Compare commits
32
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
  Thore CimbalandClaude Fable 5
|
6e021ee853 | ||
|
Thore CimbalandClaude Fable 5
|
5a8c42b5e9 | ||
|
Thore CimbalandClaude Fable 5
|
5505b9cfc1 | ||
|
Thore CimbalandClaude Fable 5
|
a2bfaaec8f | ||
|
Thore CimbalandClaude Fable 5
|
b656eefdc7 | ||
|
Thore CimbalandClaude Fable 5
|
a55adfdd65 | ||
|
Thore CimbalandClaude Fable 5
|
cf66ff018d | ||
|
Thore CimbalandClaude Fable 5
|
97e18bbf2f | ||
|
Thore Cimbal
|
c401f54e4d | ||
|
Thore Cimbal
|
1eb4968968 | ||
|
Thore CimbalandClaude Fable 5
|
a8767583da | ||
|
Thore Cimbal
|
0d0c1659c6 | ||
|
Thore Cimbal
|
624274f5f0 | ||
|
Thore CimbalandClaude Fable 5
|
9e2f49b3dd | ||
|
Thore Cimbal
|
a414bb8585 | ||
|
Thore Cimbal
|
8465457a48 | ||
|
Thore Cimbal
|
252b16ca71 | ||
|
Thore CimbalandClaude Fable 5
|
0d0255cb7f | ||
|
Thore Cimbal
|
bc0769809d | ||
|
Thore CimbalandClaude Fable 5
|
e21e101004 | ||
|
Thore CimbalandClaude Sonnet 5
|
8d46fb33d2 | ||
|
Thore CimbalandClaude Sonnet 5
|
71ac7c4346 | ||
|
Thore Cimbal
|
8faade6c7b | ||
|
Thore CimbalandClaude Sonnet 5
|
f2abae85dd | ||
|
Thore Cimbal
|
0f1d31021c | ||
|
Thore Cimbal
|
bd8298db39 | ||
|
Thore CimbalandClaude Sonnet 5
|
77ffeb4514 | ||
|
Thore Cimbal
|
45fb329577 | ||
|
Thore Cimbal
|
42285021cb | ||
|
Thore Cimbal
|
44305556c3 | ||
|
Thore Cimbal
|
306cca041c | ||
|
Thore Cimbal
|
1822fe80f0 |
@@ -1,34 +0,0 @@
|
||||
name: Backport
|
||||
on:
|
||||
# Privilege escalation necessary to enable backporting PRs from forks
|
||||
# 🚨 We must not execute any checked out code here.
|
||||
pull_request_target: # zizmor: ignore[dangerous-triggers]
|
||||
types:
|
||||
- closed
|
||||
- labeled
|
||||
branches:
|
||||
- develop
|
||||
|
||||
permissions: {} # We use ELEMENT_BOT_TOKEN instead
|
||||
|
||||
jobs:
|
||||
backport:
|
||||
name: Backport
|
||||
runs-on: ubuntu-24.04
|
||||
# Only react to merged PRs for security reasons.
|
||||
# See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
|
||||
if: >
|
||||
github.event.pull_request.merged
|
||||
&& (
|
||||
github.event.action == 'closed'
|
||||
|| (
|
||||
github.event.action == 'labeled'
|
||||
&& contains(github.event.label.name, 'backport')
|
||||
)
|
||||
)
|
||||
steps:
|
||||
- uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # v2
|
||||
with:
|
||||
labels_template: "<%= JSON.stringify([...labels, 'X-Release-Blocker']) %>"
|
||||
# We can't use GITHUB_TOKEN here or CI won't run on the new PR
|
||||
github_token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
@@ -1,48 +0,0 @@
|
||||
# Triggers after the playwright tests have finished,
|
||||
# taking the artifact and uploading it to Netlify for easier viewing
|
||||
name: Upload End to End Test report to Netlify
|
||||
on:
|
||||
# Privilege escalation necessary to publish to Netlify
|
||||
# 🚨 We must not execute any checked out code here.
|
||||
workflow_run: # zizmor: ignore[dangerous-triggers]
|
||||
workflows: ["Build & Test"]
|
||||
types:
|
||||
- completed
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.run_id }}
|
||||
cancel-in-progress: ${{ github.event.workflow_run.event == 'pull_request' }}
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
report:
|
||||
if: github.event.workflow_run.conclusion != 'cancelled'
|
||||
name: Report results
|
||||
runs-on: ubuntu-24.04
|
||||
environment: Netlify
|
||||
permissions:
|
||||
statuses: write
|
||||
deployments: write
|
||||
actions: read
|
||||
steps:
|
||||
- name: Download HTML report
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
run-id: ${{ github.event.workflow_run.id }}
|
||||
name: html-report
|
||||
path: playwright-report
|
||||
|
||||
- name: 📤 Deploy to Netlify
|
||||
uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
|
||||
with:
|
||||
path: playwright-report
|
||||
owner: ${{ github.event.workflow_run.head_repository.owner.login }}
|
||||
branch: ${{ github.event.workflow_run.head_branch }}
|
||||
revision: ${{ github.event.workflow_run.head_sha }}
|
||||
token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
|
||||
site_id: ${{ vars.NETLIFY_SITE_ID }}
|
||||
desc: Playwright Report
|
||||
deployment_env: EndToEndTests
|
||||
prefix: "e2e-"
|
||||
@@ -1,311 +0,0 @@
|
||||
# builds Element Web
|
||||
# runs Playwright tests against the built Element Web
|
||||
# builds Element Desktop using the built Element Web
|
||||
#
|
||||
# Tries to use a matching js-sdk branch for the build.
|
||||
#
|
||||
# Produces a `webapp` artifact
|
||||
# Produces multiple Desktop artifacts
|
||||
# Produces multiple Playwright report artifacts
|
||||
name: Build & Test
|
||||
on:
|
||||
# CRON to run all Projects at 6am UTC
|
||||
schedule:
|
||||
- cron: "0 6 * * *"
|
||||
pull_request: {}
|
||||
merge_group:
|
||||
types: [checks_requested]
|
||||
push:
|
||||
# We do not build on push to develop as the merge_group check handles that
|
||||
branches: [staging, master]
|
||||
|
||||
# support triggering from other workflows
|
||||
workflow_call:
|
||||
inputs:
|
||||
skip:
|
||||
type: boolean
|
||||
required: false
|
||||
default: false
|
||||
description: "A boolean to skip the playwright check itself while still creating the passing check. Useful when only running in Merge Queues."
|
||||
|
||||
matrix-js-sdk-sha:
|
||||
type: string
|
||||
required: false
|
||||
description: "The Git SHA of matrix-js-sdk to build against. By default, will use a matching branch name if it exists, or develop."
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
# fetchdep.sh needs to know our PR number
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
# Use 4 runners in the default case, but only 1 when running on a schedule where we run all 5 projects
|
||||
NUM_RUNNERS: ${{ github.event_name == 'schedule' && 1 || 4 }}
|
||||
NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
|
||||
|
||||
permissions: {} # No permissions required
|
||||
|
||||
jobs:
|
||||
build_ew:
|
||||
name: "Build Element Web"
|
||||
runs-on: ubuntu-24.04
|
||||
if: inputs.skip != true
|
||||
outputs:
|
||||
num-runners: ${{ env.NUM_RUNNERS }}
|
||||
runners-matrix: ${{ steps.runner-vars.outputs.matrix }}
|
||||
# Skip pull_request runs on renovate PRs to speed up CI time, delegating to the full run in merge queue
|
||||
skip: ${{ inputs.skip || (github.event_name == 'pull_request' && startsWith(github.head_ref, 'renovate/')) }}
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
repository: element-hq/element-web
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
cache: "pnpm"
|
||||
node-version: "lts/*"
|
||||
|
||||
- name: Fetch layered build
|
||||
env:
|
||||
# tell layered.sh to check out the right sha of the JS-SDK & EW, if they were given one
|
||||
JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}
|
||||
run: scripts/layered.sh
|
||||
|
||||
- name: Copy config
|
||||
working-directory: apps/web
|
||||
run: cp element.io/develop/config.json config.json
|
||||
|
||||
- name: Build
|
||||
env:
|
||||
CI_PACKAGE: true
|
||||
working-directory: apps/web
|
||||
run: VERSION=$(scripts/get-version-from-git.sh) pnpm run build
|
||||
|
||||
- name: Upload Artifact
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: webapp
|
||||
path: apps/web/webapp
|
||||
retention-days: 1
|
||||
|
||||
- name: Calculate runner variables
|
||||
id: runner-vars
|
||||
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
|
||||
with:
|
||||
script: |
|
||||
const numRunners = parseInt(process.env.NUM_RUNNERS, 10);
|
||||
const matrix = Array.from({ length: numRunners }, (_, i) => i + 1);
|
||||
core.setOutput("matrix", JSON.stringify(matrix));
|
||||
|
||||
playwright_ew:
|
||||
name: "Run Tests [${{ matrix.project }}] ${{ matrix.runner }}/${{ needs.build_ew.outputs.num-runners }}"
|
||||
needs: build_ew
|
||||
if: needs.build_ew.outputs.skip == 'false'
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
actions: read
|
||||
issues: read
|
||||
pull-requests: read
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# Run multiple instances in parallel to speed up the tests
|
||||
runner: ${{ fromJSON(needs.build_ew.outputs.runners-matrix) }}
|
||||
project:
|
||||
- Chrome
|
||||
- Firefox
|
||||
- WebKit
|
||||
- Dendrite
|
||||
- Pinecone
|
||||
runAllTests:
|
||||
- ${{ github.event_name == 'schedule' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests') }}
|
||||
# Skip the Firefox & Safari runs unless this was a cron trigger or PR has X-Run-All-Tests label
|
||||
exclude:
|
||||
- runAllTests: false
|
||||
project: Firefox
|
||||
- runAllTests: false
|
||||
project: WebKit
|
||||
- runAllTests: false
|
||||
project: Dendrite
|
||||
- runAllTests: false
|
||||
project: Pinecone
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
repository: element-hq/element-web
|
||||
|
||||
- name: 📥 Download artifact
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
name: webapp
|
||||
path: apps/web/webapp
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
cache: "pnpm"
|
||||
cache-dependency-path: pnpm-lock.yaml
|
||||
node-version: "lts/*"
|
||||
|
||||
- name: Install dependencies
|
||||
run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Setup playwright
|
||||
uses: ./.github/actions/setup-playwright
|
||||
with:
|
||||
needs-webkit: ${{ matrix.project == 'WebKit' }}
|
||||
write-cache: ${{ github.event_name != 'merge_group' }}
|
||||
|
||||
# We skip tests tagged with @mergequeue when running on PRs, but run them in MQ and everywhere else
|
||||
- name: Run Playwright tests
|
||||
working-directory: apps/web
|
||||
run: |
|
||||
pnpm test:playwright \
|
||||
--shard "$SHARD" \
|
||||
--project="${{ matrix.project }}" \
|
||||
${{ (github.event_name == 'pull_request' && matrix.runAllTests == false ) && '--grep-invert @mergequeue' || '' }}
|
||||
env:
|
||||
SHARD: ${{ format('{0}/{1}', matrix.runner, needs.build_ew.outputs.num-runners) }}
|
||||
|
||||
- name: Upload blob report to GitHub Actions Artifacts
|
||||
if: always()
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: blob-report-${{ matrix.project }}-${{ matrix.runner }}
|
||||
path: apps/web/blob-report
|
||||
retention-days: 1
|
||||
if-no-files-found: error
|
||||
|
||||
downstream-modules:
|
||||
name: Downstream Playwright tests [element-modules]
|
||||
needs: build_ew
|
||||
if: needs.build_ew.outputs.skip == 'false' && github.event_name == 'merge_group'
|
||||
uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main # zizmor: ignore[unpinned-uses]
|
||||
with:
|
||||
webapp-artifact: webapp
|
||||
reporter: blob
|
||||
|
||||
prepare_ed:
|
||||
name: "Prepare Element Desktop"
|
||||
uses: ./.github/workflows/build_desktop_prepare.yaml
|
||||
needs: build_ew
|
||||
if: needs.build_ew.outputs.skip == 'false'
|
||||
permissions:
|
||||
contents: read
|
||||
with:
|
||||
config: ${{ (github.event.pull_request.base.ref || github.ref_name) == 'develop' && 'element.io/nightly' || 'element.io/release' }}
|
||||
version: ${{ case((github.event.pull_request.base.ref || github.ref_name) == 'develop' || github.event_name == 'merge_group', 'develop', '') }}
|
||||
webapp-artifact: webapp
|
||||
|
||||
build_ed_windows:
|
||||
needs: prepare_ed
|
||||
name: "Desktop Windows"
|
||||
uses: ./.github/workflows/build_desktop_windows.yaml
|
||||
# Skip Windows builds on PRs, as the Linux amd64 build is enough of a smoke test and includes the screenshot tests
|
||||
if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests')
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [x64, ia32, arm64]
|
||||
with:
|
||||
arch: ${{ matrix.arch }}
|
||||
blob_report: true
|
||||
|
||||
build_ed_linux:
|
||||
needs: prepare_ed
|
||||
name: "Desktop Linux"
|
||||
uses: ./.github/workflows/build_desktop_linux.yaml
|
||||
strategy:
|
||||
matrix:
|
||||
sqlcipher: [system, static]
|
||||
arch: [amd64, arm64]
|
||||
runAllTests:
|
||||
- ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests') }}
|
||||
exclude:
|
||||
# We ship static sqlcipher builds, so delegate testing the system builds to the merge queue
|
||||
- runAllTests: false
|
||||
sqlcipher: system
|
||||
# Additionally skip arm64 system builds on PRs, as the amd64 test is enough for a smoke test and includes the screenshot tests
|
||||
- runAllTests: false
|
||||
arch: arm64
|
||||
with:
|
||||
sqlcipher: ${{ matrix.sqlcipher }}
|
||||
arch: ${{ matrix.arch }}
|
||||
blob_report: true
|
||||
|
||||
build_ed_macos:
|
||||
needs: prepare_ed
|
||||
name: "Desktop macOS"
|
||||
uses: ./.github/workflows/build_desktop_macos.yaml
|
||||
# Skip macOS builds on PRs, as the Linux amd64 build is enough of a smoke test and includes the screenshot tests
|
||||
# and we have a very low limit of concurrent macos runners (5) across the Github org.
|
||||
if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests')
|
||||
with:
|
||||
blob_report: true
|
||||
|
||||
complete:
|
||||
name: end-to-end-tests
|
||||
needs:
|
||||
- build_ew
|
||||
- playwright_ew
|
||||
- downstream-modules
|
||||
- prepare_ed
|
||||
- build_ed_windows
|
||||
- build_ed_linux
|
||||
- build_ed_macos
|
||||
if: always()
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
if: needs.build_ew.outputs.skip == 'false'
|
||||
with:
|
||||
persist-credentials: false
|
||||
repository: element-hq/element-web
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
if: needs.build_ew.outputs.skip == 'false'
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
if: needs.build_ew.outputs.skip == 'false'
|
||||
with:
|
||||
cache: "pnpm"
|
||||
node-version: "lts/*"
|
||||
|
||||
- name: Install dependencies
|
||||
if: needs.build_ew.outputs.skip == 'false'
|
||||
run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Download blob reports from GitHub Actions Artifacts
|
||||
if: needs.build_ew.outputs.skip == 'false'
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
pattern: blob-report-*
|
||||
path: all-blob-reports
|
||||
merge-multiple: true
|
||||
|
||||
- name: Merge into HTML Report
|
||||
if: needs.build_ew.outputs.skip == 'false'
|
||||
run: |
|
||||
pnpm playwright merge-reports \
|
||||
--config=playwright-merge.config.ts \
|
||||
./all-blob-reports
|
||||
env:
|
||||
# Only pass creds to the flaky-reporter on main branch runs
|
||||
GITHUB_TOKEN: ${{ github.ref_name == 'develop' && secrets.ELEMENT_BOT_TOKEN || '' }}
|
||||
PLAYWRIGHT_HTML_TITLE: ${{ case(github.event_name == 'pull_request', format('Playwright Report PR-{0}', env.PR_NUMBER), 'Playwright Report') }}
|
||||
|
||||
# Upload the HTML report even if one of our reporters fails, this can happen when stale screenshots are detected
|
||||
- name: Upload HTML report
|
||||
if: always() && needs.build_ew.outputs.skip == 'false'
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: html-report
|
||||
path: playwright-report
|
||||
retention-days: 14
|
||||
if-no-files-found: error
|
||||
|
||||
- if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
|
||||
run: exit 1
|
||||
@@ -1,76 +0,0 @@
|
||||
name: Build
|
||||
on:
|
||||
pull_request: {}
|
||||
push:
|
||||
branches: [develop, master]
|
||||
merge_group:
|
||||
types: [checks_requested]
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
|
||||
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
||||
# develop pushes and repository_dispatch handled in build_develop.yaml
|
||||
env:
|
||||
# This must be set for fetchdep.sh to get the right branch
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
|
||||
permissions: {} # No permissions required
|
||||
jobs:
|
||||
build:
|
||||
name: "Build on ${{ matrix.image }}"
|
||||
# We build on all 3 platforms to ensure we don't have any OS-specific build incompatibilities
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
image:
|
||||
- ubuntu-24.04
|
||||
- windows-2022
|
||||
- macos-14
|
||||
isDevelop:
|
||||
- ${{ github.event_name == 'push' && github.ref_name == 'develop' }}
|
||||
isPullRequest:
|
||||
- ${{ github.event_name == 'pull_request' }}
|
||||
# Skip the ubuntu-24.04 build for the develop branch as the dedicated CD build_develop workflow handles that
|
||||
# Skip the non-linux builds for pull requests as Windows is awfully slow, so run in merge queue only
|
||||
exclude:
|
||||
- isDevelop: true
|
||||
image: ubuntu-24.04
|
||||
- isPullRequest: true
|
||||
image: windows-2022
|
||||
- isPullRequest: true
|
||||
image: macos-14
|
||||
runs-on: ${{ matrix.image }}
|
||||
defaults:
|
||||
run:
|
||||
shell: bash
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
# Disable cache on Windows as it is slower than not caching
|
||||
# https://github.com/actions/setup-node/issues/975
|
||||
cache: ${{ runner.os != 'Windows' && 'pnpm' || '' }}
|
||||
node-version: "lts/*"
|
||||
|
||||
- name: Fetch layered build
|
||||
run: ./scripts/layered.sh
|
||||
|
||||
- name: Copy config
|
||||
working-directory: apps/web
|
||||
run: cp element.io/develop/config.json config.json
|
||||
|
||||
- name: Build
|
||||
working-directory: apps/web
|
||||
env:
|
||||
CI_PACKAGE: true
|
||||
run: VERSION=$(scripts/get-version-from-git.sh) pnpm run build
|
||||
|
||||
- name: Upload Artifact
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: webapp-${{ matrix.image }}
|
||||
path: apps/web/webapp
|
||||
retention-days: 1
|
||||
@@ -1,86 +0,0 @@
|
||||
name: Build Debian package
|
||||
on:
|
||||
release:
|
||||
types: [published]
|
||||
concurrency: ${{ github.workflow }}
|
||||
permissions: {} # We use ELEMENT_BOT_TOKEN instead
|
||||
jobs:
|
||||
build:
|
||||
name: Build package
|
||||
environment: packages.element.io
|
||||
runs-on: ubuntu-24.04
|
||||
env:
|
||||
R2_INCOMING_BUCKET: ${{ vars.R2_INCOMING_BUCKET }}
|
||||
R2_URL: ${{ vars.CF_R2_S3_API }}
|
||||
VERSION: ${{ github.ref_name }}
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Download package
|
||||
working-directory: apps/web
|
||||
run: |
|
||||
wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz"
|
||||
wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz.asc"
|
||||
|
||||
- name: Check GPG signature
|
||||
working-directory: apps/web
|
||||
run: |
|
||||
wget "https://packages.element.io/element-release-key.gpg"
|
||||
gpg --import element-release-key.gpg
|
||||
gpg --fingerprint "$FINGERPRINT"
|
||||
gpg --verify "element-$VERSION.tar.gz.asc" "element-$VERSION.tar.gz"
|
||||
env:
|
||||
FINGERPRINT: ${{ vars.GPG_FINGERPRINT }}
|
||||
|
||||
- name: Prepare
|
||||
working-directory: apps/web
|
||||
run: |
|
||||
mkdir -p debian/tmp/DEBIAN
|
||||
find debian -maxdepth 1 -type f -exec cp "{}" debian/tmp/DEBIAN/ \;
|
||||
mkdir -p debian/tmp/usr/share/element-web/ debian/tmp/etc/element-web/
|
||||
|
||||
tar -xf "element-$VERSION.tar.gz" -C debian/tmp/usr/share/element-web --strip-components=1 --no-same-owner --no-same-permissions
|
||||
mv debian/tmp/usr/share/element-web/config.sample.json debian/tmp/etc/element-web/config.json
|
||||
ln -s /etc/element-web/config.json debian/tmp/usr/share/element-web/config.json
|
||||
|
||||
- name: Write changelog
|
||||
working-directory: apps/web
|
||||
run: |
|
||||
VERSION=$(cat package.json | jq -r .version)
|
||||
TIME=$(date -d "$PUBLISHED_AT" -R)
|
||||
{
|
||||
echo "element-web ($VERSION) default; urgency=medium"
|
||||
echo "$BODY" | sed 's/^##/\n */g;s/^\*/ */g' | perl -pe 's/\[.+?]\((.+?)\)/\1/g'
|
||||
echo ""
|
||||
echo " -- $ACTOR <support@element.io> $TIME"
|
||||
} > debian/tmp/DEBIAN/changelog
|
||||
env:
|
||||
ACTOR: ${{ github.actor }}
|
||||
VERSION: ${{ github.event.release.tag_name }}
|
||||
BODY: ${{ github.event.release.body }}
|
||||
PUBLISHED_AT: ${{ github.event.release.published_at }}
|
||||
|
||||
- name: Build deb package
|
||||
working-directory: apps/web
|
||||
run: |
|
||||
VERSION=$(cat package.json | jq -r .version)
|
||||
dpkg-gencontrol -v"$VERSION" -ldebian/tmp/DEBIAN/changelog
|
||||
dpkg-deb -Zxz --root-owner-group --build debian/tmp element-web.deb
|
||||
|
||||
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: element-web.deb
|
||||
path: apps/web/element-web.deb
|
||||
retention-days: 14
|
||||
|
||||
- name: Publish to packages.element.io
|
||||
if: github.event.release.prerelease == false
|
||||
uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
|
||||
with:
|
||||
file: apps/web/element-web.deb
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
bucket-api: ${{ vars.CF_R2_S3_API }}
|
||||
bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
|
||||
bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
|
||||
@@ -1,313 +0,0 @@
|
||||
name: Build and Deploy
|
||||
on:
|
||||
# Nightly build
|
||||
schedule:
|
||||
- cron: "0 9 * * *"
|
||||
# Release build
|
||||
release:
|
||||
types: [published]
|
||||
# Manual nightly & release
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
mode:
|
||||
description: What type of build to trigger. Release builds MUST be ran from the `master` branch.
|
||||
required: true
|
||||
default: nightly
|
||||
type: choice
|
||||
options:
|
||||
- nightly
|
||||
- release
|
||||
macos:
|
||||
description: Build macOS
|
||||
required: true
|
||||
type: boolean
|
||||
default: true
|
||||
windows:
|
||||
description: Build Windows
|
||||
required: true
|
||||
type: boolean
|
||||
default: true
|
||||
linux:
|
||||
description: Build Linux
|
||||
required: true
|
||||
type: boolean
|
||||
default: true
|
||||
deploy:
|
||||
description: Deploy artifacts
|
||||
required: true
|
||||
type: boolean
|
||||
default: true
|
||||
run-name: Element ${{ inputs.mode != 'release' && github.event_name != 'release' && 'Nightly' || 'Desktop' }}
|
||||
concurrency: ${{ github.workflow }}
|
||||
env:
|
||||
R2_BUCKET: ${{ vars.R2_BUCKET }}
|
||||
permissions: {} # Uses ELEMENT_BOT_TOKEN
|
||||
jobs:
|
||||
prepare:
|
||||
uses: ./.github/workflows/build_desktop_prepare.yaml
|
||||
permissions:
|
||||
contents: read
|
||||
with:
|
||||
config: element.io/${{ inputs.mode || (github.event_name == 'release' && 'release') || 'nightly' }}
|
||||
version: ${{ (inputs.mode != 'release' && github.event_name != 'release') && 'develop' || '' }}
|
||||
nightly: ${{ inputs.mode != 'release' && github.event_name != 'release' }}
|
||||
deploy: ${{ inputs.deploy || (github.event_name != 'workflow_dispatch' && github.event.release.prerelease != true) }}
|
||||
secrets:
|
||||
CF_R2_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
|
||||
CF_R2_TOKEN: ${{ secrets.CF_R2_TOKEN }}
|
||||
|
||||
trigger-pro-pipeline:
|
||||
name: Trigger Pro pipeline
|
||||
needs: prepare
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
|
||||
with:
|
||||
repository: element-hq/element-web-pro
|
||||
token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
event-type: trigger-pipeline
|
||||
client-payload: |-
|
||||
{
|
||||
"base-ref": "${{ github.ref_name }}"
|
||||
}
|
||||
|
||||
windows:
|
||||
if: github.event_name != 'workflow_dispatch' || inputs.windows
|
||||
needs: prepare
|
||||
name: Windows ${{ matrix.arch }}
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [x64, arm64]
|
||||
uses: ./.github/workflows/build_desktop_windows.yaml
|
||||
secrets: inherit # zizmor: ignore[secrets-inherit]
|
||||
with:
|
||||
sign: true
|
||||
arch: ${{ matrix.arch }}
|
||||
version: ${{ needs.prepare.outputs.nightly-version }}
|
||||
|
||||
macos:
|
||||
if: github.event_name != 'workflow_dispatch' || inputs.macos
|
||||
needs: prepare
|
||||
name: macOS
|
||||
uses: ./.github/workflows/build_desktop_macos.yaml
|
||||
secrets: inherit # zizmor: ignore[secrets-inherit]
|
||||
with:
|
||||
sign: true
|
||||
base-url: https://packages.element.io/${{ needs.prepare.outputs.packages-dir }}
|
||||
version: ${{ needs.prepare.outputs.nightly-version }}
|
||||
|
||||
linux:
|
||||
if: github.event_name != 'workflow_dispatch' || inputs.linux
|
||||
needs: prepare
|
||||
name: Linux ${{ matrix.arch }} (sqlcipher ${{ matrix.sqlcipher }})
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
sqlcipher: [static]
|
||||
uses: ./.github/workflows/build_desktop_linux.yaml
|
||||
with:
|
||||
arch: ${{ matrix.arch }}
|
||||
sqlcipher: ${{ matrix.sqlcipher }}
|
||||
version: ${{ needs.prepare.outputs.nightly-version }}
|
||||
|
||||
deploy:
|
||||
needs:
|
||||
- prepare
|
||||
- macos
|
||||
- linux
|
||||
- windows
|
||||
runs-on: ubuntu-24.04
|
||||
name: ${{ needs.prepare.outputs.deploy == 'true' && 'Deploy' || 'Deploy (dry-run)' }}
|
||||
if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
|
||||
environment: ${{ needs.prepare.outputs.deploy == 'true' && 'packages.element.io' || '' }}
|
||||
steps:
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
|
||||
- name: Prepare artifacts for deployment
|
||||
run: |
|
||||
set -ex
|
||||
|
||||
# Windows
|
||||
for arch in x64 arm64
|
||||
do
|
||||
if [ -d "win-$arch" ]; then
|
||||
mkdir -p packages.element.io/{install,update}/win32/$arch
|
||||
mv win-$arch/squirrel-windows*/*.exe "packages.element.io/install/win32/$arch/"
|
||||
mv win-$arch/squirrel-windows*/*.nupkg "packages.element.io/update/win32/$arch/"
|
||||
mv win-$arch/squirrel-windows*/RELEASES "packages.element.io/update/win32/$arch/"
|
||||
fi
|
||||
done
|
||||
|
||||
# macOS
|
||||
if [ -d macos ]; then
|
||||
mkdir -p packages.element.io/{install,update}/macos
|
||||
mv macos/*.dmg packages.element.io/install/macos/
|
||||
mv macos/*-mac.zip packages.element.io/update/macos/
|
||||
mv macos/*.json packages.element.io/update/macos/
|
||||
fi
|
||||
|
||||
# Linux
|
||||
if [ -d linux-amd64-sqlcipher-static ]; then
|
||||
mkdir -p packages.element.io/install/linux/glibc-x86-64
|
||||
mv linux-amd64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-x86-64
|
||||
fi
|
||||
if [ -d linux-arm64-sqlcipher-static ]; then
|
||||
mkdir -p packages.element.io/install/linux/glibc-aarch64
|
||||
mv linux-arm64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-aarch64
|
||||
fi
|
||||
|
||||
# We don't wish to store the installer for every nightly ever, so we only keep the latest
|
||||
- name: "[Nightly] Strip version from installer file"
|
||||
if: needs.prepare.outputs.nightly-version != ''
|
||||
run: |
|
||||
set -ex
|
||||
|
||||
# Windows
|
||||
for arch in x64 arm64
|
||||
do
|
||||
if [ -d "win-$arch" ]; then mv packages.element.io/install/win32/$arch/{*,"Element Nightly Setup"}.exe; fi
|
||||
done
|
||||
|
||||
# macOS
|
||||
if [ -d macos ]; then mv packages.element.io/install/macos/{*,"Element Nightly"}.dmg; fi
|
||||
|
||||
# Linux
|
||||
if [ -d linux-amd64-sqlcipher-static ]; then mv packages.element.io/install/linux/glibc-x86-64/{*,element-desktop-nightly}.tar.gz; fi
|
||||
if [ -d linux-arm64-sqlcipher-static ]; then mv packages.element.io/install/linux/glibc-aarch64/{*,element-desktop-nightly}.tar.gz; fi
|
||||
|
||||
- name: "[Release] Prepare release latest symlink"
|
||||
if: needs.prepare.outputs.nightly-version == ''
|
||||
run: |
|
||||
set -ex
|
||||
|
||||
# Windows
|
||||
for arch in x64 arm64
|
||||
do
|
||||
if [ -d "win-$arch" ]; then
|
||||
pushd packages.element.io/install/win32/$arch
|
||||
ln -s "$(find . -type f -iname "*.exe" | xargs -0 -n1 -- basename)" "Element Setup.exe"
|
||||
popd
|
||||
fi
|
||||
done
|
||||
|
||||
# macOS
|
||||
if [ -d macos ]; then
|
||||
pushd packages.element.io/install/macos
|
||||
ln -s "$(find . -type f -iname "*.dmg" | xargs -0 -n1 -- basename)" "Element.dmg"
|
||||
popd
|
||||
fi
|
||||
|
||||
# Linux
|
||||
if [ -d linux-amd64-sqlcipher-static ]; then
|
||||
pushd packages.element.io/install/linux/glibc-x86-64
|
||||
ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
|
||||
popd
|
||||
fi
|
||||
if [ -d linux-arm64-sqlcipher-static ]; then
|
||||
pushd packages.element.io/install/linux/glibc-aarch64
|
||||
ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
|
||||
popd
|
||||
fi
|
||||
|
||||
- name: Stash packages.element.io
|
||||
if: needs.prepare.outputs.deploy == 'false'
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: packages.element.io
|
||||
path: packages.element.io
|
||||
|
||||
# Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
|
||||
- name: Deploy artifacts
|
||||
if: needs.prepare.outputs.deploy == 'true'
|
||||
run: |
|
||||
set -x
|
||||
aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto --checksum-algorithm CRC32
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
|
||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
|
||||
R2_URL: ${{ vars.CF_R2_S3_API }}
|
||||
DEPLOYMENT_DIR: ${{ needs.prepare.outputs.packages-dir }}
|
||||
|
||||
- name: Notify packages.element.io of new files
|
||||
if: needs.prepare.outputs.deploy == 'true'
|
||||
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
|
||||
with:
|
||||
token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
repository: element-hq/packages.element.io
|
||||
event-type: packages-index
|
||||
|
||||
- name: Find debs
|
||||
id: deb
|
||||
if: needs.linux.result == 'success'
|
||||
run: |
|
||||
set -x
|
||||
|
||||
for arch in amd64 arm64
|
||||
do
|
||||
echo "$arch=$(ls linux-$arch-sqlcipher-static/*.deb | tail -n1)" >> $GITHUB_OUTPUT
|
||||
done
|
||||
|
||||
- name: Stash debs
|
||||
if: needs.prepare.outputs.deploy == 'false' && needs.linux.result == 'success'
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: debs
|
||||
path: |
|
||||
${{ steps.deb.outputs.amd64 }}
|
||||
${{ steps.deb.outputs.arm64 }}
|
||||
|
||||
- name: Publish amd64 deb to packages.element.io
|
||||
uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
|
||||
if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
|
||||
with:
|
||||
file: ${{ steps.deb.outputs.amd64 }}
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
bucket-api: ${{ vars.CF_R2_S3_API }}
|
||||
bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
|
||||
bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
|
||||
|
||||
- name: Publish arm64 deb to packages.element.io
|
||||
uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
|
||||
if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
|
||||
with:
|
||||
file: ${{ steps.deb.outputs.arm64 }}
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
bucket-api: ${{ vars.CF_R2_S3_API }}
|
||||
bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
|
||||
bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
|
||||
|
||||
deploy-ess:
|
||||
needs: deploy
|
||||
runs-on: ubuntu-24.04
|
||||
name: Deploy builds to ESS
|
||||
if: needs.prepare.outputs.deploy == 'true' && github.event_name == 'release'
|
||||
env:
|
||||
BUCKET_NAME: "element-desktop-msi.onprem.element.io"
|
||||
AWS_REGION: "eu-central-1"
|
||||
permissions:
|
||||
id-token: write # This is required for requesting the JWT
|
||||
steps:
|
||||
- name: Configure AWS credentials
|
||||
uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6
|
||||
with:
|
||||
role-to-assume: arn:aws:iam::264135176173:role/Push-ElementDesktop-MSI
|
||||
role-session-name: githubaction-run-${{ github.run_id }}
|
||||
aws-region: ${{ env.AWS_REGION }}
|
||||
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
pattern: win-*
|
||||
|
||||
- name: Copy files to S3
|
||||
run: |
|
||||
set -x
|
||||
|
||||
PREFIX="${VERSION%.*}"
|
||||
for file in win-*/*.msi; do
|
||||
filename=$(basename "$file")
|
||||
aws s3 cp "$file" "s3://${{ env.BUCKET_NAME }}/$PREFIX/$filename"
|
||||
done
|
||||
env:
|
||||
VERSION: ${{ github.event.release.tag_name }}
|
||||
@@ -1,265 +0,0 @@
|
||||
# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
|
||||
# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
|
||||
# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
ref:
|
||||
type: string
|
||||
required: false
|
||||
description: "The git ref to checkout, defaults to the default branch"
|
||||
arch:
|
||||
type: string
|
||||
required: true
|
||||
description: "The architecture to build for, one of 'amd64' | 'arm64'"
|
||||
version:
|
||||
type: string
|
||||
required: false
|
||||
description: "Version string to override the one in package.json, used for non-release builds"
|
||||
sqlcipher:
|
||||
type: string
|
||||
required: true
|
||||
description: "How to link sqlcipher, one of 'system' | 'static'"
|
||||
blob_report:
|
||||
type: boolean
|
||||
required: false
|
||||
description: "Whether to run the blob report"
|
||||
prepare-artifact-name:
|
||||
type: string
|
||||
required: false
|
||||
description: |
|
||||
The name of the prepare artifact to use, defaults to 'desktop-prepare'.
