reticulum-ref/MeshChatX
1
0
Fork 0
mirror of https://github.com/Quad4-Software/MeshChatX.git synced 2026-08-18 09:49:09 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(github-actions): add new actions for fetching frontend artifacts and setting up development environments, update workflows to utilize these actions

Browse source
This commit is contained in:
Ivan 2026-07-04 16:09:34 -05:00
parent adc4ce26f9
commit bf443b6e2d
No known key found for this signature in database
15 changed files with 358 additions and 677 deletions
Download patch file Download diff file Expand all files Collapse all files

32
.github/actions/fetch-frontend-artifact/action.yml vendored Normal file
View file

@ -0,0 +1,32 @@
# Pinned actions (bump tag and SHA together when upgrading):
# actions/download-artifact@v5.0.0 634f93cb2916e3fdff6788551b99b062d0335ce0
name: Fetch frontend artifact
description: Download a prebuilt meshchatx/public artifact and verify required paths
inputs:
artifact-name:
description: Artifact name from the reusable frontend-build workflow
required: true
path:
description: Destination directory for meshchatx/public contents
required: false
default: meshchatx/public
runs:
using: composite
steps:
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
with:
name: ${{ inputs.artifact-name }}
path: ${{ inputs.path }}
- name: Verify frontend artifact contents
shell: bash
env:
FRONTEND_PATH: ${{ inputs.path }}
run: |
set -euo pipefail
test -f "${FRONTEND_PATH}/index.html"
test -d "${FRONTEND_PATH}/assets"
test -d "${FRONTEND_PATH}/reticulum-docs-bundled/current"

37
.github/actions/setup-dev-environment/action.yml vendored Normal file
View file

@ -0,0 +1,37 @@
name: Set up development environment
description: Python/UV, Node/pnpm, and full project dependencies for CI jobs
inputs:
python-version:
description: Python version
required: true
uv-version:
description: UV version installed from PyPI
required: false
default: "0.11.15"
node-version:
description: Node.js version
required: true
pnpm-version:
description: pnpm version activated through corepack
required: false
default: "11.1.2"
runs:
using: composite
steps:
- name: Set up Python and UV
uses: ./.github/actions/setup-python-uv
with:
python-version: ${{ inputs.python-version }}
uv-version: ${{ inputs.uv-version }}
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
node-version: ${{ inputs.node-version }}
pnpm-version: ${{ inputs.pnpm-version }}
- name: Install dependencies
shell: bash
run: bash scripts/ci/github-install-deps.sh

36
.github/actions/setup-python-uv/action.yml vendored Normal file
View file

@ -0,0 +1,36 @@
# Pinned actions (bump tag and SHA together when upgrading):
# actions/setup-python@v6.2.0 a309ff8b426b58ec0e2a45f0f869d46889d02405
# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
name: Set up Python and UV
description: Python runtime, pinned UV installer, and UV download cache
inputs:
python-version:
description: Python version
required: true
uv-version:
description: UV version installed from PyPI
required: false
default: "0.11.15"
runs:
using: composite
steps:
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ inputs.python-version }}
- name: Install UV (PyPI pin)
shell: bash
env:
UV_VERSION: ${{ inputs.uv-version }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-

16
.github/dependabot.yml vendored
View file

@ -12,3 +12,19 @@ updates:
- electron
- electron-*
- "@electron/*"
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 10
groups:
actions:
patterns:
- actions/*
- docker/*
- github/*
- sigstore/*
- pypa/*
- benchmark-action/*
- slsa-framework/*

12
.github/workflows/android-apk-tag.yml vendored
View file

@ -114,17 +114,9 @@ jobs:
python-version: ${{ env.PYTHON_VERSION }}
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
uses: ./.github/actions/fetch-frontend-artifact
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
- name: Install Android wheel build dependencies
run: |

14
.github/workflows/android-build.yml vendored
View file

@ -35,7 +35,7 @@ permissions:
actions: write
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
group: android-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
env:
@ -142,17 +142,9 @@ jobs:
python-version: ${{ env.PYTHON_VERSION }}
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
uses: ./.github/actions/fetch-frontend-artifact
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
- name: Install Android wheel build dependencies
run: |

