appimage.yml

name: AppImage (Linux, nix)

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"
    paths:
      - "flake.nix"
      - "flake.lock"
      - "docs/icon.svg"
      - "shell/gpui/**"
      - "crates/**"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".github/workflows/appimage.yml"
  # PRs build only when packaging inputs change; code-only PRs are already compile-covered by GPUI CI's Linux job.
  pull_request:
    paths:
      - "flake.nix"
      - "flake.lock"
      - "docs/icon.svg"
      - "shell/gpui/linux/**"
      - ".github/workflows/appimage.yml"
  release:
    types: [published]

permissions:
  contents: read

concurrency:
  group: appimage-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  appimage:
    name: Build AppImage (${{ matrix.system }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        # PRs build aarch64 only (x86_64 is compile-covered by GPUI CI); tags/releases build both.
        include: ${{ github.event_name == 'pull_request' && fromJSON('[{"system":"aarch64-linux","runner":"ubuntu-24.04-arm","artifact":"jayjay-gpui-aarch64-linux.AppImage"}]') || fromJSON('[{"system":"x86_64-linux","runner":"ubuntu-latest","artifact":"jayjay-gpui-x86_64-linux.AppImage"},{"system":"aarch64-linux","runner":"ubuntu-24.04-arm","artifact":"jayjay-gpui-aarch64-linux.AppImage"}]') }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Validate Linux metadata
        run: |
          sudo apt-get update
          sudo apt-get install -y appstream desktop-file-utils
          desktop-file-validate shell/gpui/linux/dev.hewig.JayJay.desktop
          appstreamcli validate --no-net shell/gpui/linux/dev.hewig.JayJay.metainfo.xml

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@33c9ab3ef95cd57c164d9d6eb1f9a46338538d41 # main
        with:
          extra-conf: |
            experimental-features = nix-command flakes

      - name: Cache /nix/store
        uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
        with:
          primary-key: nix-${{ runner.os }}-${{ matrix.system }}-${{ hashFiles('flake.nix', 'flake.lock', '**/Cargo.lock') }}
          restore-prefixes-first-match: nix-${{ runner.os }}-${{ matrix.system }}-
          # Must hold the full crane deps closure (the gpui tree is large) or cache hits still partially rebuild.
          gc-max-store-size-linux: 10G
          purge: true
          purge-prefixes: nix-${{ runner.os }}-${{ matrix.system }}-
          purge-created: 0
          purge-last-accessed: 0
          purge-primary-key: never

      - name: Build AppImage
        run: nix build --print-build-logs ".#packages.${{ matrix.system }}.appimage"

      - name: Inspect AppImage metadata
        run: |
          rm -rf squashfs-root
          ./result --appimage-extract >/tmp/jayjay-appimage-extract.log
          test -f squashfs-root/dev.hewig.JayJay.desktop
          test -f squashfs-root/.DirIcon
          test -f squashfs-root/usr/share/icons/hicolor/scalable/apps/dev.hewig.JayJay.svg
          test -f squashfs-root/usr/share/icons/hicolor/256x256/apps/dev.hewig.JayJay.png
          grep -q '#3B82F6' squashfs-root/usr/share/icons/hicolor/scalable/apps/dev.hewig.JayJay.svg
          grep -q '^Exec=jayjay-gpui %F$' squashfs-root/dev.hewig.JayJay.desktop
          grep -q '^Icon=dev.hewig.JayJay$' squashfs-root/dev.hewig.JayJay.desktop

      - name: Stage artifact
        run: |
          mkdir -p out
          cp -L result "out/${{ matrix.artifact }}"
          cd out
          sha256sum "${{ matrix.artifact }}" | tee "${{ matrix.artifact }}.sha256"
          ls -lh .

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.artifact }}
          path: out/
          retention-days: 14

  release-assets:
    name: Publish AppImage release assets
    if: github.event_name == 'release'
    needs: appimage
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download AppImage artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist/appimage
          merge-multiple: true

      - name: Upload release asset
        env:
          GH_TOKEN: ${{ github.token }}
          # No checkout in this job, so gh needs the repo made explicit.
          GH_REPO: ${{ github.repository }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          ls -lh dist/appimage
          gh release upload "$TAG_NAME" \
            dist/appimage/*.AppImage \
            dist/appimage/*.AppImage.sha256 \
            --clobber