openclaw/.github/workflows/linux-app-release.yml

name: Linux App Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing OpenClaw release tag to receive Linux companion bundles, for example v2026.7.1
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: linux-app-release-${{ inputs.tag }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  build_and_attach:
    name: Build and attach Linux companion bundles
    # Oldest supported build base: bundles link against this glibc, so newer
    # runners would silently drop Ubuntu 22.04/Debian 12 users.
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    steps:
      - name: Validate tag input format
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(-[1-9][0-9]*)?$ ]]; then
            # Alpha/beta semver suffixes map to a Debian revision that sorts
            # AFTER the plain stable version, breaking beta-to-stable upgrades;
            # numeric stable revisions (-N) order correctly and stay allowed.
            echo "Linux bundles ship for stable release tags only (vYYYY.M.PATCH or vYYYY.M.PATCH-N); got: ${RELEASE_TAG}"
            exit 1
          fi

      - name: Checkout selected tag
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: refs/tags/${{ inputs.tag }}
          fetch-depth: 0
          persist-credentials: false

      - name: Ensure tag commit is reachable from main
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          git fetch --quiet origin main
          tag_sha=$(git rev-parse "refs/tags/${RELEASE_TAG}^{commit}")
          if ! git merge-base --is-ancestor "${tag_sha}" origin/main; then
            echo "Tag ${RELEASE_TAG} (${tag_sha}) is not reachable from main; Linux bundles ship for main-based releases only."
            exit 1
          fi

      - name: Ensure matching GitHub release exists
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
        run: gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" --json tagName --jq .tagName

      - name: Install Tauri system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential \
            curl \
            file \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libssl-dev \
            libwebkit2gtk-4.1-dev \
            libxdo-dev \
            wget

      - name: Install Rust
        run: rustup toolchain install stable --profile minimal

      - name: Setup Node environment
        uses: ./.github/actions/setup-node-env
        with:
          install-bun: "false"
          install-deps: "false"

      - name: Build Linux companion bundles
        working-directory: apps/linux/src-tauri
        env:
          # appimagetool strips fail on CI runners; Tauri documents NO_STRIP for Actions.
          NO_STRIP: "true"
          RELEASE_TAG: ${{ inputs.tag }}
          # Sign the AppImage updater artifact so the companion can verify updates.
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          # Stamp the release version into the bundles; the committed manifests
          # keep a placeholder 0.1.0 so releases stay tag-driven.
          pnpm dlx @tauri-apps/cli@2.11.4 build --bundles deb,appimage \
            --config "{\"version\":\"${version}\"}"

      - name: Verify and rename bundles for the release tag
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          deb=$(ls apps/linux/src-tauri/target/release/bundle/deb/*.deb)
          deb_version=$(dpkg-deb -f "${deb}" Version)
          if [[ "${deb_version}" != "${version}"* ]]; then
            echo "Debian package version '${deb_version}' does not match release version '${version}'"
            exit 1
          fi
          mkdir -p dist/linux-app
          cp "${deb}" "dist/linux-app/OpenClaw-${version}-amd64.deb"
          cp apps/linux/src-tauri/target/release/bundle/appimage/*.AppImage \
            "dist/linux-app/OpenClaw-${version}-amd64.AppImage"
          (cd dist/linux-app && sha256sum ./* > SHA256SUMS.linux-app.txt)
          cat dist/linux-app/SHA256SUMS.linux-app.txt

      - name: Generate updater manifest (latest.json)
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          # The signature is over the AppImage bytes, so renaming the file does
          # not invalidate it. The committed pubkey verifies it in the app.
          sig_file=$(ls apps/linux/src-tauri/target/release/bundle/appimage/*.AppImage.sig)
          signature=$(cat "${sig_file}")
          pub_date=$(date -u +%Y-%m-%dT%H:%M:%SZ)
          # Capture the full body (no early-closing pipe under pipefail), then
          # truncate to 2000 Unicode chars inside jq so we never split a
          # multibyte character or SIGPIPE the release-view command.
          notes=$(gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" --json body --jq '.body // ""')
          url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${RELEASE_TAG}/OpenClaw-${version}-amd64.AppImage"
          jq -n \
            --arg version "${version}" \
            --arg notes "${notes}" \
            --arg pub_date "${pub_date}" \
            --arg signature "${signature}" \
            --arg url "${url}" \
            '{version: $version, notes: ($notes | .[0:2000]), pub_date: $pub_date, platforms: {"linux-x86_64": {signature: $signature, url: $url}}}' \
            > dist/linux-app/latest.json
          cat dist/linux-app/latest.json

      - name: Attach bundles to the release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          gh release upload "${RELEASE_TAG}" \
            --repo "${GITHUB_REPOSITORY}" \
            --clobber \
            dist/linux-app/*