33
.github/workflows/bench.yml vendored
View file

@ -5,8 +5,6 @@
#
# Pinned first-party actions (bump tag and SHA together when upgrading):
# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
# actions/setup-python@v6.2.0 a309ff8b426b58ec0e2a45f0f869d46889d02405
# actions/setup-node@v6.1.0 395ad3262231945c25e8478fd5baf05154b1d79f
# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
# benchmark-action/github-action-benchmark@v1.22.0
# a60cea5bc7b49e15c1f58f411161f99e0df48372
@ -21,7 +19,7 @@ on:
- dev
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
group: bench-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
@ -43,33 +41,14 @@ jobs:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
- name: Set up development environment
uses: ./.github/actions/setup-dev-environment
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
uv-version: ${{ env.UV_VERSION }}
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Setup Task
run: sh scripts/ci/setup-task.sh
@ -100,10 +79,6 @@ jobs:
output-file-path: bench_results.json
external-data-json-path: ./cache/benchmark-data.json
github-token: ${{ secrets.GITHUB_TOKEN }}
# GitHub shared runners have 20-40% variance even with identical
# code. alert-threshold posts a comment; fail-threshold fails
# the job. Sub-ms operations are especially noisy so we keep
# the comment bar at 2x and the hard-fail bar at 3x.
alert-threshold: "200%"
fail-threshold: "300%"
fail-on-alert: true

172
.github/workflows/build-linux-packages.yml vendored
View file

@ -1,13 +1,9 @@
# Linux packaging build test: AppImage, deb, rpm, Flatpak (branches and PRs).
# Tagged release assets run in .github/workflows/build-release.yml with draft.
# Tagged release assets run in build-release.yml with draft.
#
# Pinned first-party actions (bump tag and SHA together when upgrading):
# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
# actions/setup-python@v6.2.0 a309ff8b426b58ec0e2a45f0f869d46889d02405
# actions/setup-node@v6.1.0 395ad3262231945c25e8478fd5baf05154b1d79f
# actions/upload-artifact@v5.0.0 330a01c490aca151604b8cf639adc76d48f6c5d4
# actions/download-artifact@v5.0.0 634f93cb2916e3fdff6788551b99b062d0335ce0
# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
name: Build Linux packages
@ -25,13 +21,14 @@ on:
- ".github/workflows/build-linux-packages.yml"
- ".github/workflows/build-release.yml"
- ".github/workflows/frontend-build.yml"
- ".github/actions/**"
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
group: linux-packages-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
env:
@ -52,10 +49,18 @@ jobs:
artifact_name: meshchatx-frontend-linux-pkg-${{ github.run_id }}-${{ github.run_attempt }}
retention_days: 1
linux-test-x64:
name: Linux build test (x64)
linux-test:
name: Linux build test (${{ matrix.arch }})
needs: frontend
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
include:
- arch: x64
runner: ubuntu-latest
- arch: arm64
runner: ubuntu-24.04-arm
runs-on: ${{ matrix.runner }}
timeout-minutes: 120
permissions:
contents: read
@ -67,23 +72,11 @@ jobs:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
- name: Set up Python and UV
uses: ./.github/actions/setup-python-uv
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
uv-version: ${{ env.UV_VERSION }}
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
@ -94,21 +87,13 @@ jobs:
- name: Linux packaging APT dependencies
run: bash scripts/ci/github-apt-linux-packaging.sh
- name: Install project dependencies
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
- name: Fetch frontend artifact
uses: ./.github/actions/fetch-frontend-artifact
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
- name: Setup Task
run: sh scripts/ci/setup-task.sh
@ -116,82 +101,10 @@ jobs:
- name: Build release-assets
run: bash scripts/ci/github-build-linux-release-assets.sh
- name: Upload Linux build-test artifact (x64)
- name: Upload Linux build-test artifact (${{ matrix.arch }})
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
with:
name: meshchatx-linux-build-test-x64-${{ github.ref_name }}-${{ github.run_id }}
path: release-assets/
if-no-files-found: warn
retention-days: 1
linux-test-arm64:
name: Linux build test (arm64)
needs: frontend
runs-on: ubuntu-24.04-arm
timeout-minutes: 120
permissions:
contents: read
actions: write
env:
FRONTEND_ARTIFACT_NAME: ${{ needs.frontend.outputs.artifact_name }}
MESHCHATX_FRONTEND_PREBUILT: "1"
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Linux packaging APT dependencies
run: bash scripts/ci/github-apt-linux-packaging.sh
- name: Install project dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
- name: Setup Task
run: sh scripts/ci/setup-task.sh
- name: Build release-assets
run: bash scripts/ci/github-build-linux-release-assets.sh
- name: Upload Linux build-test artifact (arm64)
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
with:
name: meshchatx-linux-build-test-arm64-${{ github.ref_name }}-${{ github.run_id }}
name: meshchatx-linux-build-test-${{ matrix.arch }}-${{ github.ref_name }}-${{ github.run_id }}
path: release-assets/
if-no-files-found: warn
retention-days: 1
@ -231,45 +144,18 @@ jobs:
org.freedesktop.Sdk//25.08 \
org.electronjs.Electron2.BaseApp//25.08
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
- name: Set up development environment
uses: ./.github/actions/setup-dev-environment
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
uv-version: ${{ env.UV_VERSION }}
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
- name: Fetch frontend artifact
uses: ./.github/actions/fetch-frontend-artifact
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
- name: Build flatpak bundle
run: bash scripts/ci/github-build-linux-flatpak.sh