|
||||
The artifact must contain the following:
|
||||
+ webapp.asar - the asar archive of the webapp to embed in the desktop app
|
||||
+ electronVersion - the version of electron to use for cache keying
|
||||
+ hakHash - the hash of the .hak directory to use for cache keying
|
||||
+ changelog.Debian - the changelog file to embed in the Debian package
|
||||
+ variant.json - the variant configuration to use for the build
|
||||
|
||||
The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
|
||||
for example icons in the `build/` directory to override the app icons.
|
||||
default: "desktop-prepare"
|
||||
test:
|
||||
type: boolean
|
||||
required: false
|
||||
default: true
|
||||
description: "Whether to run the test stage after building"
|
||||
test-args:
|
||||
type: string
|
||||
required: false
|
||||
description: "Additional arguments to pass to playwright"
|
||||
runs-on:
|
||||
type: string
|
||||
required: false
|
||||
description: "The runner image to use, normally set for you, may be needed for running in private repos."
|
||||
artifact-prefix:
|
||||
type: string
|
||||
required: false
|
||||
description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
|
||||
default: ""
|
||||
targets:
|
||||
type: string
|
||||
required: false
|
||||
description: "List of targets to build"
|
||||
default: "tar.gz deb"
|
||||
env:
|
||||
SQLCIPHER_BUNDLED: ${{ inputs.sqlcipher == 'static' && '1' || '' }}
|
||||
MAX_GLIBC: 2.31 # bullseye-era glibc, used by glibc-check.sh
|
||||
permissions: {} # No permissions required
|
||||
jobs:
|
||||
build:
|
||||
name: Build Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
|
||||
# We build on native infrastructure as matrix-seshat fails to cross-compile properly
|
||||
# https://github.com/matrix-org/seshat/issues/135
|
||||
runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
|
||||
env:
|
||||
HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-web/desktop-build-env:${{ case(github.event_name == 'push', inputs.ref || github.ref_name, github.event_name == 'release', 'staging', 'develop') }}
|
||||
steps:
|
||||
- uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
|
||||
id: config
|
||||
with:
|
||||
key: "${{ inputs.arch }}"
|
||||
export_to: output
|
||||
map: |
|
||||
{
|
||||
"amd64": {
|
||||
"arch": "x86-64"
|
||||
},
|
||||
"arm64": {
|
||||
"arch": "aarch64",
|
||||
"build-args": "--arm64"
|
||||
}
|
||||
}
|
||||
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
repository: element-hq/element-web
|
||||
ref: ${{ inputs.ref }}
|
||||
persist-credentials: false
|
||||
|
||||
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
name: ${{ inputs.prepare-artifact-name }}
|
||||
path: apps/desktop
|
||||
|
||||
- name: Cache .hak
|
||||
id: cache
|
||||
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
||||
with:
|
||||
key: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('apps/desktop/hakHash', 'apps/desktop/electronVersion', 'apps/desktop/dockerbuild/*') }}
|
||||
path: |
|
||||
apps/desktop/.hak
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
node-version-file: apps/desktop/.node-version
|
||||
cache: "pnpm"
|
||||
env:
|
||||
# Workaround for https://github.com/actions/setup-node/issues/317
|
||||
FORCE_COLOR: 0
|
||||
|
||||
- name: Install Deps
|
||||
working-directory: apps/desktop
|
||||
run: "pnpm install --frozen-lockfile --filter element-desktop"
|
||||
|
||||
- name: "Get modified files"
|
||||
id: changed_files
|
||||
if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request' && github.repository == 'element-hq/element-web'
|
||||
uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47
|
||||
with:
|
||||
files: |
|
||||
apps/desktop/dockerbuild/**
|
||||
|
||||
# This allows contributors to test changes to the dockerbuild image within a pull request
|
||||
- name: Build docker image
|
||||
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
|
||||
if: steps.changed_files.outputs.any_modified == 'true'
|
||||
with:
|
||||
file: apps/desktop/dockerbuild/Dockerfile
|
||||
context: apps/desktop
|
||||
load: true
|
||||
platforms: linux/${{ inputs.arch }}
|
||||
tags: ${{ env.HAK_DOCKER_IMAGE }}
|
||||
|
||||
- name: Build Natives
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
run: |
|
||||
docker run \
|
||||
-v ${{ github.workspace }}:/work -w /work \
|
||||
-e SQLCIPHER_BUNDLED \
|
||||
-e CI=1 \
|
||||
$HAK_DOCKER_IMAGE \
|
||||
pnpm -C apps/desktop run build:native
|
||||
|
||||
- name: Fix permissions
|
||||
run: |
|
||||
# For .hak
|
||||
sudo chown -R $USER:$USER apps/desktop/.hak
|
||||
# For node_modules pnpm strict security
|
||||
sudo chmod +x node_modules/7zip-bin/linux/*/7za
|
||||
|
||||
- name: Check native libraries in hak dependencies
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
shopt -s globstar
|
||||
|
||||
for filename in ./.hak/hakModules/**/*.node; do
|
||||
./scripts/glibc-check.sh $filename
|
||||
done
|
||||
|
||||
- name: Generate debian files and arguments
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
if [ -f changelog.Debian ]; then
|
||||
echo "ED_DEBIAN_CHANGELOG=changelog.Debian" >> $GITHUB_ENV
|
||||
fi
|
||||
|
||||
- name: Build App
|
||||
working-directory: apps/desktop
|
||||
run: pnpm run build --publish never $BUILD_ARGS -l $TARGETS
|
||||
env:
|
||||
VARIANT_PATH: variant.json
|
||||
# Only set for Nightly builds
|
||||
VERSION: ${{ inputs.version }}
|
||||
# Workaround for https://github.com/electron-userland/electron-builder/issues/5721
|
||||
USE_HARD_LINKS: false
|
||||
BUILD_ARGS: ${{ steps.config.outputs.build-args }}
|
||||
TARGETS: ${{ inputs.targets }}
|
||||
|
||||
- name: Check native libraries
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
set -x
|
||||
shopt -s globstar
|
||||
|
||||
FILES=$(file dist/**/*.node)
|
||||
echo $FILES
|
||||
|
||||
! echo "$FILES" | grep -v "$ARCH"
|
||||
|
||||
LIBS=$(readelf -d dist/**/*.node | grep NEEDED)
|
||||
echo "$LIBS"
|
||||
|
||||
set +x
|
||||
assert_contains_string() { [[ "$1" == *"$2"* ]]; }
|
||||
! assert_contains_string "$LIBS" "libcrypto.so.1.1"
|
||||
if [ "$SQLCIPHER_BUNDLED" == "1" ]; then
|
||||
! assert_contains_string "$LIBS" "libsqlcipher.so.0"
|
||||
else
|
||||
assert_contains_string "$LIBS" "libsqlcipher.so.0"
|
||||
fi
|
||||
|
||||
./scripts/glibc-check.sh dist/linux-*unpacked/element-desktop*
|
||||
env:
|
||||
ARCH: ${{ steps.config.outputs.arch }}
|
||||
|
||||
# We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
|
||||
- name: Upload Artifacts
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
|
||||
path: |
|
||||
apps/desktop/dist
|
||||
!apps/desktop/dist/*-unpacked/**
|
||||
retention-days: 1
|
||||
|
||||
- name: Assert deb is present and valid
|
||||
if: contains(inputs.targets, 'deb')
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
test -f ./dist/element-desktop*$ARCH.deb
|
||||
|
||||
DEB_LISTING=$(dpkg-deb --fsys-tarfile ./dist/element-desktop*.deb | tar -tv)
|
||||
echo "deb listing: "
|
||||
echo "$DEB_LISTING"
|
||||
! echo "$DEB_LISTING" | grep '^h'
|
||||
env:
|
||||
ARCH: ${{ inputs.arch }}
|
||||
|
||||
- name: Assert tar.gz is present
|
||||
if: contains(inputs.targets, 'tar.gz')
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
test -f ./dist/element-desktop*.tar.gz
|
||||
|
||||
TAR_GZ_LISTING=$(tar -tvf ./dist/element-desktop*.tar.gz)
|
||||
echo "tar.gz listing: "
|
||||
echo "$TAR_GZ_LISTING"
|
||||
! echo "$TAR_GZ_LISTING" | grep '^h'
|
||||
|
||||
test:
|
||||
name: Test Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
|
||||
needs: build
|
||||
if: inputs.test && contains(inputs.targets, 'deb')
|
||||
uses: ./.github/workflows/build_desktop_test.yaml
|
||||
with:
|
||||
project: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
|
||||
artifact: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
|
||||
runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
|
||||
executable: /opt/Element*/element-desktop*
|
||||
prepare_cmd: |
|
||||
sudo apt-get -qq update
|
||||
sudo apt install ./dist/*.deb
|
||||
blob_report: ${{ inputs.blob_report }}
|
||||
args: ${{ inputs.test-args }}
|
||||
@@ -1,234 +0,0 @@
|
||||
# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
|
||||
# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
|
||||
# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
|
||||
on:
|
||||
workflow_call:
|
||||
secrets:
|
||||
APPLE_ID:
|
||||
required: false
|
||||
APPLE_ID_PASSWORD:
|
||||
required: false
|
||||
APPLE_CSC_KEY_PASSWORD:
|
||||
required: false
|
||||
APPLE_CSC_LINK:
|
||||
required: false
|
||||
inputs:
|
||||
ref:
|
||||
type: string
|
||||
required: false
|
||||
description: "The git ref to checkout, defaults to the default branch"
|
||||
version:
|
||||
type: string
|
||||
required: false
|
||||
description: "Version string to override the one in package.json, used for non-release builds"
|
||||
sign:
|
||||
type: string
|
||||
required: false
|
||||
description: "Whether to sign & notarise the build, requires 'Desktop Apple' environment"
|
||||
base-url:
|
||||
type: string
|
||||
required: false
|
||||
description: "The URL to which the output will be deployed."
|
||||
blob_report:
|
||||
type: boolean
|
||||
required: false
|
||||
description: "Whether to run the blob report"
|
||||
prepare-artifact-name:
|
||||
type: string
|
||||
required: false
|
||||
description: |
|
||||
The name of the prepare artifact to use, defaults to 'desktop-prepare'.
|
||||
The artifact must contain the following:
|
||||
+ webapp.asar - the asar archive of the webapp to embed in the desktop app
|
||||
+ electronVersion - the version of electron to use for cache keying
|
||||
+ hakHash - the hash of the .hak directory to use for cache keying
|
||||
+ variant.json - the variant configuration to use for the build
|
||||
|
||||
The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
|
||||
for example icons in the `build/` directory to override the app icons.
|
||||
default: "desktop-prepare"
|
||||
test:
|
||||
type: boolean
|
||||
required: false
|
||||
default: true
|
||||
description: "Whether to run the test stage after building"
|
||||
test-args:
|
||||
type: string
|
||||
required: false
|
||||
description: "Additional arguments to pass to playwright"
|
||||
artifact-prefix:
|
||||
type: string
|
||||
required: false
|
||||
description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
|
||||
default: ""
|
||||
targets:
|
||||
type: string
|
||||
required: false
|
||||
description: "List of targets to build"
|
||||
default: "dmg zip"
|
||||
permissions: {} # No permissions required
|
||||
jobs:
|
||||
build:
|
||||
name: Build macOS Universal
|
||||
runs-on: macos-15 # M1
|
||||
environment: ${{ inputs.sign && 'Desktop Apple' || '' }}
|
||||
steps:
|
||||
- uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
|
||||
with:
|
||||
xcode-version: latest-stable
|
||||
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
repository: element-hq/element-web
|
||||
ref: ${{ inputs.ref }}
|
||||
persist-credentials: false
|
||||
|
||||
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
name: ${{ inputs.prepare-artifact-name }}
|
||||
path: apps/desktop
|
||||
|
||||
- name: Cache .hak
|
||||
id: cache
|
||||
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
||||
with:
|
||||
key: ${{ runner.os }}-${{ hashFiles('apps/desktop/hakHash', 'apps/desktop/electronVersion') }}
|
||||
path: |
|
||||
apps/desktop/.hak
|
||||
|
||||
- name: Install Rust
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
run: |
|
||||
rustup toolchain install stable --profile minimal --no-self-update
|
||||
rustup default stable
|
||||
rustup target add aarch64-apple-darwin
|
||||
rustup target add x86_64-apple-darwin
|
||||
|
||||
# M1 macos-14 comes without Python preinstalled
|
||||
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
||||
with:
|
||||
python-version: "3.13"
|
||||
|
||||
# Install Quartz for DMG badges
|
||||
# https://github.com/electron-userland/electron-builder/issues/9511#issuecomment-3774092888
|
||||
- run: sudo pip3 install pyobjc-framework-Quartz
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
node-version-file: apps/desktop/.node-version
|
||||
cache: "pnpm"
|
||||
|
||||
- name: Install Deps
|
||||
working-directory: apps/desktop
|
||||
run: "pnpm install --frozen-lockfile --filter element-desktop"
|
||||
|
||||
- name: Build Natives
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
working-directory: apps/desktop
|
||||
run: pnpm run build:native:universal
|
||||
|
||||
# We split these because electron-builder gets upset if we set CSC_LINK even to an empty string
|
||||
- name: "[Signed] Build App"
|
||||
if: inputs.sign != ''
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
pnpm run build:universal --publish never -m ${TARGETS}
|
||||
env:
|
||||
APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
|
||||
APPLE_ID: ${{ secrets.APPLE_ID }}
|
||||
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
|
||||
CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
|
||||
CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
|
||||
VARIANT_PATH: variant.json
|
||||
# Only set for Nightly builds
|
||||
VERSION: ${{ inputs.version }}
|
||||
TARGETS: ${{ inputs.targets }}
|
||||
|
||||
- name: Check app was signed & notarised successfully
|
||||
if: inputs.sign != ''
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
hdiutil attach dist/*.dmg -mountpoint /Volumes/Element
|
||||
codesign -dv --verbose=4 /Volumes/Element/*.app
|
||||
spctl -a -vvv -t install /Volumes/Element/*.app
|
||||
hdiutil detach /Volumes/Element
|
||||
|
||||
- name: "[Unsigned] Build App"
|
||||
if: inputs.sign == ''
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
pnpm run build:universal --publish never -m ${TARGETS}
|
||||
env:
|
||||
CSC_IDENTITY_AUTO_DISCOVERY: false
|
||||
VARIANT_PATH: variant.json
|
||||
TARGETS: ${{ inputs.targets }}
|
||||
|
||||
- name: Generate releases.json
|
||||
if: inputs.base-url
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
PKG_JSON_VERSION=$(cat package.json | jq -r .version)
|
||||
LATEST=$(find dist -type f -iname "*-mac.zip" | xargs -0 -n1 -- basename)
|
||||
# Encode spaces in the URL as Squirrel.Mac complains about bad JSON otherwise
|
||||
URL="${BASE_URL}/update/macos/${LATEST// /%20}"
|
||||
|
||||
jq -n --arg version "${VERSION:-$PKG_JSON_VERSION}" --arg url "$URL" '
|
||||
{
|
||||
currentRelease: $version,
|
||||
releases: [{
|
||||
version: $version,
|
||||
updateTo: {
|
||||
version: $version,
|
||||
url: $url,
|
||||
},
|
||||
}],
|
||||
}
|
||||
' > dist/releases.json
|
||||
jq -n --arg url "$URL" '
|
||||
{ url: $url }
|
||||
' > dist/releases-legacy.json
|
||||
env:
|
||||
VERSION: ${{ inputs.version }}
|
||||
BASE_URL: ${{ inputs.base-url }}
|
||||
|
||||
# We exclude mac-universal as the unpacked app takes forever to upload and zip and dmg already contains it
|
||||
- name: Upload Artifacts
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: ${{ inputs.artifact-prefix }}macos
|
||||
path: |
|
||||
apps/desktop/dist
|
||||
!apps/desktop/dist/mac-universal/**
|
||||
retention-days: 1
|
||||
|
||||
- name: Assert zip is present
|
||||
if: contains(inputs.targets, 'zip')
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
test -f ./dist/Element*-mac.zip
|
||||
|
||||
- name: Assert dmg is present
|
||||
if: contains(inputs.targets, 'dmg')
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
test -f ./dist/Element*.dmg
|
||||
|
||||
test:
|
||||
name: Test macOS Universal
|
||||
needs: build
|
||||
if: inputs.test && contains(inputs.targets, 'dmg')
|
||||
uses: ./.github/workflows/build_desktop_test.yaml
|
||||
with:
|
||||
project: macos
|
||||
artifact: ${{ inputs.artifact-prefix }}macos
|
||||
runs-on: macos-14
|
||||
executable: /Users/runner/Applications/Element*.app/Contents/MacOS/Element*
|
||||
# We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
|
||||
# read-only and thus would not allow us to override the fuses as is required for Playwright.
|
||||
prepare_cmd: |
|
||||
hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
|
||||
rsync -a /Volumes/Element/Element*.app ~/Applications/ &&
|
||||
hdiutil detach /Volumes/Element
|
||||
blob_report: ${{ inputs.blob_report }}
|
||||
args: ${{ inputs.test-args }}
|
||||
@@ -1,197 +0,0 @@
|
||||
# This action helps perform common actions before the build_* actions are started in parallel.
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
config:
|
||||
type: string
|
||||
required: true
|
||||
description: "The config directory to use"
|
||||
version:
|
||||
type: string
|
||||
required: false
|
||||
description: "The version tag to fetch, or 'develop', will pick automatically if not passed"
|
||||
nightly:
|
||||
type: boolean
|
||||
required: false
|
||||
default: false
|
||||
description: "Whether the build is a Nightly and to calculate the version strings new builds should use"
|
||||
deploy:
|
||||
type: boolean
|
||||
required: false
|
||||
default: false
|
||||
description: "Whether the build should be deployed to production"
|
||||
webapp-artifact:
|
||||
type: string
|
||||
required: false
|
||||
description: "Name of the webapp artifact that should be used, will fetch a relevant build if omitted"
|
||||
secrets:
|
||||
# Required if `nightly` is set
|
||||
CF_R2_ACCESS_KEY_ID:
|
||||
required: false
|
||||
# Required if `nightly` is set
|
||||
CF_R2_TOKEN:
|
||||
required: false
|
||||
outputs:
|
||||
nightly-version:
|
||||
description: "The version string the next Nightly should use, only output for nightly"
|
||||
value: ${{ jobs.prepare.outputs.nightly-version }}
|
||||
packages-dir:
|
||||
description: "The directory non-deb packages for this run should live in within packages.element.io"
|
||||
value: ${{ inputs.nightly && 'nightly' || 'desktop' }}
|
||||
# This is just a simple pass-through of the input to simplify reuse of complex inline conditions
|
||||
deploy:
|
||||
description: "Whether the build should be deployed to production"
|
||||
value: ${{ inputs.deploy }}
|
||||
permissions: {}
|
||||
jobs:
|
||||
prepare:
|
||||
name: Prepare
|
||||
environment: ${{ inputs.nightly && 'packages.element.io' || '' }}
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
contents: read
|
||||
outputs:
|
||||
nightly-version: ${{ steps.versions.outputs.nightly }}
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
repository: element-hq/element-web
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
node-version-file: apps/desktop/.node-version
|
||||
cache: "pnpm"
|
||||
|
||||
- name: Install Deps
|
||||
working-directory: apps/desktop
|
||||
run: "pnpm install --frozen-lockfile --filter element-desktop"
|
||||
|
||||
- name: Fetch Element Web (from artifact)
|
||||
if: inputs.webapp-artifact != ''
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
name: ${{ inputs.webapp-artifact }}
|
||||
path: apps/desktop/webapp
|
||||
|
||||
- name: Build webapp.asar (from artifact)
|
||||
if: inputs.webapp-artifact != ''
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
cp -f "$CONFIG_DIR/config.json" webapp/config.json
|
||||
pnpm run asar-webapp
|
||||
env:
|
||||
CONFIG_DIR: ${{ inputs.config }}
|
||||
|
||||
- name: Fetch Element Web (${{ inputs.version }})
|
||||
if: inputs.webapp-artifact == ''
|
||||
working-directory: apps/desktop
|
||||
run: pnpm run fetch --noverify -d ${CONFIG} ${VERSION}
|
||||
env:
|
||||
CONFIG: ${{ inputs.config }}
|
||||
VERSION: ${{ inputs.version }}
|
||||
|
||||
- name: Copy variant config
|
||||
working-directory: apps/desktop
|
||||
run: cp "$CONFIG_DIR/build.json" variant.json
|
||||
env:
|
||||
CONFIG_DIR: ${{ inputs.config }}
|
||||
|
||||
# We split this out to save the build_* scripts having to do it to make use of `hashFiles` in the cache action
|
||||
- name: Generate cache hash files
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
set -ex
|
||||
# Add --no-sandbox as otherwise it fails because the helper isn't setuid root. It's only getting the version.
|
||||
pnpm --silent electron --no-sandbox --version > electronVersion
|
||||
cat package.json | jq -c .hakDependencies | sha1sum > hakHash
|
||||
find hak -type f -print0 | xargs -0 sha1sum >> hakHash
|
||||
find scripts/hak -type f -print0 | xargs -0 sha1sum >> hakHash
|
||||
|
||||
- name: "[Nightly] Calculate version"
|
||||
id: versions
|
||||
if: inputs.nightly
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
set -e
|
||||
|
||||
# Find all latest Nightly versions
|
||||
aws s3 cp s3://$R2_BUCKET/nightly/update/macos/releases.json - --endpoint-url $R2_URL --region auto | jq -r .currentRelease >> VERSIONS
|
||||
aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-amd64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
|
||||
aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-arm64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
|
||||
aws s3 cp s3://$R2_BUCKET/nightly/update/win32/x64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
|
||||
aws s3 cp s3://$R2_BUCKET/nightly/update/win32/arm64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
|
||||
|
||||
# Pick the greatest one
|
||||
VERSION=$(cat VERSIONS | sort -uf | tail -n1)
|
||||
echo "Found latest nightly version $VERSION"
|
||||
# Increment it
|
||||
echo "nightly=$(scripts/generate-nightly-version.ts --latest $VERSION)" >> $GITHUB_OUTPUT
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
|
||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
|
||||
R2_BUCKET: ${{ vars.R2_BUCKET }}
|
||||
R2_URL: ${{ vars.CF_R2_S3_API }}
|
||||
|
||||
- name: Check version
|
||||
id: package
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
echo "version=$(cat package.json | jq -r .version)" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: "[Release] Fetch release"
|
||||
id: release
|
||||
if: ${{ !inputs.nightly && inputs.version != 'develop' }}
|
||||
uses: cardinalby/git-get-release-action@5172c3a026600b1d459b117738c605fabc9e4e44 # 1.2.5
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ github.token }}
|
||||
with:
|
||||
tag: v${{ steps.package.outputs.version }}
|
||||
|
||||
- name: "[Release] Write changelog"
|
||||
if: ${{ !inputs.nightly && inputs.version != 'develop' }}
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
TIME=$(date -d "$PUBLISHED_AT" -R)
|
||||
echo "element-desktop ($VERSION) default; urgency=medium" >> changelog.Debian
|
||||
echo "$BODY" | sed 's/^##/\n */g;s/^\*/ */g' | perl -pe 's/\[.+?]\((.+?)\)/\1/g' >> changelog.Debian
|
||||
echo "" >> changelog.Debian
|
||||
echo " -- $ACTOR <support@element.io> $TIME" >> changelog.Debian
|
||||
env:
|
||||
ACTOR: ${{ github.actor }}
|
||||
VERSION: v${{ steps.package.outputs.version }}
|
||||
BODY: ${{ steps.release.outputs.body }}
|
||||
PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
|
||||
|
||||
- name: "[Nightly] Write summary"
|
||||
if: inputs.nightly
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
set -e
|
||||
|
||||
BUNDLE_HASH=$(npx asar l webapp.asar | grep /bundles/ | head -n 1 | sed 's|.*/||')
|
||||
WEBAPP_VERSION=$(./scripts/get-version.ts)
|
||||
WEB_VERSION=${WEBAPP_VERSION:0:12}
|
||||
JS_VERSION=${WEBAPP_VERSION:16:12}
|
||||
|
||||
echo "### Nightly build ${NIGHTLY_VERSION}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Component | Version |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| ----------- | ------- |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Bundle Hash | $BUNDLE_HASH |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Element Web | [$WEB_VERSION](https://github.com/element-hq/element-web/commit/$WEB_VERSION) |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| JS SDK | [$JS_VERSION](https://github.com/matrix-org/matrix-js-sdk/commit/$JS_VERSION) |" >> $GITHUB_STEP_SUMMARY
|
||||
env:
