leeguooooo
44b6218ef9
Cherry-picks upstream agent-browser #1377 (chore: enforce pnpm minimum release age), adapted for the fork: - add .node-version (24); workflows read node-version-file instead of inline - pin packageManager pnpm@11.1.3; drop hard-coded pnpm/action-setup versions - pnpm-workspace.yaml: add minimumReleaseAge (48h supply-chain cooldown) + allowBuilds allowlist, keeping our trimmed packages list (no packages/*, docs) Deliberately dropped from upstream: - engines.node >=24 / engines.pnpm >=11 — would impose a Node 24 floor on end-users of the published agent-browser-stealth CLI (a compiled binary that doesn't need it). packageManager + .node-version cover dev/CI pinning. - docs/ and README hunks — those paths are removed/rewritten in this fork.
333 lines
11 KiB
YAML
333 lines
11 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
concurrency: ${{ github.workflow }}-${{ github.ref }}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
check-release:
|
|
name: Check for new version
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
should_release: ${{ steps.check.outputs.should_release }}
|
|
needs_github_release: ${{ steps.check.outputs.needs_github_release }}
|
|
version: ${{ steps.check.outputs.version }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .node-version
|
|
|
|
- name: Compare package.json version to npm and check GitHub release
|
|
id: check
|
|
run: |
|
|
LOCAL_VERSION=$(node -p "require('./package.json').version")
|
|
echo "Local version: $LOCAL_VERSION"
|
|
|
|
NPM_VERSION=$(npm view agent-browser version 2>/dev/null || echo "0.0.0")
|
|
echo "npm version: $NPM_VERSION"
|
|
|
|
if [ "$LOCAL_VERSION" != "$NPM_VERSION" ]; then
|
|
echo "Version changed: $NPM_VERSION -> $LOCAL_VERSION"
|
|
echo "should_release=true" >> "$GITHUB_OUTPUT"
|
|
echo "needs_github_release=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "Version unchanged on npm, skipping build and publish"
|
|
echo "should_release=false" >> "$GITHUB_OUTPUT"
|
|
|
|
# Check if GitHub release exists; it may be missing if a prior run
|
|
# published to npm but failed before creating the release.
|
|
TAG="v$LOCAL_VERSION"
|
|
if gh release view "$TAG" &>/dev/null; then
|
|
echo "GitHub release $TAG exists"
|
|
echo "needs_github_release=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "GitHub release $TAG is missing, will rebuild and create it"
|
|
echo "needs_github_release=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
fi
|
|
echo "version=$LOCAL_VERSION" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
build-binaries:
|
|
name: Build ${{ matrix.name }}
|
|
needs: check-release
|
|
if: needs.check-release.outputs.should_release == 'true' || needs.check-release.outputs.needs_github_release == 'true'
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- name: Linux x64
|
|
os: ubuntu-latest
|
|
target: x86_64-unknown-linux-gnu
|
|
binary: agent-browser-linux-x64
|
|
use_zigbuild: true
|
|
- name: Linux ARM64
|
|
os: ubuntu-latest
|
|
target: aarch64-unknown-linux-gnu
|
|
binary: agent-browser-linux-arm64
|
|
use_zigbuild: true
|
|
- name: Linux musl x64
|
|
os: ubuntu-latest
|
|
target: x86_64-unknown-linux-musl
|
|
binary: agent-browser-linux-musl-x64
|
|
use_zigbuild: true
|
|
- name: Linux musl ARM64
|
|
os: ubuntu-latest
|
|
target: aarch64-unknown-linux-musl
|
|
binary: agent-browser-linux-musl-arm64
|
|
use_zigbuild: true
|
|
- name: Windows x64
|
|
os: ubuntu-latest
|
|
target: x86_64-pc-windows-gnu
|
|
binary: agent-browser-win32-x64.exe
|
|
use_zigbuild: false
|
|
- name: macOS x64
|
|
os: macos-latest
|
|
target: x86_64-apple-darwin
|
|
binary: agent-browser-darwin-x64
|
|
use_zigbuild: false
|
|
- name: macOS ARM64
|
|
os: macos-latest
|
|
target: aarch64-apple-darwin
|
|
binary: agent-browser-darwin-arm64
|
|
use_zigbuild: false
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .node-version
|
|
cache: pnpm
|
|
|
|
- name: Install npm dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Sync version
|
|
run: pnpm run version:sync
|
|
|
|
- name: Build dashboard
|
|
run: pnpm --filter dashboard build
|
|
|
|
- name: Setup Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
|
|
- name: Install cross-compilation tools (Linux)
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y gcc-aarch64-linux-gnu gcc-x86-64-linux-gnu mingw-w64
|
|
|
|
- name: Install cargo-zigbuild
|
|
if: matrix.use_zigbuild
|
|
run: |
|
|
pip3 install ziglang
|
|
cargo install cargo-zigbuild
|
|
|
|
- name: Configure Rust linkers
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
mkdir -p ~/.cargo
|
|
cat >> ~/.cargo/config.toml << 'EOF'
|
|
[target.aarch64-unknown-linux-gnu]
|
|
linker = "aarch64-linux-gnu-gcc"
