Merge 5e65508fed into 33a8fdb8c2

.github/workflows/spotube-release-binary.yml

@@ -22,20 +22,17 @@ on:
         type: boolean
         default: false
 
-# Read-only by default; only create-release gets write access
-permissions:
-  contents: read
-
-# Never cancel a running release when another is dispatched, and let stable and nightly run side by side
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.release_type }}
+  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 env:
   COMPOSE_WEBVIEW_REPO: KRTirtho/ComposeNativeWebview
   COMPOSE_WEBVIEW_COMMIT: cbd36f88927298a28a2d64c6acf7ec3b2def6f9d
   GRADLE_PLUGIN_REPO: team-spotube/gradle-plugin
   VLCJ_BUNDLER_REPO: team-spotube/vlcj-bundler-gradle-plugin
+  # Nucleus lists GraalVM CE releases via the GitHub API; unauthenticated calls hit the 60/hour limit on shared runners
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   prepare-deps:
@@ -106,7 +103,6 @@ jobs:
   build-android:
     name: Android
     needs: prepare-deps
-    timeout-minutes: 120
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -133,23 +129,17 @@ jobs:
         run: chmod +x gradlew
 
       - name: Decode keystore
-        env:
-          KEYSTORE: ${{ secrets.KEYSTORE }}
         run: |
-          echo "$KEYSTORE" | base64 --decode > "${{ github.workspace }}/composeApp/upload-keystore.jks"
+          echo '${{ secrets.KEYSTORE }}' | base64 --decode > "${{ github.workspace }}/composeApp/upload-keystore.jks"
 
       - name: Configure Android signing
         working-directory: composeApp
-        env:
-          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
-          KEYSTORE_KEY_ALIAS: ${{ secrets.KEYSTORE_KEY_ALIAS }}
-          KEYSTORE_KEY_PASSWORD: ${{ secrets.KEYSTORE_KEY_PASSWORD }}
         run: |
           cat >> local.properties <<EOF
           release.signing.storeFile=${{ github.workspace }}/composeApp/upload-keystore.jks
-          release.signing.storePassword=${KEYSTORE_PASSWORD}
+          release.signing.storePassword=${{ secrets.KEYSTORE_PASSWORD }}
-          release.signing.keyAlias=${KEYSTORE_KEY_ALIAS}
+          release.signing.keyAlias=${{ secrets.KEYSTORE_KEY_ALIAS }}
-          release.signing.keyPassword=${KEYSTORE_KEY_PASSWORD}
+          release.signing.keyPassword=${{ secrets.KEYSTORE_KEY_PASSWORD }}
           EOF
 
       - name: Assemble Release
@@ -180,7 +170,6 @@ jobs:
   build-linux:
     name: Linux Desktop
     needs: prepare-deps
-    timeout-minutes: 120
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -215,13 +204,9 @@ jobs:
         uses: actions/cache@v6
         with:
           path: ~/.gradle/nucleus/graalvm
-          key: graalvm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('gradle/libs.versions.toml', 'composeApp/build.gradle.kts') }}
+          key: graalvm-${{ runner.os }}-${{ runner.arch }}
-          restore-keys: graalvm-${{ runner.os }}-${{ runner.arch }}-
 
       - name: Package Linux
-        env:
-          # Nucleus lists GraalVM CE releases via the GitHub API; unauthenticated calls hit the 60/hour limit
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./gradlew :composeApp:packageGraalvmDeb :composeApp:packageGraalvmRpm -Pnightly=${{ inputs.release_type == 'nightly' }} -PbuildNumber=${{ github.run_number }}
 
       - name: Rename Linux artifacts
@@ -252,17 +237,13 @@ jobs:
   build-linux-arm64:
     name: Linux Desktop (aarch64)
     needs: prepare-deps
-    timeout-minutes: 120
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v7
 
-      # The arm64 runner image ships without an Android SDK/NDK, but :composeApp configuration needs both
+      # The arm64 runner image ships without an Android SDK, but :composeApp configuration requires one
-      # (Gobley's cargo plugin resolves the NDK directory for the Android Rust targets)
       - name: Set up Android SDK
         uses: android-actions/setup-android@v4
-        with:
-          packages: tools platform-tools ndk;28.2.13676358
 
       - name: Download maven local
         uses: actions/download-artifact@v8
@@ -294,13 +275,9 @@ jobs:
         uses: actions/cache@v6
         with:
           path: ~/.gradle/nucleus/graalvm
-          key: graalvm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('gradle/libs.versions.toml', 'composeApp/build.gradle.kts') }}
+          key: graalvm-${{ runner.os }}-${{ runner.arch }}
-          restore-keys: graalvm-${{ runner.os }}-${{ runner.arch }}-
 
       - name: Package Linux
-        env:
-          # Nucleus lists GraalVM CE releases via the GitHub API; unauthenticated calls hit the 60/hour limit
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./gradlew :composeApp:packageGraalvmDeb :composeApp:packageGraalvmRpm -Pnightly=${{ inputs.release_type == 'nightly' }} -PbuildNumber=${{ github.run_number }}
 