|
||||
NIGHTLY_VERSION: ${{ steps.versions.outputs.nightly }}
|
||||
|
||||
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: desktop-prepare
|
||||
retention-days: 1
|
||||
path: |
|
||||
apps/desktop/webapp.asar
|
||||
apps/desktop/electronVersion
|
||||
apps/desktop/hakHash
|
||||
apps/desktop/changelog.Debian
|
||||
apps/desktop/variant.json
|
||||
@@ -1,118 +0,0 @@
|
||||
# This action helps run Playwright tests within one of the build_* stages.
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
runs-on:
|
||||
type: string
|
||||
required: true
|
||||
description: "The runner image to use"
|
||||
artifact:
|
||||
type: string
|
||||
required: true
|
||||
description: "The name of the artifact to download"
|
||||
project:
|
||||
type: string
|
||||
required: true
|
||||
description: "The Playwright project to use for testing"
|
||||
executable:
|
||||
type: string
|
||||
required: true
|
||||
description: "Path to the executable to test"
|
||||
prepare_cmd:
|
||||
type: string
|
||||
required: false
|
||||
description: "Command to run to prepare the executable or environment for testing"
|
||||
blob_report:
|
||||
type: boolean
|
||||
default: false
|
||||
description: "Whether to upload a blob report instead of the HTML report"
|
||||
args:
|
||||
type: string
|
||||
required: false
|
||||
description: "Additional arguments to pass to playwright, for e.g. skipping specific tests"
|
||||
permissions: {}
|
||||
jobs:
|
||||
test:
|
||||
name: Test ${{ inputs.project }}
|
||||
runs-on: ${{ inputs.runs-on }}
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
repository: element-hq/element-web
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
node-version-file: apps/desktop/.node-version
|
||||
cache: "pnpm"
|
||||
|
||||
- name: Install Deps
|
||||
run: "pnpm install --frozen-lockfile --filter element-desktop"
|
||||
|
||||
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
name: ${{ inputs.artifact }}
|
||||
path: apps/desktop/dist
|
||||
|
||||
- name: Prepare for tests
|
||||
working-directory: apps/desktop
|
||||
# This is set by the caller of the reusable workflow, they have the ability to run the command they specify
|
||||
# directly without our help so this is fine.
|
||||
run: ${{ inputs.prepare_cmd }} # zizmor: ignore[template-injection]
|
||||
if: inputs.prepare_cmd
|
||||
|
||||
- name: Expand executable path
|
||||
id: executable
|
||||
working-directory: apps/desktop
|
||||
shell: bash
|
||||
env:
|
||||
EXECUTABLE: ${{ inputs.executable }}
|
||||
run: |
|
||||
FILES=($EXECUTABLE)
|
||||
echo "path=${FILES[0]}" >> $GITHUB_OUTPUT
|
||||
|
||||
# We previously disabled the `EnableNodeCliInspectArguments` fuse, but Playwright requires
|
||||
# it to be enabled to test Electron apps, so turn it back on.
|
||||
- name: Set EnableNodeCliInspectArguments fuse enabled
|
||||
run: $RUN_AS npx @electron/fuses write --app "$EXECUTABLE" EnableNodeCliInspectArguments=on
|
||||
working-directory: apps/desktop
|
||||
shell: bash
|
||||
env:
|
||||
# We need sudo on Linux as it is installed in /opt/
|
||||
RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
|
||||
EXECUTABLE: ${{ steps.executable.outputs.path }}
|
||||
|
||||
- name: Run tests
|
||||
timeout-minutes: 20
|
||||
shell: bash
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
$PREFIX pnpm playwright test \
|
||||
${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }} \
|
||||
${{ inputs.blob_report == false && '--reporter=html' || '' }} \
|
||||
$ARGS
|
||||
env:
|
||||
PREFIX: ${{ runner.os == 'Linux' && 'xvfb-run' || '' }}
|
||||
PW_TAG: ${{ inputs.project }}
|
||||
ELEMENT_DESKTOP_EXECUTABLE: ${{ steps.executable.outputs.path }}
|
||||
ARGS: ${{ inputs.args }}
|
||||
DEBUG: pw:browser
|
||||
|
||||
- name: Upload blob report
|
||||
if: always() && inputs.blob_report
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: blob-report-${{ inputs.artifact }}
|
||||
path: apps/desktop/blob-report
|
||||
retention-days: 1
|
||||
if-no-files-found: error
|
||||
|
||||
- name: Upload HTML report
|
||||
if: always() && inputs.blob_report == false
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: ${{ inputs.artifact }}-test
|
||||
path: apps/desktop/playwright-report
|
||||
retention-days: 14
|
||||
if-no-files-found: error
|
||||
@@ -1,314 +0,0 @@
|
||||
# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
|
||||
# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
|
||||
# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
|
||||
|
||||
# Windows GHA runner by default uses the pwsh shell which breaks codeSigningCert in the workflow
|
||||
# We always sign using eSignerCKA to ensure it keeps working, but aside from release & nightlies we use demo credentials
|
||||
# which do not yield trusted signatures.
|
||||
defaults:
|
||||
run:
|
||||
shell: powershell
|
||||
on:
|
||||
workflow_call:
|
||||
secrets:
|
||||
ESIGNER_USER_NAME:
|
||||
required: false
|
||||
ESIGNER_USER_PASSWORD:
|
||||
required: false
|
||||
ESIGNER_USER_TOTP:
|
||||
required: false
|
||||
inputs:
|
||||
ref:
|
||||
type: string
|
||||
required: false
|
||||
description: "The git ref to checkout, defaults to the default branch"
|
||||
arch:
|
||||
type: string
|
||||
required: true
|
||||
description: "The architecture to build for, one of 'x64' | 'ia32' | 'arm64'"
|
||||
version:
|
||||
type: string
|
||||
required: false
|
||||
description: "Version string to override the one in package.json, used for non-release builds"
|
||||
sign:
|
||||
type: string
|
||||
required: false
|
||||
description: "Whether to sign & notarise the build, requires 'Desktop eSigner' environment"
|
||||
blob_report:
|
||||
type: boolean
|
||||
required: false
|
||||
description: "Whether to run the blob report"
|
||||
prepare-artifact-name:
|
||||
type: string
|
||||
required: false
|
||||
description: |
|
||||
The name of the prepare artifact to use, defaults to 'desktop-prepare'.
|
||||
The artifact must contain the following:
|
||||
+ webapp.asar - the asar archive of the webapp to embed in the desktop app
|
||||
+ electronVersion - the version of electron to use for cache keying
|
||||
+ hakHash - the hash of the .hak directory to use for cache keying
|
||||
+ variant.json - the variant configuration to use for the build
|
||||
|
||||
|
||||
The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
|
||||
for example icons in the `build/` directory to override the app icons.
|
||||
default: "desktop-prepare"
|
||||
test:
|
||||
type: boolean
|
||||
required: false
|
||||
default: true
|
||||
description: "Whether to run the test stage after building"
|
||||
test-runs-on:
|
||||
type: string
|
||||
required: false
|
||||
description: "The runner image to use for testing, normally set for you, may be needed for running in private repos."
|
||||
test-args:
|
||||
type: string
|
||||
required: false
|
||||
description: "Additional arguments to pass to playwright"
|
||||
artifact-prefix:
|
||||
type: string
|
||||
required: false
|
||||
description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
|
||||
default: ""
|
||||
targets:
|
||||
type: string
|
||||
required: false
|
||||
description: "List of targets to build"
|
||||
default: "squirrel msi"
|
||||
permissions: {} # No permissions required
|
||||
jobs:
|
||||
build:
|
||||
name: Build Windows ${{ inputs.arch }}
|
||||
runs-on: windows-2025
|
||||
environment: ${{ inputs.sign && 'Desktop eSigner' || '' }}
|
||||
env:
|
||||
SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x86/signtool.exe"
|
||||
steps:
|
||||
- uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
|
||||
id: config
|
||||
with:
|
||||
key: "${{ inputs.arch }}"
|
||||
export_to: output
|
||||
map: |
|
||||
{
|
||||
"x64": {
|
||||
"target": "x86_64-pc-windows-msvc"
|
||||
},
|
||||
"arm64": {
|
||||
"target": "aarch64-pc-windows-msvc",
|
||||
"build-args": "--arm64",
|
||||
"arch": "amd64_arm64"
|
||||
},
|
||||
"ia32": {
|
||||
"target": "i686-pc-windows-msvc",
|
||||
"build-args": "--ia32",
|
||||
"arch": "x86",
|
||||
"extra_config": "{\"user_notice\": {\"title\": \"Your desktop environment is unsupported.\",\"description\": \"Support for 32-bit Windows installations has ended. Transition to the web or mobile app for continued access.\"}}"
|
||||
}
|
||||
}
|
||||
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
repository: element-hq/element-web
|
||||
ref: ${{ inputs.ref }}
|
||||
persist-credentials: false
|
||||
|
||||
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
name: ${{ inputs.prepare-artifact-name }}
|
||||
path: apps/desktop/
|
||||
|
||||
- name: Cache .hak
|
||||
id: cache
|
||||
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
||||
with:
|
||||
key: ${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('apps/desktop/hakHash', 'apps/desktop/electronVersion') }}
|
||||
path: |
|
||||
apps/desktop/.hak
|
||||
|
||||
# ActiveTCL package on choco is from 2015,
|
||||
# this one is newer but includes more than we need
|
||||
- name: Choco install tclsh
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
shell: pwsh
|
||||
run: |
|
||||
choco install -y magicsplat-tcl-tk --no-progress
|
||||
echo "${HOME}/AppData/Local/Apps/Tcl86/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
|
||||
|
||||
- name: Choco install NetWide Assembler
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
shell: pwsh
|
||||
run: |
|
||||
choco install -y nasm --no-progress
|
||||
echo "C:/Program Files/NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
|
||||
|
||||
- name: Install Rust
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
run: |
|
||||
rustup toolchain install stable --profile minimal --no-self-update
|
||||
rustup default stable
|
||||
rustup target add $env:TARGET
|
||||
env:
|
||||
TARGET: ${{ steps.config.outputs.target }}
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
node-version-file: apps/desktop/.node-version
|
||||
cache: "pnpm"
|
||||
|
||||
- name: Install Deps
|
||||
working-directory: apps/desktop
|
||||
run: "pnpm install --frozen-lockfile --filter element-desktop"
|
||||
|
||||
- name: Insert config snippet
|
||||
if: steps.config.outputs.extra_config != ''
|
||||
working-directory: apps/desktop
|
||||
shell: bash
|
||||
run: |
|
||||
mkdir config-edit
|
||||
pnpm asar extract webapp.asar config-edit
|
||||
cd config-edit
|
||||
mv config.json old-config.json
|
||||
echo '${{ steps.config.outputs.extra_config }}' | jq -s '.[0] * .[1]' old-config.json - > config.json
|
||||
rm old-config.json
|
||||
cd ..
|
||||
rm webapp.asar
|
||||
pnpm asar pack config-edit/ webapp.asar
|
||||
|
||||
- name: Set up sqlcipher macros
|
||||
if: steps.cache.outputs.cache-hit != 'true' && contains(inputs.arch, 'arm')
|
||||
shell: pwsh
|
||||
run: |
|
||||
echo "NCC=${{ github.workspace }}\scripts\cl.bat" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
|
||||
|
||||
- name: Set up build tools
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
|
||||
with:
|
||||
arch: ${{ steps.config.outputs.arch || inputs.arch }}
|
||||
|
||||
- name: Build Natives
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
refreshenv
|
||||
pnpm run build:native --target $env:TARGET
|
||||
env:
|
||||
TARGET: ${{ steps.config.outputs.target }}
|
||||
|
||||
- name: Install and configure eSigner CKA
|
||||
run: |
|
||||
Set-StrictMode -Version 'Latest'
|
||||
|
||||
# Download, extract, and rename
|
||||
Invoke-WebRequest -OutFile eSigner_CKA.zip "$env:ESIGNER_URL"
|
||||
Expand-Archive -Path eSigner_CKA.zip -DestinationPath .
|
||||
Get-ChildItem -Path * -Include "*_build_*.exe" | Rename-Item -NewName eSigner_CKA.exe
|
||||
|
||||
# Install
|
||||
New-Item -ItemType Directory -Force -Path "$env:INSTALL_DIR"
|
||||
./eSigner_CKA.exe /CURRENTUSER /VERYSILENT /SUPPRESSMSGBOXES /DIR="${{ env.INSTALL_DIR }}" | Out-Null
|
||||
|
||||
# Disable logger
|
||||
$LogConfig = Get-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
|
||||
$LogConfig[0] = '<log4net threshold="OFF">'
|
||||
$LogConfig | Set-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
|
||||
|
||||
# Configure - default credentials from https://www.ssl.com/guide/esigner-demo-credentials-and-certificates/
|
||||
${{ env.INSTALL_DIR }}/eSignerCKATool.exe config `
|
||||
-mode "$env:ESIGNER_MODE" `
|
||||
-user "${{ secrets.ESIGNER_USER_NAME || 'esigner_demo' }}" `
|
||||
-pass "${{ secrets.ESIGNER_USER_PASSWORD || 'esignerDemo#1' }}" `
|
||||
-totp "${{ secrets.ESIGNER_USER_TOTP || 'RDXYgV9qju+6/7GnMf1vCbKexXVJmUVr+86Wq/8aIGg=' }}" `
|
||||
-key "${{ env.MASTER_KEY_FILE }}" -r
|
||||
${{ env.INSTALL_DIR }}/eSignerCKATool.exe unload
|
||||
${{ env.INSTALL_DIR }}/eSignerCKATool.exe load
|
||||
|
||||
# Find certificate
|
||||
$CodeSigningCert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
|
||||
echo Certificate: $CodeSigningCert
|
||||
|
||||
# Extract thumbprint and subject name
|
||||
$Thumbprint = $CodeSigningCert.Thumbprint
|
||||
$SubjectName = ($CodeSigningCert.Subject -replace ", ?", "`n" | ConvertFrom-StringData).CN
|
||||
|
||||
echo "ED_SIGNTOOL_THUMBPRINT=$Thumbprint" >> $env:GITHUB_ENV
|
||||
echo "ED_SIGNTOOL_SUBJECT_NAME=$SubjectName" >> $env:GITHUB_ENV
|
||||
env:
|
||||
ESIGNER_MODE: ${{ vars.ESIGNER_MODE || 'sandbox' }}
|
||||
ESIGNER_URL: https://github.com/SSLcom/eSignerCKA/releases/download/v1.0.6/SSL.COM-eSigner-CKA_1.0.6.zip
|
||||
INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
|
||||
MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
|
||||
|
||||
- name: Build App
|
||||
working-directory: apps/desktop
|
||||
run: pnpm run build --publish never $BUILD_ARGS -w $TARGETS
|
||||
shell: bash
|
||||
env:
|
||||
VARIANT_PATH: variant.json
|
||||
# Only set for Nightly builds
|
||||
# The windows packager relies on parsing this as semver, so we have to make it look like one.
|
||||
# This will give our update packages really stupid names, but we probably can't change that either
|
||||
# because squirrel windows parses them for the version too. We don't really care: nobody sees them.
|
||||
# We just give the installer a static name, so you'll just see this in the 'about' dialog.
|
||||
# Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
|
||||
VERSION: ${{ inputs.version && format('0.0.1-nightly.{0}', inputs.version) || '' }}
|
||||
BUILD_ARGS: ${{ steps.config.outputs.build-args }}
|
||||
TARGETS: ${{ inputs.targets }}
|
||||
|
||||
- name: Trust eSigner sandbox cert
|
||||
if: inputs.sign == ''
|
||||
run: |
|
||||
Set-StrictMode -Version 'Latest'
|
||||
Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root -FilePath .github/SSLcom-sandbox.crt
|
||||
|
||||
- name: Check app was signed successfully
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
Set-StrictMode -Version 'Latest'
|
||||
Get-ChildItem `
|
||||
-Recurse dist `
|
||||
-Include *.exe, *.msi `
|
||||
| ForEach-Object -Process {. $env:SIGNTOOL_PATH verify /pa $_.FullName; if(!$?) { throw }}
|
||||
|
||||
- name: Upload Artifacts
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
|
||||
path: |
|
||||
apps/desktop/dist
|
||||
retention-days: 1
|
||||
|
||||
- name: Assert executable is present
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
Test-Path './dist/win-*unpacked/Element*.exe'
|
||||
|
||||
- name: Assert all Squirrel files are present
|
||||
if: contains(inputs.targets, 'squirrel')
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
Test-Path './dist/squirrel-windows*/Element Setup*.exe'
|
||||
Test-Path './dist/squirrel-windows*/element-desktop-*-full.nupkg'
|
||||
Test-Path './dist/squirrel-windows*/RELEASES'
|
||||
|
||||
- name: Assert MSI is present
|
||||
if: contains(inputs.targets, 'msi')
|
||||
working-directory: apps/desktop
|
||||
run: |
|
||||
Test-Path './dist/Element*.msi'
|
||||
|
||||
test:
|
||||
name: Test Windows ${{ inputs.arch }}
|
||||
needs: build
|
||||
if: inputs.test
|
||||
uses: ./.github/workflows/build_desktop_test.yaml
|
||||
with:
|
||||
project: win-${{ inputs.arch }}
|
||||
artifact: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
|
||||
runs-on: ${{ inputs.test-runs-on || (inputs.arch == 'arm64' && 'windows-11-arm' || 'windows-2022') }}
|
||||
executable: ./dist/win*-unpacked/Element*.exe
|
||||
blob_report: ${{ inputs.blob_report }}
|
||||
args: ${{ inputs.test-args }}
|
||||
@@ -1,141 +0,0 @@
|
||||
# Separate to the main build workflow for access to develop
|
||||
# environment secrets, largely similar to build.yaml.
|
||||
name: Build and Deploy develop
|
||||
on:
|
||||
push:
|
||||
branches: [develop]
|
||||
repository_dispatch:
|
||||
types: [element-web-notify]
|
||||
concurrency:
|
||||
group: ${{ github.repository_owner }}-${{ github.workflow }}-${{ github.ref_name }}
|
||||
cancel-in-progress: true
|
||||
env:
|
||||
NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
|
||||
permissions: {}
|
||||
jobs:
|
||||
build:
|
||||
name: "Build & Deploy develop.element.io"
|
||||
# Only respect triggers from our develop branch, ignore that of forks
|
||||
if: github.repository == 'element-hq/element-web'
|
||||
runs-on: ubuntu-24.04
|
||||
environment: develop
|
||||
permissions:
|
||||
checks: read
|
||||
pages: write
|
||||
deployments: write
|
||||
env:
|
||||
R2_BUCKET: "element-web-develop"
|
||||
R2_URL: ${{ vars.CF_R2_S3_API }}
|
||||
R2_PUBLIC_URL: "https://element-web-develop.element.io"
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
cache: "pnpm"
|
||||
node-version: "lts/*"
|
||||
|
||||
- name: Install Dependencies
|
||||
run: "./scripts/layered.sh"
|
||||
|
||||
- name: Build, Package & Upload sourcemaps
|
||||
working-directory: apps/web
|
||||
run: "./scripts/ci_package.sh"
|
||||
env:
|
||||
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
||||
SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
|
||||
SENTRY_URL: ${{ secrets.SENTRY_URL }}
|
||||
SENTRY_ORG: element
|
||||
SENTRY_PROJECT: riot-web
|
||||
# We only deploy the latest bundles to Cloudflare Pages and use _redirects to fallback to R2 for
|
||||
# older ones. This redirect means that 'self' is insufficient in the CSP,
|
||||
# and we have to add the R2 URL.
|
||||
# Once Cloudflare redirects support proxying mode we will be able to ditch this.
|
||||
# See Proxying in support table at https://developers.cloudflare.com/pages/platform/redirects
|
||||
CSP_EXTRA_SOURCE: ${{ env.R2_PUBLIC_URL }}
|
||||
|
||||
- run: mv dist/element-*.tar.gz dist/develop.tar.gz
|
||||
working-directory: apps/web
|
||||
|
||||
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: webapp
|
||||
path: apps/web/dist/develop.tar.gz
|
||||
retention-days: 1
|
||||
|
||||
- name: Extract webapp
|
||||
run: |
|
||||
mkdir _deploy
|
||||
tar xf apps/web/dist/develop.tar.gz -C _deploy --strip-components=1
|
||||
|
||||
- name: Copy config
|
||||
run: cp apps/web/element.io/develop/config.json _deploy/config.json
|
||||
|
||||
- name: Populate 404.html
|
||||
run: echo "404 Not Found" > _deploy/404.html
|
||||
|
||||
- name: Populate _headers
|
||||
run: cp .github/cfp_headers _deploy/_headers
|
||||
|
||||
# Redirect requests for the develop tarball and the historical bundles to R2
|
||||
# We find the latest 100 bundle.css files and add their bundles to the redirects file
|
||||
# S3 has no sane way to get the age of a directory as they don't really exist
|
||||
- name: Populate _redirects
|
||||
run: |
|
||||
{
|
||||
echo "/develop.tar.gz $R2_PUBLIC_URL/develop.tar.gz 301"
|
||||
aws s3api --region auto --endpoint-url $R2_URL list-objects-v2 --bucket $R2_BUCKET \
|
||||
--query "sort_by(Contents[?ends_with(Key, '/bundle.css')], &LastModified)[-100:].Key" \
|
||||
--prefix "bundles/" | jq -r '.[]' | grep -oE '[^\"].*\/\s*' | while read -r path ; do
|
||||
echo "/${path}* $R2_PUBLIC_URL/${path}:splat 301"
|
||||
done
|
||||
} | tee _deploy/_redirects
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
|
||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
|
||||
|
||||
# We may be trying to deploy the same webapp bundles again, we need to ensure that the live bundles
|
||||
# are not present in the _redirects file and instead accessed directly from Cloudflare Pages.
|
||||
- name: Trim _redirects
|
||||
working-directory: _deploy
|
||||
run: |
|
||||
find bundles -type d -mindepth 1 -maxdepth 1 -exec sed -i "\:{}:d" _redirects \;
|
||||
|
||||
- name: Wait for other steps to succeed
|
||||
uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
|
||||
with:
|
||||
ref: ${{ github.sha }}
|
||||
running-workflow-name: "Build & Deploy develop.element.io"
|
||||
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
wait-interval: 10
|
||||
check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages|Upload|Netlify|Report).)*$
|
||||
|
||||
# We keep the latest develop.tar.gz on R2 instead of relying on the github artifact uploaded earlier
|
||||
# as the expires after 24h and requires auth to download.
|
||||
# Element Desktop's fetch script uses this tarball to fetch latest develop to build Nightlies.
|
||||
# Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
|
||||
- name: Deploy to R2
|
||||
run: |
|
||||
aws s3 cp apps/web/dist/develop.tar.gz s3://$R2_BUCKET/develop.tar.gz --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
|
||||
aws s3 cp _deploy/ s3://$R2_BUCKET/ --recursive --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
|
||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
|
||||
|
||||
- name: Deploy to Cloudflare Pages
|
||||
id: cfp
|
||||
uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1
|
||||
with:
|
||||
apiToken: ${{ secrets.CF_PAGES_TOKEN }}
|
||||
accountId: ${{ secrets.CF_PAGES_ACCOUNT_ID }}
|
||||
projectName: element-web-develop
|
||||
directory: _deploy
|
||||
gitHubToken: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- run: |
|
||||
echo "Deployed to ${STEPS_CFP_OUTPUTS_URL}" >> $GITHUB_STEP_SUMMARY
|
||||
env:
|
||||
STEPS_CFP_OUTPUTS_URL: ${{ steps.cfp.outputs.url }}
|
||||
@@ -1,75 +0,0 @@
|
||||
name: CD # Continuous Delivery
|
||||
on:
|
||||
push:
|
||||
branches: [master, staging, develop]
|
||||
paths:
|
||||
- "**/Dockerfile"
|
||||
- "**/dockerbuild"
|
||||
- "**/docker"
|
||||
- "**/docker-*"
|
||||
- "pnpm-lock.yaml"
|
||||
|
||||
concurrency: ${{ github.workflow }}-${{ github.ref_name }}
|
||||
|
||||
permissions: {}
|
||||
env:
|
||||
NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
|
||||
|
||||
jobs:
|
||||
docker:
|
||||
name: Docker Bake
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
id-token: write # needed for signing the images with GitHub OIDC Token
|
||||
packages: write # needed for publishing packages to GHCR
|
||||
# Needed for nx-set-shas
|
||||
contents: read
|
||||
actions: read
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Install Cosign
|
||||
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
id: builder
|
||||
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
cache: "pnpm"
|
||||
|
||||
- name: Install Deps
|
||||
run: "pnpm install --frozen-lockfile"
|
||||
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.repository_owner }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- run: pnpm nx run-many --nxBail -t docker:build
|
||||
id: build
|
||||
env:
|
||||
INPUT_PUSH: true
|
||||
INPUT_LOAD: false
|
||||
INPUT_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
INPUT_BUILDER: ${{ steps.builder.outputs.name }}
|
||||
|
||||
- name: Sign the images with GitHub OIDC token
|
||||
run: |
|
||||
shopt -s globstar
|
||||
|
||||
for FILE in ./node_modules/.cache/nx-container/**/metadata; do
|
||||
TARGET=$(jq -r '(.["image.name"] | split(",") | last) + "@" + .["containerimage.digest"]' "$FILE")
|
||||
echo "Signing $TARGET..."
|
||||
cosign sign --yes "$TARGET"
|
||||
done
|
||||
@@ -1,101 +0,0 @@
|
||||
# Manual deploy workflow for deploying to app.element.io & staging.element.io
|
||||
# Runs automatically for staging.element.io when an RC or Release is published
|
||||
# Note: Does *NOT* run automatically for app.element.io so that it gets tested on staging.element.io beforehand
|
||||
name: Deploy release
|
||||
run-name: Deploy ${{ github.ref_name }} to ${{ inputs.site || 'staging.element.io' }}
|
||||
on:
|
||||
release:
|
||||
types: [published]
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
site:
|
||||
description: Which site to deploy to
|
||||
required: true
|
||||
default: staging.element.io
|
||||
type: choice
|
||||
options:
|
||||
- staging.element.io
|
||||
- app.element.io
|
||||
skip-checks:
|
||||
description: Skip CI on the tagged commit
|
||||
required: true
|
||||
default: false
|
||||
type: boolean
|
||||
concurrency: ${{ inputs.site || 'staging.element.io' }}
|
||||
permissions: {}
|
||||
jobs:
|
||||
deploy:
|
||||
name: "Deploy to Cloudflare Pages"
|
||||
runs-on: ubuntu-24.04
|
||||
environment: ${{ inputs.site || 'staging.element.io' }}
|
||||
permissions:
|
||||
checks: read
|
||||
deployments: write
|
||||
env:
|
||||
SITE: ${{ inputs.site || 'staging.element.io' }}
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Load GPG key
|
||||
run: |
|
||||
curl https://packages.element.io/element-release-key.gpg | gpg --import
|
||||
gpg -k "$GPG_FINGERPRINT"
|
||||
env:
|
||||
GPG_FINGERPRINT: ${{ vars.GPG_FINGERPRINT }}
|
||||
|
||||
- name: Check current version on deployment
|
||||
id: current_version
|
||||
run: |
|
||||
version=$(curl -s https://$SITE/version)
|
||||
echo "version=${version#v}" >> $GITHUB_OUTPUT
|
||||
|
||||
# The current version bundle melding dance is skipped if the version we're deploying is the same
|
||||
# as then we're just doing a re-deploy of the same version with potentially different configs.
|
||||
- name: Download current version for its old bundles
|
||||
id: current_download
|
||||
if: steps.current_version.outputs.version != github.ref_name
|
||||
uses: ./.github/actions/download-verify-element-tarball
|
||||
with:
|
||||
tag: v${{ steps.current_version.outputs.version }}
|
||||
out-file-path: _current_version
|
||||
|
||||
- name: Download target version
|
||||
uses: ./.github/actions/download-verify-element-tarball
|
||||
with:
|
||||
tag: ${{ github.ref_name }}
|
||||
out-file-path: _deploy
|
||||
|
||||
- name: Merge current bundles into target
|
||||
if: steps.current_download.outcome == 'success'
|
||||
run: cp -vnpr _current_version/bundles/* _deploy/bundles/
|
||||
|
||||
- name: Copy config
|
||||
run: cp apps/web/element.io/app/config.json _deploy/config.json
|
||||
|
||||
- name: Populate 404.html
|
||||
run: echo "404 Not Found" > _deploy/404.html
|
||||
|
||||
- name: Populate _headers
|
||||
run: cp .github/cfp_headers _deploy/_headers
|
||||
|
||||
- name: Wait for other steps to succeed
|
||||
uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
|
||||
if: inputs.skip-checks != true
|
||||
with:
|
||||
ref: ${{ github.sha }}
|
||||
running-workflow-name: "Deploy to Cloudflare Pages"
|
||||
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
wait-interval: 10
|
||||
check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages).)*$
|
||||
|
||||
- name: Deploy to Cloudflare Pages
|
||||
uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1
|
||||
with:
|
||||
apiToken: ${{ secrets.CF_PAGES_TOKEN }}
|
||||
accountId: ${{ secrets.CF_PAGES_ACCOUNT_ID }}
|
||||
projectName: ${{ env.SITE == 'staging.element.io' && 'element-web-staging' || 'element-web' }}
|
||||
directory: _deploy
|
||||
gitHubToken: ${{ secrets.GITHUB_TOKEN }}
|
||||
branch: main
|
||||
@@ -1,181 +0,0 @@
|
||||
name: Docker
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
push:
|
||||
tags: [v*]
|
||||
pull_request: {}
|
||||
schedule:
|
||||
# This job can take a while, and we have usage limits, so just publish develop only twice a day
|
||||
- cron: "0 7/12 * * *"
|
||||
concurrency: ${{ github.workflow }}-${{ github.ref_name }}
|
||||
permissions: {}
|
||||
jobs:
|
||||
buildx:
|
||||
name: Docker Buildx
|
||||
runs-on: ubuntu-24.04
|
||||
environment: ${{ github.event_name != 'pull_request' && 'dockerhub' || '' }}
|
||||
permissions:
|
||||
id-token: write # needed for signing the images with GitHub OIDC Token
|
||||
packages: write # needed for publishing packages to GHCR
|
||||
env:
|
||||
TEST_TAG: vectorim/element-web:test
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 0 # needed for docker-package to be able to calculate the version
|
||||
persist-credentials: false
|
||||
|
||||
- name: Install Cosign
|
||||
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
|
||||
if: github.event_name != 'pull_request'
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
|
||||
with:
|
||||
install: true
|
||||
|
||||
- name: Build and load
|
||||
id: test-build
|
||||
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
|
||||
with:
|
||||
context: .
