Add Fedora and Arch package recipes (#24)

* Package Ferese for Fedora and Arch releases * Build release packages alongside workspace checks * Include dependency licenses and software GPU test drivers * Limit package checks to release PRs and fix Arch Cargo dependency * Prepare Ferese 0.1.0-beta * Release config locks before closing inherited file descriptions * Install the lock PAM policy for native release checks * Include xauth in distribution package test dependencies * Regenerate Arch Git package metadata * Run package checks with an explicit UTC timezone * Remove unused bundled fonts and accept installed license receipts * Format the system font test helper * Load an installed font for headless text rendering checks * Isolate package test runtimes and reap container child processes
2026-10-11 14:16:00 +01:00
1 parent 587602b493
commit 1b9fabbbe4
@@ -3,12 +3,12 @@ on:
  pull_request:
  push:
    branches: [main]
-    tags: ["v*"]
  workflow_dispatch:
+  workflow_call:
 permissions:
  contents: read
 concurrency:
-  group: release-checks-${{ github.ref }}
+  group: release-checks-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false
 jobs:
  workspace:
@@ -69,7 +69,9 @@ jobs:
          cargo test --locked -p ferese backends::direct::capture::tests::capture_recomposes_cursor_without_touching_the_display_target -- --ignored
          cargo test --locked -p ferese winit::tests::capture_failure_restores_display_target_and_subsequent_frames_render -- --ignored
      - name: Test native shell, visibility and resize behavior
-        run: python3 scripts/ci/run-native-checks.py --suite desktop --log-dir native-logs
+        run: |
+          install -m 0644 packaging/pam.d/ferese-lock.fedora /etc/pam.d/ferese-lock
+          python3 scripts/ci/run-native-checks.py --suite desktop --log-dir native-logs
      - name: Upload native test logs
        if: always()
        uses: actions/upload-artifact@v4
@@ -79,37 +81,3 @@ jobs:
          if-no-files-found: ignore
      - name: Test installer, session recovery and private portal contracts
        run: python3 -m unittest discover -s scripts/tests -v
-
-  publish:
-    name: Publish validated tag
-    needs: workspace
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/github-script@v8
-        with:
-          script: |
-            const tag = context.ref.slice('refs/tags/'.length);
-            const repo = context.repo;
-            const commit = await github.rest.repos.getCommit({...repo, ref: tag});
-            if (commit.data.sha !== context.sha) {
-              throw new Error('Release tag moved after validation');
-            }
-            let release;
-            try {
-              release = (await github.rest.repos.getReleaseByTag({...repo, tag})).data;
-            } catch (error) {
-              if (error.status !== 404) throw error;
-            }
-            if (release?.draft) {
-              await github.rest.repos.updateRelease({...repo, release_id: release.id, draft: false});
-            } else if (!release) {
-              await github.rest.repos.createRelease({
-                ...repo, tag_name: tag, name: tag,
-                generate_release_notes: true, prerelease: tag.includes('-')
-              });
-            } else {
-              core.notice(`Release ${tag} is already published`);
-            }
@@ -0,0 +1,173 @@
+name: Release packages
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_BUILD_JOBS: '2'
+  CARGO_INCREMENTAL: '0'
+  CARGO_PROFILE_RELEASE_DEBUG: '0'
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  checks:
+    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'release')
+    uses: ./.github/workflows/release-checks.yml
+
+  source:
+    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'release')
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Read release version
+        id: version
+        env:
+          RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || '' }}
+        run: |
+          python3 - <<'PY'
+          import importlib.util, os
+          spec = importlib.util.spec_from_file_location('package', 'scripts/package.py')
+          package = importlib.util.module_from_spec(spec)
+          spec.loader.exec_module(package)
+          version = package.version()
+          package.check_tag(os.environ['RELEASE_TAG'], version)
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              print(f'version={version}', file=output)
+          PY
