-opus-5
69 lines
2.3 KiB
YAML
69 lines
2.3 KiB
YAML
name: build
|
|
|
|
# Builds the Nextcloud app archive on the psn runner.
|
|
#
|
|
# Toolchain comes from psn-base + deb.bawnet.io -- notably composer, because
|
|
# the upstream makefile falls back to `curl https://getcomposer.org/installer | php`
|
|
# when composer is not on PATH, and this node does not run pipe-to-shell installers.
|
|
#
|
|
# npm dependencies are the one non-sovereign hop: `npm ci` fetches from the
|
|
# public registry. package-lock.json pins every dependency with an integrity
|
|
# hash, which is the mitigation.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: psn
|
|
container:
|
|
image: code.bawnet.io/ops/psn-base:latest
|
|
steps:
|
|
- name: Install toolchain from the node's own mirror
|
|
run: |
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq
|
|
apt-get install -y -qq --no-install-recommends \
|
|
nodejs npm php-cli php-xml php-mbstring php-zip \
|
|
composer git make rsync sudo ca-certificates
|
|
node --version && npm --version
|
|
command -v composer >/dev/null || {
|
|
echo "FATAL: composer absent -- makefile would pipe an installer to php"; exit 1; }
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Resolve version from appinfo
|
|
id: v
|
|
run: |
|
|
v=$(sed -n 's:.*<version>\(.*\)</version>.*:\1:p' appinfo/info.xml | head -1)
|
|
echo "version=$v" >> "$GITHUB_OUTPUT"
|
|
echo "building $v"
|
|
|
|
- name: PHP dependencies
|
|
run: composer install --prefer-dist --no-interaction --no-progress -q
|
|
|
|
- name: JS dependencies and production bundle
|
|
run: |
|
|
npm ci --no-audit --no-fund
|
|
npm run build
|
|
|
|
- name: Lint PHP
|
|
run: find lib -name '*.php' -exec php -l {} \; | grep -v 'No syntax errors' && exit 1 || true
|
|
|
|
- name: Package
|
|
run: |
|
|
make appstore version=${{ steps.v.outputs.version }}
|
|
mkdir -p artifacts
|
|
cp /tmp/build/integration_gotosocial-${{ steps.v.outputs.version }}.tar.gz artifacts/
|
|
cd artifacts
|
|
sha256sum integration_gotosocial-${{ steps.v.outputs.version }}.tar.gz \
|
|
| tee integration_gotosocial-${{ steps.v.outputs.version }}.tar.gz.sha256
|
|
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: integration_gotosocial-${{ steps.v.outputs.version }}
|
|
path: artifacts/
|