|
||||
file: apps/web/Dockerfile
|
||||
load: true
|
||||
|
||||
- name: Test the image
|
||||
env:
|
||||
IMAGEID: ${{ steps.test-build.outputs.imageid }}
|
||||
timeout-minutes: 2
|
||||
run: |
|
||||
set -x
|
||||
|
||||
# Make a fake module to test the image
|
||||
MODULE_PATH="modules/module_name/index.js"
|
||||
mkdir -p $(dirname $MODULE_PATH)
|
||||
echo 'alert("Testing");' > $MODULE_PATH
|
||||
|
||||
# Spin up a container of the image
|
||||
ELEMENT_WEB_PORT=8181
|
||||
CONTAINER_ID=$(
|
||||
docker run \
|
||||
--rm \
|
||||
-e "ELEMENT_WEB_PORT=$ELEMENT_WEB_PORT" \
|
||||
-dp "$ELEMENT_WEB_PORT:$ELEMENT_WEB_PORT" \
|
||||
-v $(pwd)/modules:/modules \
|
||||
"$IMAGEID" \
|
||||
)
|
||||
|
||||
# Run some smoke tests
|
||||
wget --retry-connrefused --tries=5 -q --wait=3 --spider "http://localhost:$ELEMENT_WEB_PORT/modules/module_name/index.js"
|
||||
MODULE_0=$(curl "http://localhost:$ELEMENT_WEB_PORT/config.json" | jq -r .modules[0])
|
||||
test "$MODULE_0" = "/${MODULE_PATH}"
|
||||
|
||||
# Check healthcheck
|
||||
until test "$(docker inspect -f {{.State.Health.Status}} $CONTAINER_ID)" == "healthy"; do
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Clean up
|
||||
docker stop "$CONTAINER_ID"
|
||||
|
||||
- name: Docker meta
|
||||
id: meta
|
||||
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
|
||||
if: github.event_name != 'pull_request'
|
||||
with:
|
||||
images: |
|
||||
vectorim/element-web
|
||||
ghcr.io/element-hq/element-web
|
||||
oci-push.vpn.infra.element.io/element-web
|
||||
tags: |
|
||||
type=ref,event=branch
|
||||
type=ref,event=tag
|
||||
flavor: |
|
||||
latest=${{ contains(github.ref_name, '-rc.') && 'false' || 'auto' }}
|
||||
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
|
||||
if: github.event_name != 'pull_request'
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
|
||||
if: github.event_name != 'pull_request'
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.repository_owner }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Connect to Tailscale
|
||||
uses: tailscale/github-action@306e68a486fd2350f2bfc3b19fcd143891a4a2d8 # v4
|
||||
if: github.event_name != 'pull_request'
|
||||
with:
|
||||
oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
|
||||
audience: ${{ secrets.TS_AUDIENCE }}
|
||||
tags: tag:github-actions
|
||||
|
||||
- name: Compute vault jwt role name
|
||||
id: vault-jwt-role
|
||||
if: github.event_name != 'pull_request'
|
||||
run: |
|
||||
echo "role_name=github_service_management_$( echo "${{ github.repository }}" | sed -r 's|[/-]|_|g')" | tee -a "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Get team registry token
|
||||
id: import-secrets
|
||||
uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3
|
||||
if: github.event_name != 'pull_request'
|
||||
with:
|
||||
url: https://vault.infra.ci.i.element.dev
|
||||
role: ${{ steps.vault-jwt-role.outputs.role_name }}
|
||||
path: service-management/github-actions
|
||||
jwtGithubAudience: https://vault.infra.ci.i.element.dev
|
||||
method: jwt
|
||||
secrets: |
|
||||
services/web-repositories/secret/data/oci.element.io username | OCI_USERNAME ;
|
||||
services/web-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;
|
||||
|
||||
- name: Login to oci.element.io Registry
|
||||
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
|
||||
if: github.event_name != 'pull_request'
|
||||
with:
|
||||
registry: oci-push.vpn.infra.element.io
|
||||
username: ${{ steps.import-secrets.outputs.OCI_USERNAME }}
|
||||
password: ${{ steps.import-secrets.outputs.OCI_PASSWORD }}
|
||||
|
||||
- name: Build and push
|
||||
id: build-and-push
|
||||
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
|
||||
if: github.event_name != 'pull_request'
|
||||
with:
|
||||
context: .
|
||||
file: apps/web/Dockerfile
|
||||
push: true
|
||||
platforms: linux/amd64,linux/arm64
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
|
||||
- name: Sign the images with GitHub OIDC Token
|
||||
env:
|
||||
DIGEST: ${{ steps.build-and-push.outputs.digest }}
|
||||
TAGS: ${{ steps.meta.outputs.tags }}
|
||||
if: github.event_name != 'pull_request'
|
||||
run: |
|
||||
images=""
|
||||
for tag in ${TAGS}; do
|
||||
images+="${tag}@${DIGEST} "
|
||||
done
|
||||
cosign sign --yes ${images}
|
||||
|
||||
- name: Update repo description
|
||||
uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5
|
||||
if: github.event_name != 'pull_request'
|
||||
continue-on-error: true
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
repository: vectorim/element-web
|
||||
@@ -1,55 +0,0 @@
|
||||
name: Deploy documentation
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [develop]
|
||||
workflow_dispatch: {}
|
||||
|
||||
permissions: {}
|
||||
|
||||
concurrency:
|
||||
group: "pages"
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: GitHub Pages
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
with:
|
||||
package_json_file: package.json
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
cache: "pnpm"
|
||||
cache-dependency-path: pnpm-lock.yaml
|
||||
node-version: "lts/*"
|
||||
|
||||
- name: Fetch layered build
|
||||
run: ./scripts/layered.sh
|
||||
|
||||
- name: Build docs
|
||||
run: pnpm run docs:build
|
||||
|
||||
- name: Upload artifact
|
||||
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
|
||||
with:
|
||||
path: ./docs/.vitepress/dist
|
||||
|
||||
deploy:
|
||||
environment:
|
||||
name: github-pages
|
||||
url: ${{ steps.deployment.outputs.page_url }}
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
pages: write
|
||||
id-token: write
|
||||
needs: build
|
||||
steps:
|
||||
- name: Deploy to GitHub Pages
|
||||
id: deployment
|
||||
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
|
||||
@@ -1,157 +0,0 @@
|
||||
# For duplicate issues, ensure the close type is right (not planned), update it if not
|
||||
# For all closed (completed) issues, cascade the closure onto any referenced rageshakes
|
||||
# For all closed (not planned) issues, comment on rageshakes to move them into the canonical issue if one exists
|
||||
on:
|
||||
issues:
|
||||
types: [closed]
|
||||
permissions: {} # We use ELEMENT_BOT_TOKEN instead
|
||||
jobs:
|
||||
tidy:
|
||||
name: Tidy closed issues
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
|
||||
id: main
|
||||
with:
|
||||
# PAT needed as the GITHUB_TOKEN won't be able to see cross-references from other orgs (matrix-org)
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
script: |
|
||||
const variables = {
|
||||
owner: context.repo.owner,
|
||||
name: context.repo.repo,
|
||||
number: context.issue.number,
|
||||
};
|
||||
|
||||
const query = `query($owner:String!, $name:String!, $number:Int!) {
|
||||
repository(owner: $owner, name: $name) {
|
||||
issue(number: $number) {
|
||||
stateReason,
|
||||
timelineItems(first: 100, itemTypes: [MARKED_AS_DUPLICATE_EVENT, UNMARKED_AS_DUPLICATE_EVENT, CROSS_REFERENCED_EVENT]) {
|
||||
edges {
|
||||
node {
|
||||
__typename
|
||||
... on MarkedAsDuplicateEvent {
|
||||
canonical {
|
||||
... on Issue {
|
||||
repository {
|
||||
nameWithOwner
|
||||
}
|
||||
number
|
||||
}
|
||||
... on PullRequest {
|
||||
repository {
|
||||
nameWithOwner
|
||||
}
|
||||
number
|
||||
}
|
||||
}
|
||||
}
|
||||
... on UnmarkedAsDuplicateEvent {
|
||||
canonical {
|
||||
... on Issue {
|
||||
repository {
|
||||
nameWithOwner
|
||||
}
|
||||
number
|
||||
}
|
||||
... on PullRequest {
|
||||
repository {
|
||||
nameWithOwner
|
||||
}
|
||||
number
|
||||
}
|
||||
}
|
||||
}
|
||||
... on CrossReferencedEvent {
|
||||
source {
|
||||
... on Issue {
|
||||
repository {
|
||||
nameWithOwner
|
||||
}
|
||||
number
|
||||
}
|
||||
... on PullRequest {
|
||||
repository {
|
||||
nameWithOwner
|
||||
}
|
||||
number
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}`;
|
||||
|
||||
const result = await github.graphql(query, variables);
|
||||
const { stateReason, timelineItems: { edges } } = result.repository.issue;
|
||||
|
||||
const RAGESHAKE_OWNER = "matrix-org";
|
||||
const RAGESHAKE_REPO = "element-web-rageshakes";
|
||||
const rageshakes = new Set();
|
||||
const duplicateOf = new Set();
|
||||
|
||||
console.log("Edges: ", JSON.stringify(edges));
|
||||
|
||||
for (const { node } of edges) {
|
||||
switch(node.__typename) {
|
||||
case "MarkedAsDuplicateEvent":
|
||||
duplicateOf.add(node.canonical.repository.nameWithOwner + "#" + node.canonical.number);
|
||||
break;
|
||||
case "UnmarkedAsDuplicateEvent":
|
||||
duplicateOf.remove(node.canonical.repository.nameWithOwner + "#" + node.canonical.number);
|
||||
break;
|
||||
case "CrossReferencedEvent":
|
||||
if (node.source.repository.nameWithOwner === (RAGESHAKE_OWNER + "/" + RAGESHAKE_REPO)) {
|
||||
rageshakes.add(node.source.number);
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
console.log("Duplicate of: ", duplicateOf);
|
||||
console.log("Found rageshakes: ", rageshakes);
|
||||
|
||||
if (duplicateOf.size) {
|
||||
const body = Array.from(duplicateOf).join("\n");
|
||||
|
||||
// Comment on all rageshakes to create relationship to the issue this was closed as duplicate of
|
||||
for (const rageshake of rageshakes) {
|
||||
github.rest.issues.createComment({
|
||||
owner: RAGESHAKE_OWNER,
|
||||
repo: RAGESHAKE_REPO,
|
||||
issue_number: rageshake,
|
||||
body,
|
||||
});
|
||||
}
|
||||
|
||||
// Duplicate was closed with wrong reason, fix it
|
||||
if (stateReason === "COMPLETED") {
|
||||
core.setOutput("closeAsNotPlanned", "true");
|
||||
}
|
||||
} else {
|
||||
// This issue was closed, close all related rageshakes
|
||||
for (const rageshake of rageshakes) {
|
||||
github.rest.issues.update({
|
||||
owner: RAGESHAKE_OWNER,
|
||||
repo: RAGESHAKE_REPO,
|
||||
issue_number: rageshake,
|
||||
state: "closed",
|
||||
});
|
||||
}
|
||||
}
|
||||
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
|
||||
name: Close duplicate as Not Planned
|
||||
if: steps.main.outputs.closeAsNotPlanned
|
||||
with:
|
||||
# We do this step separately, and with the default token so as to not re-trigger this workflow when re-closing
|
||||
script: |
|
||||
await github.graphql(`mutation($id:ID!) {
|
||||
closeIssue(input: { issueId:$id, stateReason:NOT_PLANNED }) {
|
||||
clientMutationId
|
||||
}
|
||||
}`, {
|
||||
id: context.payload.issue.node_id,
|
||||
});
|
||||
@@ -1,14 +0,0 @@
|
||||
name: Localazy Download
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
schedule:
|
||||
- cron: "0 6 * * 1,3,5" # Every Monday, Wednesday and Friday at 6am UTC
|
||||
permissions:
|
||||
pull-requests: write # needed to auto-approve PRs
|
||||
jobs:
|
||||
download:
|
||||
uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
|
||||
with:
|
||||
packageManager: pnpm
|
||||
secrets:
|
||||
ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
@@ -1,14 +0,0 @@
|
||||
name: Localazy Upload
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
push:
|
||||
branches: [develop]
|
||||
paths:
|
||||
- "apps/web/src/i18n/strings/en_EN.json"
|
||||
- "packages/shared-components/src/i18n/strings/en_EN.json"
|
||||
permissions: {} # No permissions needed
|
||||
jobs:
|
||||
upload:
|
||||
uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
|
||||
secrets:
|
||||
LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}
|
||||
@@ -1,29 +0,0 @@
|
||||
# Tweaks the behaviour of Merge Queue to skip certain checks
|
||||
name: Merge Queue tweaks
|
||||
on:
|
||||
merge_group:
|
||||
types: [checks_requested]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
run:
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
statuses: write
|
||||
steps:
|
||||
# This is only needed as license/cla at time of writing seems to be extraordinarily flaky
|
||||
# and Github doesn't support conditional checks between PR & merge queue.
|
||||
# This is fine to do as a PR won't make it to merge queue until it has license/cla passing.
|
||||
- name: Skip license/cla on merge queues
|
||||
uses: guibranco/github-status-action-v2@9bfa8773cdbdc6c185747fd43cd7faa9d7c32f09
|
||||
with:
|
||||
authToken: ${{ secrets.GITHUB_TOKEN }}
|
||||
state: success
|
||||
context: license/cla
|
||||
sha: ${{ github.sha }}
|
||||
target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
||||
@@ -1,53 +0,0 @@
|
||||
# Triggers after the layered build has finished, taking the artifact
|
||||
# and uploading it to netlify
|
||||
name: Upload Preview Build to Netlify
|
||||
on:
|
||||
# Privilege escalation necessary to publish to Netlify
|
||||
# 🚨 We must not execute any checked out code here.
|
||||
workflow_run: # zizmor: ignore[dangerous-triggers]
|
||||
workflows: ["Build"]
|
||||
types:
|
||||
- completed
|
||||
jobs:
|
||||
deploy:
|
||||
if: github.event.workflow_run.conclusion != 'cancelled' && github.event.workflow_run.event == 'pull_request'
|
||||
runs-on: ubuntu-24.04
|
||||
environment: Netlify
|
||||
permissions:
|
||||
actions: read
|
||||
deployments: write
|
||||
steps:
|
||||
- name: 📝 Create Deployment
|
||||
uses: bobheadxi/deployments@648679e8e4915b27893bd7dbc35cb504dc915bc8 # v1
|
||||
id: deployment
|
||||
with:
|
||||
step: start
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
env: Netlify
|
||||
ref: ${{ github.event.workflow_run.head_sha }}
|
||||
desc: |
|
||||
Do you trust the author of this PR? Maybe this build will steal your keys or give you malware.
|
||||
Exercise caution. Use test accounts.
|
||||
|
||||
- name: 📥 Download artifact
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
run-id: ${{ github.event.workflow_run.id }}
|
||||
name: webapp-ubuntu-24.04
|
||||
path: webapp
|
||||
|
||||
- name: 📤 Deploy to Netlify
|
||||
uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
|
||||
with:
|
||||
path: webapp
|
||||
owner: ${{ github.event.workflow_run.head_repository.owner.login }}
|
||||
branch: ${{ github.event.workflow_run.head_branch }}
|
||||
revision: ${{ github.event.workflow_run.head_sha }}
|
||||
token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
|
||||
site_id: ${{ vars.NETLIFY_SITE_ID }}
|
||||
deployment_env: ${{ steps.deployment.outputs.env }}
|
||||
deployment_id: ${{ steps.deployment.outputs.deployment_id }}
|
||||
desc: |
|
||||
Do you trust the author of this PR? Maybe this build will steal your keys or give you malware.
|
||||
Exercise caution. Use test accounts.
|
||||
@@ -1,47 +0,0 @@
|
||||
name: Publish npm package
|
||||
run-name: Publish ${{ inputs.package }}
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
package:
|
||||
description: Which package to release
|
||||
required: true
|
||||
type: choice
|
||||
options:
|
||||
- playwright-common
|
||||
- shared-components
|
||||
- module-api
|
||||
|
||||
concurrency: release
|
||||
jobs:
|
||||
publish:
|
||||
name: "Publish"
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
id-token: write
|
||||
|
||||
steps:
|
||||
- name: 🧮 Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- name: 🔧 Set up node environment
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
cache: "pnpm"
|
||||
node-version-file: ".node-version"
|
||||
registry-url: "https://registry.npmjs.org"
|
||||
|
||||
# Ensure npm 11.5.1 or later is installed
|
||||
- name: Update npm
|
||||
run: npm install -g npm@latest
|
||||
|
||||
- name: 🛠️ Install dependencies
|
||||
run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: 🚀 Publish to npm
|
||||
working-directory: packages/${{ inputs.package }}
|
||||
run: npm publish --access public --provenance
|
||||
@@ -1,16 +0,0 @@
|
||||
name: Pull Request
|
||||
on:
|
||||
# Privilege escalation necessary access members of the review teams
|
||||
# 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
|
||||
pull_request_target: # zizmor: ignore[dangerous-triggers]
|
||||
types: [opened, edited, labeled, unlabeled, synchronize]
|
||||
merge_group:
|
||||
types: [checks_requested]
|
||||
permissions: {}
|
||||
jobs:
|
||||
action:
|
||||
uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
|
||||
permissions:
|
||||
pull-requests: write
|
||||
secrets:
|
||||
ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
@@ -1,17 +0,0 @@
|
||||
name: Pull Request Base Branch
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, edited, synchronize]
|
||||
permissions: {} # No permissions required
|
||||
jobs:
|
||||
check_base_branch:
|
||||
name: Check PR base branch
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
|
||||
with:
|
||||
script: |
|
||||
const baseBranch = context.payload.pull_request.base.ref;
|
||||
if (!['develop', 'staging'].includes(baseBranch) && !baseBranch.startsWith('feat/')) {
|
||||
core.setFailed(`Invalid base branch: ${baseBranch}`);
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Release Drafter
|
||||
on:
|
||||
push:
|
||||
branches: [staging]
|
||||
workflow_dispatch: {}
|
||||
concurrency: ${{ github.workflow }}
|
||||
permissions: {}
|
||||
jobs:
|
||||
draft:
|
||||
permissions:
|
||||
contents: write
|
||||
uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop # zizmor: ignore[unpinned-uses]
|
||||
@@ -1,17 +0,0 @@
|
||||
# Gitflow merge-back master->develop
|
||||
name: Merge master -> develop
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
concurrency: ${{ github.repository }}-${{ github.workflow }}
|
||||
permissions: {} # We use ELEMENT_BOT_TOKEN instead
|
||||
jobs:
|
||||
merge:
|
||||
uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop # zizmor: ignore[unpinned-uses]
|
||||
secrets:
|
||||
ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
with:
|
||||
# This relates to the directory in which to reset dependencies, only web needs this
|
||||
dir: apps/web
|
||||
dependencies: |
|
||||
matrix-js-sdk
|
||||
@@ -1,68 +0,0 @@
|
||||
name: Release Process
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
mode:
|
||||
description: What type of release
|
||||
required: true
|
||||
default: rc
|
||||
type: choice
|
||||
options:
|
||||
- rc
|
||||
- final
|
||||
concurrency: ${{ github.workflow }}
|
||||
permissions: {}
|
||||
jobs:
|
||||
release:
|
||||
uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop # zizmor: ignore[unpinned-uses]
|
||||
permissions:
|
||||
contents: write
|
||||
issues: write
|
||||
pull-requests: read
|
||||
id-token: write
|
||||
secrets:
|
||||
ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
||||
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
||||
with:
|
||||
final: ${{ inputs.mode == 'final' }}
|
||||
gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
|
||||
asset-path: dist/*.tar.gz
|
||||
expected-asset-count: 3
|
||||
# Desktop has no dist script so we only target web here
|
||||
dist-dir: apps/web
|
||||
version-dirs: apps/web apps/desktop
|
||||
|
||||
check:
|
||||
name: Post release checks
|
||||
needs: release
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
checks: read
|
||||
steps:
|
||||
- name: Wait for docker build
|
||||
uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
|
||||
with:
|
||||
ref: master
|
||||
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
wait-interval: 10
|
||||
check-name: "Docker Buildx"
|
||||
allowed-conclusions: success
|
||||
|
||||
- name: Wait for debian package
|
||||
uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
|
||||
with:
|
||||
ref: master
|
||||
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
wait-interval: 10
|
||||
check-name: Build package
|
||||
allowed-conclusions: success
|
||||
|
||||
- name: Wait for desktop packaging
|
||||
uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
|
||||
with:
|
||||
ref: master
|
||||
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
wait-interval: 10
|
||||
check-regexp: Prepare|Linux|macOS|Windows|Deploy|deploy
|
||||
allowed-conclusions: success
|
||||
@@ -1,97 +0,0 @@
|
||||
name: Cut branches
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
element-web:
|
||||
description: Prepare element-web
|
||||
required: true
|
||||
type: boolean
|
||||
default: true
|
||||
matrix-js-sdk:
|
||||
description: Prepare matrix-js-sdk
|
||||
required: true
|
||||
type: boolean
|
||||
default: true
|
||||
permissions: {} # Uses ELEMENT_BOT_TOKEN instead
|
||||
jobs:
|
||||
checks:
|
||||
name: Sanity checks
|
||||
strategy:
|
||||
matrix:
|
||||
repo:
|
||||
- matrix-org/matrix-js-sdk
|
||||
- element-hq/element-web
|
||||
uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop # zizmor: ignore[unpinned-uses]
|
||||
secrets:
|
||||
ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
with:
|
||||
repository: ${{ matrix.repo }}
|
||||
|
||||
prepare:
|
||||
runs-on: ubuntu-24.04
|
||||
needs: checks
|
||||
env:
|
||||
# The order is specified bottom-up to avoid any races for allchange
|
||||
REPOS: matrix-js-sdk element-web
|
||||
steps:
|
||||
- name: Checkout Element Web
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
if: inputs.element-web
|
||||
with:
|
||||
repository: element-hq/element-web
|
||||
path: element-web
|
||||
ref: staging
|
||||
fetch-depth: 0
|
||||
fetch-tags: true
|
||||
token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
persist-credentials: true
|
||||
- name: Checkout Matrix JS SDK
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
if: inputs.matrix-js-sdk
|
||||
with:
|
||||
repository: matrix-org/matrix-js-sdk
|
||||
path: matrix-js-sdk
|
||||
ref: staging
|
||||
fetch-depth: 0
|
||||
fetch-tags: true
|
||||
token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
persist-credentials: true
|
||||
|
||||
- name: Prepare Git
|
||||
run: |
|
||||
git config --global user.email "releases@riot.im"
|
||||
git config --global user.name "RiotRobot"
|
||||
|
||||
- name: Merge Element Web
|
||||
if: inputs.element-web
|
||||
run: |
|
||||
git -C "element-web" merge origin/develop
|
||||
- name: Merge JS SDK
|
||||
if: inputs.matrix-js-sdk
|
||||
run: |
|
||||
git -C "matrix-js-sdk" merge origin/develop
|
||||
|
||||
- name: Push staging
|
||||
run: for REPO in $REPOS; do [ -d "$REPO" ] && git -C "$REPO" push origin staging; done
|
||||
|
||||
- name: Wait for matrix-js-sdk draft
|
||||
if: inputs.matrix-js-sdk
|
||||
uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
|
||||
with:
|
||||
ref: staging
|
||||
repo: matrix-org/matrix-js-sdk
|
||||
repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
wait-interval: 10
|
||||
check-name: "draft / draft"
|
||||
allowed-conclusions: success
|
||||
|
||||
- name: Wait for element-web draft
|
||||
if: inputs.element-web
|
||||
uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
|
||||
with:
|
||||
ref: staging
|
||||
repo: element-hq/element-web
|
||||
repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
wait-interval: 10
|
||||
check-name: "draft / draft"
|
||||
allowed-conclusions: success
|
||||
@@ -1,38 +0,0 @@
|
||||
name: Build shared component storybook
|
||||
on:
|
||||
merge_group: {}
|
||||
pull_request: {}
|
||||
workflow_call: {}
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
doc:
|
||||
name: Build storybook
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: 🧮 Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- name: 🔧 Pnpm cache
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
cache: "pnpm"
|
||||
node-version-file: package.json
|
||||
|
||||
- name: 🔨 Install dependencies
|
||||
working-directory: packages/shared-components
|
||||
run: "pnpm install --frozen-lockfile"
|
||||
|
||||
- name: 📖 Build Storybook
|
||||
working-directory: packages/shared-components
|
||||
run: pnpm build:storybook
|
||||
|
||||
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: shared-components-storybook
|
||||
path: packages/shared-components/storybook-static
|
||||
retention-days: 1
|
||||
@@ -1,33 +0,0 @@
|
||||
name: Publish shared component storybook
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
push:
|
||||
branches:
|
||||
- "develop"
|
||||
paths:
|
||||
- "packages/shared-components/**/*"
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: Build storybook
|
||||
uses: ./.github/workflows/shared-component-storybook-build.yml
|
||||
|
||||
publish:
|
||||
name: Publish storybook
|
||||
runs-on: ubuntu-latest
|
||||
needs: build
|
||||
environment: SharedComponents
|
||||
steps:
|
||||
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
name: shared-components-storybook
|
||||
path: storybook-static
|
||||
|
||||
- name: 🚀 Deploy to Cloudflare Pages
|
||||
uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
|
||||
with:
|
||||
apiToken: ${{ secrets.CF_PAGES_TOKEN }}
|
||||
accountId: ${{ secrets.CF_PAGES_ACCOUNT_ID }}
|
||||
command: pages deploy storybook-static --project-name=shared-components-storybook
|
||||
@@ -1,50 +0,0 @@
|
||||
# Triggers after the shared component tests have finished,
|
||||
# It uploads the received images and diffs to netlify, printing the URLs to the console
|
||||
name: Upload Shared Component Visual Test Diffs
|
||||
on:
|
||||
# Privilege escalation necessary to deploy to Netlify
|
||||
# 🚨 We must not execute any checked out code here.
|
||||
workflow_run: # zizmor: ignore[dangerous-triggers]
|
||||
workflows: ["Shared Component Visual Tests"]
|
||||
types:
|
||||
- completed
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.run_id }}
|
||||
cancel-in-progress: ${{ github.event.workflow_run.event == 'pull_request' }}
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
report:
|
||||
if: github.event.workflow_run.conclusion == 'failure'
|
||||
name: Upload Diffs
|
||||
runs-on: ubuntu-24.04
|
||||
environment: Netlify
|
||||
permissions:
|
||||
actions: read
|
||||
deployments: write
|
||||
steps:
|
||||
- name: Download Diffs
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
run-id: ${{ github.event.workflow_run.id }}
|
||||
name: received-images
|
||||
path: received-images
|
||||
|
||||
- name: Generate Index
|
||||
run: "cd received-images && tree -L 1 --noreport -H '' -o index.html ."
