linux-packages.yml

name: Linux packages

# Builds the Ubuntu and Fedora packages from the release source tarballs.
# The Debian source package is built once for each Ubuntu series the PPA
# builds for, and its binaries are built from it the way Launchpad builds
# them: offline, in a fresh container with only the declared build
# dependencies, then checked with lintian. The .rpm is built in Mock, as
# COPR builds it, for each Fedora release COPR builds for: the BuildRequires
# go into a fresh chroot, then the build runs there with no network, then
# rpmlint. Each package is then installed in another fresh container of its
# release with only its runtime dependencies and started.
# release-matrix.json names the series and releases.
# The Flatpak is built offline from the same tarballs with the release
# manifest, with every Meson suite, on the nightly and when asked for. It is
# signed with a throwaway key into repositories laid out as
# flatpak.tablepro.app serves them, validated, then installed from a
# .flatpakref and from a bundle, updated, and switched between the release
# and beta branches, in fresh Ubuntu 22.04, 24.04 and 26.04 containers that
# have only their own Flatpak.
# release-linux.yml calls this workflow in a dry run, and the tag of that
# commit publishes what it built, the source packages to the PPA.
# ci.yml calls it when a change touches what the packages declare or how they
# build (the packages suite), x86_64 only. nightly.yml calls it with the
# Flatpak every night, and with arm64 on Sundays. A run by hand can add both.
# Given a release tag, it packages that release's tarballs instead, with
# the packaging from this checkout, for a PPA upload with a new revision.
# Only release-linux.yml passes the PostHog key, so every other run builds
# packages that send no usage data.

on:
  workflow_dispatch:
    inputs:
      arm64:
        description: Also build, test and install the arm64 .deb and .rpm
        type: boolean
        default: false
      flatpak:
        description: Also build the Flatpak, and install and update it from a repository
        type: boolean
        default: false
  workflow_call:
    inputs:
      deb-runners:
        description: JSON list of runners; each series' .deb is built once per runner architecture.
        type: string
        default: '["ubuntu-24.04"]'
      rpm-runners:
        description: JSON list of runners; the .rpm is built once per runner architecture.
        type: string
        default: '["ubuntu-24.04"]'
      release-tag:
        description: A published linux-vX.Y.Z whose tarballs are packaged, with the .deb packaging from this checkout. No .rpm is built.
        type: string
        default: ""
      revision:
        description: The PPA upload number, the N in X.Y.Z-0ppaN.
        type: string
        default: "1"
      flatpak:
        description: Also build the Flatpak once per rpm-runners architecture, and install and update it from a repository.
        type: boolean
        default: false
      flatpak-branch:
        description: The Flatpak branch, stable or beta.
        type: string
        default: stable
      # Only a release's call passes it, so a run of this workflow on its own builds packages without one.
      posthog-key:
        description: The PostHog project key the vendor tarball carries for the .deb, the .rpm and the Flatpak. Public by design.
        type: string
        default: ""
      retention-days:
        description: Days the tarballs, source packages, packages and Flatpak repositories are kept, 0 for the repository's default.
        type: number
        default: 0

permissions:
  contents: read

jobs:
  # The Ubuntu series and Fedora releases come from release-matrix.json, which
  # release_assets.py checks a release's assets against.
  matrix:
    name: Release matrix
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      ubuntu-series: ${{ steps.read.outputs.ubuntu-series }}
      fedora: ${{ steps.read.outputs.fedora }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Read release-matrix.json
        id: read
        run: |
          python3 - >> "$GITHUB_OUTPUT" <<'EOF'
          import json
          with open("linux/build-aux/packaging/release-matrix.json", encoding="utf-8") as file:
              matrix = json.load(file)
          print("ubuntu-series=" + " ".join(ubuntu["series"] for ubuntu in matrix["ubuntu"]))
          print("fedora=" + json.dumps(matrix["fedora"]))
          EOF

  sources:
    name: Source tarballs
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    container:
      image: ubuntu:26.04
    steps:
      # Before the checkout: without git, actions/checkout downloads a
      # tarball, which leaves no .git for make-dist.sh to archive.
      - name: Install git
        run: |
          apt-get update
          apt-get install -y --no-install-recommends ca-certificates git
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Make the source and vendor tarballs
        if: inputs.release-tag == ''
        env:
          POSTHOG_KEY: ${{ inputs.posthog-key }}
        run: linux/build-aux/packaging/make-sources.sh --install-deps --posthog-key "$POSTHOG_KEY" _packages/sources
      - name: Download the released source and vendor tarballs
        if: inputs.release-tag != ''
        env:
          TAG: ${{ inputs.release-tag }}
        run: linux/build-aux/packaging/fetch-release-sources.sh --install-deps "$GITHUB_REPOSITORY" "$TAG" _packages/sources
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-sources
          path: _packages/sources
          if-no-files-found: error
          retention-days: ${{ inputs.retention-days }}

