Repository navigation
Agent: fade long sidebar task titles #1439
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Desktop App PR Build | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| # Run unprivileged validation for stacked PRs as well as master targets. | |
| types: [opened, synchronize, reopened, labeled] | |
| concurrency: | |
| # Label events cannot cancel useful source-validation runs or other labels. | |
| group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }}${{ github.event.action == 'labeled' && format('-label-{0}', github.event.label.name) || '' }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Keep metadata-only check names separate from source-validation results. | |
| changes: | |
| name: changes${{ github.event.action == 'labeled' && format(' (label {0})', github.event.label.name) || '' }} | |
| if: github.event.action != 'labeled' | |
| uses: ./.github/workflows/app-change-detection.yml | |
| build-macos: | |
| name: build-macos${{ github.event.action == 'labeled' && format(' (label {0})', github.event.label.name) || '' }} | |
| needs: changes | |
| if: ${{ always() && !cancelled() && github.event.action != 'labeled' && (needs.changes.result != 'success' || needs.changes.outputs.macos != 'false') }} | |
| runs-on: blacksmith-6vcpu-macos-26 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| - name: Select pinned Xcode | |
| run: python3 scripts/ci/select-xcode.py | |
| - name: Install Nix | |
| uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3 | |
| with: | |
| source-tag: v3.23.3 | |
| github-token: "" | |
| - name: Verify pinned Nix runtime | |
| run: bash scripts/ci/verify-nix-runtime.sh | |
| - name: Cache sccache | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: ~/Library/Caches/Mozilla.sccache | |
| key: ${{ runner.os }}-sccache-macos-${{ hashFiles('apps/maple-research/frontend/src-tauri/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-sccache-macos- | |
| ${{ runner.os }}-sccache- | |
| - name: Build Tauri App (macOS, unsigned) | |
| run: nix develop --no-update-lock-file .#ci -c ./scripts/ci/desktop-pr.sh | |
| - name: Show sccache stats | |
| if: always() | |
| run: nix develop --no-update-lock-file .#ci -c ./scripts/ci/sccache-stats.sh | |
| - name: Upload macOS PR Build | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 | |
| with: | |
| name: maple-macos-universal-pr | |
| path: | | |
| apps/maple-research/frontend/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg | |
| apps/maple-research/frontend/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app | |
| apps/maple-research/frontend/src-tauri/target/reproducibility/maple-macos-app.tar.gz | |
| apps/maple-research/frontend/src-tauri/target/reproducibility/desktop-pr-macos-*.sha256 | |
| retention-days: 5 | |
| build-research-dev-macos: | |
| name: build-research-dev-macos${{ github.event.action == 'labeled' && format(' (label {0})', github.event.label.name) || '' }} | |
| needs: changes | |
| if: >- | |
| ${{ always() && !cancelled() && ( | |
| (github.event.action == 'labeled' && github.event.label.name == 'ci:research-dev-macos') || | |
| (github.event.action != 'labeled' && ( | |
| needs.changes.result != 'success' || needs.changes.outputs.macos != 'false' || | |
| contains(github.event.pull_request.labels.*.name, 'ci:research-dev-macos') | |
| )) | |
| ) }} | |
| # A fresh source or opt-in run replaces an older Dev candidate for this PR. | |
| concurrency: | |
| group: research-dev-macos-pr-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| runs-on: blacksmith-6vcpu-macos-26 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - name: Select pinned Xcode | |
| run: python3 scripts/ci/select-xcode.py | |
| - name: Install Nix | |
| uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3 | |
| with: | |
| source-tag: v3.23.3 | |
| github-token: "" | |
