mirror of
https://github.com/outbackdingo/hyprcosmic.git
synced 2026-08-25 14:53:21 +00:00
gitops
a397334242
Run 31383454158, debian job, eighteen minutes in:
error: failed to run custom build command for `dav1d-sys v0.8.3`
Package 'dav1d', required by 'virtual:world', not found
dav1d is pulled in by cosmic-bg, and nothing in the obvious set of
compositor dependencies names it. A hand-assembled list will keep having
that shape of hole, and each one costs a full run to find.
So the lists are now the union of Build-Depends across all 27 upstream
components' debian/control files, collected mechanically. That adds
libdav1d-dev, libglib2.0-dev, libspa-0.2-dev, libegl1-mesa-dev,
imagemagick, intltool and fonts-open-sans, none of which were present
before and all of which upstream declares.
The Fedora and Arch translations were verified against `dnf repoquery` and
archlinux.org's package API rather than guessed, because a name that does
not exist fails the whole step and costs another run to discover: it is
libdav1d-devel on Fedora and not dav1d-devel, and ttf-opensans on Arch and
not otf-opensans. Both mistakes were in the first draft of this commit.
405 lines
18 KiB
YAML
405 lines
18 KiB
YAML
# Build installable HyprCosmic packages for Fedora, Arch and Debian.
|
|
#
|
|
# WHY THIS IS A SEPARATE WORKFLOW FROM hyprcosmic.yml
|
|
# --------------------------------------------------
|
|
# hyprcosmic.yml beside it answers "does the fork still build and do the assets
|
|
# still install where they claim to", on every push, in a few minutes. This one
|
|
# compiles 27 Rust components three times over and takes hours. Sharing a file
|
|
# would mean either running the slow thing on every push or never running the
|
|
# fast thing on a tag, and a `if:` guard threaded through a shared matrix to
|
|
# avoid that is harder to read than two files.
|
|
#
|
|
# WHY IT DOES NOT RUN ON EVERY PUSH
|
|
# ---------------------------------
|
|
# Three full desktop builds per commit is hours of runner time to produce
|
|
# artifacts nobody downloads. Tags get packages because that is when a package
|
|
# means something; workflow_dispatch covers wanting one at any other time.
|
|
#
|
|
# WHY THE WHOLE JOB RUNS IN A CONTAINER
|
|
# -------------------------------------
|
|
# Nothing here is statically linked, so a package is only valid on the
|
|
# distribution that built it -- an RPM built on Ubuntu's runner would name
|
|
# Ubuntu's sonames and refuse to install on Fedora. `container:` puts the
|
|
# compile, the staging and the package build all inside an image of the target,
|
|
# so the sonames recorded are the ones that will exist on the machine installing
|
|
# it. This is also why no step here runs on a developer's workstation: the
|
|
# distribution being targeted is rarely the one being typed at.
|
|
name: Packages
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'Version to stamp on the packages'
|
|
required: false
|
|
default: '0.1.0'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
RUST_BACKTRACE: 1
|
|
|
|
jobs:
|
|
package:
|
|
name: ${{ matrix.distro }}
|
|
runs-on: ubuntu-latest
|
|
container: ${{ matrix.image }}
|
|
# GitHub defaults `run:` to `sh -e {0}` inside a container, and on Debian
|
|
# that is dash. Several steps below use brace expansion and process
|
|
# substitution, which dash does not have and which bash-invoked-as-sh
|
|
# disables. Naming bash once here is better than writing POSIX around a
|
|
# constraint no target actually imposes -- all three images ship bash.
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
strategy:
