feat: publish Flatpak to our own signed repo on each release

.github/workflows/electron.yml

@@ -293,7 +293,7 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libfuse2 flatpak flatpak-builder imagemagick
+          sudo apt-get install -y libfuse2
 
       - name: Install dependencies
         run: |
@@ -426,89 +426,6 @@ jobs:
           path: release/termix_linux_armv7l_portable.tar.gz
           retention-days: 30
 
-      - name: Add Flathub repository
-        run: |
-          sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-
-      - name: Install Flatpak runtime and SDK
-        run: |
-          sudo flatpak install -y flathub org.freedesktop.Platform//24.08
-          sudo flatpak install -y flathub org.freedesktop.Sdk//24.08
-          sudo flatpak install -y flathub org.electronjs.Electron2.BaseApp//24.08
-
-      - name: Get version for Flatpak
-        id: flatpak-version
-        run: |
-          VERSION="${{ inputs.version_override }}"
-          if [ -z "$VERSION" ]; then
-            VERSION=$(node -p "require('./package.json').version")
-          fi
-          RELEASE_DATE=$(date +%Y-%m-%d)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "release_date=$RELEASE_DATE" >> $GITHUB_OUTPUT
-
-      - name: Prepare Flatpak files
-        run: |
-          VERSION="${{ steps.flatpak-version.outputs.version }}"
-          RELEASE_DATE="${{ steps.flatpak-version.outputs.release_date }}"
-
-          CHECKSUM_X64=$(sha256sum "release/termix_linux_x64_appimage.AppImage" | awk '{print $1}')
-          CHECKSUM_ARM64=$(sha256sum "release/termix_linux_arm64_appimage.AppImage" | awk '{print $1}')
-
-          mkdir -p flatpak-build
-          cp packaging/flatpak/com.karmaa.termix.yml flatpak-build/
-          cp packaging/flatpak/com.karmaa.termix.desktop flatpak-build/
-          cp packaging/flatpak/com.karmaa.termix.metainfo.xml flatpak-build/
-          cp public/icon.svg flatpak-build/com.karmaa.termix.svg
-          convert public/icon.png -resize 256x256 flatpak-build/icon-256.png
-          convert public/icon.png -resize 128x128 flatpak-build/icon-128.png
-
-          cd flatpak-build
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_x64_appimage.AppImage|file://$(realpath ../release/termix_linux_x64_appimage.AppImage)|g" com.karmaa.termix.yml
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_arm64_appimage.AppImage|file://$(realpath ../release/termix_linux_arm64_appimage.AppImage)|g" com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_X64_PLACEHOLDER/$CHECKSUM_X64/g" com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_ARM64_PLACEHOLDER/$CHECKSUM_ARM64/g" com.karmaa.termix.yml
-          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" com.karmaa.termix.metainfo.xml
-          sed -i "s/DATE_PLACEHOLDER/$RELEASE_DATE/g" com.karmaa.termix.metainfo.xml
-
-      - name: Build Flatpak bundle
-        run: |
-          cd flatpak-build
-          flatpak-builder --repo=repo --force-clean --disable-rofiles-fuse build-dir com.karmaa.termix.yml
-
-          ARCH=$(uname -m)
-          if [ "$ARCH" = "x86_64" ]; then
-            FLATPAK_ARCH="x86_64"
-          elif [ "$ARCH" = "aarch64" ]; then
-            FLATPAK_ARCH="aarch64"
-          else
-            FLATPAK_ARCH="$ARCH"
-          fi
-
-          flatpak build-bundle repo ../release/termix_linux_flatpak.flatpak com.karmaa.termix --runtime-repo=https://flathub.org/repo/flathub.flatpakrepo
-
-      - name: Create flatpakref file
-        run: |
-          VERSION="${{ steps.flatpak-version.outputs.version }}"
-          cp packaging/flatpak/com.karmaa.termix.flatpakref release/
-          sed -i "s|VERSION_PLACEHOLDER|v${VERSION}|g" release/com.karmaa.termix.flatpakref
-
-      - name: Upload Flatpak bundle
-        uses: actions/upload-artifact@v7
-        if: hashFiles('release/termix_linux_flatpak.flatpak') != '' && inputs.artifact_destination != 'none'
-        with:
-          name: termix_linux_flatpak
-          path: release/termix_linux_flatpak.flatpak
-          retention-days: 30
-
-      - name: Upload Flatpakref
-        uses: actions/upload-artifact@v7
-        if: hashFiles('release/com.karmaa.termix.flatpakref') != '' && inputs.artifact_destination != 'none'
-        with:
-          name: termix_linux_flatpakref
-          path: release/com.karmaa.termix.flatpakref
-          retention-days: 30
-
       # Every official plugin, for installs without internet. No update files.
       - name: Build Linux x64 full packages
         if: inputs.artifact_destination != 'none'