| - name: Verify pinned Nix runtime | |
| run: bash scripts/ci/verify-nix-runtime.sh | |
| - name: Cache sccache | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: ~/Library/Caches/Mozilla.sccache | |
| key: ${{ runner.os }}-sccache-research-dev-${{ hashFiles('apps/maple-research/frontend/src-tauri/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-sccache-research-dev- | |
| - name: Build isolated Research Dev app (unsigned) | |
| run: nix develop --no-update-lock-file .#ci -c ./scripts/ci/research-dev-desktop.sh | |
| - name: Upload Research Dev PR package and identity proof | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 | |
| with: | |
| name: maple-research-dev-macos-pr | |
| path: | | |
| apps/maple-research/frontend/src-tauri/target/research-dev/maple-research-dev-macos.tar.gz | |
| apps/maple-research/frontend/src-tauri/target/research-dev/build-profile.json | |
| if-no-files-found: error | |
| retention-days: 5 | |
| build-linux: | |
| name: build-linux${{ github.event.action == 'labeled' && format(' (label {0})', github.event.label.name) || '' }} | |
| needs: changes | |
| if: ${{ always() && !cancelled() && github.event.action != 'labeled' && (needs.changes.result != 'success' || needs.changes.outputs.linux != 'false') }} | |
| runs-on: blacksmith-8vcpu-ubuntu-2404 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3 | |
| with: | |
| source-tag: v3.23.3 | |
| github-token: "" | |
| - name: Verify pinned Nix runtime | |
| run: bash scripts/ci/verify-nix-runtime.sh | |
| - name: Cache sccache | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: ~/.cache/sccache | |
| key: ${{ runner.os }}-sccache-linux-${{ hashFiles('apps/maple-research/frontend/src-tauri/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-sccache-linux- | |
| ${{ runner.os }}-sccache- | |
| - name: Allow bubblewrap user namespaces | |
| run: | | |
| set -euo pipefail | |
| # Ubuntu 24.04 restricts unprivileged user namespaces by default; linuxdeploy/AppImage | |
| # packaging uses bubblewrap and otherwise fails with "bwrap: setting up uid map: Permission denied". | |
| if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then | |
| sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 | |
| fi | |
| if [ -e /proc/sys/kernel/unprivileged_userns_clone ]; then | |
| sudo sysctl -w kernel.unprivileged_userns_clone=1 | |
| fi | |
| - name: Build Tauri App (Linux, unsigned + fake updater signing) | |
| run: nix develop --no-update-lock-file .#desktop-linux -c ./scripts/ci/desktop-pr.sh | |
| env: | |
| MAPLE_TAURI_FAKE_UPDATER_SIGNING: "1" | |
| - name: Show sccache stats | |
| if: always() | |
| run: nix develop --no-update-lock-file .#desktop-linux -c ./scripts/ci/sccache-stats.sh | |
| - name: Upload Linux PR Builds | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 | |
| with: | |
| name: maple-linux-pr | |
| path: | | |
| apps/maple-research/frontend/src-tauri/target/release/bundle/appimage/*.AppImage | |
| apps/maple-research/frontend/src-tauri/target/release/bundle/appimage/*.AppImage.sig | |
| apps/maple-research/frontend/src-tauri/target/release/bundle/deb/*.deb | |
| apps/maple-research/frontend/src-tauri/target/release/bundle/deb/*.deb.sig | |
| apps/maple-research/frontend/src-tauri/target/release/bundle/rpm/*.rpm | |
| apps/maple-research/frontend/src-tauri/target/release/bundle/rpm/*.rpm.sig | |
| apps/maple-research/frontend/src-tauri/target/reproducibility/desktop-pr-linux-fake-updater.pub | |
| apps/maple-research/frontend/src-tauri/target/reproducibility/desktop-pr-linux-*.sha256 | |
| retention-days: 5 | |
| build-windows: | |
| name: build-windows${{ github.event.action == 'labeled' && format(' (label {0})', github.event.label.name) || '' }} | |
| needs: changes | |
| if: ${{ always() && !cancelled() && github.event.action != 'labeled' && (needs.changes.result != 'success' || needs.changes.outputs.windows != 'false') }} | |