|
|
# One distribution failing on a package name is worth seeing on its own,
|
|
# and the other two artifacts are still worth having.
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- distro: fedora
|
|
image: fedora:44
|
|
- distro: arch
|
|
image: archlinux:base-devel
|
|
# trixie rather than the bookworm the other workflows use. bookworm has
|
|
# no `just` package -- it arrived in trixie -- and its rustc is 1.63,
|
|
# so `just` would have to be compiled by a toolchain installed before
|
|
# the thing that installs toolchains. CI pays that to prove the crate
|
|
# builds on the oldest supported Debian; a package has no such point
|
|
# to make.
|
|
- distro: debian
|
|
image: debian:trixie
|
|
|
|
steps:
|
|
# Before checkout, deliberately: actions/checkout needs git in the image
|
|
# and these are bare.
|
|
#
|
|
# The library lists are the union of Build-Depends across all 27 upstream
|
|
# components' debian/control files, translated per distribution rather
|
|
# than trimmed. Derived mechanically rather than assembled by hand, after
|
|
# a hand-assembled list built for eighteen minutes and then failed on
|
|
# dav1d -- a dependency of cosmic-bg that nothing in the obvious set names.
|
|
#
|
|
# The Fedora and Arch translations were checked against dnf repoquery and
|
|
# archlinux.org's package API rather than guessed, because a name that
|
|
# does not exist fails the whole step: it is libdav1d-devel on Fedora, not
|
|
# dav1d-devel, and ttf-opensans on Arch, not otf-opensans.
|
|
#
|
|
# The Fedora list names a set of basic tools the other two get for free.
|
|
# Fedora's container image is deliberately minimal: no `which` (deprecated
|
|
# there in favour of `command -v`), no make, no findutils, no tar. Arch's
|
|
# base-devel and Debian's build-essential plus its essential set include
|
|
# all of them, which is why this only ever broke on one of the three.
|
|
#
|
|
# These are not guesses. The top-level justfile opens with
|
|
# `make := \`which make\``, and the submodules' own recipes shell out to
|
|
# find, xargs, tar and sed -- 114 tar invocations and 18 find between
|
|
# them. Several steps in this workflow use find as well.
|
|
- name: Install build dependencies (fedora)
|
|
if: matrix.distro == 'fedora'