|
||||
|
||||
- name: 📤 Deploy to Netlify
|
||||
uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
|
||||
with:
|
||||
path: received-images
|
||||
owner: ${{ github.event.workflow_run.head_repository.owner.login }}
|
||||
branch: ${{ github.event.workflow_run.head_branch }}
|
||||
revision: ${{ github.event.workflow_run.head_sha }}
|
||||
token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
|
||||
site_id: ${{ vars.NETLIFY_SITE_ID }}
|
||||
desc: Shared Component Visual Diffs
|
||||
deployment_env: SharedComponentDiffs
|
||||
prefix: "diffs-"
|
||||
@@ -1,60 +0,0 @@
|
||||
name: Shared Component Visual Tests
|
||||
on:
|
||||
pull_request: {}
|
||||
merge_group:
|
||||
types: [checks_requested]
|
||||
push:
|
||||
branches: [develop, master]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions: {} # No permissions required
|
||||
|
||||
jobs:
|
||||
testStorybook:
|
||||
name: "Run Visual Tests"
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
actions: read
|
||||
issues: read
|
||||
pull-requests: read
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
repository: element-hq/element-web
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
cache: "pnpm"
|
||||
node-version: "lts/*"
|
||||
|
||||
- name: Install dependencies
|
||||
working-directory: packages/shared-components
|
||||
run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Setup playwright
|
||||
uses: ./.github/actions/setup-playwright
|
||||
with:
|
||||
write-cache: ${{ github.event_name != 'merge_group' }}
|
||||
|
||||
- name: Run Visual tests
|
||||
working-directory: packages/shared-components
|
||||
run: "pnpm test:storybook --run"
|
||||
|
||||
- name: Detect stale screenshots
|
||||
run: |
|
||||
if diff -rq __baselines__ __results__ | grep "^Only in __baselines__"; then
|
||||
exit 1
|
||||
fi
|
||||
working-directory: packages/shared-components/__vis__/linux
|
||||
|
||||
- name: Upload received images & diffs
|
||||
if: always()
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: received-images
|
||||
path: packages/shared-components/__vis__/linux
|
||||
@@ -1,27 +0,0 @@
|
||||
name: SonarQube
|
||||
on:
|
||||
# Privilege escalation necessary to call upon SonarCloud
|
||||
# 🚨 We must not execute any checked out code here.
|
||||
workflow_run: # zizmor: ignore[dangerous-triggers]
|
||||
workflows: ["Tests"]
|
||||
types:
|
||||
- completed
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }}
|
||||
cancel-in-progress: true
|
||||
permissions: {}
|
||||
jobs:
|
||||
sonarqube:
|
||||
name: 🩻 SonarQube
|
||||
if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
|
||||
uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop # zizmor: ignore[unpinned-uses]
|
||||
permissions:
|
||||
actions: read
|
||||
statuses: write
|
||||
id-token: write # sonar
|
||||
secrets:
|
||||
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
||||
ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
with:
|
||||
sharded: true
|
||||
version-pkg-json-dir: ./apps/web
|
||||
@@ -1,133 +0,0 @@
|
||||
name: Static Analysis
|
||||
on:
|
||||
pull_request: {}
|
||||
push:
|
||||
branches: [develop, master]
|
||||
merge_group:
|
||||
types: [checks_requested]
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
# This must be set for fetchdep.sh to get the right branch
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
|
||||
|
||||
permissions: {} # No permissions required
|
||||
|
||||
jobs:
|
||||
lint:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- name: Typescript Syntax Check
|
||||
install: layered
|
||||
command: "lint:types"
|
||||
- name: Prettier
|
||||
install: normal
|
||||
command: "lint:prettier"
|
||||
- name: ESLint
|
||||
install: normal
|
||||
command: "lint:js"
|
||||
- name: Style Lint
|
||||
install: normal
|
||||
command: "lint:style"
|
||||
- name: Workflow Lint
|
||||
install: normal
|
||||
command: "lint:workflows"
|
||||
- name: Analyse Dead Code
|
||||
install: normal
|
||||
command: "lint:knip"
|
||||
- name: Rethemendex Check
|
||||
command: "rethemendex"
|
||||
assert-diff: true
|
||||
- name: Docs
|
||||
install: layered
|
||||
command: "docs:build"
|
||||
name: ${{ matrix.name }}
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
if: matrix.install != ''
|
||||
with:
|
||||
cache: "pnpm"
|
||||
node-version: "lts/*"
|
||||
|
||||
- name: Install Dependencies (layered)
|
||||
if: matrix.install == 'layered'
|
||||
run: "./scripts/layered.sh"
|
||||
- name: Install Dependencies (normal)
|
||||
if: matrix.install == 'normal'
|
||||
run: "pnpm install --frozen-lockfile"
|
||||
|
||||
- name: Run ${{ matrix.command }}
|
||||
run: pnpm --if-present run "$CMD" && pnpm -r --if-present run "$CMD"
|
||||
env:
|
||||
CMD: ${{ matrix.command }}
|
||||
|
||||
- name: Assert no changes
|
||||
run: git diff --exit-code
|
||||
if: matrix.assert-diff
|
||||
|
||||
zizmor:
|
||||
name: Zizmor Github Actions lint
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
security-events: write
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Run zizmor
|
||||
uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
|
||||
|
||||
i18n:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- name: Element Web
|
||||
path: "apps/web"
|
||||
allowed-hardcoded-keys: |
|
||||
console_dev_note
|
||||
labs|element_call_video_rooms
|
||||
labs|feature_disable_call_per_sender_encryption
|
||||
voip|element_call
|
||||
error|invalid_json
|
||||
error|misconfigured
|
||||
welcome|title_element
|
||||
devtools|settings|elementCallUrl
|
||||
labs|sliding_sync_description
|
||||
settings|voip|noise_suppression_description
|
||||
settings|voip|echo_cancellation_description
|
||||
- name: Element Desktop
|
||||
path: "apps/desktop"
|
||||
- name: Shared Components
|
||||
path: "packages/shared-components"
|
||||
name: "i18n Check (${{ matrix.name }})"
|
||||
uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
|
||||
permissions:
|
||||
pull-requests: read
|
||||
with:
|
||||
hardcoded-words: "Element"
|
||||
packageManager: pnpm
|
||||
path: ${{ matrix.path }}
|
||||
allowed-hardcoded-keys: ${{ matrix.allowed-hardcoded-keys }}
|
||||
|
||||
# Dummy job to simplify branch protections
|
||||
ci:
|
||||
name: Static Analysis
|
||||
needs: [lint, i18n, zizmor]
|
||||
if: always()
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
|
||||
run: exit 1
|
||||
@@ -1,24 +0,0 @@
|
||||
name: Sync labels
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
schedule:
|
||||
- cron: "0 1 * * *" # 1am every day
|
||||
push:
|
||||
branches:
|
||||
- develop
|
||||
paths:
|
||||
- .github/labels.yml
|
||||
|
||||
permissions: {} # We use ELEMENT_BOT_TOKEN instead
|
||||
|
||||
jobs:
|
||||
sync-labels:
|
||||
uses: element-hq/element-meta/.github/workflows/sync-labels.yml@7f2f93fb9b52ece7a0998f60e64862aa203c1746
|
||||
with:
|
||||
LABELS: |
|
||||
element-hq/element-meta
|
||||
.github/labels.yml
|
||||
DELETE: true
|
||||
WET: true
|
||||
secrets:
|
||||
ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
@@ -1,188 +0,0 @@
|
||||
name: Tests
|
||||
on:
|
||||
pull_request: {}
|
||||
merge_group:
|
||||
types: [checks_requested]
|
||||
push:
|
||||
branches: [develop, master]
|
||||
workflow_call:
|
||||
inputs:
|
||||
disable_coverage:
|
||||
type: boolean
|
||||
required: false
|
||||
description: "Specify true to skip generating and uploading coverage for tests"
|
||||
matrix-js-sdk-sha:
|
||||
type: string
|
||||
required: false
|
||||
description: "The matrix-js-sdk SHA to use"
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
ENABLE_COVERAGE: ${{ github.event_name != 'merge_group' && inputs.disable_coverage != 'true' }}
|
||||
# fetchdep.sh needs to know our PR number
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
jest_ew:
|
||||
name: Jest (Element Web)
|
||||
runs-on: ubuntu-24.04
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# Run multiple instances in parallel to speed up the tests
|
||||
runner: [1, 2]
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- name: pnpm cache
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
node-version: "lts/*"
|
||||
cache: "pnpm"
|
||||
|
||||
- name: Install Deps
|
||||
run: "./scripts/layered.sh"
|
||||
env:
|
||||
JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}
|
||||
|
||||
- name: Jest Cache
|
||||
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
||||
with:
|
||||
path: /tmp/jest_cache
|
||||
key: ${{ hashFiles('**/pnpm-lock.yaml') }}
|
||||
|
||||
- name: Get number of CPU cores
|
||||
id: cpu-cores
|
||||
uses: SimenB/github-actions-cpu-cores@97330871fe1b7d3529392ea000e3d2c4b357e403 # v3
|
||||
|
||||
- name: Run tests
|
||||
working-directory: apps/web
|
||||
run: |
|
||||
pnpm test \
|
||||
--coverage=$ENABLE_COVERAGE \
|
||||
--ci \
|
||||
--max-workers $MAX_WORKERS \
|
||||
--shard "$SHARD" \
|
||||
--cacheDirectory /tmp/jest_cache
|
||||
env:
|
||||
JEST_SONAR_UNIQUE_OUTPUT_NAME: true
|
||||
|
||||
# tell jest to use coloured output
|
||||
FORCE_COLOR: true
|
||||
MAX_WORKERS: ${{ steps.cpu-cores.outputs.count }}
|
||||
SHARD: ${{ format('{0}/{1}', matrix.runner, strategy.job-total) }}
|
||||
|
||||
- name: Move coverage files into place
|
||||
if: env.ENABLE_COVERAGE == 'true'
|
||||
working-directory: apps/web
|
||||
run: mv coverage/lcov.info coverage/$NODE_VERSION-${{ matrix.runner }}.lcov.info
|
||||
env:
|
||||
NODE_VERSION: ${{ steps.setupNode.outputs.node-version }}
|
||||
|
||||
- name: Upload Artifact
|
||||
if: env.ENABLE_COVERAGE == 'true'
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: coverage-jest-${{ matrix.runner }}
|
||||
path: |
|
||||
apps/web/coverage
|
||||
!apps/web/coverage/lcov-report
|
||||
|
||||
complete:
|
||||
name: jest-tests
|
||||
needs: [jest_ew, vitest]
|
||||
if: always()
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
statuses: write
|
||||
steps:
|
||||
- if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
|
||||
run: exit 1
|
||||
|
||||
- name: Skip SonarCloud in merge queue
|
||||
if: github.event_name == 'merge_group' || inputs.disable_coverage == 'true'
|
||||
uses: guibranco/github-status-action-v2@9bfa8773cdbdc6c185747fd43cd7faa9d7c32f09
|
||||
with:
|
||||
authToken: ${{ secrets.GITHUB_TOKEN }}
|
||||
state: success
|
||||
description: SonarCloud skipped
|
||||
context: SonarCloud Code Analysis
|
||||
sha: ${{ github.sha }}
|
||||
target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
||||
|
||||
vitest:
|
||||
name: Vitest
|
||||
strategy:
|
||||
matrix:
|
||||
path:
|
||||
- apps/desktop
|
||||
- packages/shared-components
|
||||
- packages/module-api
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- name: pnpm cache
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
node-version: "lts/*"
|
||||
cache: "pnpm"
|
||||
|
||||
- name: Install Deps
|
||||
run: "pnpm install"
|
||||
|
||||
- name: Cache storybook & vitest
|
||||
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
||||
with:
|
||||
path: |
|
||||
${{ matrix.path }}/node_modules/.cache
|
||||
${{ matrix.path }}/node_modules/.vite/vitest
|
||||
key: ${{ matrix.path }}-${{ hashFiles('pnpm-lock.yaml') }}
|
||||
|
||||
- name: Setup playwright
|
||||
uses: ./.github/actions/setup-playwright
|
||||
if: matrix.path == 'packages/shared-components'
|
||||
with:
|
||||
write-cache: ${{ github.event_name != 'merge_group' }}
|
||||
|
||||
- name: Run tests
|
||||
working-directory: ${{ matrix.path }}
|
||||
run: pnpm test:unit --coverage=$ENABLE_COVERAGE
|
||||
|
||||
# Dump the disk usage on failure, because this job seems to fail with disk fills sometimes
|
||||
- name: df
|
||||
run: df -h && df -i
|
||||
if: ${{ failure() }}
|
||||
|
||||
- name: Calculate artifact name
|
||||
if: env.ENABLE_COVERAGE == 'true'
|
||||
id: artifact
|
||||
run: |
|
||||
NAME=$(basename "$MATRIX_PATH")
|
||||
echo "name=$NAME" >> $GITHUB_OUTPUT
|
||||
env:
|
||||
MATRIX_PATH: ${{ matrix.path }}
|
||||
|
||||
- name: Upload Artifact
|
||||
if: env.ENABLE_COVERAGE == 'true'
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: coverage-${{ steps.artifact.outputs.name }}
|
||||
path: |
|
||||
${{ matrix.path }}/coverage
|
||||
!${{ matrix.path }}/coverage/lcov-report
|
||||
@@ -1,21 +0,0 @@
|
||||
name: Move issued assigned to specific team members to their boards
|
||||
|
||||
on:
|
||||
issues:
|
||||
types: [assigned]
|
||||
|
||||
permissions: {} # We use ELEMENT_BOT_TOKEN instead
|
||||
|
||||
jobs:
|
||||
web-app-team:
|
||||
runs-on: ubuntu-24.04
|
||||
if: |
|
||||
contains(github.event.issue.assignees.*.login, 't3chguy') ||
|
||||
contains(github.event.issue.assignees.*.login, 'florianduros') ||
|
||||
contains(github.event.issue.assignees.*.login, 'dbkr') ||
|
||||
contains(github.event.issue.assignees.*.login, 'MidhunSureshR')
|
||||
steps:
|
||||
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: https://github.com/orgs/element-hq/projects/67
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
@@ -1,16 +0,0 @@
|
||||
name: Move new issues into Issue triage board
|
||||
|
||||
on:
|
||||
issues:
|
||||
types: [opened]
|
||||
|
||||
permissions: {} # We use ELEMENT_BOT_TOKEN instead
|
||||
|
||||
jobs:
|
||||
automate-project-columns:
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: https://github.com/orgs/element-hq/projects/120
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
@@ -1,178 +0,0 @@
|
||||
name: Move labelled issues to correct projects
|
||||
|
||||
on:
|
||||
issues:
|
||||
types: [labeled]
|
||||
workflow_call:
|
||||
secrets:
|
||||
ELEMENT_BOT_TOKEN:
|
||||
required: true
|
||||
|
||||
permissions: {} # We use ELEMENT_BOT_TOKEN instead
|
||||
|
||||
jobs:
|
||||
apply_Z-Labs_label:
|
||||
name: Add Z-Labs label for features behind labs flags
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'A-Maths') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Location-Sharing') ||
|
||||
contains(github.event.issue.labels.*.name, 'Z-IA') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Jump-To-Date ') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Themes-Custom') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-E2EE-Dehydration') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Tags') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Video-Rooms') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Message-Starring') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Rich-Text-Editor') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Element-Call')
|
||||
steps:
|
||||
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
|
||||
with:
|
||||
script: |
|
||||
github.rest.issues.addLabels({
|
||||
issue_number: context.issue.number,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
labels: ['Z-Labs']
|
||||
})
|
||||
|
||||
apply_Help-Wanted_label:
|
||||
name: Add "Help Wanted" label to all "good first issue" and Hacktoberfest
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'good first issue') ||
|
||||
contains(github.event.issue.labels.*.name, 'Hacktoberfest')
|
||||
steps:
|
||||
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
|
||||
with:
|
||||
script: |
|
||||
github.rest.issues.addLabels({
|
||||
issue_number: context.issue.number,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
labels: ['Help Wanted']
|
||||
})
|
||||
|
||||
move_needs_info_issues:
|
||||
name: X-Needs-Info issues to Need info column on triage board
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'X-Needs-Info')
|
||||
steps:
|
||||
- id: add_to_project
|
||||
uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: ${{ env.PROJECT_URL }}
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
|
||||
- id: set_fields
|
||||
uses: titoportas/update-project-fields@421a54430b3cdc9eefd8f14f9ce0142ab7678751 # v0.1.0
|
||||
with:
|
||||
project-url: ${{ env.PROJECT_URL }}
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
item-id: ${{ steps.add_to_project.outputs.itemId }} # Use the item-id output of the previous step
|
||||
field-keys: Status
|
||||
field-values: "Needs info"
|
||||
env:
|
||||
PROJECT_URL: https://github.com/orgs/element-hq/projects/120
|
||||
|
||||
move_flakey_test_issues:
|
||||
name: Z-Flaky-Test issues to Sized for maintainer column on triage board
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'Z-Flaky-Test')
|
||||
steps:
|
||||
- id: add_to_project
|
||||
uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: ${{ env.PROJECT_URL }}
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
|
||||
- id: set_fields
|
||||
uses: titoportas/update-project-fields@421a54430b3cdc9eefd8f14f9ce0142ab7678751 # v0.1.0
|
||||
with:
|
||||
project-url: ${{ env.PROJECT_URL }}
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
item-id: ${{ steps.add_to_project.outputs.itemId }} # Use the item-id output of the previous step
|
||||
field-keys: Status
|
||||
field-values: "Sized for maintainer"
|
||||
env:
|
||||
PROJECT_URL: https://github.com/orgs/element-hq/projects/120
|
||||
|
||||
add_priority_design_issues_to_project:
|
||||
name: P1 X-Needs-Design to Design project board
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'X-Needs-Design') &&
|
||||
(contains(github.event.issue.labels.*.name, 'S-Critical') &&
|
||||
(contains(github.event.issue.labels.*.name, 'O-Frequent') ||
|
||||
contains(github.event.issue.labels.*.name, 'O-Occasional')) ||
|
||||
contains(github.event.issue.labels.*.name, 'S-Major') &&
|
||||
contains(github.event.issue.labels.*.name, 'O-Frequent') ||
|
||||
contains(github.event.issue.labels.*.name, 'A11y'))
|
||||
steps:
|
||||
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: https://github.com/orgs/element-hq/projects/18
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
|
||||
add_product_issues:
|
||||
name: X-Needs-Product to product project board
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'X-Needs-Product')
|
||||
steps:
|
||||
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: https://github.com/orgs/element-hq/projects/28
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
|
||||
Search_issues_to_board:
|
||||
name: Search issues to project board
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'A-New-Search-Experience')
|
||||
steps:
|
||||
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: https://github.com/orgs/element-hq/projects/48
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
|
||||
voip:
|
||||
name: Add labelled issues to VoIP project board
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'Team: VoIP')
|
||||
steps:
|
||||
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: https://github.com/orgs/element-hq/projects/41
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
|
||||
crypto:
|
||||
name: Add labelled issues to Crypto project
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'Team: Crypto')
|
||||
steps:
|
||||
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: https://github.com/orgs/element-hq/projects/76
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
|
||||
tech_debt:
|
||||
name: Add labelled issues to tech debt project
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
contains(github.event.issue.labels.*.name, 'A-Developer-Experience') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Documentation') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Packaging') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Technical-Debt') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Testing') ||
|
||||
contains(github.event.issue.labels.*.name, 'Z-Flaky-Test')
|
||||
steps:
|
||||
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
|
||||
with:
|
||||
project-url: https://github.com/orgs/element-hq/projects/101
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
@@ -1,140 +0,0 @@
|
||||
name: Move pull requests asking for review to the relevant project
|
||||
on:
|
||||
pull_request_target:
|
||||
types: [review_requested]
|
||||
|
||||
permissions: {} # Uses ELEMENT_BOT_TOKEN instead
|
||||
jobs:
|
||||
add_design_pr_to_project:
|
||||
name: Move PRs asking for design review to the design board
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
|
||||
id: find_team_members
|
||||
with:
|
||||
headers: '{"GraphQL-Features": "projects_next_graphql"}'
|
||||
query: |
|
||||
query find_team_members($team: String!) {
|
||||
organization(login: "element-hq") {
|
||||
team(slug: $team) {
|
||||
members {
|
||||
nodes {
|
||||
login
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
team: ${{ env.TEAM }}
|
||||
env:
|
||||
TEAM: "design"
|
||||
GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
- id: any_matching_reviewers
|
||||
run: |
|
||||
# Fetch requested reviewers, and people who are on the team
|
||||
echo '${{ tojson(fromjson(steps.find_team_members.outputs.data).organization.team.members.nodes[*].login) }}' | tee /tmp/team_members.json
|
||||
echo '${{ tojson(github.event.pull_request.requested_reviewers[*].login) }}' | tee /tmp/reviewers.json
|
||||
jq --raw-output .[] < /tmp/team_members.json | sort | tee /tmp/team_members.txt
|
||||
jq --raw-output .[] < /tmp/reviewers.json | sort | tee /tmp/reviewers.txt
|
||||
|
||||
# Fetch requested team reviewers, and the name of the team
|
||||
echo '${{ tojson(github.event.pull_request.requested_teams[*].slug) }}' | tee /tmp/team_reviewers.json
|
||||
jq --raw-output .[] < /tmp/team_reviewers.json | sort | tee /tmp/team_reviewers.txt
|
||||
echo '${{ env.TEAM }}' | tee /tmp/team.txt
|
||||
|
||||
# If either a reviewer matches a team member, or a team matches our team, say "true"
|
||||
if [ $(join /tmp/team_members.txt /tmp/reviewers.txt | wc -l) != 0 ]; then
|
||||
echo "match=true" >> $GITHUB_OUTPUT
|
||||
elif [ $(join /tmp/team.txt /tmp/team_reviewers.txt | wc -l) != 0 ]; then
|
||||
echo "match=true" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "match=false" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
env:
|
||||
TEAM: "design"
|
||||
- uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
|
||||
id: add_to_project
|
||||
if: steps.any_matching_reviewers.outputs.match == 'true'
|
||||
with:
|
||||
headers: '{"GraphQL-Features": "projects_next_graphql"}'
|
||||
query: |
|
||||
mutation add_to_project($projectid:ID!, $contentid:ID!) {
|
||||
addProjectV2ItemById(input: {projectId: $projectid contentId: $contentid}) {
|
||||
item {
|
||||
id
|
||||
}
|
||||
}
|
||||
}
|
||||
projectid: ${{ env.PROJECT_ID }}
|
||||
contentid: ${{ github.event.pull_request.node_id }}
|
||||
env:
|
||||
PROJECT_ID: "PVT_kwDOAM0swc0sUA"
|
||||
TEAM: "design"
|
||||
GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
|
||||
add_product_pr_to_project:
|
||||
name: Move PRs asking for design review to the design board
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
|
||||
id: find_team_members
|
||||
with:
|
||||
headers: '{"GraphQL-Features": "projects_next_graphql"}'
|
||||
query: |
|
||||
query find_team_members($team: String!) {
|
||||
organization(login: "element-hq") {
|
||||
team(slug: $team) {
|
||||
members {
|
||||
nodes {
|
||||
login
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
team: ${{ env.TEAM }}
|
||||
env:
|
||||
TEAM: "product"
|
||||
GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
- id: any_matching_reviewers
|
||||
run: |
|
||||
# Fetch requested reviewers, and people who are on the team
|
||||
echo '${{ tojson(fromjson(steps.find_team_members.outputs.data).organization.team.members.nodes[*].login) }}' | tee /tmp/team_members.json
|
||||
echo '${{ tojson(github.event.pull_request.requested_reviewers[*].login) }}' | tee /tmp/reviewers.json
|
||||
jq --raw-output .[] < /tmp/team_members.json | sort | tee /tmp/team_members.txt
|
||||
jq --raw-output .[] < /tmp/reviewers.json | sort | tee /tmp/reviewers.txt
|
||||
|
||||
# Fetch requested team reviewers, and the name of the team
|
||||
echo '${{ tojson(github.event.pull_request.requested_teams[*].slug) }}' | tee /tmp/team_reviewers.json
|
||||
jq --raw-output .[] < /tmp/team_reviewers.json | sort | tee /tmp/team_reviewers.txt
|
||||
echo '${{ env.TEAM }}' | tee /tmp/team.txt
|
||||
|
||||
# If either a reviewer matches a team member, or a team matches our team, say "true"
|
||||
if [ $(join /tmp/team_members.txt /tmp/reviewers.txt | wc -l) != 0 ]; then
|
||||
echo "match=true" >> $GITHUB_OUTPUT
|
||||
elif [ $(join /tmp/team.txt /tmp/team_reviewers.txt | wc -l) != 0 ]; then
|
||||
echo "match=true" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "match=false" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
env:
|
||||
TEAM: "product"
|
||||
- uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
|
||||
id: add_to_project
|
||||
if: steps.any_matching_reviewers.outputs.match == 'true'
|
||||
with:
|
||||
headers: '{"GraphQL-Features": "projects_next_graphql"}'
|
||||
query: |
|
||||
mutation add_to_project($projectid:ID!, $contentid:ID!) {
|
||||
addProjectV2ItemById(input: {projectId: $projectid contentId: $contentid}) {
|
||||
item {
|
||||
id
|
||||
}
|
||||
}
|
||||
}
|
||||
projectid: ${{ env.PROJECT_ID }}
|
||||
contentid: ${{ github.event.pull_request.node_id }}
|
||||
env:
|
||||
PROJECT_ID: "PVT_kwDOAM0swc4AAg6N"
|
||||
TEAM: "product"
|
||||
GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
@@ -1,29 +0,0 @@
|
||||
name: Close stale issues & PRs
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
schedule:
|
||||
- cron: "30 1 * * *"
|
||||
permissions: {}
|
||||
jobs:
|
||||
close:
|
||||
runs-on: ubuntu-24.04
|
||||
permissions:
|
||||
actions: write
|
||||
issues: write
|
||||
pull-requests: write
|
||||
steps:
|
||||
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
|
||||
with:
|
||||
operations-per-run: 100
|
||||
|
||||
# Flaky test issue closing
|
||||
any-of-issue-labels: "Z-Flaky-Test-Chrome,Z-Flaky-Test-Firefox,Z-Flaky-Test-Webkit"
|
||||
days-before-issue-stale: 14
|
||||
days-before-issue-close: 0
|
||||
close-issue-message: "This flaky test issue has not been updated in 14 days. It is being closed as presumed resolved."
|
||||
exempt-issue-labels: "Z-Flaky-Test-Disabled"
|
||||
|
||||
# Stale PR closing
|
||||
days-before-pr-stale: 180
|
||||
days-before-pr-close: 0
|
||||
close-pr-message: "This PR has been automatically closed because it has been stale for 180 days. If you wish to continue working on this PR, please ping a maintainer to reopen it."