137
.github/workflows/build-release.yml vendored
View file

@ -15,8 +15,9 @@
# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
# actions/setup-java@v4.7.1 c5195efecf7bdfc987ee8bae7a71cb8b11521c00
#
# SLSA generator (must stay @vX.Y.Z semver per upstream):
# SLSA generator (pinned to v2.1.0 commit):
# slsa-framework/slsa-github-generator/generator_generic_slsa3.yml@v2.1.0
# f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
name: Build release
@ -81,9 +82,19 @@ jobs:
run_unit_tests: true
linux-release:
name: Linux release assets (x64)
name: Linux release assets (${{ matrix.arch }})
needs: frontend
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
include:
- arch: x64
runner: ubuntu-latest
setup_trivy: true
- arch: arm64
runner: ubuntu-24.04-arm
setup_trivy: false
runs-on: ${{ matrix.runner }}
timeout-minutes: 120
permissions:
contents: read
@ -95,23 +106,11 @@ jobs:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
- name: Set up Python and UV
uses: ./.github/actions/setup-python-uv
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
uv-version: ${{ env.UV_VERSION }}
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
@ -122,114 +121,40 @@ jobs:
- name: Linux packaging APT dependencies
run: bash scripts/ci/github-apt-linux-packaging.sh
- name: Install project dependencies
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
- name: Fetch frontend artifact
uses: ./.github/actions/fetch-frontend-artifact
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
- name: Setup Task
if: matrix.setup_trivy
run: sh scripts/ci/setup-task.sh
- name: Apt update (for Trivy .deb)
if: matrix.setup_trivy
run: sh scripts/ci/exec-priv.sh apt-get update -qq
- name: Setup Trivy
if: matrix.setup_trivy
run: sh scripts/ci/setup-trivy.sh
- name: Build release-assets
run: bash scripts/ci/github-build-linux-release-assets.sh
- name: Upload Linux release artifact (x64)
- name: Upload Linux release artifact (${{ matrix.arch }})
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
with:
name: meshchatx-linux-release-x64-${{ github.ref_name }}-${{ github.run_id }}
path: release-assets/
if-no-files-found: error
retention-days: 30
linux-release-arm64:
name: Linux release assets (arm64)
needs: frontend
runs-on: ubuntu-24.04-arm
timeout-minutes: 120
permissions:
contents: read
actions: write
env:
FRONTEND_ARTIFACT_NAME: ${{ needs.frontend.outputs.artifact_name }}
MESHCHATX_FRONTEND_PREBUILT: "1"
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Linux packaging APT dependencies
run: bash scripts/ci/github-apt-linux-packaging.sh
- name: Install project dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
- name: Build release-assets
run: bash scripts/ci/github-build-linux-release-assets.sh
- name: Upload Linux release artifact (arm64)
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
with:
name: meshchatx-linux-release-arm64-${{ github.ref_name }}-${{ github.run_id }}
name: meshchatx-linux-release-${{ matrix.arch }}-${{ github.ref_name }}-${{ github.run_id }}
path: release-assets/
if-no-files-found: error
retention-days: 30
collect-linux-slsa-subjects:
name: SLSA subjects + cosign (Linux)
needs: [linux-release, linux-release-arm64]
needs: [linux-release]
if: startsWith(github.ref, 'refs/tags/')
runs-on: ubuntu-latest
outputs:
@ -542,7 +467,7 @@ jobs:
id-token: write
contents: write
actions: read
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
with:
base64-subjects: ${{ needs.collect-linux-slsa-subjects.outputs.hashes }}
upload-assets: false
@ -560,7 +485,7 @@ jobs:
id-token: write
contents: write
actions: read
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
with:
base64-subjects: ${{ needs.collect-desktop-slsa-subjects.outputs.hashes }}
upload-assets: false
@ -609,7 +534,7 @@ jobs:
id-token: write
contents: write
actions: read
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
with:
base64-subjects: ${{ needs.collect-android-flatpak-slsa-subjects.outputs.hashes }}
upload-assets: false
@ -619,7 +544,6 @@ jobs:
name: Draft GitHub release (all assets + SLSA)
needs:
- linux-release
- linux-release-arm64
- collect-linux-slsa-subjects
- slsa-provenance-linux
- build-release
@ -633,7 +557,6 @@ jobs:
!cancelled() &&
startsWith(github.ref, 'refs/tags/') &&
needs.linux-release.result == 'success' &&
needs.linux-release-arm64.result == 'success' &&
needs.collect-linux-slsa-subjects.result == 'success' &&
needs.slsa-provenance-linux.result == 'success' &&
(needs.build-release.result == 'success' || needs.build-release.result == 'failure') &&