|
|
run: |
|
|
dnf -y install --setopt=install_weak_deps=False \
|
|
git curl ca-certificates just \
|
|
gcc gcc-c++ make which findutils tar gzip sed diffutils \
|
|
cmake pkgconf-pkg-config nasm lld mold \
|
|
clang-devel llvm-devel \
|
|
desktop-file-utils rpm-build intltool ImageMagick open-sans-fonts \
|
|
dbus-devel expat-devel fontconfig-devel freetype-devel \
|
|
libinput-devel libseat-devel libxkbcommon-devel \
|
|
mesa-libgbm-devel mesa-libEGL-devel libglvnd-devel \
|
|
wayland-devel libdisplay-info-devel libdav1d-devel \
|
|
pixman-devel cairo-devel pango-devel glib2-devel gtk3-devel gtk4-devel \
|
|
pipewire-devel pulseaudio-libs-devel \
|
|
gstreamer1-devel gstreamer1-plugins-base-devel \
|
|
flatpak-devel systemd-devel libgudev-devel \
|
|
openssl-devel pam-devel libxml2-devel xkeyboard-config-devel
|
|
|
|
# Shorter than the others, and not by omission: Arch ships headers in the
|
|
# main package rather than splitting a -devel, so `wayland` here is
|
|
# `wayland-devel` on Fedora.
|
|
- name: Install build dependencies (arch)
|
|
if: matrix.distro == 'arch'
|
|
run: |
|
|
pacman -Syu --noconfirm --needed \
|
|
git curl just cmake pkgconf nasm lld mold clang llvm \
|
|
desktop-file-utils sudo intltool imagemagick ttf-opensans \
|
|
dbus expat fontconfig freetype2 \
|
|
libinput seatd libxkbcommon \
|
|
mesa libglvnd wayland libdisplay-info dav1d \
|
|
pixman cairo pango glib2 gtk3 gtk4 \
|
|
pipewire libpipewire libpulse gst-plugins-base-libs \
|
|
flatpak systemd-libs libgudev \
|
|
openssl pam libxml2 xkeyboard-config
|
|
|
|
- name: Install build dependencies (debian)
|
|
if: matrix.distro == 'debian'
|
|
run: |
|
|
apt-get update
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
git curl ca-certificates just \
|
|
build-essential cmake pkg-config nasm lld mold \
|
|
clang libclang-dev llvm-dev \
|
|
desktop-file-utils dpkg-dev fakeroot file \
|
|
intltool imagemagick fonts-open-sans \
|
|
libdbus-1-dev libexpat1-dev libfontconfig-dev libfreetype-dev \
|
|
libinput-dev libseat-dev libxkbcommon-dev \
|
|
libgbm-dev libegl-dev libegl1-mesa-dev libgles-dev \
|
|
libwayland-dev libdisplay-info-dev libdav1d-dev \
|
|
libpixman-1-dev libcairo2-dev libpango1.0-dev libglib2.0-dev \
|
|
libgtk-3-dev libgtk-4-dev \
|
|
libpipewire-0.3-dev libspa-0.2-dev libpulse-dev \
|
|
libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \
|
|
libflatpak-dev libsystemd-dev libudev-dev libgudev-1.0-dev \
|
|
libssl-dev libpam0g-dev libxml2-dev xkb-data libxcb1-dev
|
|
|
|
# submodules: recursive is the whole point -- this repository is 27
|
|
# components plus the two forks, and a checkout without them builds
|
|
# nothing.
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
submodules: recursive
|
|
|
|
# stable as the default, not `none`.
|
|
#
|
|
# The two fork workflows use --default-toolchain none and let
|
|
# rust-toolchain.toml decide, which is right there because the checkout
|
|
# root is the crate and the pin sits in it. Here it does not: the pin is
|
|
# cosmic-comp/rust-toolchain.toml, one level down, and this job's other 27
|
|
# components have no pin at all. With `none` there is no default to fall
|
|
# back to and the first cargo invocation at the repository root fails
|
|
# before anything is built.
|
|
#
|
|
# Naming stable does not weaken the pin. rustup applies a directory-local
|
|
# rust-toolchain.toml whenever it enters that directory and installs it on
|
|
# demand, so cosmic-comp still compiles with the 1.93 it asks for while
|
|
# everything else uses stable.
|
|
- name: Install Rust
|
|
run: |
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
|
|
| sh -s -- -y --default-toolchain stable --profile minimal
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Show toolchain
|
|
run: |
|
|
rustup show
|
|
cargo --version
|
|
just --version
|
|
|
|
# No Swatinem/rust-cache here, unlike the two fork workflows.
|
|
#
|
|
# It was tried and it fails on this repository specifically: the action
|
|
# runs `cargo metadata` at the workspace root to work out what to cache,
|
|
# and this root is a meta-repository with no Cargo.toml -- it is 29
|
|
# submodules, each its own crate with its own target/. The action reported
|
|
# `could not find Cargo.toml in /__w/hyprcosmic/hyprcosmic` and cached
|
|
# nothing.
|
|
#
|
|
# Listing all 29 workspaces would fix the error and create a worse
|
|
# problem: their target directories come to roughly 17 GB, against a 10 GB
|
|
# per-repository cache limit, so the jobs would evict each other's entries
|
|
# every run and pay upload time for the privilege. A cold build is the
|
|
# honest cost of a workflow that only runs on tags and on demand.
|
|
- name: Determine version
|
|
id: ver
|
|
run: |
|
|
set -eux
|
|
# A tag is authoritative; a manual run uses its input; anything else
|
|
# falls back so the job is still testable from a branch.
|
|
if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
|
|
v="${GITHUB_REF_NAME#v}"
|
|
else
|
|
v="${{ inputs.version || '0.1.0' }}"