|
||||
@@ -1,54 +0,0 @@
|
||||
name: Move unlabelled from needs info columns to triaged
|
||||
|
||||
on:
|
||||
issues:
|
||||
types: [unlabeled]
|
||||
permissions: {}
|
||||
jobs:
|
||||
move_no_longer_needs_info_issues:
|
||||
name: Move no longer X-Needs-Info issues to Triaged
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
!contains(github.event.issue.labels.*.name, 'X-Needs-Info')
|
||||
steps:
|
||||
- id: set_fields
|
||||
uses: nipe0324/update-project-v2-item-field@c4af58452d1c5a788c1ea4f20e073fa722ec4a6b #v2.0.2
|
||||
with:
|
||||
project-url: ${{ env.PROJECT_URL }}
|
||||
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
skip-update-script: |
|
||||
const isIssue = item.type === 'ISSUE'
|
||||
const status = item.fieldValues['Status']
|
||||
return !isIssue || status !== 'Needs info'
|
||||
field-name: Status
|
||||
field-value: "Triaged"
|
||||
env:
|
||||
PROJECT_URL: https://github.com/orgs/element-hq/projects/120
|
||||
|
||||
remove_Z-Labs_label:
|
||||
name: Remove Z-Labs label when features behind labs flags are removed
|
||||
runs-on: ubuntu-24.04
|
||||
if: >
|
||||
!(contains(github.event.issue.labels.*.name, 'A-Maths') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Message-Pinning') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Location-Sharing') ||
|
||||
contains(github.event.issue.labels.*.name, 'Z-IA') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Jump-To-Date') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Themes-Custom') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-E2EE-Dehydration') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Tags') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Video-Rooms') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Message-Starring') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Rich-Text-Editor') ||
|
||||
contains(github.event.issue.labels.*.name, 'A-Element-Call')) &&
|
||||
contains(github.event.issue.labels.*.name, 'Z-Labs')
|
||||
steps:
|
||||
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
|
||||
with:
|
||||
script: |
|
||||
github.rest.issues.removeLabel({
|
||||
issue_number: context.issue.number,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: ['Z-Labs']
|
||||
})
|
||||
@@ -1,37 +0,0 @@
|
||||
# Re-fetches the Jitsi SDK and opens a PR to update it if it's different from what's in the repository
|
||||
name: Update Jitsi
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
schedule:
|
||||
- cron: "0 3 * * 0" # 3am every Sunday
|
||||
permissions: {} # We use ELEMENT_BOT_TOKEN instead
|
||||
jobs:
|
||||
update:
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
cache: "pnpm"
|
||||
node-version: "lts/*"
|
||||
|
||||
- name: Install Deps
|
||||
run: "pnpm install --frozen-lockfile"
|
||||
|
||||
- name: Fetch Jitsi
|
||||
working-directory: apps/web
|
||||
run: "pnpm vendor:jitsi"
|
||||
|
||||
- name: Create Pull Request
|
||||
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
|
||||
with:
|
||||
token: ${{ secrets.ELEMENT_BOT_TOKEN }}
|
||||
branch: actions/jitsi-update
|
||||
delete-branch: true
|
||||
title: Jitsi Update
|
||||
labels: |
|
||||
T-Task
|
||||
@@ -1,119 +0,0 @@
|
||||
name: Update release topics
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
expected_status:
|
||||
description: What type of release is the next expected release
|
||||
required: true
|
||||
default: RC
|
||||
type: choice
|
||||
options:
|
||||
- RC
|
||||
- Release
|
||||
expected_date:
|
||||
description: Expected release date e.g. July 11th
|
||||
required: true
|
||||
type: string
|
||||
concurrency: ${{ github.workflow }}
|
||||
permissions: {} # No permissions required
|
||||
jobs:
|
||||
bot:
|
||||
name: Release topic update
|
||||
runs-on: ubuntu-24.04
|
||||
environment: Matrix
|
||||
steps:
|
||||
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
|
||||
env:
|
||||
HS_URL: ${{ secrets.BETABOT_HS_URL }}
|
||||
LOBBY_ROOM_ID: ${{ secrets.ROOM_ID }}
|
||||
PUBLIC_DISCUSSION_ROOM_ID: "!xUW4PpAe1CmThA3r2wI8IrgwwsK006-zqWdJCljpd10"
|
||||
ANNOUNCEMENT_ROOM_ID: "!ars5ndgI6IIYZXECiJ-u8YljHNzShJn3nHdB-3rYI2M"
|
||||
TOKEN: ${{ secrets.BETABOT_ACCESS_TOKEN }}
|
||||
RELEASE_STATUS: "Release status: ${{ inputs.expected_status }} expected ${{ inputs.expected_date }}"
|
||||
with:
|
||||
script: |
|
||||
const { HS_URL, TOKEN, RELEASE_STATUS, LOBBY_ROOM_ID, PUBLIC_DISCUSSION_ROOM_ID, ANNOUNCEMENT_ROOM_ID } = process.env;
|
||||
|
||||
const repo = context.repo;
|
||||
const { data } = await github.rest.repos.getLatestRelease({
|
||||
owner: repo.owner,
|
||||
repo: repo.repo,
|
||||
});
|
||||
console.log("Found latest version: " + data.tag_name);
|
||||
|
||||
const releaseTopic = `Stable: ${data.tag_name} | ${RELEASE_STATUS}`;
|
||||
console.log("Release topic: " + releaseTopic);
|
||||
|
||||
const regex = /Stable: v(.+) \| Release status: (\w+) expected (\w+ \d+\w\w)/gm;
|
||||
|
||||
async function updateReleaseInTopic(roomId) {
|
||||
const apiUrl = `${HS_URL}/_matrix/client/v3/rooms/${roomId}/state/m.room.topic/`;
|
||||
const headers = {
|
||||
"Content-Type": "application/json",
|
||||
"Authorization": `Bearer ${TOKEN}`,
|
||||
};
|
||||
await fetch(`${HS_URL}/_matrix/client/v3/rooms/${roomId}/join`, {
|
||||
method: "POST",
|
||||
headers,
|
||||
body: "{}",
|
||||
});
|
||||
|
||||
let res = await fetch(apiUrl, {
|
||||
method: "GET",
|
||||
headers,
|
||||
});
|
||||
|
||||
if (!res.ok) {
|
||||
console.log(roomId, "failed to fetch", await res.text());
|
||||
return;
|
||||
}
|
||||
|
||||
const data = await res.json();
|
||||
console.log(roomId, "got event", data);
|
||||
|
||||
if (!regex.test(data.topic)) {
|
||||
core.setFailed("Topic format is incorrect for room " + roomId);
|
||||
return;
|
||||
}
|
||||
|
||||
const topic = data.topic.replace(regex, releaseTopic);
|
||||
if (topic === data.topic) {
|
||||
console.log(roomId, "nothing to do");
|
||||
return;
|
||||
}
|
||||
if (data["org.matrix.msc3765.topic"]) {
|
||||
data["org.matrix.msc3765.topic"]?.["m.text"].forEach(d => {
|
||||
d.body = d.body.replace(regex, releaseTopic);
|
||||
});
|
||||
}
|
||||
if (data["m.topic"]) {
|
||||
data["m.topic"]?.["m.text"].forEach(d => {
|
||||
d.body = d.body.replace(regex, releaseTopic);
|
||||
});
|
||||
}
|
||||
|
||||
res = await fetch(apiUrl, {
|
||||
method: "PUT",
|
||||
body: JSON.stringify({
|
||||
...data,
|
||||
topic,
|
||||
}),
|
||||
headers,
|
||||
});
|
||||
|
||||
if (res.ok) {
|
||||
const resJson = res.json();
|
||||
if (resJson.errcode) {
|
||||
core.setFailed(`Error updating ${roomId}: ${resJson.error}`);
|
||||
} else {
|
||||
console.log(roomId, "topic updated:", topic);
|
||||
}
|
||||
} else {
|
||||
const errText = await res.text();
|
||||
core.setFailed(`Error updating ${roomId}: ${errText}`);
|
||||
}
|
||||
}
|
||||
|
||||
await updateReleaseInTopic(LOBBY_ROOM_ID);
|
||||
await updateReleaseInTopic(PUBLIC_DISCUSSION_ROOM_ID);
|
||||
await updateReleaseInTopic(ANNOUNCEMENT_ROOM_ID);
|
||||
+268
@@ -0,0 +1,268 @@
|
||||
# GitLab-CI fuer den ThreadNet-Web-Fork (Lab-GitLab: git.lab).
|
||||
# Ersetzt die frueheren GitHub/Gitea-Actions-Workflows - Hintergrund: docs/axion1337-fork.md.
|
||||
#
|
||||
# Erkenntnisse aus den Gitea-CI-Versuchen (2026-07-30), hier eingeflossen:
|
||||
# - kein scripts/layered.sh: wuerde den gepinnten matrix-js-sdk-Stand aus pnpm-lock.yaml
|
||||
# mit Upstream-develop ueberschreiben (und braucht jq) -> frozen-lockfile-Install
|
||||
# - webpack braucht ~4 GB Heap -> NODE_OPTIONS
|
||||
# - Desktop-Build laeuft im dockerbuild-Image (rust:bullseye + node, glibc-2.31-Ziel)
|
||||
|
||||
stages:
|
||||
- build
|
||||
- package
|
||||
|
||||
# --- Windows-Runner-VM-Steuerung (Issue #5) ---------------------------------
|
||||
# Die Windows-Build-VM (dockur/windows-Fork, siehe git.lab/axion1337.chat/vendor/windows,
|
||||
# Runbook: docs/axion-runner.md dort) laeuft on-demand auf Overmind. Diese beiden Jobs
|
||||
# starten/stoppen sie vom Linux-Runner aus ueber den Docker-Socket - der
|
||||
# desktop_windows-Job wartet danach einfach in der Queue, bis der Runner online ist.
|
||||
|
||||
start_windows_vm:
|
||||
stage: build
|
||||
image: docker:27-cli
|
||||
rules:
|
||||
- if: $CI_COMMIT_TAG =~ /^v/
|
||||
when: manual
|
||||
allow_failure: true
|
||||
- if: $CI_COMMIT_BRANCH == "main"
|
||||
when: manual
|
||||
allow_failure: true
|
||||
script:
|
||||
- docker start windows-runner
|
||||
|
||||
stop_windows_vm:
|
||||
stage: package
|
||||
image: docker:27-cli
|
||||
rules:
|
||||
- if: $CI_COMMIT_TAG =~ /^v/
|
||||
when: manual
|
||||
allow_failure: true
|
||||
- if: $CI_COMMIT_BRANCH == "main"
|
||||
when: manual
|
||||
allow_failure: true
|
||||
script:
|
||||
- docker stop windows-runner
|
||||
|
||||
# CVE-Scan des eigenen Prod-Images (gitops#31): woechentlich per Schedule und
|
||||
# manuell triggerbar. Bricht bewusst nicht hart ab (allow_failure) - Funde landen
|
||||
# als Artifact + Job-Log, die Bewertung bleibt menschlich. Lab-interne Images
|
||||
# (desktop-build, windows-vm) brauchen erst CA-Trust im Trivy-Container - notiert
|
||||
# in gitops#31 als Ausbaustufe.
|
||||
trivy_scan:
|
||||
stage: build
|
||||
image:
|
||||
name: aquasec/trivy:0.58.2
|
||||
entrypoint: [""]
|
||||
rules:
|
||||
- if: $CI_PIPELINE_SOURCE == "schedule"
|
||||
allow_failure: true
|
||||
- if: $CI_COMMIT_BRANCH == "main"
|
||||
when: manual
|
||||
allow_failure: true
|
||||
variables:
|
||||
GIT_STRATEGY: none
|
||||
TRIVY_NO_PROGRESS: "true"
|
||||
script:
|
||||
- trivy image --severity HIGH,CRITICAL --format table --output trivy-web.txt rohana.axion1337.de/sorb/threadnet-web:latest-ci
|
||||
- grep -E "Total|CRITICAL|HIGH" trivy-web.txt | head -20 || true
|
||||
artifacts:
|
||||
paths:
|
||||
- trivy-web.txt
|
||||
expire_in: 30 days
|
||||
when: always
|
||||
|
||||
web:
|
||||
stage: build
|
||||
image: node:24-bullseye
|
||||
rules:
|
||||
# Release-Tags bauen immer (docker_web/desktop_* brauchen web als needs)
|
||||
- if: $CI_COMMIT_TAG =~ /^v/
|
||||
# Scheduled Pipelines gehoeren dem trivy_scan - kein wochentlicher Leerbuild
|
||||
- if: $CI_PIPELINE_SOURCE == "schedule"
|
||||
when: never
|
||||
# Pushes nur, wenn build-relevante Pfade betroffen sind - Doku-Commits kosten nichts
|
||||
- if: $CI_COMMIT_BRANCH
|
||||
changes:
|
||||
- apps/**/*
|
||||
- packages/**/*
|
||||
- patches/**/*
|
||||
- scripts/**/*
|
||||
- pnpm-lock.yaml
|
||||
- pnpm-workspace.yaml
|
||||
- .gitlab-ci.yml
|
||||
variables:
|
||||
NODE_OPTIONS: "--max-old-space-size=6144"
|
||||
CI_PACKAGE: "true"
|
||||
before_script:
|
||||
- corepack enable
|
||||
script:
|
||||
- pnpm install --frozen-lockfile
|
||||
- cp apps/web/element.io/develop/config.json apps/web/config.json
|
||||
- VERSION=$(scripts/get-version-from-git.sh) pnpm --dir apps/web build
|
||||
artifacts:
|
||||
paths:
|
||||
- apps/web/webapp
|
||||
expire_in: 1 day
|
||||
|
||||
# Baut das kanonische Web-Image (apps/web/Dockerfile, Kontext = Monorepo-Root) und pusht
|
||||
# es in die rohana-Registry, aus der Flux/k8s zieht. Deploy bleibt ein manueller Tag-Bump
|
||||
# im gitops-Repo. Bewusster Doppel-Build (webpack laeuft im web-Job UND im Dockerfile) -
|
||||
# kanonisch/reproduzierbar vor schnell; Optimierung als Folgearbeit in Issue #2.
|
||||
docker_web:
|
||||
stage: package
|
||||
image: docker:27-cli
|
||||
needs:
|
||||
- job: web
|
||||
artifacts: false
|
||||
rules:
|
||||
# Nur bei Release-Tags (v*) - "releasen" ist ein bewusster Akt:
|
||||
# Tag pushen -> Image entsteht -> Tag-Bump im gitops-Repo deployt es
|
||||
- if: $CI_COMMIT_TAG =~ /^v/
|
||||
variables:
|
||||
IMAGE: rohana.axion1337.de/sorb/threadnet-web
|
||||
DOCKER_BUILDKIT: "1"
|
||||
script:
|
||||
- echo "$REGISTRY_PASSWORD" | docker login rohana.axion1337.de -u "$REGISTRY_USER" --password-stdin
|
||||
- docker build -f apps/web/Dockerfile -t "$IMAGE:$CI_COMMIT_TAG" -t "$IMAGE:latest-ci" .
|
||||
- docker push "$IMAGE:$CI_COMMIT_TAG"
|
||||
- docker push "$IMAGE:latest-ci"
|
||||
|
||||
# Einmalig/selten: Build-Image fuer den Desktop-Build (rust:bullseye + node + tcl/sqlcipher,
|
||||
# aus apps/desktop/dockerbuild). Manuell ausloesen, wenn sich .node-version oder das
|
||||
# Dockerfile aendert.
|
||||
desktop_image:
|
||||
stage: package
|
||||
image: docker:27-cli
|
||||
rules:
|
||||
- if: $CI_COMMIT_BRANCH == "main"
|
||||
when: manual
|
||||
allow_failure: true
|
||||
variables:
|
||||
# Lab-Registry statt rohana (OVERMIND-01): Konsument ist nur die Lab-CI selbst
|
||||
IMAGE: $CI_REGISTRY_IMAGE/desktop-build
|
||||
script:
|
||||
- echo "$CI_JOB_TOKEN" | docker login "$CI_REGISTRY" -u gitlab-ci-token --password-stdin
|
||||
- docker build -f apps/desktop/dockerbuild/Dockerfile -t "$IMAGE:bullseye" apps/desktop
|
||||
- docker push "$IMAGE:bullseye"
|
||||
|
||||
# Electron-Linux-Build (amd64, static sqlcipher) - repliziert den am 2026-07-29 manuell
|
||||
# verifizierten Build-Weg. Automatisch bei Release-Tags, auf main manuell triggerbar.
|
||||
desktop_linux:
|
||||
stage: package
|
||||
image: registry.git.lab/axion1337.chat/threadnet-web/desktop-build:bullseye
|
||||
needs:
|
||||
- job: web
|
||||
artifacts: true
|
||||
rules:
|
||||
- if: $CI_COMMIT_TAG =~ /^v/
|
||||
- if: $CI_COMMIT_BRANCH == "main"
|
||||
when: manual
|
||||
allow_failure: true
|
||||
variables:
|
||||
MAX_GLIBC: "2.31"
|
||||
USE_HARD_LINKS: "false"
|
||||
SQLCIPHER_BUNDLED: "1"
|
||||
script:
|
||||
- pnpm install --frozen-lockfile --filter element-desktop
|
||||
- cp -r apps/web/webapp apps/desktop/webapp
|
||||
# Produktions-Client-Config (getrackt seit diesem Commit, vorher nur im manuellen Build)
|
||||
- cp apps/desktop/axion1337/config.json apps/desktop/webapp/config.json
|
||||
- cd apps/desktop
|
||||
- pnpm run asar-webapp
|
||||
- pnpm run build:native
|
||||
# pnpm/npm setzen beim Install kein Executable-Bit auf 7za - bekannter Fix,
|
||||
# gleicher Schritt wie in der Upstream-CI ("Fix permissions")
|
||||
- chmod +x ../../node_modules/7zip-bin/linux/*/7za || true
|
||||
- pnpm run build --publish never -l tar.gz -l deb
|
||||
artifacts:
|
||||
paths:
|
||||
- apps/desktop/dist/*.deb
|
||||
- apps/desktop/dist/*.tar.gz
|
||||
expire_in: 1 week
|
||||
|
||||
# Windows-Desktop-Build (x64, unsigniert - Signing siehe Issue #5). Laeuft NUR auf dem
|
||||
# Windows-Runner (tags), manuell: vorher start_windows_vm ausloesen. Uebersetzt aus dem
|
||||
# Upstream-Workflow build_desktop_windows.yaml (x64-Pfad; arm-only-Schritte entfallen).
|
||||
desktop_windows:
|
||||
stage: package
|
||||
tags:
|
||||
- windows
|
||||
needs:
|
||||
- job: web
|
||||
artifacts: true
|
||||
rules:
|
||||
- if: $CI_COMMIT_TAG =~ /^v/
|
||||
when: manual
|
||||
allow_failure: true
|
||||
- if: $CI_COMMIT_BRANCH == "main"
|
||||
when: manual
|
||||
allow_failure: true
|
||||
variables:
|
||||
SQLCIPHER_BUNDLED: "1"
|
||||
ELECTRON_CACHE: C:\electron-cache
|
||||
ELECTRON_BUILDER_CACHE: C:\eb-cache
|
||||
script:
|
||||
- pnpm install --frozen-lockfile --filter element-desktop
|
||||
# GitHub-CDN-Downloads (Electron-Binary, winCodeSign, NSIS) reissen im Gast
|
||||
# reproduzierbar ab und app-builder kann nicht fortsetzen (Jobs 415/416/424) -
|
||||
# das Skript laedt alles resumefaehig in die persistenten Caches vor.
|
||||
- powershell -ExecutionPolicy Bypass -File apps\desktop\axion1337\prefetch-buildcache.ps1
|
||||
- Copy-Item -Recurse apps/web/webapp apps/desktop/webapp
|
||||
- Copy-Item apps/desktop/axion1337/config.json apps/desktop/webapp/config.json -Force
|
||||
- cd apps/desktop
|
||||
- pnpm run asar-webapp
|
||||
- '& "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\Common7\Tools\Launch-VsDevShell.ps1" -Arch amd64 -SkipAutomaticLocation'
|
||||
- pnpm run build:native --target x86_64-pc-windows-msvc
|
||||
- pnpm run build --publish never -w nsis
|
||||
artifacts:
|
||||
paths:
|
||||
- apps/desktop/dist/*.exe
|
||||
expire_in: 1 week
|
||||
|
||||
# Idempotente Werkzeug-Provisionierung im Windows-Gast (laeuft als SYSTEM ueber den
|
||||
# Runner selbst - kein noVNC/RDP noetig). Hintergrund: choco akzeptiert --version nicht
|
||||
# bei Mehrfach-Paketen, der urspruengliche Runbook-Einzeiler hat still nichts installiert.
|
||||
# Startet am Ende den Runner-Dienst verzoegert neu, damit der neue PATH fuer
|
||||
# Folge-Jobs greift (der Job selbst wird davon nicht mehr unterbrochen).
|
||||
windows_provision:
|
||||
stage: build
|
||||
tags:
|
||||
- windows
|
||||
rules:
|
||||
- if: $CI_COMMIT_BRANCH == "main"
|
||||
when: manual
|
||||
allow_failure: true
|
||||
variables:
|
||||
# Kein Checkout - der braeuchte git, das dieser Job erst installiert (Henne-Ei)
|
||||
GIT_STRATEGY: none
|
||||
script:
|
||||
- choco install -y git
|
||||
- choco install -y nasm
|
||||
- choco install -y magicsplat-tcl-tk
|
||||
- choco install -y nodejs --version=24.15.0
|
||||
# Fuer den seshat-hak-Build (hak/matrix-seshat/check.ts): perl+patch (Strawberry
|
||||
# liefert beides, patch.exe in C:\Strawberry\c\bin), python (node-gyp), rustc.
|
||||
- choco install -y strawberryperl
|
||||
- choco install -y python3
|
||||
# Rust maschinenweit statt Benutzerprofil: der Runner-Dienst laeuft als SYSTEM und
|
||||
# sieht nur die Maschinen-Umgebung - ein Default-rustup unter %USERPROFILE% waere
|
||||
# fuer Jobs unsichtbar.
|
||||
- $env:RUSTUP_HOME='C:\Rust\rustup'; $env:CARGO_HOME='C:\Rust\cargo'; Invoke-WebRequest -UseBasicParsing https://win.rustup.rs/x86_64 -OutFile "$env:TEMP\rustup-init.exe"
|
||||
- '& "$env:TEMP\rustup-init.exe" -y --profile minimal --default-toolchain stable --default-host x86_64-pc-windows-msvc'
|
||||
- '[Environment]::SetEnvironmentVariable(''RUSTUP_HOME'',''C:\Rust\rustup'',''Machine'')'
|
||||
- '[Environment]::SetEnvironmentVariable(''CARGO_HOME'',''C:\Rust\cargo'',''Machine'')'
|
||||
# choco-nasm traegt sich nicht selbst in den PATH ein (Upstream macht das auch
|
||||
# explizit via GITHUB_PATH) - zusammen mit cargo\bin hier maschinenweit nachziehen
|
||||
- $mp=[Environment]::GetEnvironmentVariable('Path','Machine'); if ($mp -notlike '*C:\Rust\cargo\bin*') { [Environment]::SetEnvironmentVariable('Path', "$mp;C:\Rust\cargo\bin;C:\Program Files\NASM", 'Machine') }
|
||||
- refreshenv; corepack enable
|
||||
- '& "C:\Program Files\Git\cmd\git.exe" --version'
|
||||
- '& "C:\Program Files\nodejs\node.exe" --version'
|
||||
- '& C:\Rust\cargo\bin\rustc.exe --version'
|
||||
# Windows-260-Zeichen-Pfadlimit: die Visual-Baseline-Pfade des Monorepos sprengen
|
||||
# MAX_PATH - beide Schalter noetig (git-seitig + OS-Policy)
|
||||
- '& "C:\Program Files\Git\cmd\git.exe" config --system core.longpaths true'
|
||||
- Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name LongPathsEnabled -Value 1 -Type DWord
|
||||
# Dienst-Neustart als Scheduled Task: ueberlebt das Prozessbaum-Cleanup des Runners
|
||||
# beim Job-Ende (der fruehere Start-Process-Trick wurde dabei gekillt und liess den
|
||||
# Dienst gestoppt zurueck - Vorfall 2026-07-31, siehe ThreadNet-Web#5).
|
||||
- schtasks /create /f /tn RunnerRestart /ru SYSTEM /sc once /st ((Get-Date).AddMinutes(1).ToString('HH:mm')) /tr "powershell -Command Restart-Service gitlab-runner -Force"
|
||||
@@ -7,6 +7,12 @@
|
||||
[](https://sonarcloud.io/summary/new_code?id=element-web)
|
||||
[](https://sonarcloud.io/summary/new_code?id=element-web)
|
||||
|
||||
> **ThreadNet-Web**: this is a fork of Element Web, customized for the self-hosted
|
||||
> [axion1337.chat](https://axion1337.chat) Matrix homeserver. See
|
||||
> [docs/axion1337-fork.md](docs/axion1337-fork.md) for everything this fork changes versus
|
||||
> upstream (Discord-style room list, client-side ClamAV content scanning, build fixes). The
|
||||
> rest of this README describes upstream Element Web and is intentionally left as-is.
