ci: geenrate linux release bins and on release hooks for updates

Author: abose

.github/workflows/tauri-build-dev.yml

@@ -277,12 +277,7 @@ jobs:
     permissions:
       contents: write
     timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        platform: [ ubuntu-22.04]
-
-    runs-on: ${{ matrix.platform }}
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - name: get Git Tag
@@ -293,20 +288,6 @@ jobs:
         with:
           node-version: 24
 
-      - name: GLIBC version
-        run: |
-          ldd --version
-      - name: install Rust stable
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: 1.85.1
-      - name: install dependencies (ubuntu only)
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libayatana-appindicator3-dev librsvg2-dev
-          sudo apt-get install -y libwebrtc-audio-processing-dev
-          sudo apt-get install -y libunwind-dev
-          sudo apt-get install -y libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libgstreamer-plugins-bad1.0-dev gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly gstreamer1.0-libav gstreamer1.0-tools gstreamer1.0-x gstreamer1.0-alsa gstreamer1.0-gl gstreamer1.0-gtk3 gstreamer1.0-qt5 gstreamer1.0-pulseaudio
       - name: install frontend dependencies
         env:
           GH_TOKEN: ${{ github.token }}
@@ -315,25 +296,41 @@ jobs:
         run: |
           npm ci
           npm run _ci-release:dev
-          npm run tauri build
-          ls -alh ./src-tauri/target/release
-          mkdir ./src-tauri/target/release/phoenix-code
-          cp ./src-tauri/target/release/phoenix-code-experimental-build ./src-tauri/target/release/phoenix-code
-          cp ./src-build/linux/install-readme.txt ./src-tauri/target/release/phoenix-code/readme.txt
-          cp ./src-tauri/target/release/phnode ./src-tauri/target/release/phoenix-code
-          cp -r ./src-tauri/target/release/src-node ./src-tauri/target/release/phoenix-code
-          ls -alh ./src-tauri/target/release/phoenix-code
-          tar -cvzf phoenix-code.tar.gz -C ./src-tauri/target/release phoenix-code
-          ls -alh phoenix-code.tar.gz
-          GLIBC_VER=$(ldd --version | head -n1 | awk '{print $NF}')
-          OUTPUT_FILENAME="phoenix-code-experimental-build_$(node -p "require('./package.json').version")_amd64_linux_bin-GLIBC-${GLIBC_VER}.tar.gz"
-          mv phoenix-code.tar.gz "$OUTPUT_FILENAME"
-          echo "OUTPUT_FILENAME=$OUTPUT_FILENAME" >> $GITHUB_ENV
-          ls
+          npm run _ci-releaseElectronApp
+          ls -alh ./src-electron/dist/
+          echo "OUTPUT_FILENAME=$(ls ./src-electron/dist/*.AppImage | head -1 | xargs basename)" >> $GITHUB_ENV
+
+      - name: Sign AppImage with minisign
+        env:
+          TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
+          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+        run: |
+          # Install minisign
+          sudo apt-get update && sudo apt-get install -y minisign
+
+          # Write private key to temp file
+          echo "$TAURI_PRIVATE_KEY" > /tmp/tauri_private.key
+
+          # Sign the AppImage
+          APPIMAGE_PATH="./src-electron/dist/${{ env.OUTPUT_FILENAME }}"
+          echo "$TAURI_KEY_PASSWORD" | minisign -S -s /tmp/tauri_private.key -m "$APPIMAGE_PATH" -t "$(date +%s)	file:${{ env.OUTPUT_FILENAME }}"
+
+          # Clean up private key
+          rm /tmp/tauri_private.key
+
+          # Show signature file
+          echo "Signature file contents:"
+          cat "${APPIMAGE_PATH}.minisig"
+
+          # Rename .minisig to .sig for consistency
+          mv "${APPIMAGE_PATH}.minisig" "${APPIMAGE_PATH}.sig"
+
       - name: Upload Release Asset
         uses: softprops/action-gh-release@v2
         with:
-          files: ${{ env.OUTPUT_FILENAME }}
+          files: |
+            ./src-electron/dist/${{ env.OUTPUT_FILENAME }}
+            ./src-electron/dist/${{ env.OUTPUT_FILENAME }}.sig
           tag_name: ${{ env.GIT_TAG_NAME }}
           draft: true
         env:

.github/workflows/updateNotification.js

@@ -87,6 +87,10 @@ const WINDOWS_X64_NAME_SUFFIX = "_x64-setup.exe";
 const MAC_INTEL_NAME_SUFFIX = "_x64.dmg";
 // "Phoenix.Code.Experimental.Build_3.4.2_aarch64.dmg"
 const MAC_M1_NAME_SUFFIX = "_aarch64.dmg";
+// "phoenix-code-experimental-build_3.4.2.AppImage"
+const LINUX_APPIMAGE_NAME_SUFFIX = ".AppImage";
+// "phoenix-code-experimental-build_3.4.2.AppImage.sig"
+const LINUX_APPIMAGE_SIG_SUFFIX = ".AppImage.sig";
 function _getDownloadURLByNameSuffix(releaseAssets, suffix) {
     for(let releaseAsset of releaseAssets) {
         if(releaseAsset.name.endsWith(suffix)){
@@ -163,6 +167,26 @@ export default async function printStuff({github, context, githubWorkspaceRoot})
     console.log("Updating tauri update JSON file: ", _identifyUpdateJSONPath(releaseAssets));
     const latestJSON = JSON.parse(await _getLatestJson(releaseAssets));
     latestJSON.notes = releaseNotes;
+
+    // Add Linux AppImage to platforms (Electron build with minisign signature)
+    try {
+        const linuxAppImageURL = _getDownloadURLByNameSuffix(releaseAssets, LINUX_APPIMAGE_NAME_SUFFIX);
+        let linuxSignature = "";
+        try {
+            const sigFileURL = _getDownloadURLByNameSuffix(releaseAssets, LINUX_APPIMAGE_SIG_SUFFIX);
+            linuxSignature = await _getTextHTTPS(sigFileURL);
+            console.log("Linux AppImage signature: ", linuxSignature);
+        } catch (sigErr) {
+            console.warn("Linux AppImage signature file not found, using empty signature");
+        }
+        latestJSON.platforms["linux-x86_64"] = {
+            "signature": linuxSignature,
+            "url": linuxAppImageURL
+        };
+    } catch (e) {
+        console.warn("Linux AppImage not found in release assets, skipping linux-x86_64 platform");
+    }
+
     const latestJsonPath = `${githubWorkspaceRoot}/docs/${_identifyUpdateJSONPath(releaseAssets)}`;
     const currentVersion = getCurrentVersion(latestJsonPath);
     const latestVersion = latestJSON.version;
@@ -179,6 +203,12 @@ export default async function printStuff({github, context, githubWorkspaceRoot})
         const windowsDownloadURL = _getDownloadURLByNameSuffix(releaseAssets, WINDOWS_X64_NAME_SUFFIX);
         const macM1DownloadURL = _getDownloadURLByNameSuffix(releaseAssets, MAC_M1_NAME_SUFFIX);
         const macIntelDownloadURL = _getDownloadURLByNameSuffix(releaseAssets, MAC_INTEL_NAME_SUFFIX);
+        let linuxAppImageURL = null;
+        try {
+            linuxAppImageURL = _getDownloadURLByNameSuffix(releaseAssets, LINUX_APPIMAGE_NAME_SUFFIX);
+        } catch (e) {
+            console.warn("Linux AppImage not found in release assets, skipping linux_appimage in install.json");
+        }
         let installJSON = {
             "phcode.io.DownloadURL": {
                 "windows_x64": windowsDownloadURL,
@@ -187,6 +217,9 @@ export default async function printStuff({github, context, githubWorkspaceRoot})
                 "chrome_os": "https://play.google.com/store/apps/details?id=prod.phcode.twa"
             }
         };
+        if (linuxAppImageURL) {
+            installJSON["phcode.io.DownloadURL"]["linux_appimage"] = linuxAppImageURL;
+        }
         installJSON = JSON.stringify(installJSON, null, 4);
         console.log("writing install.json to path: ", installJsonPath, " contents: ",  installJSON)
         fs.writeFileSync(installJsonPath, installJSON);