  source-package:
    name: Debian source packages
    needs: [matrix, sources]
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    container:
      image: ubuntu:26.04
    env:
      # Every Ubuntu series the PPA builds for.
      UBUNTU_SERIES: ${{ needs.matrix.outputs.ubuntu-series }}
    outputs:
      series: ${{ steps.build.outputs.series }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: linux-sources
          path: _packages/sources
      - name: Build an unsigned source package for each series
        id: build
        env:
          RELEASE_TAG: ${{ inputs.release-tag }}
          REVISION: ${{ inputs.revision || '1' }}
        run: |
          dist="$(find _packages/sources -name 'tablepro-*.tar.xz' ! -name '*-vendor.tar.xz')"
          vendor="$(find _packages/sources -name 'tablepro-*-vendor.tar.xz')"
          set -- --revision "$REVISION"
          if [ -n "$RELEASE_TAG" ]; then
            set -- "$@" --debian linux/build-aux/debian
          fi
          # shellcheck disable=SC2086 # one word per series
          linux/build-aux/packaging/build-source.sh --install-deps "$@" "$dist" "$vendor" _packages/source $UBUNTU_SERIES
          series=""
          for name in $UBUNTU_SERIES; do
            series="$series${series:+, }\"$name\""
          done
          echo "series=[$series]" >> "$GITHUB_OUTPUT"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-source-package
          path: _packages/source
          if-no-files-found: error
          retention-days: ${{ inputs.retention-days }}

  # On the runner itself rather than in a job container, so build-deb.sh
  # can start the containers it builds in, the build one with no network.
  deb:
    name: Debian package (${{ matrix.series }}, ${{ matrix.runner }})
    needs: source-package
    strategy:
      fail-fast: false
      matrix:
        runner: ${{ fromJSON(inputs.deb-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
        series: ${{ fromJSON(needs.source-package.outputs.series) }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 300
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/linux-package-disk
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: linux-source-package
          path: _packages/source
      - name: Build offline, test and lint the package
        env:
          SERIES: ${{ matrix.series }}
        run: |
          changes="$(grep -l -x "Distribution: $SERIES" _packages/source/*_source.changes)"
          linux/build-aux/packaging/build-deb.sh "${changes%_source.changes}.dsc" _packages/deb
      - name: Keep the Meson test log
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-deb-testlog-${{ matrix.series }}-${{ runner.arch }}
          path: _packages/deb/testlog.txt
          if-no-files-found: ignore
          retention-days: 7
      - name: Install, start and validate in a fresh container
        env:
          SERIES: ${{ matrix.series }}
          RELEASE_TAG: ${{ inputs.release-tag }}
        run: |
          set -- "$(find _packages/deb -name 'tablepro_*.deb')"
          # A published release's tarballs may ship other languages than
          # this checkout's LINGUAS names.
          if [ -z "$RELEASE_TAG" ]; then
            set -- "$@" linux/po/LINGUAS
          fi
          docker run --rm -v "$PWD:$PWD" -w "$PWD" "ubuntu:$SERIES" \
            linux/build-aux/packaging/smoke-test.sh "$@"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-deb-${{ matrix.series }}-${{ runner.arch }}
          path: _packages/deb
          if-no-files-found: error
          retention-days: ${{ inputs.retention-days }}

  rpm:
    name: RPM package (Fedora ${{ matrix.fedora }}, ${{ matrix.runner }})
    needs: [matrix, sources]
    if: inputs.release-tag == ''
    strategy:
      fail-fast: false
      matrix:
        runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
        # Every Fedora release the COPR project builds for, from release-matrix.json.
        fedora: ${{ fromJSON(needs.matrix.outputs.fedora) }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 300
    # On the runner itself, so the build's container can go on the larger
    # disk. It is privileged, since Mock mounts the chroot's filesystems and
    # build-rpm.sh unshares the network for the build.
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/linux-package-disk
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: linux-sources
          path: _packages/sources
      - name: Build, test and lint the package
        env:
          FEDORA: ${{ matrix.fedora }}
        run: |
          dist="$(find _packages/sources -name 'tablepro-*.tar.xz' ! -name '*-vendor.tar.xz')"
          vendor="$(find _packages/sources -name 'tablepro-*-vendor.tar.xz')"
          docker run --rm --privileged -v "$PWD:$PWD" -w "$PWD" "fedora:$FEDORA" \
            linux/build-aux/packaging/build-rpm.sh "$dist" "$vendor" _packages/rpm
      - name: Keep the RPM failure logs
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-rpm-testlog-${{ matrix.fedora }}-${{ runner.arch }}
          path: |
            _packages/rpm/testlog.txt
            _packages/rpm/build.log
            _packages/rpm/disk-usage.tsv
            _packages/rpm/disk-usage.txt
          if-no-files-found: ignore
          retention-days: 7
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-rpm-${{ matrix.fedora }}-${{ runner.arch }}
          path: _packages/rpm
          if-no-files-found: error
          retention-days: ${{ inputs.retention-days }}