|
||||
|
||||
# Element
|
||||
|
||||
Element (formerly known as Vector and Riot) is a Matrix web & desktop client built using the [Matrix
|
||||
|
||||
@@ -0,0 +1,649 @@
|
||||
{
|
||||
"brand": "aXion1337.Chat",
|
||||
"default_server_config": {
|
||||
"m.homeserver": {
|
||||
"base_url": "https://matrix.axion1337.chat",
|
||||
"server_name": "axion1337.chat"
|
||||
}
|
||||
},
|
||||
"default_theme": "aXion1337 Dark",
|
||||
"element_call": {
|
||||
"use_exclusively": true
|
||||
},
|
||||
"embedded_pages": {
|
||||
"login_for_welcome": true
|
||||
},
|
||||
"features": {
|
||||
"feature_element_call_video_rooms": true,
|
||||
"feature_group_calls": true,
|
||||
"feature_new_room_decoration_ui": true,
|
||||
"feature_new_room_list": true,
|
||||
"feature_qr_code_login": true,
|
||||
"feature_video_rooms": true
|
||||
},
|
||||
"map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx",
|
||||
"mobile_guide_app_variant": "element",
|
||||
"setting_defaults": {
|
||||
"UIFeature.deactivate": false,
|
||||
"UIFeature.passwordReset": false,
|
||||
"UIFeature.registration": false,
|
||||
"custom_themes": [
|
||||
{
|
||||
"colors": {
|
||||
"accent-color": "#ffaf0f",
|
||||
"primary-color": "#ffaf0f",
|
||||
"secondary-color": "#ffaf0f"
|
||||
},
|
||||
"is_dark": true,
|
||||
"name": "aXion1337 Dark true"
|
||||
},
|
||||
{
|
||||
"colors": {
|
||||
"accent-color": "#6503b3",
|
||||
"primary-color": "#368bd6",
|
||||
"roomlist-background-color": "#22262E",
|
||||
"roomlist-highlights-color": "#343A46",
|
||||
"roomlist-separator-color": "#a1b2d1",
|
||||
"roomlist-text-color": "#A1B2D1",
|
||||
"roomlist-text-secondary-color": "#EDF3FF",
|
||||
"sidebar-color": "#15171B",
|
||||
"timeline-background-color": "#181b21",
|
||||
"timeline-highlights-color": "#22262E",
|
||||
"timeline-text-color": "#EDF3FF",
|
||||
"timeline-text-secondary-color": "#A1B2D1",
|
||||
"warning-color": "#b30356"
|
||||
},
|
||||
"is_dark": true,
|
||||
"name": "Deep Purple"
|
||||
},
|
||||
{
|
||||
"colors": {
|
||||
"accent": "#747ff4",
|
||||
"accent-color": "#747ff4",
|
||||
"alert": "#faa81ad9",
|
||||
"focus-bg-color": "#4752c4",
|
||||
"menu-selected-color": "#4752c4",
|
||||
"other-user-pill-bg-color": "#4752c4",
|
||||
"primary-color": "#00aff4",
|
||||
"reaction-row-button-selected-bg-color": "#4752c4",
|
||||
"room-highlight-color": "#4752c4",
|
||||
"roomlist-background-color": "#2f3136",
|
||||
"roomlist-highlights-color": "#4f545c52",
|
||||
"roomlist-separator-color": "#40444b",
|
||||
"roomlist-text-color": "#dcddde",
|
||||
"roomlist-text-secondary-color": "#8e9297",
|
||||
"secondary-content": "#dcddde",
|
||||
"sidebar-color": "#202225",
|
||||
"tertiary-content": "#dcddde",
|
||||
"timeline-background-color": "#36393f",
|
||||
"timeline-highlights-color": "#04040512",
|
||||
"timeline-text-color": "#dcddde",
|
||||
"timeline-text-secondary-color": "#b9bbbe",
|
||||
"togglesw-off-color": "#72767d",
|
||||
"warning-color": "#faa81ad9"
|
||||
},
|
||||
"compound": {
|
||||
"--cpd-color-bg-accent-rest": "#4cb387",
|
||||
"--cpd-color-bg-action-primary-rest": "#dcddde",
|
||||
"--cpd-color-bg-action-secondary-rest": "#2f3136",
|
||||
"--cpd-color-bg-canvas-default": "#2f3136",
|
||||
"--cpd-color-bg-critical-hovered": "#fd3f3c",
|
||||
"--cpd-color-bg-critical-primary": "#fd3f3c",
|
||||
"--cpd-color-bg-critical-subtle": "#745862",
|
||||
"--cpd-color-bg-subtle-primary": "#4f545c52",
|
||||
"--cpd-color-bg-subtle-secondary": "#2f3136",
|
||||
"--cpd-color-border-critical-primary": "#fd3f3c",
|
||||
"--cpd-color-border-interactive-primary": "#5d6064",
|
||||
"--cpd-color-border-interactive-secondary": "#5d6064",
|
||||
"--cpd-color-border-success-subtle": "#4cb387",
|
||||
"--cpd-color-icon-accent-tertiary": "#4cb387",
|
||||
"--cpd-color-icon-primary": "#dcddde",
|
||||
"--cpd-color-icon-secondary": "#dcddde",
|
||||
"--cpd-color-icon-tertiary": "#a7a0a7",
|
||||
"--cpd-color-text-action-accent": "#b9bbbe",
|
||||
"--cpd-color-text-critical-primary": "#fd3f3c",
|
||||
"--cpd-color-text-primary": "#dcddde",
|
||||
"--cpd-color-text-secondary": "#b9bbbe",
|
||||
"--cpd-color-text-success-primary": "#4cb387",
|
||||
"--cpd-color-theme-bg": "#0019ff"
|
||||
},
|
||||
"is_dark": true,
|
||||
"name": "Discord Dark"
|
||||
},
|
||||
{
|
||||
"colors": {
|
||||
"accent-color": "#3596fc",
|
||||
"avatar-background-colors": [
|
||||
"#cc0000",
|
||||
"#cc6600",
|
||||
"#cccc00",
|
||||
"#00cc00",
|
||||
"#0000cc",
|
||||
"#3b0066",
|
||||
"#7a00b3",
|
||||
"#cc1077"
|
||||
],
|
||||
"primary-color": "#368bd6",
|
||||
"roomlist-background-color": "#f3f8fd",
|
||||
"roomlist-highlights-color": "#ffffff",
|
||||
"roomlist-separator-color": "#e3e8f0",
|
||||
"roomlist-text-color": "#2e2f32",
|
||||
"roomlist-text-secondary-color": "#61708b",
|
||||
"sidebar-color": "#27303a",
|
||||
"timeline-background-color": "#ffffff",
|
||||
"timeline-highlights-color": "#f3f8fd",
|
||||
"timeline-text-color": "#2e2f32",
|
||||
"timeline-text-secondary-color": "#61708b",
|
||||
"username-colors": [
|
||||
"#ff0000",
|
||||
"#ff7f00",
|
||||
"#ffff00",
|
||||
"#00ff00",
|
||||
"#0000ff",
|
||||
"#4b0082",
|
||||
"#9400d3",
|
||||
"#ff1493"
|
||||
],
|
||||
"warning-color": "#ff4b55"
|
||||
},
|
||||
"compound": {
|
||||
"--cpd-color-icon-accent-tertiary": "var(--cpd-color-blue-800)",
|
||||
"--cpd-color-text-action-accent": "var(--cpd-color-blue-900)"
|
||||
},
|
||||
"is_dark": false,
|
||||
"name": "Electric Blue"
|
||||
},
|
||||
{
|
||||
"colors": {
|
||||
"accent-color": "#a7c080",
|
||||
"primary-color": "#a7c080",
|
||||
"reaction-row-button-selected-bg-color": "#4b565c",
|
||||
"roomlist-background-color": "#2f383e",
|
||||
"roomlist-highlights-color": "#4b565c",
|
||||
"roomlist-separator-color": "#4b565c",
|
||||
"roomlist-text-color": "#d3c6aa",
|
||||
"roomlist-text-secondary-color": "#d3c6aa",
|
||||
"secondary-content": "#d3c6aa",
|
||||
"sidebar-color": "#323d43",
|
||||
"tertiary-content": "#d3c6aa",
|
||||
"timeline-background-color": "#2b3339",
|
||||
"timeline-highlights-color": "#4b565c",
|
||||
"timeline-text-color": "#d3c6aa",
|
||||
"timeline-text-secondary-color": "#a7c080",
|
||||
"warning-color": "#e67e80"
|
||||
},
|
||||
"is_dark": true,
|
||||
"name": "Everforest dark hard"
|
||||
},
|
||||
{
|
||||
"colors": {
|
||||
"accent": "#689d6a",
|
||||
"accent-color": "#bd93f9",
|
||||
"alert": "#cc241d",
|
||||
"icon-button-color": "#928374",
|
||||
"menu-selected-color": "#504945",
|
||||
"primary-color": "#fe8019",
|
||||
"quinary-content": "#504945",
|
||||
"reaction-row-button-selected-bg-color": "#689d6a",
|
||||
"roomlist-background-color": "#1d2021",
|
||||
"roomlist-highlights-color": "#00000030",
|
||||
"roomlist-separator-color": "#4d4d4d90",
|
||||
"roomlist-text-color": "#a89984",
|
||||
"roomlist-text-secondary-color": "#00ff00",
|
||||
"secondary-content": "#928374",
|
||||
"sidebar-color": "#282828",
|
||||
"tertiary-content": "#928374",
|
||||
"timeline-background-color": "#282828",
|
||||
"timeline-highlights-color": "#00000030",
|
||||
"timeline-text-color": "#ebdbb2",
|
||||
"timeline-text-secondary-color": "#a89984",
|
||||
"username-colors": [
|
||||
"#cc241d",
|
||||
"#98971a",
|
||||
"#d79921",
|
||||
"#458588",
|
||||
"#b16286",
|
||||
"#689d6a",
|
||||
"#a89984",
|
||||
"#d65d0e"
|
||||
],
|
||||
"warning-color": "#fb4934"
|
||||
},
|
||||
"is_dark": true,
|
||||
"name": "aXion1337 Dark"
|
||||
},
|
||||
{
|
||||
"name": "aXion1337 Light",
|
||||
"is_dark": false,
|
||||
"colors": {
|
||||
"accent-color": "#8f3f71",
|
||||
"primary-color": "#af3a03",
|
||||
"warning-color": "#9d0006",
|
||||
"sidebar-color": "#ebdbb2",
|
||||
"roomlist-background-color": "#f2e5bc",
|
||||
"roomlist-text-color": "#665c54",
|
||||
"roomlist-text-secondary-color": "#427b58",
|
||||
"roomlist-highlights-color": "#00000012",
|
||||
"roomlist-separator-color": "#bdae9330",
|
||||
"timeline-background-color": "#fbf1c7",
|
||||
"timeline-text-color": "#3c3836",
|
||||
"secondary-content": "#7c6f64",
|
||||
"tertiary-content": "#7c6f64",
|
||||
"quinary-content": "#d5c4a1",
|
||||
"timeline-text-secondary-color": "#665c54",
|
||||
"timeline-highlights-color": "#00000012",
|
||||
"reaction-row-button-selected-bg-color": "#8ec07c",
|
||||
"menu-selected-color": "#d5c4a1",
|
||||
"icon-button-color": "#7c6f64",
|
||||
"accent": "#427b58",
|
||||
"alert": "#9d0006",
|
||||
"username-colors": [
|
||||
"#9d0006",
|
||||
"#79740e",
|
||||
"#b57614",
|
||||
"#076678",
|
||||
"#8f3f71",
|
||||
"#427b58",
|
||||
"#665c54",
|
||||
"#af3a03"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Ocean Depths",
|
||||
"is_dark": true,
|
||||
"colors": {
|
||||
"accent-color": "#2ec4b6",
|
||||
"accent": "#2ec4b6",
|
||||
"primary-color": "#48a9d8",
|
||||
"warning-color": "#e07a5f",
|
||||
"alert": "#e07a5f",
|
||||
"sidebar-color": "#071a26",
|
||||
"roomlist-background-color": "#0d2635",
|
||||
"roomlist-text-color": "#d6e6f2",
|
||||
"roomlist-text-secondary-color": "#8badc4",
|
||||
"roomlist-highlights-color": "#ffffff10",
|
||||
"roomlist-separator-color": "#ffffff20",
|
||||
"timeline-background-color": "#12303f",
|
||||
"timeline-text-color": "#d6e6f2",
|
||||
"secondary-content": "#8badc4",
|
||||
"tertiary-content": "#8badc4",
|
||||
"timeline-text-secondary-color": "#8badc4",
|
||||
"timeline-highlights-color": "#ffffff10",
|
||||
"reaction-row-button-selected-bg-color": "#1b4a63",
|
||||
"menu-selected-color": "#1b4a63",
|
||||
"focus-bg-color": "#1b4a63",
|
||||
"room-highlight-color": "#1b4a63",
|
||||
"other-user-pill-bg-color": "#1b4a63",
|
||||
"icon-button-color": "#8badc4",
|
||||
"username-colors": [
|
||||
"#2ec4b6",
|
||||
"#48a9d8",
|
||||
"#7fd1c1",
|
||||
"#e07a5f",
|
||||
"#a8d0e6",
|
||||
"#5c9ead",
|
||||
"#c9e4de",
|
||||
"#3d7ea6"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Sunset Boulevard",
|
||||
"is_dark": true,
|
||||
"colors": {
|
||||
"accent-color": "#ff6b6b",
|
||||
"accent": "#ff6b6b",
|
||||
"primary-color": "#ffa552",
|
||||
"warning-color": "#ff3f6b",
|
||||
"alert": "#ff3f6b",
|
||||
"sidebar-color": "#2b1424",
|
||||
"roomlist-background-color": "#3a1c2c",
|
||||
"roomlist-text-color": "#ffe8d6",
|
||||
"roomlist-text-secondary-color": "#e0a899",
|
||||
"roomlist-highlights-color": "#ffffff10",
|
||||
"roomlist-separator-color": "#ffffff20",
|
||||
"timeline-background-color": "#452133",
|
||||
"timeline-text-color": "#ffe8d6",
|
||||
"secondary-content": "#e0a899",
|
||||
"tertiary-content": "#e0a899",
|
||||
"timeline-text-secondary-color": "#e0a899",
|
||||
"timeline-highlights-color": "#ffffff10",
|
||||
"reaction-row-button-selected-bg-color": "#5c2b40",
|
||||
"menu-selected-color": "#5c2b40",
|
||||
"focus-bg-color": "#5c2b40",
|
||||
"room-highlight-color": "#5c2b40",
|
||||
"other-user-pill-bg-color": "#5c2b40",
|
||||
"icon-button-color": "#e0a899",
|
||||
"username-colors": [
|
||||
"#ff6b6b",
|
||||
"#ffa552",
|
||||
"#ffd166",
|
||||
"#ef476f",
|
||||
"#f78c6b",
|
||||
"#e56b6f",
|
||||
"#ff9770",
|
||||
"#c9184a"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Forest Canopy",
|
||||
"is_dark": true,
|
||||
"colors": {
|
||||
"accent-color": "#7fb069",
|
||||
"accent": "#7fb069",
|
||||
"primary-color": "#a3c9a8",
|
||||
"warning-color": "#c1666b",
|
||||
"alert": "#c1666b",
|
||||
"sidebar-color": "#14211a",
|
||||
"roomlist-background-color": "#1b2c22",
|
||||
"roomlist-text-color": "#e4e9d7",
|
||||
"roomlist-text-secondary-color": "#9db096",
|
||||
"roomlist-highlights-color": "#ffffff10",
|
||||
"roomlist-separator-color": "#ffffff20",
|
||||
"timeline-background-color": "#22372b",
|
||||
"timeline-text-color": "#e4e9d7",
|
||||
"secondary-content": "#9db096",
|
||||
"tertiary-content": "#9db096",
|
||||
"timeline-text-secondary-color": "#9db096",
|
||||
"timeline-highlights-color": "#ffffff10",
|
||||
"reaction-row-button-selected-bg-color": "#2f4a38",
|
||||
"menu-selected-color": "#2f4a38",
|
||||
"focus-bg-color": "#2f4a38",
|
||||
"room-highlight-color": "#2f4a38",
|
||||
"other-user-pill-bg-color": "#2f4a38",
|
||||
"icon-button-color": "#9db096",
|
||||
"username-colors": [
|
||||
"#7fb069",
|
||||
"#a3c9a8",
|
||||
"#588157",
|
||||
"#c1666b",
|
||||
"#b8c9a3",
|
||||
"#6a994e",
|
||||
"#a7c957",
|
||||
"#386641"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Modern Minimalist",
|
||||
"is_dark": false,
|
||||
"colors": {
|
||||
"accent-color": "#3d5a80",
|
||||
"accent": "#3d5a80",
|
||||
"primary-color": "#4a4a4a",
|
||||
"warning-color": "#8b1e3f",
|
||||
"alert": "#8b1e3f",
|
||||
"sidebar-color": "#f0f0f0",
|
||||
"roomlist-background-color": "#f7f7f7",
|
||||
"roomlist-text-color": "#1a1a1a",
|
||||
"roomlist-text-secondary-color": "#5c5c5c",
|
||||
"roomlist-highlights-color": "#00000010",
|
||||
"roomlist-separator-color": "#00000018",
|
||||
"timeline-background-color": "#ffffff",
|
||||
"timeline-text-color": "#1a1a1a",
|
||||
"secondary-content": "#5c5c5c",
|
||||
"tertiary-content": "#5c5c5c",
|
||||
"timeline-text-secondary-color": "#5c5c5c",
|
||||
"timeline-highlights-color": "#00000010",
|
||||
"reaction-row-button-selected-bg-color": "#e2e2e2",
|
||||
"menu-selected-color": "#e2e2e2",
|
||||
"focus-bg-color": "#e2e2e2",
|
||||
"room-highlight-color": "#e2e2e2",
|
||||
"other-user-pill-bg-color": "#e2e2e2",
|
||||
"icon-button-color": "#5c5c5c",
|
||||
"username-colors": [
|
||||
"#3d5a80",
|
||||
"#4a4a4a",
|
||||
"#6b6b6b",
|
||||
"#8b1e3f",
|
||||
"#2f3e46",
|
||||
"#52796f",
|
||||
"#84a98c",
|
||||
"#354f52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Golden Hour",
|
||||
"is_dark": true,
|
||||
"colors": {
|
||||
"accent-color": "#d4a017",
|
||||
"accent": "#d4a017",
|
||||
"primary-color": "#e8b04b",
|
||||
"warning-color": "#b5442f",
|
||||
"alert": "#b5442f",
|
||||
"sidebar-color": "#2a1f14",
|
||||
"roomlist-background-color": "#35281a",
|
||||
"roomlist-text-color": "#f2e3c9",
|
||||
"roomlist-text-secondary-color": "#c4a882",
|
||||
"roomlist-highlights-color": "#ffffff10",
|
||||
"roomlist-separator-color": "#ffffff20",
|
||||
"timeline-background-color": "#3f2f1f",
|
||||
"timeline-text-color": "#f2e3c9",
|
||||
"secondary-content": "#c4a882",
|
||||
"tertiary-content": "#c4a882",
|
||||
"timeline-text-secondary-color": "#c4a882",
|
||||
"timeline-highlights-color": "#ffffff10",
|
||||
"reaction-row-button-selected-bg-color": "#54402a",
|
||||
"menu-selected-color": "#54402a",
|
||||
"focus-bg-color": "#54402a",
|
||||
"room-highlight-color": "#54402a",
|
||||
"other-user-pill-bg-color": "#54402a",
|
||||
"icon-button-color": "#c4a882",
|
||||
"username-colors": [
|
||||
"#d4a017",
|
||||
"#e8b04b",
|
||||
"#c98a2e",
|
||||
"#b5442f",
|
||||
"#e0c068",
|
||||
"#a67c00",
|
||||
"#d98e04",
|
||||
"#8b5e00"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Arctic Frost",
|
||||
"is_dark": false,
|
||||
"colors": {
|
||||
"accent-color": "#3b9ec7",
|
||||
"accent": "#3b9ec7",
|
||||
"primary-color": "#5aa9d6",
|
||||
"warning-color": "#d1495b",
|
||||
"alert": "#d1495b",
|
||||
"sidebar-color": "#e3eef5",
|
||||
"roomlist-background-color": "#eef5f9",
|
||||
"roomlist-text-color": "#1c3d52",
|
||||
"roomlist-text-secondary-color": "#4a6f87",
|
||||
"roomlist-highlights-color": "#00000010",
|
||||
"roomlist-separator-color": "#00000018",
|
||||
"timeline-background-color": "#ffffff",
|
||||
"timeline-text-color": "#1c3d52",
|
||||
"secondary-content": "#4a6f87",
|
||||
"tertiary-content": "#4a6f87",
|
||||
"timeline-text-secondary-color": "#4a6f87",
|
||||
"timeline-highlights-color": "#00000010",
|
||||
"reaction-row-button-selected-bg-color": "#d3e6f0",
|
||||
"menu-selected-color": "#d3e6f0",
|
||||
"focus-bg-color": "#d3e6f0",
|
||||
"room-highlight-color": "#d3e6f0",
|
||||
"other-user-pill-bg-color": "#d3e6f0",
|
||||
"icon-button-color": "#4a6f87",
|
||||
"username-colors": [
|
||||
"#3b9ec7",
|
||||
"#5aa9d6",
|
||||
"#2a7ea3",
|
||||
"#d1495b",
|
||||
"#7fb3cc",
|
||||
"#1d5f7a",
|
||||
"#8ecae6",
|
||||
"#023e8a"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Desert Rose",
|
||||
"is_dark": false,
|
||||
"colors": {
|
||||
"accent-color": "#c08497",
|
||||
"accent": "#c08497",
|
||||
"primary-color": "#cc9b9b",
|
||||
"warning-color": "#b56576",
|
||||
"alert": "#b56576",
|
||||
"sidebar-color": "#eaddd9",
|
||||
"roomlist-background-color": "#f2e8e5",
|
||||
"roomlist-text-color": "#4a3b38",
|
||||
"roomlist-text-secondary-color": "#7d6660",
|
||||
"roomlist-highlights-color": "#00000010",
|
||||
"roomlist-separator-color": "#00000018",
|
||||
"timeline-background-color": "#fdfaf9",
|
||||
"timeline-text-color": "#4a3b38",
|
||||
"secondary-content": "#7d6660",
|
||||
"tertiary-content": "#7d6660",
|
||||
"timeline-text-secondary-color": "#7d6660",
|
||||
"timeline-highlights-color": "#00000010",
|
||||
"reaction-row-button-selected-bg-color": "#e0cdc7",
|
||||
"menu-selected-color": "#e0cdc7",
|
||||
"focus-bg-color": "#e0cdc7",
|
||||
"room-highlight-color": "#e0cdc7",
|
||||
"other-user-pill-bg-color": "#e0cdc7",
|
||||
"icon-button-color": "#7d6660",
|
||||
"username-colors": [
|
||||
"#c08497",
|
||||
"#cc9b9b",
|
||||
"#a3697c",
|
||||
"#b56576",
|
||||
"#d4a5a5",
|
||||
"#8d6a75",
|
||||
"#e0b1ab",
|
||||
"#6d4c52"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Tech Innovation",
|
||||
"is_dark": true,
|
||||
"colors": {
|
||||
"accent-color": "#00e5ff",
|
||||
"accent": "#00e5ff",
|
||||
"primary-color": "#7c4dff",
|
||||
"warning-color": "#ff1744",
|
||||
"alert": "#ff1744",
|
||||
"sidebar-color": "#0a0e14",
|
||||
"roomlist-background-color": "#111721",
|
||||
"roomlist-text-color": "#e6edf3",
|
||||
"roomlist-text-secondary-color": "#8b98a9",
|
||||
"roomlist-highlights-color": "#ffffff10",
|
||||
"roomlist-separator-color": "#ffffff20",
|
||||
"timeline-background-color": "#161d29",
|
||||
"timeline-text-color": "#e6edf3",
|
||||
"secondary-content": "#8b98a9",
|
||||
"tertiary-content": "#8b98a9",
|
||||
"timeline-text-secondary-color": "#8b98a9",
|
||||
"timeline-highlights-color": "#ffffff10",
|
||||
"reaction-row-button-selected-bg-color": "#1f2b3d",
|
||||
"menu-selected-color": "#1f2b3d",
|
||||
"focus-bg-color": "#1f2b3d",
|
||||
"room-highlight-color": "#1f2b3d",
|
||||
"other-user-pill-bg-color": "#1f2b3d",
|
||||
"icon-button-color": "#8b98a9",
|
||||
"username-colors": [
|
||||
"#00e5ff",
|
||||
"#7c4dff",
|
||||
"#00bfa5",
|
||||
"#ff1744",
|
||||
"#40c4ff",
|
||||
"#651fff",
|
||||
"#1de9b6",
|
||||
"#d500f9"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Botanical Garden",
|
||||
"is_dark": false,
|
||||
"colors": {
|
||||
"accent-color": "#4c9a5d",
|
||||
"accent": "#4c9a5d",
|
||||
"primary-color": "#6bb77b",
|
||||
"warning-color": "#d2691e",
|
||||
"alert": "#d2691e",
|
||||
"sidebar-color": "#e6f2e2",
|
||||
"roomlist-background-color": "#f0f8ed",
|
||||
"roomlist-text-color": "#23402c",
|
||||
"roomlist-text-secondary-color": "#4f6b56",
|
||||
"roomlist-highlights-color": "#00000010",
|
||||
"roomlist-separator-color": "#00000018",
|
||||
"timeline-background-color": "#ffffff",
|
||||
"timeline-text-color": "#23402c",
|
||||
"secondary-content": "#4f6b56",
|
||||
"tertiary-content": "#4f6b56",
|
||||
"timeline-text-secondary-color": "#4f6b56",
|
||||
"timeline-highlights-color": "#00000010",
|
||||
"reaction-row-button-selected-bg-color": "#d7ead2",
|
||||
"menu-selected-color": "#d7ead2",
|
||||
"focus-bg-color": "#d7ead2",
|
||||
"room-highlight-color": "#d7ead2",
|
||||
"other-user-pill-bg-color": "#d7ead2",
|
||||
"icon-button-color": "#4f6b56",
|
||||
"username-colors": [
|
||||
"#4c9a5d",
|
||||
"#6bb77b",
|
||||
"#2d6a4f",
|
||||
"#d2691e",
|
||||
"#95d5b2",
|
||||
"#40916c",
|
||||
"#b7e4c7",
|
||||
"#1b4332"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Midnight Galaxy",
|
||||
"is_dark": true,
|
||||
"colors": {
|
||||
"accent-color": "#b388ff",
|
||||
"accent": "#b388ff",
|
||||
"primary-color": "#7c4dff",
|
||||
"warning-color": "#ff4081",
|
||||
"alert": "#ff4081",
|
||||
"sidebar-color": "#0d0a1f",
|
||||
"roomlist-background-color": "#150f2e",
|
||||
"roomlist-text-color": "#e8e3ff",
|
||||
"roomlist-text-secondary-color": "#a396d4",
|
||||
"roomlist-highlights-color": "#ffffff10",
|
||||
"roomlist-separator-color": "#ffffff20",
|
||||
"timeline-background-color": "#1c1440",
|
||||
"timeline-text-color": "#e8e3ff",
|
||||
"secondary-content": "#a396d4",
|
||||
"tertiary-content": "#a396d4",
|
||||
"timeline-text-secondary-color": "#a396d4",
|
||||
"timeline-highlights-color": "#ffffff10",
|
||||
"reaction-row-button-selected-bg-color": "#2d2159",
|
||||
"menu-selected-color": "#2d2159",
|
||||
"focus-bg-color": "#2d2159",
|
||||
"room-highlight-color": "#2d2159",
|
||||
"other-user-pill-bg-color": "#2d2159",
|
||||
"icon-button-color": "#a396d4",
|
||||
"username-colors": [
|
||||
"#b388ff",
|
||||
"#7c4dff",
|
||||
"#8c9eff",
|
||||
"#ff4081",
|
||||
"#e1bee7",
|
||||
"#6a5acd",
|
||||
"#ce93d8",
|
||||
"#4527a0"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"feature_group_calls": true
|
||||
},
|
||||
"show_labs_settings": true,
|
||||
"sso_redirect_options": {
|
||||
"immediate": false
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
# Laedt die Build-Artefakte resumefaehig vor, die app-builder sonst selbst (ohne
|
||||
# Resume) von GitHub laedt: das CDN (185.199.109.x) reisst im Lab-Gast groessere
|
||||
# Transfers reproduzierbar mitten im Stream ab (Jobs 415/416/424, wsarecv-Reset).
|
||||
# curl -C - setzt nach jedem Abriss am letzten Byte fort; einmal geladen liegen
|
||||
# die Artefakte in den persistenten Caches (ELECTRON_CACHE/ELECTRON_BUILDER_CACHE)
|
||||
# und werden nie erneut geholt.
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
function Get-Resumable([string]$Url, [string]$Out) {
|
||||
foreach ($i in 1..8) {
|
||||
& curl.exe -sSL -C - -o $Out $Url
|
||||
if ($LASTEXITCODE -eq 0) { return }
|
||||
Start-Sleep 5
|
||||
}
|
||||
throw "Download nach 8 Versuchen gescheitert: $Url"
|
||||
}
|
||||
|
||||
# --- 1. Electron-Binary -> ELECTRON_CACHE ------------------------------------
|
||||
$pkg = Join-Path $PSScriptRoot '..\package.json'
|
||||
$ev = (& node -p "require(process.argv[1]).devDependencies.electron" $pkg) -replace '[\^~]', ''
|
||||
New-Item -ItemType Directory -Force $env:ELECTRON_CACHE | Out-Null
|
||||
$zip = Join-Path $env:ELECTRON_CACHE "electron-v$ev-win32-x64.zip"
|
||||
if (-not (Test-Path $zip)) {
|
||||
Get-Resumable "https://github.com/electron/electron/releases/download/v$ev/electron-v$ev-win32-x64.zip" "$zip.part"
|
||||
Move-Item -Force "$zip.part" $zip
|
||||
}
|
||||
|
||||
# --- 2. electron-builder-Werkzeuge -> ELECTRON_BUILDER_CACHE -----------------
|
||||
# Zielstruktur laut app-builder-Quellcode (artifactDownloader.go) + electron-builder
|
||||
# 26.9.1 (binDownload.js): der Cache-Schluessel ist "<release>-<dateiname-ohne-ext>",
|
||||
# also GEDOPPELT (z.B. nsis-3.0.4.1-nsis-3.0.4.1), und liegt unter dem Teil des
|
||||
# Namens VOR dem ersten Bindestrich als Unterverzeichnis - nsis-resources landet
|
||||
# deshalb ebenfalls unter nsis\. Job 431 bewies den Miss mit einfachem Namen.
|
||||
$sevenZa = Join-Path $PSScriptRoot '..\..\..\node_modules\7zip-bin\win\x64\7za.exe'
|
||||
function Get-EbArtifact([string]$Release, [string]$SubDir) {
|
||||
$dest = Join-Path $env:ELECTRON_BUILDER_CACHE (Join-Path $SubDir "$Release-$Release")
|
||||
if (Test-Path $dest) { return }
|
||||
$tmp = Join-Path $env:TEMP "$Release.7z"
|
||||
Get-Resumable "https://github.com/electron-userland/electron-builder-binaries/releases/download/$Release/$Release.7z" $tmp
|
||||
New-Item -ItemType Directory -Force $dest | Out-Null
|
||||
& $sevenZa x -y "-o$dest" $tmp | Out-Null
|
||||
if ($LASTEXITCODE -ne 0) { Remove-Item -Recurse -Force $dest; throw "Entpacken gescheitert: $tmp" }
|
||||
}
|
||||
|
||||
# Versionen passend zu electron-builder 26.9.1 (winCodeSign aus dem Job-424-Trace,
|
||||
# nsis/nsis-resources samt Checksummen aus nsisUtil.js). Bei einem kuenftigen
|
||||
# Mismatch laedt app-builder selbst und der Fehler nennt die richtige Version.
|
||||
Get-EbArtifact 'winCodeSign-2.6.0' 'winCodeSign'
|
||||
Get-EbArtifact 'nsis-3.0.4.1' 'nsis'
|
||||
Get-EbArtifact 'nsis-resources-3.4.1' 'nsis'
|
||||
|
||||
Write-Output "prefetch ok: electron v$ev + winCodeSign/nsis in den Caches"
|
||||
Regular → Executable
Regular → Executable
Regular → Executable
Regular → Executable
Regular → Executable
@@ -81,7 +81,7 @@
|
||||
"lodash": "npm:lodash-es@4.18.1",
|
||||
"maplibre-gl": "^5.0.0",
|
||||
"matrix-encrypt-attachment": "^1.0.3",
|
||||
"matrix-js-sdk": "github:matrix-org/matrix-js-sdk#develop",
|
||||
"matrix-js-sdk": "github:matrix-org/matrix-js-sdk#d19cb751da8bbdc75c19db751fff25f21761d23a",
|
||||
"matrix-widget-api": "^1.16.1",
|
||||
"memoize-one": "^6.0.0",
|
||||
"mime": "^4.0.4",
|
||||
@@ -125,7 +125,7 @@
|
||||
"@babel/preset-react": "^7.12.10",
|
||||
"@babel/preset-typescript": "^7.12.7",
|
||||
"@casualbot/jest-sonar-reporter": "2.7.0",
|
||||
"@element-hq/element-call-embedded": "0.19.2",
|
||||
"@sorb/threadnet-call-embedded": "0.19.2-threadnet.5",
|
||||
"@element-hq/element-web-playwright-common": "workspace:*",
|
||||
"@fetch-mock/jest": "^0.2.20",
|
||||
"@jest/globals": "^30.2.0",
|
||||
|
||||
Regular → Executable
Regular → Executable
Regular → Executable
Regular → Executable
@@ -49,6 +49,7 @@ import SettingsStore from "./settings/SettingsStore";
|
||||
import { decorateStartSendingTime, sendRoundTripMetric } from "./sendTimePerformanceMetrics";
|
||||
import { TimelineRenderingType } from "./contexts/RoomContext";
|
||||
import { addReplyToMessageContent } from "./utils/Reply";
|
||||
import { scanContent, ContentScanRejectedError } from "./utils/ContentScanner";
|
||||
import ErrorDialog from "./components/views/dialogs/ErrorDialog";
|
||||
import UploadFailureDialog from "./components/views/dialogs/UploadFailureDialog";
|
||||
import UploadConfirmDialog from "./components/views/dialogs/UploadConfirmDialog";
|
||||
@@ -350,10 +351,24 @@ export async function uploadFile(
|
||||
): Promise<{ url?: string; file?: EncryptedFile }> {
|
||||
const abortController = controller ?? new AbortController();
|
||||
|
||||
// Issue #19 extension: scan the plaintext before it's ever encrypted or uploaded - the
|
||||
// one place both directions of client-side scanning meet, since this function backs
|
||||
// every room-attachment upload (main file, generated thumbnails, and voice messages -
|
||||
// see VoiceMessageRecording.ts) regardless of whether the target room is encrypted.
|
||||
// This does mean reading the whole file into memory even for unencrypted-room uploads,
|
||||
// which previously streamed straight from the File object - unavoidable, since scanning
|
||||
// requires the bytes in hand either way.
|
||||
const dataForScan = await readFileAsArrayBuffer(file);
|
||||
if (abortController.signal.aborted) throw new UploadCanceledError();
|
||||
const accessTokenForScan = matrixClient.getAccessToken();
|
||||
if (accessTokenForScan) {
|
||||
await scanContent(dataForScan, accessTokenForScan);
|
||||
}
|
||||
|
||||
// If the room is encrypted then encrypt the file before uploading it.
|
||||
if (await matrixClient.getCrypto()?.isEncryptionEnabledInRoom(roomId)) {
|
||||
// First read the file into memory.
|
||||
const data = await readFileAsArrayBuffer(file);
|
||||
// Already read into memory above (dataForScan).
|
||||
const data = dataForScan;
|
||||
if (abortController.signal.aborted) throw new UploadCanceledError();
|
||||
|
||||
// Then encrypt the file.