.github/workflows/flatpak.yml

@@ -0,0 +1,112 @@
+name: Publish Flatpak
+
+# Builds the Flatpak from a release's portable tarballs and adds the bundles to
+# that release. Stable releases also replace the repo at flatpak.termix.site,
+# which is what `flatpak update` reads.
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Release tag to package, like v26.11.1"
+        required: true
+        type: string
+      publish:
+        description: "Replace the live Flatpak repo"
+        required: true
+        default: true
+        type: boolean
+  workflow_call:
+    inputs:
+      release_tag:
+        description: "Release tag to package"
+        required: true
+        type: string
+      publish:
+        description: "Replace the live Flatpak repo"
+        required: true
+        type: boolean
+
+env:
+  FLATPAK_REPO_URL: https://flatpak.termix.site
+
+jobs:
+  build:
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.release_tag }}
+          fetch-depth: 1
+
+      # A tag from before this workflow has no build script.
+      - name: Use the newest packaging files
+        env:
+          WORKFLOW_SHA: ${{ github.sha }}
+        run: |
+          git fetch --depth 1 origin "$WORKFLOW_SHA"
+          git checkout "$WORKFLOW_SHA" -- packaging/flatpak
+
+      - name: Install tools
+        run: |
+          sudo add-apt-repository -y ppa:flatpak/stable
+          sudo apt-get update
+          sudo apt-get install -y flatpak flatpak-builder imagemagick qemu-user-static
+          flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+
+      - name: Download release tarballs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.release_tag }}
+        run: |
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --dir tarballs \
+            --pattern termix_linux_x64_portable.tar.gz \
+            --pattern termix_linux_arm64_portable.tar.gz
+
+      - name: Import signing key
+        env:
+          FLATPAK_GPG_KEY: ${{ secrets.FLATPAK_GPG_KEY }}
+        run: |
+          export GNUPGHOME="$RUNNER_TEMP/gnupg"
+          mkdir -m 700 "$GNUPGHOME"
+          printf '%s' "$FLATPAK_GPG_KEY" | gpg --batch --import
+          echo "FLATPAK_GPG_HOME=$GNUPGHOME" >> "$GITHUB_ENV"
+          echo "FLATPAK_GPG_KEY_ID=$(gpg --list-keys --with-colons | awk -F: '/^fpr/ { print $10; exit }')" >> "$GITHUB_ENV"
+
+      - name: Build
+        env:
+          TAG: ${{ inputs.release_tag }}
+        run: |
+          bash packaging/flatpak/build-repo.sh "${TAG#v}" tarballs out
+          chmod -R a+rX out/site
+
+      - name: Add bundles to the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.release_tag }}
+        run: |
+          gh release upload "$TAG" out/*.flatpak out/com.karmaa.termix.flatpakref \
+            --repo "$GITHUB_REPOSITORY" --clobber
+
+      - name: Upload repo for Pages
+        if: inputs.publish
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: out/site
+
+  deploy:
+    needs: build
+    if: inputs.publish
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ env.FLATPAK_REPO_URL }}
+    steps:
+      - name: Deploy
+        uses: actions/deploy-pages@v5

.github/workflows/release.yml

@@ -543,6 +543,19 @@ jobs:
       source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.translate.outputs.sha || needs.prep.outputs.sha }}
     secrets: inherit
 
+  flatpak:
+    needs: [prep, electron-release]
+    if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
+    permissions:
+      contents: write
+      pages: write
+      id-token: write
+    uses: ./.github/workflows/flatpak.yml
+    with:
+      release_tag: ${{ needs.prep.outputs.release_tag }}
+      publish: ${{ needs.prep.outputs.channel == 'Stable' }}
+    secrets: inherit
+
   electron-submit:
     needs: [prep, merge-to-main, electron-release]
     if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Skip submit' }}