144
.github/workflows/build.yml vendored
View file

@ -1,144 +0,0 @@
# Native build verification (Windows + macOS).
#
# Pulls the prebuilt meshchatx/public artifact produced by the reusable
# Frontend build workflow so that each platform job only has to compile the
# cx_Freeze backend and run electron-builder.
#
# Pinned first-party actions (bump tag and SHA together when upgrading):
# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
# actions/setup-python@v6.2.0 a309ff8b426b58ec0e2a45f0f869d46889d02405
# actions/setup-node@v6.1.0 395ad3262231945c25e8478fd5baf05154b1d79f
# actions/download-artifact@v5.0.0 634f93cb2916e3fdff6788551b99b062d0335ce0
name: Build
on:
push:
branches:
- dev
pull_request:
branches:
- dev
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
NODE_OPTIONS: --max-old-space-size=8192
PYTHON_VERSION: "3.14"
NODE_VERSION: "24"
UV_VERSION: "0.11.15"
PNPM_VERSION: "11.1.2"
jobs:
frontend:
name: Build frontend artifact
uses: ./.github/workflows/frontend-build.yml
permissions:
contents: read
with:
artifact_name: meshchatx-frontend-build-${{ github.run_id }}-${{ github.run_attempt }}
retention_days: 1
build-test:
name: Build test (${{ matrix.label }})
needs: frontend
permissions:
contents: read
strategy:
fail-fast: false
matrix:
include:
- os: windows-latest
label: windows
timeout: 120
build_script: scripts/ci/github-build-windows.sh
- os: macos-latest
label: macos
timeout: 180
build_script: scripts/ci/github-build-macos.sh
runs-on: ${{ matrix.os }}
timeout-minutes: ${{ matrix.timeout }}
defaults:
run:
shell: bash
env:
FRONTEND_ARTIFACT_NAME: ${{ needs.frontend.outputs.artifact_name }}
MESHCHATX_FRONTEND_PREBUILT: "1"
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Install Rosetta (Apple Silicon)
if: matrix.label == 'macos'
run: /usr/sbin/softwareupdate --install-rosetta --agree-to-license || true
- name: Ensure x86_64 Homebrew (/usr/local) for universal slice
if: matrix.label == 'macos'
run: bash scripts/ci/github-ensure-macos-x86-64-homebrew.sh
- name: Set up Python x64 for cx_Freeze universal slice
id: python_x64
if: matrix.label == 'macos'
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ env.PYTHON_VERSION }}
architecture: x64
update-environment: false
- name: Install x86_64 codec2 for pycodec2 (universal slice)
if: matrix.label == 'macos'
run: |
set -euo pipefail
arch -x86_64 /usr/local/bin/brew install codec2
- name: Install Rust x86_64-apple-darwin target (cbor2 x64 slice)
if: matrix.label == 'macos'
run: bash scripts/ci/github-macos-rust-x64-target.sh
- name: Install project deps into x64 Python (mac universal cx_Freeze)
if: matrix.label == 'macos'
env:
PY_X64: ${{ steps.python_x64.outputs.python-path }}
run: bash scripts/ci/github-install-macos-x64-python-deps.sh
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
- name: Build distributables
run: bash "${{ matrix.build_script }}"