|
|
|
|
[target.x86_64-pc-windows-gnu]
|
|
linker = "x86_64-w64-mingw32-gcc"
|
|
EOF
|
|
|
|
- name: Cache Rust build artifacts
|
|
uses: Swatinem/rust-cache@v2
|
|
with:
|
|
workspaces: cli
|
|
|
|
- name: Build with zigbuild
|
|
if: matrix.use_zigbuild
|
|
run: cargo zigbuild --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
|
|
|
|
- name: Build with cargo
|
|
if: '!matrix.use_zigbuild'
|
|
run: cargo build --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
|
|
|
|
- name: Copy binary
|
|
run: |
|
|
mkdir -p artifacts
|
|
if [[ "${{ matrix.target }}" == *"windows"* ]]; then
|
|
cp cli/target/${{ matrix.target }}/release/agent-browser.exe artifacts/${{ matrix.binary }}
|
|
else
|
|
cp cli/target/${{ matrix.target }}/release/agent-browser artifacts/${{ matrix.binary }}
|
|
chmod +x artifacts/${{ matrix.binary }}
|
|
fi
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: ${{ matrix.binary }}
|
|
path: artifacts/${{ matrix.binary }}
|
|
retention-days: 7
|
|
|
|
publish:
|
|
name: Publish to npm
|
|
needs: [check-release, build-binaries]
|
|
if: needs.check-release.outputs.should_release == 'true'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: Release
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .node-version
|
|
cache: pnpm
|
|
registry-url: 'https://registry.npmjs.org'
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Download all binary artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
path: artifacts/
|
|
|
|
- name: Move binaries to bin directory
|
|
run: |
|
|
mkdir -p bin
|
|
find artifacts -type f -name 'agent-browser-*' -exec mv {} bin/ \;
|
|
rm -rf artifacts
|
|
chmod +x bin/agent-browser-* 2>/dev/null || true
|
|
echo "Binaries in bin/:"
|
|
ls -la bin/
|
|
|
|
- name: Verify all binaries exist
|
|
run: |
|
|
EXPECTED_BINARIES=(
|
|
"agent-browser-linux-x64"
|
|
"agent-browser-linux-arm64"
|
|
"agent-browser-linux-musl-x64"
|
|
"agent-browser-linux-musl-arm64"
|
|
"agent-browser-win32-x64.exe"
|
|
"agent-browser-darwin-x64"
|
|
"agent-browser-darwin-arm64"
|
|
)
|
|
MIN_SIZE=100000
|
|
ERRORS=0
|
|
for binary in "${EXPECTED_BINARIES[@]}"; do
|
|
if [ ! -f "bin/$binary" ]; then
|
|
echo "ERROR: Missing bin/$binary"
|
|
ERRORS=$((ERRORS + 1))
|
|
else
|
|
SIZE=$(stat -c%s "bin/$binary" 2>/dev/null || stat -f%z "bin/$binary")
|
|
if [ "$SIZE" -lt "$MIN_SIZE" ]; then
|
|
echo "ERROR: bin/$binary is too small ($SIZE bytes, expected >= $MIN_SIZE)"
|
|
ERRORS=$((ERRORS + 1))
|
|
else
|
|
echo "OK: bin/$binary ($SIZE bytes)"
|
|
fi
|
|
fi
|
|
done
|
|
if [ "$ERRORS" -gt 0 ]; then
|
|
echo "Error: $ERRORS binary issues found"
|
|
exit 1
|
|
fi
|
|
echo "All 7 platform binaries present and valid"
|
|
|
|
- name: Publish to npm
|
|
run: npm publish --provenance
|
|
|
|
github-release:
|
|
name: Create GitHub Release
|
|
needs: [check-release, build-binaries, publish]
|
|
if: always() && needs.build-binaries.result == 'success' && needs.check-release.outputs.needs_github_release == 'true'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Download all artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
path: artifacts/
|
|
|
|
- name: Move binaries to bin directory
|
|
run: |
|
|
mkdir -p bin
|
|
find artifacts -type f -name 'agent-browser-*' -exec mv {} bin/ \;
|
|
rm -rf artifacts
|
|
chmod +x bin/agent-browser-* 2>/dev/null || true
|
|
ls -la bin/
|
|
|
|
- name: Verify binaries exist
|
|
run: |
|
|
BINARY_COUNT=$(ls bin/agent-browser-* 2>/dev/null | wc -l)
|
|
if [ "$BINARY_COUNT" -lt 7 ]; then
|
|
echo "Error: Expected 7 binaries, found $BINARY_COUNT"
|
|
ls -la bin/
|
|
exit 1
|
|
fi
|
|
echo "Found $BINARY_COUNT binaries"
|
|
|
|
- name: Extract changelog entry
|
|
run: |
|
|
VERSION="${{ needs.check-release.outputs.version }}"
|
|
awk '/<!-- release:start -->/{found=1; next} /<!-- release:end -->/{found=0} found{print}' CHANGELOG.md > /tmp/release-notes.md
|
|
|
|
LINES=$(wc -l < /tmp/release-notes.md | tr -d ' ')
|
|
if [ "$LINES" -lt 2 ]; then
|
|
echo "Error: No release notes found between <!-- release:start --> and <!-- release:end --> markers in CHANGELOG.md"
|
|
exit 1
|
|
fi
|
|
echo "Extracted release notes for $VERSION ($LINES lines)"
|
|
|
|
- name: Create GitHub Release
|
|
run: |
|
|
VERSION="${{ needs.check-release.outputs.version }}"
|
|
TAG="v$VERSION"
|
|
|
|
if gh release view "$TAG" &>/dev/null; then
|
|
echo "Release $TAG already exists, uploading assets..."
|
|
gh release upload "$TAG" bin/agent-browser-* --clobber
|
|
else
|
|
echo "Creating release $TAG..."
|
|
gh release create "$TAG" \
|
|
--title "$TAG" \
|
|
--notes-file /tmp/release-notes.md \
|
|
bin/agent-browser-*
|
|
fi
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|