+      - name: Install pinned Rust toolchain
+        run: rustup show
+      - name: Package offline sources and recipes
+        env:
+          RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || '' }}
+        run: |
+          python3 -m unittest discover -s scripts/tests -p test_package.py
+          python3 scripts/package.py source --tag "$RELEASE_TAG"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-source
+          path: target/dist/*
+          if-no-files-found: error
+          compression-level: 0
+
+  fedora:
+    needs: source
+    runs-on: ubuntu-24.04
+    container:
+      image: fedora:44
+      options: --init
+    steps:
+      - name: Install RPM tooling
+        run: dnf install -y rpm-build dnf5-plugins git findutils tar gzip
+      - uses: actions/download-artifact@v8
+        with:
+          name: release-source
+          path: dist
+      - name: Build and test Fedora package
+        run: |
+          dnf builddep -y dist/ferese.spec
+          mkdir -p /tmp/rpmbuild/SOURCES
+          cp dist/ferese-*.tar.gz /tmp/rpmbuild/SOURCES/
+          rpmbuild -ba --define '_topdir /tmp/rpmbuild' dist/ferese.spec
+          mkdir -p artifacts
+          find /tmp/rpmbuild/RPMS /tmp/rpmbuild/SRPMS -name '*.rpm' -exec cp '{}' artifacts/ \;
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-fedora
+          path: artifacts/*.rpm
+          if-no-files-found: error
+          compression-level: 0
+
+  arch:
+    needs: source
+    runs-on: ubuntu-24.04
+    container:
+      image: archlinux:base-devel
+      options: --init
+    steps:
+      - name: Prepare Arch build user and dependencies
+        run: |
+          pacman -Syu --noconfirm --needed rust cargo cmake clang pkgconf python git desktop-file-utils \
+            wayland libxkbcommon libinput systemd seatd mesa vulkan-swrast libdrm fontconfig freetype2 expat dbus \
+            pam polkit foot pipewire wireplumber libpipewire gstreamer xdg-desktop-portal xdg-desktop-portal-gtk xorg-xauth
+          useradd --create-home builder
+      - uses: actions/download-artifact@v8
+        with:
+          name: release-source
+          path: dist
+      - name: Build and test Arch package
+        run: |
+          mkdir -p /home/builder/package
+          cp dist/PKGBUILD dist/ferese-*.tar.gz /home/builder/package/
+          chown -R builder:builder /home/builder/package
+          runuser -u builder -- bash -c 'cd /home/builder/package && makepkg --cleanbuild --noconfirm'
+          mkdir -p artifacts
+          cp /home/builder/package/*.pkg.tar.zst artifacts/
+          runuser -u builder -- bash -c 'cd /home/builder/package && makepkg --printsrcinfo' > artifacts/ferese.SRCINFO
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-arch
+          path: artifacts/*
+          if-no-files-found: error
+          compression-level: 0
+
+  publish:
+    if: github.event_name == 'push' && github.ref_type == 'tag'
+    needs: [source, checks, fedora, arch]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: release-*
+          merge-multiple: true
+          path: artifacts
+      - name: Prepare draft release
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const tag = context.ref.slice('refs/tags/'.length);
+            const repo = context.repo;
+            const commit = await github.rest.repos.getCommit({...repo, ref: tag});
+            if (commit.data.sha !== context.sha) {
+              throw new Error('Release tag moved after validation');
+            }
+            let release;
+            try {
+              release = (await github.rest.repos.getReleaseByTag({...repo, tag})).data;
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+            if (release && !release.draft) {
+              throw new Error(`Release ${tag} is already published`);
+            }
+            if (!release) {
+              await github.rest.repos.createRelease({
+                ...repo, tag_name: tag, name: tag, draft: true,
+                generate_release_notes: true, prerelease: tag.includes('-')
+              });
+            }
+      - name: Upload packages and publish completed release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          cd artifacts
+          rm SHA256SUMS
+          sha256sum * > SHA256SUMS
+          gh release upload "$RELEASE_TAG" ./* --clobber
+          test "$(gh api "repos/$GH_REPO/commits/$RELEASE_TAG" --jq .sha)" = "$GITHUB_SHA"
+          gh release edit "$RELEASE_TAG" --draft=false