flatpak-smoke.yml

name: Flatpak Smoke

# Builds the desktop AppImage from the current tree and repacks it with the
# in-repo Flatpak manifest (issue #232) - the same two-step chain Flathub would
# run, minus publishing. It deliberately does NOT depend on a released asset:
# the manifest is rendered against the locally built AppImage
# (scripts/render-flatpak-manifest.mjs --local), so the packaging is verifiable
# before a release exists and stays verified afterwards.
#
# This is now the only consumer of packaging/flatpak/. The Flathub submission
# (flathub/flathub#9538) was declined in 2026-07 under their generative AI
# policy, so flathub/org.libredb.Studio was never created and there is no
# External Data Checker bumping anything. The job is kept because it is real
# coverage of the desktop AppImage - see packaging/flatpak/README.md. Nothing
# here publishes anywhere: no flat-manager step and no credential.
#
# Path-filtered on purpose - a Next.js build, a Rust release build and a
# flatpak-builder run per architecture is expensive.

on:
  pull_request:
    paths:
      - 'desktop/**'
      - 'packaging/flatpak/**'
      - 'scripts/build-desktop-appimage.sh'
      - 'scripts/build-flatpak-local.sh'
      - 'scripts/render-flatpak-manifest.mjs'
      - 'scripts/build-standalone-payload.sh'
      - '.github/workflows/flatpak-smoke.yml'
  push:
    branches: [main]
    paths:
      - 'desktop/**'
      - 'packaging/flatpak/**'
      - 'scripts/build-desktop-appimage.sh'
      - 'scripts/build-flatpak-local.sh'
      - 'scripts/render-flatpak-manifest.mjs'
      - 'scripts/build-standalone-payload.sh'
      - '.github/workflows/flatpak-smoke.yml'
  workflow_dispatch:

concurrency:
  group: flatpak-smoke-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  appimage:
    name: Build AppImage (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x64
            flatpak_arch: x86_64
            runner: ubuntu-24.04
          - arch: arm64
            flatpak_arch: aarch64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: "1.3.14"

      - name: Install dependencies
        uses: ./.github/actions/bun-install

      - name: Setup Rust toolchain
        run: |
          rustup toolchain install stable --profile minimal --no-self-update
          rustup default stable
          rustc --version

      - name: Install Tauri Linux build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev patchelf file

      - name: Build the AppImage and smoke test the bundled server
        # --keep-stage leaves the payload and the Node sidecar in place, which the
        # cargo test below needs: tauri-build refuses to compile the crate when the
        # externalBin and resources the bundle config declares are missing.
        run: bash scripts/build-desktop-appimage.sh dist --smoke --keep-stage

      - name: Unit test the desktop shell
        run: cargo test --manifest-path desktop/src-tauri/Cargo.toml

      - name: Render the Flatpak manifests
        env:
          FLATPAK_ARCH: ${{ matrix.flatpak_arch }}
          ARCH: ${{ matrix.arch }}
        run: |
          set -euo pipefail
          VERSION=$(node -p "require('./package.json').version")
          APPIMAGE="libredb-studio-desktop-${VERSION}-linux-${ARCH}.AppImage"
          mkdir -p build/flatpak
          # The AppImage travels next to the manifest so the rendered `path:`
          # source stays valid inside the flatpak-builder container.
          cp "dist/${APPIMAGE}" "build/flatpak/${APPIMAGE}"
          cat dist/*.AppImage.sha256 > build/flatpak/appimage-sums.txt
          # Both digests are required by the release manifest; the architecture
          # this runner did not build gets a placeholder that the --local render
          # drops together with that source.
          for other in x64 arm64; do
            if [ "$other" != "$ARCH" ]; then
              printf '%064d  libredb-studio-desktop-%s-linux-%s.AppImage\n' 0 "$VERSION" "$other" \
                >> build/flatpak/appimage-sums.txt
            fi
          done
          node scripts/render-flatpak-manifest.mjs \
            packaging/flatpak/org.libredb.Studio.yml.tmpl build/flatpak/appimage-sums.txt \
            "$VERSION" build/flatpak/org.libredb.Studio.yml
          node scripts/render-flatpak-manifest.mjs \
            packaging/flatpak/org.libredb.Studio.yml.tmpl build/flatpak/appimage-sums.txt \
            "$VERSION" build/flatpak/org.libredb.Studio.local.yml \
            --local "$FLATPAK_ARCH" "build/flatpak/${APPIMAGE}"
          cp packaging/flatpak/libredb-studio.sh packaging/flatpak/org.libredb.Studio.desktop \
            packaging/flatpak/org.libredb.Studio.metainfo.xml packaging/flatpak/lint-exceptions.json \
            build/flatpak/
          cat build/flatpak/org.libredb.Studio.local.yml

      - name: Upload the Flatpak build inputs
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: flatpak-inputs-${{ matrix.arch }}
          path: build/flatpak
          if-no-files-found: error
          retention-days: 3

  flatpak:
    name: Repack as Flatpak (${{ matrix.flatpak_arch }})
    needs: appimage
    runs-on: ${{ matrix.runner }}
    # The GNOME major of this image MUST match runtime-version in the manifest.
    container:
      image: ghcr.io/flathub-infra/flatpak-github-actions:gnome-50
      options: --privileged
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x64
            flatpak_arch: x86_64
            runner: ubuntu-24.04
          - arch: arm64
            flatpak_arch: aarch64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - name: Download the Flatpak build inputs
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: flatpak-inputs-${{ matrix.arch }}
          path: build/flatpak

      - name: Validate the metainfo and lint the release manifest
        # Linted against the manifest as Flathub receives it (release URLs and
        # checksums), not the local variant that is built below.
        run: |
          appstreamcli validate build/flatpak/org.libredb.Studio.metainfo.xml
          flatpak-builder-lint manifest build/flatpak/org.libredb.Studio.yml

      - name: Build the Flatpak
        uses: flatpak/flatpak-github-actions/flatpak-builder@401fe28a8384095fc1531b9d320b292f0ee45adb # v6
        with:
          manifest-path: build/flatpak/org.libredb.Studio.local.yml
          bundle: libredb-studio-${{ matrix.arch }}.flatpak
          arch: ${{ matrix.flatpak_arch }}
          repo-dir: repo
          # Mirroring the metainfo screenshots into the repository is what the
          # repo lint below checks for; Flathub's own build does the same.
          mirror-screenshots-url: https://dl.flathub.org/media
          cache-key: flatpak-builder-${{ matrix.flatpak_arch }}-${{ github.sha }}
          verbose: true

      - name: Lint the built repository
        # The two media-mirroring checks can only pass inside Flathub's own build
        # pipeline; everything else stays a hard failure. See the exceptions file.
        run: |
          flatpak-builder-lint --exceptions \
            --user-exceptions build/flatpak/lint-exceptions.json repo repo