183
.github/workflows/ci.yml vendored
View file

@ -1,16 +1,14 @@
# Linux CI: lint, frontend/backend tests, localization, and a Linux build check.
# Primary CI: lint, tests, localization, Linux build check, E2E, and native builds (dev).
#
# The frontend bundle is produced once by the reusable Frontend build workflow
# and downloaded by the Linux build-check job (and by the platform build/release
# workflows) instead of being rebuilt on every job.
# The frontend bundle is built once via the reusable frontend-build workflow and
# downloaded by downstream jobs instead of rebuilding on every runner.
#
# Pinned first-party actions (bump tag and SHA together when upgrading):
# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
# actions/setup-python@v6.2.0 a309ff8b426b58ec0e2a45f0f869d46889d02405
# actions/setup-node@v6.1.0 395ad3262231945c25e8478fd5baf05154b1d79f
# actions/upload-artifact@v5.0.0 330a01c490aca151604b8cf639adc76d48f6c5d4
# actions/download-artifact@v5.0.0 634f93cb2916e3fdff6788551b99b062d0335ce0
# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
name: CI
on:
@ -27,7 +25,7 @@ permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
env:
@ -75,33 +73,14 @@ jobs:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
- name: Set up development environment
uses: ./.github/actions/setup-dev-environment
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
uv-version: ${{ env.UV_VERSION }}
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Run matrix task
run: |
set -euo pipefail
@ -143,45 +122,18 @@ jobs:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
- name: Set up development environment
uses: ./.github/actions/setup-dev-environment
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
uv-version: ${{ env.UV_VERSION }}
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
- name: Fetch frontend artifact
uses: ./.github/actions/fetch-frontend-artifact
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
- name: Compile backend sources
run: uv run python -m compileall meshchatx/
@ -222,33 +174,43 @@ jobs:
test -n "$(ls -A .artifacts/linux-build-check/build/exe)"
echo "Linux build artifact download + content validation passed."
e2e:
name: E2E smoke
runs-on: ubuntu-latest
timeout-minutes: 20
native-build:
name: Native build (${{ matrix.label }})
if: >-
github.ref == 'refs/heads/dev' ||
(github.event_name == 'pull_request' && github.base_ref == 'dev')
needs: frontend
permissions:
contents: read
strategy:
fail-fast: false
matrix:
include:
- os: windows-latest
label: windows
timeout: 120
build_script: scripts/ci/github-build-windows.sh
- os: macos-latest
label: macos
timeout: 180
build_script: scripts/ci/github-build-macos.sh
runs-on: ${{ matrix.os }}
timeout-minutes: ${{ matrix.timeout }}
defaults:
run:
shell: bash
env:
FRONTEND_ARTIFACT_NAME: ${{ needs.frontend.outputs.artifact_name }}
MESHCHATX_FRONTEND_PREBUILT: "1"
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
- name: Set up Python and UV
uses: ./.github/actions/setup-python-uv
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
uv-version: ${{ env.UV_VERSION }}
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
@ -259,5 +221,64 @@ jobs:
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Install Rosetta (Apple Silicon)
if: matrix.label == 'macos'
run: /usr/sbin/softwareupdate --install-rosetta --agree-to-license || true
- name: Ensure x86_64 Homebrew (/usr/local) for universal slice
if: matrix.label == 'macos'
run: bash scripts/ci/github-ensure-macos-x86-64-homebrew.sh
- name: Set up Python x64 for cx_Freeze universal slice
id: python_x64
if: matrix.label == 'macos'
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ env.PYTHON_VERSION }}
architecture: x64
update-environment: false
- name: Install x86_64 codec2 for pycodec2 (universal slice)
if: matrix.label == 'macos'
run: |
set -euo pipefail
arch -x86_64 /usr/local/bin/brew install codec2
- name: Install Rust x86_64-apple-darwin target (cbor2 x64 slice)
if: matrix.label == 'macos'
run: bash scripts/ci/github-macos-rust-x64-target.sh
- name: Install project deps into x64 Python (mac universal cx_Freeze)
if: matrix.label == 'macos'
env:
PY_X64: ${{ steps.python_x64.outputs.python-path }}
run: bash scripts/ci/github-install-macos-x64-python-deps.sh
- name: Fetch frontend artifact
uses: ./.github/actions/fetch-frontend-artifact
with:
artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
- name: Build distributables
run: bash "${{ matrix.build_script }}"
e2e:
name: E2E smoke
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up development environment
uses: ./.github/actions/setup-dev-environment
with:
python-version: ${{ env.PYTHON_VERSION }}
uv-version: ${{ env.UV_VERSION }}
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Run Playwright smoke E2E
run: bash scripts/ci/github-e2e.sh