|
||||
@@ -670,6 +685,10 @@ export default class ContentMessages {
|
||||
desc = _t("upload_failed_size", {
|
||||
fileName: upload.fileName,
|
||||
});
|
||||
} else if (unwrappedError instanceof ContentScanRejectedError) {
|
||||
desc = _t("upload_failed_scan_rejected", {
|
||||
fileName: upload.fileName,
|
||||
});
|
||||
}
|
||||
Modal.createDialog(ErrorDialog, {
|
||||
title: _t("upload_failed_title"),
|
||||
|
||||
@@ -21,9 +21,10 @@ import RoomContext, { TimelineRenderingType } from "../../../contexts/RoomContex
|
||||
import MediaProcessingError from "./shared/MediaProcessingError";
|
||||
import { AudioPlayerViewModel } from "../../../viewmodels/room/timeline/event-tile/body/AudioPlayerViewModel";
|
||||
import { FileBodyFactory, renderMBody } from "./MBodyFactory";
|
||||
import { ContentScanRejectedError } from "../../../utils/ContentScanner";
|
||||
|
||||
interface IState {
|
||||
error?: boolean;
|
||||
error?: unknown;
|
||||
playback?: Playback;
|
||||
}
|
||||
|
||||
@@ -40,12 +41,12 @@ export default class MAudioBody extends React.PureComponent<IBodyProps, IState>
|
||||
const blob = await this.props.mediaEventHelper!.sourceBlob.value;
|
||||
buffer = await blob.arrayBuffer();
|
||||
} catch (e) {
|
||||
this.setState({ error: true });
|
||||
this.setState({ error: e });
|
||||
logger.warn("Unable to decrypt audio message", e);
|
||||
return; // stop processing the audio file
|
||||
}
|
||||
} catch (e) {
|
||||
this.setState({ error: true });
|
||||
this.setState({ error: e });
|
||||
logger.warn("Unable to decrypt/download audio message", e);
|
||||
return; // stop processing the audio file
|
||||
}
|
||||
@@ -81,11 +82,11 @@ export default class MAudioBody extends React.PureComponent<IBodyProps, IState>
|
||||
|
||||
public render(): React.ReactNode {
|
||||
if (this.state.error) {
|
||||
return (
|
||||
<MediaProcessingError className="mx_MAudioBody">
|
||||
{_t("timeline|m.audio|error_processing_audio")}
|
||||
</MediaProcessingError>
|
||||
);
|
||||
const errorText =
|
||||
this.state.error instanceof ContentScanRejectedError
|
||||
? _t("timeline|m.audio|error_scan_rejected")
|
||||
: _t("timeline|m.audio|error_processing_audio");
|
||||
return <MediaProcessingError className="mx_MAudioBody">{errorText}</MediaProcessingError>;
|
||||
}
|
||||
|
||||
if (this.props.forExport) {
|
||||
|
||||
@@ -34,6 +34,7 @@ import { presentableTextForFile } from "../../../utils/FileUtils";
|
||||
import { createReconnectedListener } from "../../../utils/connection";
|
||||
import MediaProcessingError from "./shared/MediaProcessingError";
|
||||
import { DecryptError, DownloadError } from "../../../utils/DecryptFile";
|
||||
import { ContentScanRejectedError } from "../../../utils/ContentScanner";
|
||||
import { useMediaVisible } from "../../../hooks/useMediaVisible";
|
||||
import { isMimeTypeAllowed } from "../../../utils/blobs.ts";
|
||||
import { FileBodyFactory, renderMBody } from "./MBodyFactory";
|
||||
@@ -673,6 +674,8 @@ export class MImageBodyInner extends React.Component<IProps, IState> {
|
||||
errorText = _t("timeline|m.image|error_decrypting");
|
||||
} else if (this.state.error instanceof DownloadError) {
|
||||
errorText = _t("timeline|m.image|error_downloading");
|
||||
} else if (this.state.error instanceof ContentScanRejectedError) {
|
||||
errorText = _t("timeline|m.image|error_scan_rejected");
|
||||
}
|
||||
|
||||
return (
|
||||
|
||||
@@ -3400,7 +3400,8 @@
|
||||
"m.audio": {
|
||||
"error_downloading_audio": "Error downloading audio",
|
||||
"error_processing_audio": "Error processing audio message",
|
||||
"error_processing_voice_message": "Error processing voice message"
|
||||
"error_processing_voice_message": "Error processing voice message",
|
||||
"error_scan_rejected": "This audio was blocked by the content scanner"
|
||||
},
|
||||
"m.beacon_info": {
|
||||
"view_live_location": "View live location"
|
||||
@@ -3432,12 +3433,14 @@
|
||||
"voice_call_unsupported": "%(senderName)s placed a voice call. (not supported by this browser)"
|
||||
},
|
||||
"m.file": {
|
||||
"error_decrypting": "Error decrypting attachment"
|
||||
"error_decrypting": "Error decrypting attachment",
|
||||
"error_scan_rejected": "This file was blocked by the content scanner"
|
||||
},
|
||||
"m.image": {
|
||||
"error": "Unable to show image due to error",
|
||||
"error_decrypting": "Error decrypting image",
|
||||
"error_downloading": "Error downloading image",
|
||||
"error_scan_rejected": "This image was blocked by the content scanner",
|
||||
"sent": "%(senderDisplayName)s sent an image.",
|
||||
"show_image": "Show image"
|
||||
},
|
||||
@@ -3563,6 +3566,7 @@
|
||||
"m.sticker": "%(senderDisplayName)s sent a sticker.",
|
||||
"m.video": {
|
||||
"error_decrypting": "Error decrypting video",
|
||||
"error_scan_rejected": "This video was blocked by the content scanner",
|
||||
"show_video": "Show video"
|
||||
},
|
||||
"m.widget": {
|
||||
@@ -3805,6 +3809,7 @@
|
||||
"title": "Allow guest users to join this room"
|
||||
},
|
||||
"upload_failed_generic": "The file '%(fileName)s' failed to upload.",
|
||||
"upload_failed_scan_rejected": "The file '%(fileName)s' was blocked by the content scanner.",
|
||||
"upload_failed_size": "The file '%(fileName)s' exceeds this homeserver's size limit for uploads",
|
||||
"upload_failed_title": "Upload Failed",
|
||||
"upload_file": {
|
||||
|
||||
@@ -0,0 +1,63 @@
|
||||
/*
|
||||
Copyright 2026 aXion1337
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
|
||||
Please see LICENSE files in the repository root for full details.
|
||||
*/
|
||||
|
||||
// Client-side ClamAV scanning (Issue #19 extension): Synapse's own server-side spam-checker
|
||||
// module can never see E2EE attachment content - only a cooperating client can, since only
|
||||
// the client ever holds the room's decryption key. This calls a small self-hosted scan
|
||||
// service (same ClamAV instance the server-side module uses) directly from the browser, both
|
||||
// before encrypting/uploading a file and after downloading/decrypting one - see
|
||||
// ContentMessages.ts (send) and DecryptFile.ts (receive) for the two call sites.
|
||||
|
||||
import { logger } from "matrix-js-sdk/src/logger";
|
||||
|
||||
export class ContentScanRejectedError extends Error {
|
||||
public readonly signature: string;
|
||||
|
||||
public constructor(signature: string) {
|
||||
super(`Blocked by content scanner: ${signature}`);
|
||||
this.name = "ContentScanRejectedError";
|
||||
this.signature = signature;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Scans plaintext bytes against the self-hosted ClamAV scan service.
|
||||
* Fails open (resolves normally) on any network/scanner-side error, matching the same
|
||||
* fail-open policy as the server-side Synapse module - a scanner outage should not block
|
||||
* uploads or downloads site-wide.
|
||||
* @throws {ContentScanRejectedError} if the scanner positively identifies the content as infected.
|
||||
*/
|
||||
export async function scanContent(data: ArrayBuffer | ArrayBufferView, accessToken: string): Promise<void> {
|
||||
let response: Response;
|
||||
try {
|
||||
response = await fetch("/_scan", {
|
||||
method: "POST",
|
||||
headers: { Authorization: `Bearer ${accessToken}` },
|
||||
body: data as BodyInit,
|
||||
});
|
||||
} catch (e) {
|
||||
logger.warn("Content scan request failed (scanner unreachable?) - allowing through", e);
|
||||
return;
|
||||
}
|
||||
|
||||
if (!response.ok) {
|
||||
logger.warn("Content scan request failed with status", response.status, "- allowing through");
|
||||
return;
|
||||
}
|
||||
|
||||
let result: { clean: boolean; signature?: string };
|
||||
try {
|
||||
result = await response.json();
|
||||
} catch (e) {
|
||||
logger.warn("Content scan response was not valid JSON - allowing through", e);
|
||||
return;
|
||||
}
|
||||
|
||||
if (result.clean === false) {
|
||||
throw new ContentScanRejectedError(result.signature ?? "unknown");
|
||||
}
|
||||
}
|
||||
@@ -13,6 +13,8 @@ import { type EncryptedFile, type MediaEventInfo } from "matrix-js-sdk/src/types
|
||||
|
||||
import { mediaFromContent } from "../customisations/Media";
|
||||
import { getBlobSafeMimeType } from "./blobs";
|
||||
import { MatrixClientPeg } from "../MatrixClientPeg";
|
||||
import { scanContent, ContentScanRejectedError } from "./ContentScanner";
|
||||
|
||||
export class DownloadError extends Error {
|
||||
public constructor(e: Error) {
|
||||
@@ -30,6 +32,8 @@ export class DecryptError extends Error {
|
||||
}
|
||||
}
|
||||
|
||||
export { ContentScanRejectedError };
|
||||
|
||||
/**
|
||||
* Decrypt a file attached to a matrix event.
|
||||
* @param {EncryptedFile} file The encrypted file information taken from the matrix event.
|
||||
@@ -55,19 +59,31 @@ export async function decryptFile(file?: EncryptedFile, info?: MediaEventInfo):
|
||||
throw new DownloadError(e as Error);
|
||||
}
|
||||
|
||||
let dataArray: ArrayBuffer;
|
||||
let mimetype: string;
|
||||
try {
|
||||
// Decrypt the array buffer using the information taken from the event content.
|
||||
const dataArray = await encrypt.decryptAttachment(responseData, file!);
|
||||
// Turn the array into a Blob and give it the correct MIME-type.
|
||||
dataArray = await encrypt.decryptAttachment(responseData, file!);
|
||||
|
||||
// IMPORTANT: we must not allow scriptable mime-types into Blobs otherwise
|
||||
// they introduce XSS attacks if the Blob URI is viewed directly in the
|
||||
// browser (e.g. by copying the URI into a new tab or window.)
|
||||
// See warning at top of file.
|
||||
const mimetype = getBlobSafeMimeType(info?.mimetype?.split(";")[0].trim() ?? "");
|
||||
|
||||
return new Blob([dataArray], { type: mimetype });
|
||||
mimetype = getBlobSafeMimeType(info?.mimetype?.split(";")[0].trim() ?? "");
|
||||
} catch (e) {
|
||||
throw new DecryptError(e as Error);
|
||||
}
|
||||
|
||||
// Issue #19 extension: Synapse's own media scanner never sees this content (it's
|
||||
// ciphertext to the server) - this is the one place in the whole app where decrypted
|
||||
// plaintext for *every* attachment type first exists, so scanning here covers all of
|
||||
// them in one spot. Deliberately outside the try/catch above: a scan rejection is a
|
||||
// distinct outcome from a decrypt failure, not wrapped as a DecryptError.
|
||||
const accessToken = MatrixClientPeg.safeGet()?.getAccessToken();
|
||||
if (accessToken) {
|
||||
await scanContent(dataArray, accessToken);
|
||||
}
|
||||
|
||||
// Turn the array into a Blob and give it the correct MIME-type.
|
||||
return new Blob([dataArray], { type: mimetype });
|
||||
}
|
||||
|
||||
@@ -25,6 +25,7 @@ import { FileDownloader } from "../../utils/FileDownloader";
|
||||
import { type MediaEventHelper } from "../../utils/MediaEventHelper";
|
||||
import { TimelineRenderingType } from "../../contexts/RoomContext";
|
||||
import ErrorDialog from "../../components/views/dialogs/ErrorDialog";
|
||||
import { ContentScanRejectedError } from "../../utils/ContentScanner";
|
||||
|
||||
export interface FileBodyViewModelProps {
|
||||
mxEvent: MatrixEvent;
|
||||
@@ -249,7 +250,10 @@ export class FileBodyViewModel
|
||||
logger.warn("Unable to decrypt attachment: ", err);
|
||||
Modal.createDialog(ErrorDialog, {
|
||||
title: _t("common|error"),
|
||||
description: _t("timeline|m.file|error_decrypting"),
|
||||
description:
|
||||
err instanceof ContentScanRejectedError
|
||||
? _t("timeline|m.file|error_scan_rejected")
|
||||
: _t("timeline|m.file|error_decrypting"),
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
@@ -23,6 +23,7 @@ import { mediaFromContent } from "../../customisations/Media";
|
||||
import { BLURHASH_FIELD } from "../../utils/image-media";
|
||||
import { type ImageSize, suggestedSize as suggestedVideoSize } from "../../settings/enums/ImageSize";
|
||||
import { type MediaEventHelper } from "../../utils/MediaEventHelper";
|
||||
import { ContentScanRejectedError } from "../../utils/ContentScanner";
|
||||
|
||||
export interface VideoBodyViewModelProps {
|
||||
/**
|
||||
@@ -203,7 +204,10 @@ export class VideoBodyViewModel
|
||||
if (state.error !== null) {
|
||||
return {
|
||||
state: VideoBodyViewState.ERROR,
|
||||
errorLabel: _t("timeline|m.video|error_decrypting"),
|
||||
errorLabel:
|
||||
state.error instanceof ContentScanRejectedError
|
||||
? _t("timeline|m.video|error_scan_rejected")
|
||||
: _t("timeline|m.video|error_decrypting"),
|
||||
maxWidth,
|
||||
maxHeight,
|
||||
aspectRatio,
|
||||
|
||||
@@ -725,7 +725,7 @@ export default (env: string, argv: Record<string, any>): webpack.Configuration =
|
||||
// Element Call embedded widget
|
||||
{
|
||||
from: "**",
|
||||
context: path.join(getPackageRoot("@element-hq/element-call-embedded"), "dist"),
|
||||
context: path.join(getPackageRoot("@sorb/threadnet-call-embedded"), "dist"),
|
||||
to: path.join(__dirname, "webapp", "widgets", "element-call"),
|
||||
},
|
||||
// Mobile guide assets
|
||||
|
||||
@@ -0,0 +1,62 @@
|
||||
# ThreadNet-Web: Fork-Anpassungen für axion1337.chat
|
||||
|
||||
Dieses Dokument beschreibt alles, was dieser Fork gegenüber Upstream Element Web ändert. Der
|
||||
Rest der `docs/`-Ordner-Dateien und das Root-`README.md` sind unverändertes Upstream-Material
|
||||
und beschreiben absichtlich **nicht** diese Anpassungen - diese Datei ist der zentrale
|
||||
Anlaufpunkt dafür.
|
||||
|
||||
## 1. Discord-Style Room-List (Call-Teilnehmer in der Raumliste)
|
||||
|
||||
Zeigt aktive Call-Teilnehmer direkt in der Raumliste an (ähnlich Discords Voice-Channel-UI),
|
||||
statt nur einen generischen "Call läuft"-Indikator. Betroffene Komponenten:
|
||||
`apps/web/src/room-list/RoomListItemView/RoomListItemView.tsx` und
|
||||
`RoomListItemView.module.css` (vertikale Ausrichtung der Teilnehmer-Avatare).
|
||||
|
||||
## 2. Client-seitiges ClamAV-Content-Scanning (Issue #19-Erweiterung)
|
||||
|
||||
Der Server-seitige Content-Scanner (Synapse-Modul, siehe gitops-Repo
|
||||
[`docs/deployment-guides/06-moderation-content-scanning.md`](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/src/branch/main/docs/deployment-guides/06-moderation-content-scanning.md))
|
||||
sieht bei Ende-zu-Ende-verschlüsselten Räumen nur Ciphertext - eine strukturelle Grenze, kein
|
||||
Bug. Da dieser Client bereits geforkt wird, scannt er stattdessen selbst, auf beiden Seiten:
|
||||
|
||||
- **Senden** (`apps/web/src/ContentMessages.ts`, `uploadFile()`): liest die Datei als
|
||||
ArrayBuffer, scannt sie über `scanContent()` **bevor** verschlüsselt/hochgeladen wird - der
|
||||
Upload wird bei Treffer gar nicht erst gestartet.
|
||||
- **Empfangen** (`apps/web/src/utils/DecryptFile.ts`, `decryptFile()`): scannt die
|
||||
entschlüsselten Bytes direkt nach dem Entschlüsseln, bevor das Blob an die UI zurückgegeben
|
||||
wird - schützt auch vor Dateien von unveränderten/fremden Matrix-Clients, die diesen Patch
|
||||
nicht haben.
|
||||
- Gemeinsame Scan-Logik: `apps/web/src/utils/ContentScanner.ts` - ruft den (im gitops-Repo
|
||||
deployten) `clamav-http-scanner`-Dienst per `fetch("/_scan", ...)` auf, mit dem eigenen
|
||||
Matrix-Access-Token als Bearer-Auth. Fail-open bei Netzwerk-/Scanner-Fehlern (blockiert
|
||||
Uploads/Downloads nicht bei einem Ausfall des Scanners).
|
||||
- Neuer Fehlertyp `ContentScanRejectedError`, verdrahtet durch die bestehenden
|
||||
Fehler-Rendering-Pfade in `MImageBody.tsx`, `MAudioBody.tsx`, `VideoBodyViewModel.ts`,
|
||||
`FileBodyViewModel.ts`.
|
||||
- Live getestet inkl. Hostile-Sender-Simulation (Datei per rohem API-Call ohne diesen Patch
|
||||
gesendet, Empfangs-Hook hat trotzdem geblockt).
|
||||
|
||||
### ⚠️ Bekannte Lücke: Electron/Desktop (Issue #2)
|
||||
|
||||
Dieser Fix ist bestätigt nur für den **Web-Client-Build** wirksam. Der Electron-Desktop-Client
|
||||
bekommt ihn aktuell **nicht automatisch** - die CI-Workflow-Kette (`build_ew`-Job) checkt
|
||||
weiterhin `element-hq/element-web` (Upstream) statt diesen Fork aus, und es ist kein GitHub-
|
||||
Actions-Runner für dieses Repo registriert. Der aktuell veröffentlichte Desktop-Build
|
||||
(`desktop-v1.12.17-clientscan` Release) wurde manuell gebaut, nicht automatisiert. Details und
|
||||
Fix-Plan: [Issue #2](https://rohana.axion1337.de/sorb/ThreadNet-Web/issues/2).
|
||||
|
||||
## 3. Build-Fixes (historisch, Issue #12)
|
||||
|
||||
Zwei Bugs blockierten einen vollständigen `docker build` von Grund auf (mussten für den
|
||||
Client-Scanning-Rebuild oben behoben werden): (1) mehrere Shell-Skripte waren mit Modus 644
|
||||
statt 755 committet (nicht ausführbar); (2) der `matrix-js-sdk#develop`-Git-Ref-Pin in
|
||||
`pnpm-lock.yaml` war veraltet (fehlte `src/oidc/authorize.ts`, das `apps/web` importiert).
|
||||
Beide behoben.
|
||||
|
||||
## Repo-Topologie (seit 2026-07-31)
|
||||
|
||||
**Kanonisch ist `git.lab/axion1337.chat/ThreadNet-Web`** (Homelab-GitLab, nur im Lab
|
||||
auflösbar) — dort laufen Entwicklung und CI (`.gitlab-ci.yml`). Die Kopie auf
|
||||
`rohana.axion1337.de/sorb/ThreadNet-Web` ist ein **Push-Mirror** (automatisch, GitLab →
|
||||
Gitea) und dient als Lesekopie plus Standort für Issues, Container-Registry und Releases.
|
||||
**Niemals direkt nach rohana pushen** — der Mirror überschreibt divergente Stände.
|
||||
Regular → Executable
Regular → Executable
Generated
+31
-20
@@ -469,8 +469,8 @@ importers:
|
||||
specifier: ^1.0.3
|
||||
version: 1.0.3
|
||||
matrix-js-sdk:
|
||||
specifier: github:matrix-org/matrix-js-sdk#develop
|
||||
version: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/349e8c5023b74b7ee17b2e9a0cba6dfce6818d68
|
||||
specifier: github:matrix-org/matrix-js-sdk#d19cb751da8bbdc75c19db751fff25f21761d23a
|
||||
version: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/d19cb751da8bbdc75c19db751fff25f21761d23a
|
||||
matrix-widget-api:
|
||||
specifier: ^1.17.0
|
||||
version: 1.17.0
|
||||
@@ -595,9 +595,6 @@ importers:
|
||||
'@casualbot/jest-sonar-reporter':
|
||||
specifier: 2.7.0
|
||||
version: 2.7.0
|
||||
'@element-hq/element-call-embedded':
|
||||
specifier: 0.19.2
|
||||
version: 0.19.2
|
||||
'@element-hq/element-web-playwright-common':
|
||||
specifier: workspace:*
|
||||
version: link:../../packages/playwright-common
|
||||
@@ -619,6 +616,9 @@ importers:
|
||||
'@sentry/webpack-plugin':
|
||||
specifier: ^5.0.0
|
||||
version: 5.2.1(encoding@0.1.13)(webpack@5.106.2)
|
||||
'@sorb/threadnet-call-embedded':
|
||||
specifier: 0.19.2-threadnet.5
|
||||
version: 0.19.2-threadnet.5
|
||||
'@stylistic/eslint-plugin':
|
||||
specifier: ^5.0.0
|
||||
version: 5.10.0(eslint@8.57.1)
|
||||
@@ -2036,6 +2036,9 @@ packages:
|
||||
resolution: {integrity: sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==}
|
||||
engines: {node: '>=6.9.0'}
|
||||
|
||||
'@babel/runtime@8.0.0':
|
||||
resolution: {integrity: sha512-sL6cvO2IfkSu/iU+zs2S/w01B7A8V7suXSIKEN4hPFFdZoiPGxrj5pAG0lCaqLWiEIrjKzdznIWuaLcxPR53qw==}
|
||||
|
||||
'@babel/template@7.28.6':
|
||||
resolution: {integrity: sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==}
|
||||
engines: {node: '>=6.9.0'}
|
||||
@@ -2525,9 +2528,6 @@ packages:
|
||||
engines: {node: '>=14.14'}
|
||||
hasBin: true
|
||||
|
||||
'@element-hq/element-call-embedded@0.19.2':
|
||||
resolution: {integrity: sha512-HlqB/5RkWU7LAvArUJdSLsHpZJyTnGzn6LPYPAMinqShLkXa0ILeurL6G6zpTmRH+/uoJUfpHo3DQd+5Tq6/zg==}
|
||||
|
||||
'@emnapi/core@1.10.0':
|
||||
resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
|
||||
|
||||
@@ -3192,8 +3192,8 @@ packages:
|
||||
'@matrix-org/emojibase-bindings@1.5.0':
|
||||
resolution: {integrity: sha512-+W9/ow2Z3iQa7ZOF698PBhwNcgGkn36B5Sr8VDPx8N8CH7+Uw+7TrtbtKPZVdgf4m/THmgmfX40jS5YDBsLaYg==}
|
||||
|
||||
'@matrix-org/matrix-sdk-crypto-wasm@18.2.0':
|
||||
resolution: {integrity: sha512-puyZefvq6sHfqlmkri8umhA44724H2JL0YtX8wlvhGuNl8awX/Q1tZyW2Iekm9ZJP7BtuOqlNdg9oQd6iaGbNw==}
|
||||
'@matrix-org/matrix-sdk-crypto-wasm@18.4.0':
|
||||
resolution: {integrity: sha512-osxkU1DQ+05+anGHapjWyvZqdHUb94Id37gy54mCKn1Cq/D7iGT5oEUEhjp4oTnCLo4TOtI6ULJ/LHsapaIptQ==}
|
||||
engines: {node: '>= 18'}
|
||||
|
||||
'@matrix-org/react-sdk-module-api@2.5.0':
|
||||
@@ -5003,6 +5003,9 @@ packages:
|
||||
'@sinonjs/fake-timers@15.1.1':
|
||||
resolution: {integrity: sha512-cO5W33JgAPbOh07tvZjUOJ7oWhtaqGHiZw+11DPbyqh2kHTBc3eF/CjJDeQ4205RLQsX6rxCuYOroFQwl7JDRw==}
|
||||
|
||||
'@sorb/threadnet-call-embedded@0.19.2-threadnet.5':
|
||||
resolution: {integrity: sha512-u2TG7i82ibkpHSH/s6xA4Q6BTJqITdYWyrVieTiRwnm2Z+SCn/GmPK8JZIp/uSnpMrl9619yp/6vDVtpDJsKZg==, tarball: https://rohana.axion1337.de/api/packages/sorb/npm/%40sorb%2Fthreadnet-call-embedded/-/0.19.2-threadnet.5/threadnet-call-embedded-0.19.2-threadnet.5.tgz}
|
||||
|
||||
'@standard-schema/spec@1.1.0':
|
||||
resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
|
||||
|
||||
@@ -7077,6 +7080,10 @@ packages:
|
||||
resolution: {integrity: sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==}
|
||||
engines: {node: '>= 0.6'}
|
||||
|
||||
content-type@2.0.0:
|
||||
resolution: {integrity: sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==}
|
||||
engines: {node: '>=18'}
|
||||
|
||||
convert-hrtime@5.0.0:
|
||||
resolution: {integrity: sha512-lOETlkIeYSJWcbbcvjRKGxVMXJR+8+OQb/mTPbA4ObPMytYIsUbuOE0Jzy60hjARYszq1id0j8KgVhC+WGZVTg==}
|
||||
engines: {node: '>=12'}
|
||||
@@ -9941,9 +9948,9 @@ packages:
|
||||
matrix-events-sdk@0.0.1:
|
||||
resolution: {integrity: sha512-1QEOsXO+bhyCroIe2/A5OwaxHvBm7EsSQ46DEDn8RBIfQwN5HWBpFvyWWR4QY0KHPPnnJdI99wgRiAl7Ad5qaA==}
|
||||
|
||||
matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/349e8c5023b74b7ee17b2e9a0cba6dfce6818d68:
|
||||
resolution: {tarball: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/349e8c5023b74b7ee17b2e9a0cba6dfce6818d68}
|
||||
version: 41.4.0
|
||||
matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/d19cb751da8bbdc75c19db751fff25f21761d23a:
|
||||
resolution: {tarball: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/d19cb751da8bbdc75c19db751fff25f21761d23a}
|
||||
version: 41.9.0
|
||||
engines: {node: '>=22.0.0'}
|
||||
|
||||
matrix-web-i18n@3.6.0:
|
||||
@@ -14503,6 +14510,8 @@ snapshots:
|
||||
|
||||
'@babel/runtime@7.29.2': {}
|
||||
|
||||
'@babel/runtime@8.0.0': {}
|
||||
|
||||
'@babel/template@7.28.6':
|
||||
dependencies:
|
||||
'@babel/code-frame': 7.29.0
|
||||
@@ -15056,8 +15065,6 @@ snapshots:
|
||||
- supports-color
|
||||
optional: true
|
||||
|
||||
'@element-hq/element-call-embedded@0.19.2': {}
|
||||
|
||||
'@emnapi/core@1.10.0':
|
||||
dependencies:
|
||||
'@emnapi/wasi-threads': 1.2.1
|
||||
@@ -15797,7 +15804,7 @@ snapshots:
|
||||
emojibase: 17.0.0
|
||||
emojibase-data: 17.0.0(emojibase@17.0.0)
|
||||
|
||||
'@matrix-org/matrix-sdk-crypto-wasm@18.2.0': {}
|
||||
'@matrix-org/matrix-sdk-crypto-wasm@18.4.0': {}
|
||||
|
||||
'@matrix-org/react-sdk-module-api@2.5.0(patch_hash=016146c9cc96e6363609d2b2ac0896ccef567882eb1d73b75a77b8a30929de96)(react@19.2.6)':
|
||||
dependencies:
|
||||
@@ -17625,6 +17632,8 @@ snapshots:
|
||||
dependencies:
|
||||
'@sinonjs/commons': 3.0.1
|
||||
|
||||
'@sorb/threadnet-call-embedded@0.19.2-threadnet.5': {}
|
||||
|
||||
'@standard-schema/spec@1.1.0': {}
|
||||
|
||||
'@storybook/addon-a11y@10.3.6(storybook@10.3.6(@testing-library/dom@10.4.1)(prettier@3.8.3)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))':
|
||||
@@ -20080,6 +20089,8 @@ snapshots:
|
||||
|
||||
content-type@1.0.5: {}
|
||||
|
||||
content-type@2.0.0: {}
|
||||
|
||||
convert-hrtime@5.0.0: {}
|
||||
|
||||
convert-source-map@2.0.0: {}
|
||||
@@ -23508,13 +23519,13 @@ snapshots:
|
||||
|
||||
matrix-events-sdk@0.0.1: {}
|
||||
|
||||
matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/349e8c5023b74b7ee17b2e9a0cba6dfce6818d68:
|
||||
matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/d19cb751da8bbdc75c19db751fff25f21761d23a:
|
||||
dependencies:
|
||||
'@babel/runtime': 7.29.2
|
||||
'@matrix-org/matrix-sdk-crypto-wasm': 18.2.0
|
||||
'@babel/runtime': 8.0.0
|
||||
'@matrix-org/matrix-sdk-crypto-wasm': 18.4.0
|
||||
another-json: 0.2.0
|
||||
bs58: 6.0.0
|
||||
content-type: 1.0.5
|
||||
content-type: 2.0.0
|
||||
jwt-decode: 4.0.0
|
||||
loglevel: 1.9.2
|
||||
matrix-events-sdk: 0.0.1
|
||||
|
||||
Regular → Executable
Regular → Executable
Regular → Executable
Regular → Executable
Regular → Executable
Regular → Executable
Reference in New Issue
Block a user