CI: build and publish every package from Woodpecker

Pushes to main run the tests. The Deploy button publishes the Windows, RPM, deb and F-Droid packages to the same NAS directories a dev machine uses, with the same keys, then runs update-repo.sh, so public URLs don't change. Builds run on Debian 12, in an image defined in ci/builder, so the Linux packages now need glibc 2.36 instead of Fedora 44's 2.43.
2026-11-01 11:54:49 -06:00
parent c7572ae7b0
commit a9ed6456da
10 changed files with 440 additions and 13 deletions
--- a/ci/builder/Dockerfile
+++ b/ci/builder/Dockerfile
@@ -0,0 +1,99 @@
+# The image every step in .woodpecker runs in. It builds the desktop app, the
+# Windows installer and the Android APK, and holds the tools that publish them.
+#
+# Build it in Woodpecker: open a pipeline, click "Deploy", and set the deploy
+# target to `builder`. Or locally:
+#
+#   podman build -t mtgc-builder ci/builder
+#
+# Debian 12 on purpose: a Linux binary needs at least the glibc it was built
+# against, so the oldest libraries we can build on reach the most machines.
+# Versions match a working dev machine; bump them here, not in the scripts.
+
+FROM debian:bookworm
+
+ENV RUST_VERSION=1.97.1 \
+    TAURI_CLI_VERSION=2.11.4 \
+    CARGO_XWIN_VERSION=0.23.1 \
+    NODE_VERSION=22.14.0 \
+    REPREPRO_VERSION=5.4.4 \
+    REPREPRO_SHA256=5b028f79183659d441d1b340deb88341a7f29335ae7370eff4b3c094fbe90bc4 \
+    FDROIDSERVER_VERSION=2.4.5 \
+    CMDLINE_TOOLS_BUILD=13114758 \
+    NDK_VERSION=28.2.13676358 \
+    ANDROID_PLATFORM=android-36 \
+    ANDROID_BUILD_TOOLS=36.0.0
+
+ENV RUSTUP_HOME=/opt/rustup \
+    CARGO_HOME=/opt/cargo \
+    ANDROID_HOME=/opt/android-sdk \
+    PATH=/opt/cargo/bin:/opt/node/bin:/opt/android-sdk/cmdline-tools/latest/bin:/usr/lib/llvm-14/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+# System packages. The first group builds the app, then Windows, then the
+# package repos and Android. libgpgme and below only build reprepro.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+        build-essential ca-certificates curl file git pkg-config unzip xz-utils \
+        libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev libssl-dev \
+        clang lld llvm nsis \
+        createrepo-c dpkg-dev gnupg rpm \
+        openjdk-17-jdk-headless python3-venv \
+        automake libarchive-dev libbz2-dev libdb-dev libgpgme-dev liblzma-dev libzstd-dev zlib1g-dev \
+ && rm -rf /var/lib/apt/lists/*
+
+# reprepro: bookworm's 5.3 can't read a repo that keeps several versions of a
+# package, which deb-publish.sh's `Limit:` makes, so use the dev machine's.
+RUN curl -fsSL -o /tmp/reprepro.tar.gz \
+        "https://salsa.debian.org/debian/reprepro/-/archive/reprepro-$REPREPRO_VERSION/reprepro-reprepro-$REPREPRO_VERSION.tar.gz" \
+ && echo "$REPREPRO_SHA256  /tmp/reprepro.tar.gz" | sha256sum -c - \
+ && mkdir /tmp/reprepro \
+ && tar xzf /tmp/reprepro.tar.gz -C /tmp/reprepro --strip-components=1 \
+ && cd /tmp/reprepro \
+ && autoreconf -fi \
+ && ./configure --with-libbz2 --with-liblzma --with-libarchive \
+ && make -j"$(nproc)" install \
+ && rm -rf /tmp/reprepro /tmp/reprepro.tar.gz
+
+# Rust
+RUN curl -fsSL -o /tmp/rustup-init https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init \
+ && chmod +x /tmp/rustup-init \
+ && /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain "$RUST_VERSION" \
+        --target x86_64-pc-windows-msvc \
+        --target aarch64-linux-android \
+        --target armv7-linux-androideabi \
+        --target i686-linux-android \
+        --target x86_64-linux-android \
+ && rm /tmp/rustup-init \
+ && cargo install --locked tauri-cli --version "$TAURI_CLI_VERSION" \
+ && cargo install --locked cargo-xwin --version "$CARGO_XWIN_VERSION" \
+ && rm -rf /opt/cargo/registry /opt/cargo/git
+
+# Node
+RUN mkdir /opt/node \
+ && curl -fsSL "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.xz" \
+    | tar xJ -C /opt/node --strip-components=1
+
+# Android SDK and NDK
+RUN mkdir -p /opt/android-sdk/cmdline-tools \
+ && curl -fsSL -o /tmp/cmdline-tools.zip \
+        "https://dl.google.com/android/repository/commandlinetools-linux-${CMDLINE_TOOLS_BUILD}_latest.zip" \
+ && unzip -q /tmp/cmdline-tools.zip -d /tmp/cmdline-tools \
+ && mv /tmp/cmdline-tools/cmdline-tools /opt/android-sdk/cmdline-tools/latest \
+ && rm -rf /tmp/cmdline-tools /tmp/cmdline-tools.zip \
+ && (yes || true) | sdkmanager --licenses >/dev/null \
+ && sdkmanager --install \
+        "platforms;$ANDROID_PLATFORM" \
+        "build-tools;$ANDROID_BUILD_TOOLS" \
+        "platform-tools" \
+        "ndk;$NDK_VERSION" >/dev/null
+
+# fdroidserver
+RUN python3 -m venv /opt/fdroidserver \
+ && /opt/fdroidserver/bin/pip install --no-cache-dir "fdroidserver==$FDROIDSERVER_VERSION" \
+ && ln -s /opt/fdroidserver/bin/fdroid /usr/local/bin/fdroid
+
+# Steps run as uid 1000, the owner of the release directories on the NAS. It
+# gets an account because keytool and Gradle ask who they're running as, and
+# the SDK because Gradle may add a build-tools package it wants.
+RUN useradd --uid 1000 --create-home builder \
+ && chown -R 1000:1000 /opt/android-sdk