2
.github/workflows/docker.yml vendored
View file

@ -44,7 +44,7 @@ permissions:
id-token: write
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
group: docker-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
env:

19
.github/workflows/pypi.yml vendored
View file

@ -16,8 +16,9 @@
# actions/upload-artifact@v5.0.0 330a01c490aca151604b8cf639adc76d48f6c5d4
# actions/download-artifact@v5.0.0 634f93cb2916e3fdff6788551b99b062d0335ce0
#
# SLSA generator (must stay @vX.Y.Z semver per upstream):
# SLSA generator (pinned to v2.1.0 commit):
# slsa-framework/slsa-github-generator/generator_generic_slsa3.yml@v2.1.0
# f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
#
# Third-party pin (resolve before bumping release/v1):
# curl -sS "https://api.github.com/repos/pypa/gh-action-pypi-publish/commits/release/v1" | jq -r '.sha'
@ -80,18 +81,10 @@ jobs:
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
- name: Fetch frontend artifact
uses: ./.github/actions/fetch-frontend-artifact
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend bundle in tree
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
- name: Install build
run: python -m pip install -U pip "build>=1.2.0"
@ -173,7 +166,7 @@ jobs:
id-token: write
contents: write
actions: read
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
with:
base64-subjects: ${{ needs.build.outputs.hashes }}
upload-assets: false

91
.github/workflows/security-scan.yml vendored
View file

@ -1,91 +0,0 @@
# Security scans migrated from .gitea/workflows/scan.yml.
#
# Pinned first-party actions (bump tag and SHA together when upgrading):
# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
# actions/setup-python@v6.2.0 a309ff8b426b58ec0e2a45f0f869d46889d02405
# actions/setup-node@v6.1.0 395ad3262231945c25e8478fd5baf05154b1d79f
# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
# FIXME: CVE-2026-3219 affects pip through 26.0.1 waiting for next release to fix for now we ignore it
name: Security scans
on:
schedule:
- cron: "30 12 * * 1"
push:
branches:
- master
- dev
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
PYTHON_VERSION: "3.14"
NODE_VERSION: "24"
UV_VERSION: "0.11.15"
PNPM_VERSION: "11.1.2"
COSIGN_VERSION: "3.0.6"
# Official .deb; setup-trivy.sh verifies sigstore + SHA256 (see build-release.yml).
TRIVY_VERSION: "0.69.3"
jobs:
scan:
runs-on: ubuntu-latest
timeout-minutes: 45
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: pip-audit
run: |
uv run pip install --upgrade "pip>=26.0" pip-audit
uv run pip-audit --ignore-vuln CVE-2026-3219
- name: Apt update (for Trivy .deb)
run: sh scripts/ci/exec-priv.sh apt-get update -qq
- name: Setup Trivy
run: sh scripts/ci/setup-trivy.sh
- name: Trivy filesystem scan (dependencies)
run: sh scripts/ci/trivy-fs-scan.sh
- name: Trivy Dockerfile misconfiguration
run: trivy config --exit-code 1 Dockerfile

107
.github/workflows/codeql.yml → .github/workflows/security.yml vendored
View file