| runs-on: blacksmith-8vcpu-windows-2025 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| - name: Record Windows runner capacity and build tools | |
| shell: pwsh | |
| run: | | |
| Write-Output "Image: $env:ImageOS $env:ImageVersion" | |
| Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber | ConvertTo-Json -Compress | |
| Get-CimInstance Win32_Processor | Select-Object Name, NumberOfLogicalProcessors | ConvertTo-Json -Compress | |
| Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory | ConvertTo-Json -Compress | |
| Get-PSDrive -PSProvider FileSystem | Select-Object Name, Used, Free | ConvertTo-Json -Compress | |
| $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe' | |
| & $vswhere -products '*' -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -format json | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 # was v1 | |
| with: | |
| bun-version: 1.3.5 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # was stable | |
| with: | |
| toolchain: 1.94.1 | |
| - name: Install sccache | |
| shell: bash | |
| run: | | |
| SCCACHE_VERSION=0.16.0 | |
| SCCACHE_SHA256="c82319cc392b693e9fc72e6567cce47e218308f00fbf1df942e39b62e30f98da" | |
| SCCACHE_ARCHIVE="sccache-v${SCCACHE_VERSION}-x86_64-pc-windows-msvc.tar.gz" | |
| SCCACHE_URL="https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/${SCCACHE_ARCHIVE}" | |
| # Run download/verify/extract inside a subshell cd'd to RUNNER_TEMP so | |
| # the archive and target dir are referenced by relative names. MSYS2 tar | |
| # mangles Windows paths like D:\a when given absolute -C/-f arguments | |
| # (even with --force-local); relative paths sidestep that. | |
| ( | |
| cd "$RUNNER_TEMP" | |
| curl --fail --location --show-error --silent "$SCCACHE_URL" --output "$SCCACHE_ARCHIVE" | |
| echo "${SCCACHE_SHA256} ${SCCACHE_ARCHIVE}" | sha256sum --check - | |
| tar xzf "$SCCACHE_ARCHIVE" | |
| ) | |
| SCCACHE_BIN_DIR="$RUNNER_TEMP/sccache-v${SCCACHE_VERSION}-x86_64-pc-windows-msvc" | |
| echo "$SCCACHE_BIN_DIR" >> "$GITHUB_PATH" | |
| "$SCCACHE_BIN_DIR/sccache.exe" --version | |
| - name: Cache sccache | |
| uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: ~\AppData\Local\Mozilla\sccache | |
| key: ${{ runner.os }}-sccache-windows-v0.16.0-rust-1.94.1-${{ hashFiles('apps/maple-research/frontend/src-tauri/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-sccache-windows-v0.16.0-rust-1.94.1- | |
| - name: Build Tauri App (Windows, unsigned) | |
| shell: bash | |
| run: ./scripts/ci/desktop-windows-pr.sh | |
| - name: Show sccache stats | |
| if: always() | |
| run: sccache --show-stats | |
| - name: Upload Windows PR Build | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 | |
| with: | |
| name: maple-windows-x64-pr | |
| path: | | |
| apps/maple-research/frontend/src-tauri/target/release/bundle/nsis/*.exe | |
| apps/maple-research/frontend/src-tauri/target/release/maple.exe | |
| apps/maple-research/frontend/src-tauri/resources/windows/*.dll | |
| apps/maple-research/frontend/src-tauri/target/reproducibility/desktop-pr-windows-*.sha256 | |
| retention-days: 5 | |
| verify-windows-artifacts: | |
| name: verify-windows-artifacts${{ github.event.action == 'labeled' && format(' (label {0})', github.event.label.name) || '' }} | |
| needs: | |
| - build-windows | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3 | |
| with: | |
| source-tag: v3.23.3 | |
| github-token: "" | |
| - name: Verify pinned Nix runtime | |
| run: bash scripts/ci/verify-nix-runtime.sh | |
| - name: Download Windows artifacts | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4 | |
| with: | |
| name: maple-windows-x64-pr | |
| path: artifacts | |
| - name: Verify Windows artifact reproducibility proofs | |
| run: nix develop --no-update-lock-file .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts windows |