  rpm-install:
    name: Install the RPM package (Fedora ${{ matrix.fedora }}, ${{ matrix.runner }})
    needs: [matrix, rpm]
    strategy:
      fail-fast: false
      matrix:
        runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
        # Every Fedora release the COPR project builds for, from release-matrix.json.
        fedora: ${{ fromJSON(needs.matrix.outputs.fedora) }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    container:
      image: fedora:${{ matrix.fedora }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: linux-rpm-${{ matrix.fedora }}-${{ runner.arch }}
          path: _packages/rpm
      - name: Install, start and validate
        run: |
          linux/build-aux/packaging/smoke-test.sh \
            "$(find _packages/rpm -name 'tablepro-[0-9]*.rpm' ! -name '*.src.rpm')" linux/po/LINGUAS

  # From the same tarballs as the packages, offline, with every Meson suite in
  # the sandbox (build-flatpak.sh). The unsigned repository goes to
  # release-linux.yml, which signs it.
  flatpak:
    name: Flatpak (${{ matrix.runner }})
    needs: sources
    if: inputs.flatpak || github.event_name == 'schedule'
    strategy:
      fail-fast: false
      matrix:
        runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 300
    container:
      image: ghcr.io/flathub-infra/flatpak-github-actions:gnome-51
      options: --privileged
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: linux-sources
          path: _packages/sources
      - name: Build and test
        env:
          BRANCH: ${{ inputs.flatpak-branch || 'stable' }}
        run: |
          xvfb-run --auto-servernum linux/build-aux/packaging/build-flatpak.sh --branch "$BRANCH" \
            "$(find _packages/sources -name 'tablepro-*.tar.xz' ! -name '*-vendor.tar.xz')" \
            "$(find _packages/sources -name 'tablepro-*-vendor.tar.xz')" _packages/flatpak
          tar -C _packages/flatpak -cf "_packages/flatpak-repo-$(uname -m).tar" repo
      # One file, since an OSTree repository is thousands.
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-flatpak-repo-${{ runner.arch }}
          path: _packages/flatpak-repo-*.tar
          if-no-files-found: error
          retention-days: ${{ inputs.retention-days }}
      - name: Lint the manifest
        if: runner.arch == 'X64'
        run: |
          flatpak-builder-lint --exceptions --user-exceptions linux/build-aux/flatpak/lint-exceptions.json \
            manifest linux/build-aux/flatpak/app.tablepro.TablePro.json

  # Signed with a throwaway key, for http://127.0.0.1:8080, by the same
  # flatpak-repo.sh release-linux.yml publishes with, on both branches
  # whatever the build's own.
  flatpak-test-repo:
    name: Flatpak test repository
    needs: flatpak
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    container:
      image: ubuntu:26.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: linux-flatpak-repo-*
          path: _packages/flatpak-repo
          merge-multiple: true
      - name: Commit twice to both repositories, bundle the first commit and validate
        run: |
          for tarball in _packages/flatpak-repo/*.tar; do
            mkdir -p "${tarball%.tar}"
            tar -C "${tarball%.tar}" -xf "$tarball"
            set -- "$@" "${tarball%.tar}/repo"
          done
          linux/build-aux/packaging/flatpak-test-site.sh --install-deps _packages/site "$@"
          tar -C _packages -cf _packages/flatpak-test-site.tar site
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-flatpak-test-site
          path: _packages/flatpak-test-site.tar
          if-no-files-found: error

  # Also on the Ubuntu releases below the GNOME 50 floor, whose users have the
  # Flatpak and not the packages, each with its own Flatpak.
  flatpak-install:
    name: Install the Flatpak (Ubuntu ${{ matrix.ubuntu }}, ${{ matrix.runner }})
    needs: flatpak-test-repo
    strategy:
      fail-fast: false
      matrix:
        runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
        ubuntu: ["22.04", "24.04", "26.04"]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    container:
      image: ubuntu:${{ matrix.ubuntu }}
      options: --privileged
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: linux-flatpak-test-site
          path: _packages
      - name: Install from the repositories and a bundle, start, update and switch branches
        run: |
          tar -C _packages -xf _packages/flatpak-test-site.tar
          linux/build-aux/packaging/smoke-test-flatpak.sh _packages/site linux/po/LINGUAS