@ -1,20 +1,26 @@
# Dependency audits, filesystem/container config scans, and CodeQL analysis.
#
# Pinned first-party actions (bump tag and SHA together when upgrading):
# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
# actions/setup-python@v6.2.0 a309ff8b426b58ec0e2a45f0f869d46889d02405
# actions/setup-node@v6.1.0 395ad3262231945c25e8478fd5baf05154b1d79f
# actions/download-artifact@v5.0.0 634f93cb2916e3fdff6788551b99b062d0335ce0
# github/codeql-action/init@v4.31.6 95e58e9a2cdfd71adc6e0353d5c52f41a045d225
# github/codeql-action/analyze@v4.31.6 95e58e9a2cdfd71adc6e0353d5c52f41a045d225
# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
#
# FIXME: CVE-2026-3219 affects pip through 26.0.1; ignored until next pip release.
name: "CodeQL Advanced"
name: Security
on:
push:
branches: ["master", "dev"]
branches:
- master
- dev
pull_request:
branches: ["master", "dev"]
branches:
- master
- dev
schedule:
- cron: "30 12 * * 1"
- cron: "35 18 * * 3"
workflow_dispatch:
@ -22,7 +28,7 @@ permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
group: security-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
env:
@ -32,8 +38,44 @@ env:
NODE_VERSION: "24"
UV_VERSION: "0.11.15"
PNPM_VERSION: "11.1.2"
TRIVY_VERSION: "0.69.3"
jobs:
dependency-audit:
name: Dependency and config scan
runs-on: ubuntu-latest
timeout-minutes: 45
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up development environment
uses: ./.github/actions/setup-dev-environment
with:
python-version: ${{ env.PYTHON_VERSION }}
uv-version: ${{ env.UV_VERSION }}
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: pip-audit
run: |
uv run pip install --upgrade "pip>=26.0" pip-audit
uv run pip-audit --ignore-vuln CVE-2026-3219
- name: Apt update (for Trivy .deb)
run: sh scripts/ci/exec-priv.sh apt-get update -qq
- name: Setup Trivy
run: sh scripts/ci/setup-trivy.sh
- name: Trivy filesystem scan (dependencies)
run: sh scripts/ci/trivy-fs-scan.sh
- name: Trivy Dockerfile misconfiguration
run: trivy config --exit-code 1 Dockerfile
frontend:
name: Build frontend artifact (CodeQL)
uses: ./.github/workflows/frontend-build.yml
@ -43,16 +85,15 @@ jobs:
artifact_name: meshchatx-frontend-codeql-${{ github.run_id }}-${{ github.run_attempt }}
retention_days: 1
analyze:
name: Analyze (${{ matrix.language }})
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
codeql:
name: CodeQL (${{ matrix.language }})
runs-on: ubuntu-latest
timeout-minutes: 360
permissions:
security-events: write
packages: read
actions: read
contents: read
strategy:
fail-fast: false
matrix:
@ -65,7 +106,6 @@ jobs:
build-mode: none
- language: python
build-mode: none
steps:
- name: Checkout repository
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
@ -81,8 +121,8 @@ jobs:
with:
category: "/language:${{matrix.language}}"
analyze-javascript:
name: Analyze (javascript-typescript)
codeql-javascript:
name: CodeQL (javascript-typescript)
runs-on: ubuntu-latest
needs: [frontend]
timeout-minutes: 360
@ -98,45 +138,18 @@ jobs:
- name: Checkout repository
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
- name: Set up development environment
uses: ./.github/actions/setup-dev-environment
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install UV (PyPI pin)
env:
UV_VERSION: ${{ env.UV_VERSION }}
run: bash scripts/ci/github-install-uv.sh
- name: Cache UV downloads
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
with:
path: ~/.cache/uv
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-
- name: Set up Node and pnpm
uses: ./.github/actions/setup-node-pnpm
with:
uv-version: ${{ env.UV_VERSION }}
node-version: ${{ env.NODE_VERSION }}
pnpm-version: ${{ env.PNPM_VERSION }}
- name: Install dependencies
run: bash scripts/ci/github-install-deps.sh
- name: Download frontend artifact
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
- name: Fetch frontend artifact
uses: ./.github/actions/fetch-frontend-artifact
with:
name: ${{ env.FRONTEND_ARTIFACT_NAME }}
path: meshchatx/public
- name: Verify frontend artifact contents
run: |
set -euo pipefail
test -f meshchatx/public/index.html
test -d meshchatx/public/assets
test -d meshchatx/public/reticulum-docs-bundled/current
artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
- name: Initialize CodeQL
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225