BridgeSwarm/.gitea/workflows/ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  ci:
    name: Build & Test
    runs-on: ssh

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_TOKEN }}

      - name: Check toolchain versions
        run: |
          node --version
          npm --version
          bare --version 2>/dev/null || echo "bare not in PATH (ok)"

      - name: Install root dependencies
        run: npm install

      - name: Install native-host dependencies
        run: npm install
        working-directory: native-host

      - name: Lint — syntax check extension
        run: |
          node --check extension/background.js
          node --check extension/content.js
          node --check extension/api.js
          node --check extension/framed-stream.js
          node --check extension/options.js
          node --check extension/dashboard.js
          node --check extension/defaults.js

      - name: Lint — syntax check native host
        run: |
          node --check native-host/host.js
          node --check native-host/messenger.js
          node --check native-host/hyperdb-minimal-definition.js

      - name: Lint — syntax check build scripts
        run: |
          node --check scripts/build-distributable.js
          node --check scripts/pack-extension.js
          node --check scripts/build-host.js
          node --check scripts/build-hrpc.js
          node --check scripts/bundle-protomux.js

      - name: Build (host launcher, protomux, hrpc)
        run: npm run build

      - name: Pack extension
        run: npm run pack

      - name: Build all platform binaries
        run: node scripts/build-distributable.js --all --package

      - name: Smoke test — run native binary for current platform
        run: |
          echo "=== releases/ layout ==="
          find releases/ -type f | sort
          echo ""

          MACHINE=$(uname -m)
          echo "uname -m: $MACHINE"

          BIN=""
          for candidate in \
            "releases/${MACHINE}/bridge-swarm-host" \
            "releases/x86_64/bridge-swarm-host" \
            "releases/aarch64/bridge-swarm-host" \
            "releases/arm64/bridge-swarm-host" \
            "releases/bridge-swarm-host"; do
            if [ -f "$candidate" ]; then
              BIN="$candidate"
              break
            fi
          done

          if [ -z "$BIN" ]; then
            echo "No runnable binary found — skipping smoke test"
            exit 0
          fi

          echo "Testing binary: $BIN"
          chmod +x "$BIN"
          OUTPUT=$(timeout 6 "$BIN" </dev/null 2>&1 || true)
          echo "$OUTPUT"

          if echo "$OUTPUT" | grep -q "\[bridge-swarm-host\] ready"; then
            echo "PASS: binary started successfully"
          else
            echo "FAIL: binary did not print ready signal"
            exit 1
          fi

          echo "Testing QVAC enable over native messaging"
          python3 scripts/qvac-packed-selftest.py "$BIN"
          echo "PASS: smoke test complete"

      - name: Generate checksums
        run: |
          cd releases
          find . -name "*.zip" -o -name "*.xpi" | sort | xargs sha256sum > SHA256SUMS.txt
          cat SHA256SUMS.txt

      - name: List artifacts
        run: |
          echo "=== All release artifacts ==="
          find releases/ -type f | sort
          echo ""
          find releases/ -type f -exec ls -lh {} \; | awk '{print $5, $9}'

      - name: Publish rolling release
        if: github.event_name == 'push'
        run: |
          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          TAG="latest-main"
          TITLE="Latest build (main @ ${SHORT_SHA})"
          COMMIT_MSG=$(echo "${{ github.event.head_commit.message }}" | sed '/^Made-with:/d' | sed '/^$/d' | head -1)
          BODY="Automated build from main branch.\n\n**Commit:** ${{ github.sha }}\n**Message:** ${COMMIT_MSG}\n\nThis release is updated on every push to main and always contains the latest artifacts."
          API="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
          AUTH="Authorization: token ${{ secrets.RELEASE_TOKEN }}"

          REPO_URL=$(git remote get-url origin | sed 's|https://|https://x-token:${{ secrets.RELEASE_TOKEN }}@|')
          git remote set-url origin "${REPO_URL}"
          git config user.email "ci@bridgeswarm"
          git config user.name "CI"
          git tag -f "${TAG}" "${{ github.sha }}"
          git push origin "refs/tags/${TAG}" --force
          echo "Tag ${TAG} force-pushed to ${{ github.sha }}"

          EXISTING=$(curl -s -H "$AUTH" "${API}/releases/tags/${TAG}")
          RELEASE_ID=$(echo "$EXISTING" | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{const r=JSON.parse(d);console.log(r.id||'')}catch{console.log('')}})")
          echo "Existing release ID: $RELEASE_ID"

          if [ -n "$RELEASE_ID" ] && [ "$RELEASE_ID" != "null" ] && [ "$RELEASE_ID" != "" ]; then
            curl -s -X PATCH \
              -H "$AUTH" -H "Content-Type: application/json" \
              "${API}/releases/${RELEASE_ID}" \
              -d "{
                \"name\": \"${TITLE}\",
                \"body\": \"${BODY}\",
                \"prerelease\": true,
                \"target_commitish\": \"${{ github.sha }}\"
              }"
            echo "Updated release ${RELEASE_ID}"

            ASSETS=$(curl -s -H "$AUTH" "${API}/releases/${RELEASE_ID}/assets")
            echo "$ASSETS" | node -e "
              let d='';
              process.stdin.on('data',c=>d+=c).on('end',()=>{
                try {
                  const assets = JSON.parse(d);
                  if (Array.isArray(assets)) assets.forEach(a => console.log(a.id));
                } catch(_) {}
              })" | while read ASSET_ID; do
              [ -z "$ASSET_ID" ] && continue
              echo "Deleting asset $ASSET_ID..."
              curl -s -X DELETE -H "$AUTH" "${API}/releases/${RELEASE_ID}/assets/${ASSET_ID}"
            done
          else
            RELEASE_ID=$(curl -s -X POST \
              -H "$AUTH" -H "Content-Type: application/json" \
              "${API}/releases" \
              -d "{
                \"tag_name\": \"${TAG}\",
                \"name\": \"${TITLE}\",
                \"body\": \"${BODY}\",
                \"prerelease\": true,
                \"target_commitish\": \"${{ github.sha }}\"
              }" | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{console.log(JSON.parse(d).id)}catch{console.log('')}})")
            echo "Created release ${RELEASE_ID}"
          fi

          for FILE in releases/*.zip releases/*.xpi releases/SHA256SUMS.txt; do
            [ -f "$FILE" ] || continue
            NAME=$(basename "$FILE")
            echo "Uploading $NAME..."
            curl -s -X POST \
              -H "$AUTH" \
              -H "Content-Type: application/octet-stream" \
              "${API}/releases/${RELEASE_ID}/assets?name=${NAME}" \
              --data-binary "@${FILE}"
            echo ""
          done

          echo "Done — release ${TAG} updated to ${{ github.sha }}"