openwork/.github/workflows/build-desktop.yml

name: Build Desktop (Linux)

on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-linux:
    name: Tauri Build (Linux)
    # Set OPENWORK_LINUX_X64_RUNNER_LABEL to route this job to a larger GitHub-hosted runner.
    runs-on: ${{ vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || 'ubuntu-22.04' }}

    steps:
      - name: Log runner selection
        run: |
          echo "Requested larger runner label: ${RUNNER_LABEL:-<unset>}"
          echo "Effective runs-on: ${EFFECTIVE_RUNS_ON}"
        env:
          RUNNER_LABEL: ${{ vars.OPENWORK_LINUX_X64_RUNNER_LABEL }}
          EFFECTIVE_RUNS_ON: ${{ vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || 'ubuntu-22.04' }}

      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.27.0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: 1.3.5

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Linux build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libgtk-3-dev \
            libglib2.0-dev \
            libayatana-appindicator3-dev \
            libsoup-3.0-dev \
            libwebkit2gtk-4.1-dev \
            libssl-dev \
            rpm \
            libdbus-1-dev \
            librsvg2-dev

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu

      - name: Create CI Tauri config (no updater artifacts)
        run: |
          node -e "const fs=require('fs'); const configPath='apps/desktop/src-tauri/tauri.conf.json'; const ciPath='apps/desktop/src-tauri/tauri.conf.ci.json'; const config=JSON.parse(fs.readFileSync(configPath,'utf8')); config.bundle={...config.bundle, createUpdaterArtifacts:false}; fs.writeFileSync(ciPath, JSON.stringify(config, null, 2));"

      - name: Download OpenCode sidecar
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
        run: |
          set -euo pipefail

          repo="${OPENCODE_GITHUB_REPO:-anomalyco/opencode}"
          version="${OPENCODE_VERSION:-}"

          if [ -z "$version" ]; then
            version="$(node -p "require('./apps/desktop/package.json').opencodeVersion || ''" 2>/dev/null || true)"
          fi

          version="$(echo "$version" | tr -d '\r\n' | sed 's/^v//')"
          if [ -z "$version" ] || [ "$version" = "latest" ]; then
            latest=""
            if [ -n "${GITHUB_TOKEN:-}" ]; then
              latest=$(curl -fsSL \
                -H "Authorization: Bearer ${GITHUB_TOKEN}" \
                -H "X-GitHub-Api-Version: 2022-11-28" \
                "https://api.github.com/repos/${repo}/releases/latest" \
                | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')
            else
              latest=$(curl -fsSL \
                -H "X-GitHub-Api-Version: 2022-11-28" \
                "https://api.github.com/repos/${repo}/releases/latest" \
                | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')
            fi
            if [ -n "$latest" ]; then
              version="$latest"
            fi
          fi

          if [ -z "$version" ]; then
            echo "Unable to resolve OpenCode version (set OPENCODE_VERSION to pin)." >&2
            exit 1
          fi

          # Reuse this resolved version for subsequent steps (e.g. prepare-sidecar).
          echo "OPENCODE_VERSION=$version" >> "$GITHUB_ENV"

          opencode_asset="opencode-linux-x64-baseline.tar.gz"
          url="https://github.com/${repo}/releases/download/v${version}/${opencode_asset}"
          tmp_dir="$RUNNER_TEMP/opencode"
          extract_dir="$tmp_dir/extracted"
          rm -rf "$tmp_dir"
          mkdir -p "$extract_dir"

          curl_headers=()
          if [ -n "${GITHUB_TOKEN:-}" ]; then
            curl_headers+=( -H "Authorization: Bearer ${GITHUB_TOKEN}" )
          fi
          curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 "${curl_headers[@]}" -o "$tmp_dir/$opencode_asset" "$url"
          tar -xzf "$tmp_dir/$opencode_asset" -C "$extract_dir"

          if [ -f "$extract_dir/opencode" ]; then
            bin_path="$extract_dir/opencode"
          else
            echo "OpenCode binary not found in archive"
            ls -la "$extract_dir"
            exit 1
          fi

          target_name="opencode-x86_64-unknown-linux-gnu"
          mkdir -p apps/desktop/src-tauri/sidecars
          cp "$bin_path" "apps/desktop/src-tauri/sidecars/${target_name}"
          chmod 755 "apps/desktop/src-tauri/sidecars/${target_name}"

      - name: Prepare desktop sidecars
        run: pnpm -C apps/desktop prepare:sidecar

      - name: Run Rust tests (engine + sidecar resolution)
        run: cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked

      - name: Build desktop app
        run: pnpm --filter @openwork/desktop exec tauri build --config src-tauri/tauri.conf.ci.json --target x86_64-unknown-linux-gnu --bundles deb