|
|
fi
|
|
echo "version=$v" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build
|
|
run: just build
|
|
|
|
# prefix=/usr, not the justfile's /usr/local default. Both .desktop files
|
|
# name an absolute Exec under /usr/bin -- a desktop entry cannot
|
|
# interpolate a prefix -- so any other prefix stages entries pointing at
|
|
# paths this step did not write.
|
|
- name: Stage the install
|
|
run: just install "$PWD/stage" /usr
|
|
|
|
# The staged tree is what all three packages wrap, so it is worth failing
|
|
# here rather than shipping a package that is missing the compositor. The
|
|
# negative assertion is the one that would rot quietly: nothing may return
|
|
# to the private libexec layout this fork used to install into, because a
|
|
# copy there is a second compositor that nothing runs and no uninstall
|
|
# removes.
|
|
- name: Assert the staged tree is a complete desktop
|
|
run: |
|
|
set -eux
|
|
test -x stage/usr/bin/cosmic-comp
|
|
test -x stage/usr/bin/cosmic-session
|
|
test -x stage/usr/bin/cosmic-conf
|
|
test -x stage/usr/bin/start-hyprcosmic
|
|
test -x stage/usr/bin/start-cosmic
|
|
test -f stage/usr/share/wayland-sessions/hyprcosmic.desktop
|
|
test -f stage/usr/share/wayland-sessions/cosmic.desktop
|
|
test -f stage/usr/lib/systemd/user/cosmic-session.target
|
|
test -f stage/usr/share/cosmic/com.system76.CosmicSettings.Shortcuts/v1/defaults
|
|
test -d stage/usr/share/hyprcosmic
|
|
test ! -e stage/usr/libexec/hyprcosmic
|
|
echo "staged files: $(find stage -type f | wc -l)"
|
|
|
|
# ---- Fedora -------------------------------------------------------
|
|
#
|
|
# The file list is generated rather than written into the spec. Across 27
|
|
# components a hand-maintained %files would be stale within a week, and
|
|
# stale in the direction that omits files nobody misses until a login
|
|
# fails.
|
|
#
|
|
# Directories need care. A %dir line for every staged directory would
|
|
# have the package claim /usr, /usr/bin and /usr/share, which the
|
|
# `filesystem` package owns -- the RPM would build fine and then refuse to
|
|
# install, or worse, take those directories with it on uninstall. So a
|
|
# directory is only claimed if no package on the build system already owns
|
|
# it, which leaves exactly the ones this fork creates
|
|
# (/usr/share/hyprcosmic and friends).
|
|
- name: Build the RPM
|
|
if: matrix.distro == 'fedora'
|
|
run: |
|
|
set -eux
|
|
mkdir -p rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
|
|
: > files.list
|
|
find stage -mindepth 1 -type d -printf '%P\n' | while read -r d; do
|
|
rpm -qf --quiet "/$d" || printf '%%%%dir "/%s"\n' "$d" >> files.list
|
|
done
|
|
find stage -mindepth 1 \! -type d -printf '"/%P"\n' >> files.list
|
|
wc -l files.list
|
|
rpmbuild -bb packaging/fedora/hyprcosmic.spec \
|
|
--define "_topdir $PWD/rpmbuild" \
|
|
--define "stagedir $PWD/stage" \
|
|
--define "filelist $PWD/files.list" \
|
|
--define "ver ${{ steps.ver.outputs.version }}"
|
|
mkdir -p dist
|
|
find rpmbuild/RPMS -name '*.rpm' -exec cp -v {} dist/ \;
|
|
|
|
# A package that installs is the claim being made, so it is tested rather
|
|
# than assumed. --setopt=tsflags=test does the whole resolution and
|
|
# conflict check without writing to the container.
|
|
- name: Verify the RPM
|
|
if: matrix.distro == 'fedora'
|
|
run: |
|
|
set -eux
|
|
rpm -qpi dist/*.rpm
|
|
rpm -qp --requires dist/*.rpm
|
|
dnf -y install --setopt=tsflags=test dist/*.rpm
|
|
|
|
# ---- Arch ---------------------------------------------------------
|
|
#
|
|
# makepkg refuses to run as root, and a container is root by default, so
|
|
# the build runs as an unprivileged user that owns the tree it reads.
|
|
# --nodeps because the depends array names a running system's runtime
|
|
# libraries, which this image has no reason to hold, and nothing is being
|
|
# compiled at this point anyway.
|
|
- name: Build the Arch package
|
|
if: matrix.distro == 'arch'
|
|
run: |
|
|
set -eux
|
|
useradd -m builder
|
|
mkdir -p dist
|
|
cp packaging/arch/PKGBUILD .
|
|
chown -R builder:builder .