       - name: Rename Linux artifacts
@@ -331,7 +308,6 @@ jobs:
   build-windows:
     name: Windows Desktop
     needs: prepare-deps
-    timeout-minutes: 120
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v7
@@ -362,13 +338,9 @@ jobs:
         uses: actions/cache@v6
         with:
           path: ~/.gradle/nucleus/graalvm
-          key: graalvm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('gradle/libs.versions.toml', 'composeApp/build.gradle.kts') }}
+          key: graalvm-${{ runner.os }}-${{ runner.arch }}
-          restore-keys: graalvm-${{ runner.os }}-${{ runner.arch }}-
 
       - name: Package EXE
-        env:
-          # Nucleus lists GraalVM CE releases via the GitHub API; unauthenticated calls hit the 60/hour limit
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./gradlew :composeApp:packageGraalvmExe -Pnightly=${{ inputs.release_type == 'nightly' }} -PbuildNumber=${{ github.run_number }}
 
       - name: Rename Windows artifacts
@@ -394,7 +366,6 @@ jobs:
   build-macos:
     name: macOS Desktop
     needs: prepare-deps
-    timeout-minutes: 120
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
@@ -424,13 +395,9 @@ jobs:
         uses: actions/cache@v6
         with:
           path: ~/.gradle/nucleus/graalvm
-          key: graalvm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('gradle/libs.versions.toml', 'composeApp/build.gradle.kts') }}
+          key: graalvm-${{ runner.os }}-${{ runner.arch }}
-          restore-keys: graalvm-${{ runner.os }}-${{ runner.arch }}-
 
       - name: Package DMG
-        env:
-          # Nucleus lists GraalVM CE releases via the GitHub API; unauthenticated calls hit the 60/hour limit
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./gradlew :composeApp:packageGraalvmDmg -Pnightly=${{ inputs.release_type == 'nightly' }} -PbuildNumber=${{ github.run_number }}
 
       - name: Rename macOS artifact
@@ -460,8 +427,6 @@ jobs:
       - build-windows
       - build-macos
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - uses: actions/checkout@v7
 
@@ -507,7 +472,7 @@ jobs:
         run: |
           echo "## Downloads" > release-notes.md
           echo "" >> release-notes.md
-          for dir in android-apk linux-deb linux-rpm linux-deb-arm64 linux-rpm-arm64 windows-exe macos-dmg; do
+          for dir in android-apk android-aab linux-deb linux-rpm linux-appimage linux-deb-arm64 linux-rpm-arm64 windows-msi windows-exe macos-dmg; do
             if [ -d "$dir" ]; then
               echo "### $dir" >> release-notes.md
               for f in "$dir"/*; do
@@ -517,29 +482,22 @@ jobs:
             fi
           done
 
-      # The rolling nightly tag already exists, and the release action never moves an existing tag
-      - name: Move nightly tag to this commit
-        if: ${{ inputs.release_type == 'nightly' }}
-        run: |
-          git tag -f nightly "$GITHUB_SHA"
-          git push -f origin refs/tags/nightly
-
       - name: Create Release
         uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.vars.outputs.tag }}
-          # A new tag (stable) would otherwise point at the default branch instead of the built commit
-          target_commitish: ${{ github.sha }}
-          fail_on_unmatched_files: true
           name: ${{ steps.vars.outputs.release_name }}
           body_path: release-notes.md
           draft: ${{ steps.vars.outputs.is_draft }}
           prerelease: ${{ steps.vars.outputs.is_prerelease }}
           files: |
             android-apk/*.apk
+            android-aab/*.aab
             linux-deb/*.deb
             linux-rpm/*.rpm
+            linux-appimage/*.AppImage
             linux-deb-arm64/*.deb
             linux-rpm-arm64/*.rpm
+            windows-msi/*.msi
             windows-exe/*.exe
             macos-dmg/*.dmg

composeApp/build.gradle.kts

@@ -543,20 +543,3 @@ cargo {
         embedRustLibrary = (rustTarget == GobleyHost.current.rustTarget)
     }
 }
-
-// Google only ships x86_64 Linux NDK toolchains, so on a Linux arm64 host the Android Rust targets can never
-// link (clang: "Exec format error"). Desktop packaging doesn't need them; Android is built on x86_64 runners.
-run {
-    val isLinuxArm64Host = System.getProperty("os.name").lowercase().contains("linux") &&
-        System.getProperty("os.arch").lowercase() in setOf("aarch64", "arm64")
-    if (isLinuxArm64Host) {
-        // Gobley generates the UniFFI bindings from the first Android build's library by default; use the host's.
-        uniffi {
-            generateFromLibrary {
-                build = GobleyHost.current.rustTarget
-            }
-        }
-        tasks.matching { it.name.startsWith("cargoBuildAndroid") || it.name.startsWith("rustUpTargetAddAndroid") }
-            .configureEach { enabled = false }
-    }
-}