|
|
sudo -u builder \
|
|
HYPRCOSMIC_STAGEDIR="$PWD/stage" \
|
|
HYPRCOSMIC_VERSION="${{ steps.ver.outputs.version }}" \
|
|
PKGDEST="$PWD/dist" \
|
|
makepkg --nodeps --noconfirm
|
|
|
|
- name: Verify the Arch package
|
|
if: matrix.distro == 'arch'
|
|
run: |
|
|
set -eux
|
|
pacman -Qip dist/*.pkg.tar.zst
|
|
# Contents rather than an install: pacman has no dry run that resolves
|
|
# dependencies without touching the filesystem, and this image is not
|
|
# a desktop, so a real install would fail on runtime libraries that
|
|
# say nothing about whether the package is well formed.
|
|
pacman -Qlp dist/*.pkg.tar.zst | head -20
|
|
|
|
# ---- Debian -------------------------------------------------------
|
|
#
|
|
# dpkg-deb --build over a staged tree, rather than a full source package.
|
|
# The Depends line is computed by dpkg-shlibdeps from the binaries
|
|
# themselves rather than written by hand -- 27 components link against
|
|
# more libraries than anyone will keep an accurate list of, and a hand
|
|
# list is wrong in the direction that installs and then fails to start.
|
|
#
|
|
# dpkg-shlibdeps insists on a debian/control in the working directory even
|
|
# when invoked outside a source package, hence the stub.
|
|
- name: Build the Debian package
|
|
if: matrix.distro == 'debian'
|
|
run: |
|
|
set -eux
|
|
mkdir -p debian
|
|
printf 'Source: hyprcosmic\n\nPackage: hyprcosmic\nArchitecture: amd64\n' > debian/control
|
|
binaries=$(find stage -type f -perm -100 -exec sh -c 'file -b "$1" | grep -q ELF && echo "$1"' _ {} \;)
|
|
dpkg-shlibdeps -O --ignore-missing-info $binaries > shlibdeps.txt
|
|
deps=$(sed 's/^shlibs:Depends=//' shlibdeps.txt)
|
|
size=$(du -sk stage | cut -f1)
|
|
|
|
mkdir -p stage/DEBIAN
|
|
sed -e "s|@VERSION@|${{ steps.ver.outputs.version }}|" \
|
|
-e "s|@INSTALLED_SIZE@|$size|" \
|
|
-e "s|@SHLIB_DEPENDS@|$deps|" \
|
|
packaging/debian/control.in > stage/DEBIAN/control
|
|
cat stage/DEBIAN/control
|
|
|
|
mkdir -p dist
|
|
dpkg-deb --build --root-owner-group stage \
|
|
"dist/hyprcosmic_${{ steps.ver.outputs.version }}_amd64.deb"
|
|
|
|
- name: Verify the Debian package
|
|
if: matrix.distro == 'debian'
|
|
run: |
|
|
set -eux
|
|
dpkg-deb --info dist/*.deb
|
|
dpkg-deb --contents dist/*.deb | head -20
|
|
# lintian is not installed and would fail this package on a dozen
|
|
# policy points that do not apply to a desktop fork shipped outside
|
|
# the archive. What matters here is that dpkg can read it back.
|
|
dpkg-deb --fsys-tarfile dist/*.deb | tar -tf - >/dev/null
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: hyprcosmic-${{ matrix.distro }}
|
|
path: dist/
|
|
retention-days: 30
|
|
|
|
# Only on a tag. A dispatch run is for getting artifacts to try, and turning
|
|
# one into a public release would make every experiment look like a shipped
|
|
# version.
|
|
release:
|
|
needs: package
|
|
if: github.ref_type == 'tag'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/download-artifact@v4
|
|
with:
|
|
path: dist
|
|
merge-multiple: true
|
|
|
|
- name: Attach the packages to the release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
files: dist/*
|
|
# Draft, deliberately. These packages conflict with the
|
|
# distribution's cosmic-comp and cosmic-session, so installing one
|
|
# replaces the machine's desktop. That is worth a human reading the
|
|
# notes before it is published rather than a tag push making it
|
|
# available.
|
|
draft: true
|
|
generate_release_notes: true
|