LinuxInstall.yml

name: Linux_AppImage

on:
  workflow_dispatch:
    inputs:
      source_sha:
        description: "Accepted Session 06 source commit to package"
        required: true
        type: string

# Least privilege for GITHUB_TOKEN: checkout reads the repo and artifacts are
# uploaded via the job token.
permissions:
  contents: read

jobs:
  build_ubuntu:
    # linuxdeployqt is pinned to a glibc-2.35-compatible build. Keep the
    # packaging runner aligned with that oldest-supported deployment tool.
    runs-on: ubuntu-22.04
    env:
      VCPKG_OVERLAY_PORTS: ${{ github.workspace }}/loop/vcpkg/overlays/linux:${{ github.workspace }}/loop/vcpkg/overlays/general
      VCPKG_INSTALLED_DIR: ${{ github.workspace }}/vcpkg_installed
      VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}/vcpkg-binary-cache
      GNUPGHOME: ${{ github.workspace }}/gnupg
      QT_QPA_PLATFORM: offscreen

    steps:
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libxcb-cursor0 libspeechd2 libfontconfig1-dev gnupg2 wget appstream libcups2 libcups2-dev

      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          path: loop
          ref: ${{ inputs.source_sha }}
          fetch-depth: 0

      - name: Verify exact source SHA
        working-directory: loop
        env:
          EXPECTED_SOURCE_SHA: ${{ inputs.source_sha }}
        run: |
          if ! [[ "$EXPECTED_SOURCE_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
            echo "::error::source_sha must be a full 40-character Git SHA"
            exit 1
          fi
          actual_sha="$(git rev-parse HEAD)"
          if [ "${actual_sha,,}" != "${EXPECTED_SOURCE_SHA,,}" ]; then
            echo "::error::Checkout SHA $actual_sha does not match source_sha $EXPECTED_SOURCE_SHA"
            exit 1
          fi
          echo "LOOP_SOURCE_SHA=$actual_sha" >> "$GITHUB_ENV"
          echo "Packaging source SHA: $actual_sha"

      - name: Verify supply-chain pins
        working-directory: loop
        run: python3 scripts/ci/check_supply_chain_pins.py

      - name: Resolve verified packaging tool pins
        working-directory: loop
        run: |
          python3 - <<'PY'
          import json
          import os

          with open(".github/pins/packaging-tools.json", encoding="utf-8") as f:
              pins = json.load(f)

          values = {
              "APPIMAGETOOL_ASSET_ID": str(pins["appimagetool"]["assetId"]),
              "APPIMAGETOOL_SHA256": pins["appimagetool"]["sha256"],
              "RUNTIME_ASSET_ID": str(pins["appimageRuntime"]["assetId"]),
              "RUNTIME_SHA256": pins["appimageRuntime"]["sha256"],
              "LINUXDEPLOYQT_ASSET_ID": str(pins["linuxdeployqt"]["assetId"]),
              "LINUXDEPLOYQT_SHA256": pins["linuxdeployqt"]["sha256"],
          }

          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
              for key, value in values.items():
                  f.write(f"{key}={value}\n")
          PY

      - name: Install appimagetool
        working-directory: loop
        run: |
          bash scripts/ci/download_verified.sh \
            --gh-asset "AppImage/appimagetool" \
            "$APPIMAGETOOL_ASSET_ID" \
            appimagetool-x86_64.AppImage \
            "$APPIMAGETOOL_SHA256"
          chmod +x appimagetool-x86_64.AppImage
          sudo mv appimagetool-x86_64.AppImage /usr/local/bin/appimagetool

      - name: Download verified AppImage runtime
        working-directory: loop
        run: |
          # appimagetool otherwise resolves the *latest* type-2 runtime on its own.
          # Supply the exact pinned runtime so packaging never resolves a mutable
          # downstream binary.
          bash scripts/ci/download_verified.sh \
            --gh-asset "AppImage/type2-runtime" \
            "$RUNTIME_ASSET_ID" \
            "$GITHUB_WORKSPACE/runtime-x86_64" \
            "$RUNTIME_SHA256"
          chmod +x "$GITHUB_WORKSPACE/runtime-x86_64"

      - name: 'VCPKG: Set up VCPKG'
        run: |
          mkdir -p "$VCPKG_DEFAULT_BINARY_CACHE"
          VCPKG_COMMIT="$(python3 - <<'PY'
          import json
          with open("loop/vcpkg-configuration.json", encoding="utf-8") as f:
              print(json.load(f)["default-registry"]["baseline"])
          PY
          )"

          if ! [[ "$VCPKG_COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
              echo "::error::Invalid vcpkg baseline: $VCPKG_COMMIT"
              exit 1
          fi

          git clone https://github.com/microsoft/vcpkg.git
          git -C vcpkg checkout --detach "$VCPKG_COMMIT"

          ACTUAL="$(git -C vcpkg rev-parse HEAD)"
          test "$ACTUAL" = "$VCPKG_COMMIT" || {
              echo "::error::vcpkg checkout does not match manifest baseline"
              exit 1
          }

          ./vcpkg/bootstrap-vcpkg.sh
          ./vcpkg/vcpkg integrate install
          echo "VCPKG_BINARY_SOURCES=clear;files,$VCPKG_DEFAULT_BINARY_CACHE,readwrite" >> "$GITHUB_ENV"

      - name: 'VCPKG: Cache vcpkg dependencies'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: |
            ./vcpkg/downloads
            ./vcpkg/packages
            ./vcpkg_installed
            ./vcpkg-binary-cache
          key: ${{ runner.os }}-vcpkg-v2-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
          restore-keys: |
            ${{ runner.os }}-vcpkg-v2-

      - name: 'VCPKG: Install Project Dependencies'
        run: |
          ./vcpkg install --triplet x64-linux-release --x-manifest-root=${{ github.workspace }}/loop --x-install-root=$VCPKG_INSTALLED_DIR --clean-buildtrees-after-build --clean-packages-after-build
        working-directory: vcpkg

      - name: Install Qt
        uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730  # v4.3.1
        with:
          version: '6.11.1'
          host: 'linux'
          target: 'desktop'
          dir: '${{ github.workspace }}/qt/'
          install-deps: 'true'
          modules: 'qtspeech qtmultimedia'
          cache: 'true'
          cache-key-prefix: ${{ runner.os }}-qt-6111

      - name: Build Project
        working-directory: loop
        run: |
          cmake -B build -S . -DLOOP_INSTALL_QT_DEPENDENCIES=0 -DCMAKE_TOOLCHAIN_FILE=../vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_VCPKG_BUILD_TYPE=Release -DLOOP_INSTALL_TO_USR=ON -DLOOP_LOOP_DISTRIBUTION=ON -DLOOP_PLUGIN_OCR=OFF -DLOOP_BUILD_PRODUCT_QUICK_A11Y_SMOKE=ON
          cmake --build build --target LoopEditor PdfTool ProductQuickAccessibilitySmoke release_translations -j6
          cmake --install build
          pwsh ./scripts/verify-loop-surface.ps1 -InstallDir "$GITHUB_WORKSPACE/loop/build/install" -Profile loop-release -BuildDir build -InstallManifestPath build/install_manifest.txt

      - name: Run product Quick accessibility qualification harness (native)
        working-directory: loop
        run: |
          evidence_dir="$RUNNER_TEMP/loop-package-boundary-linux"
          mkdir -p "$evidence_dir"
          set -o pipefail
          echo "source_sha=$LOOP_SOURCE_SHA" | tee "$evidence_dir/quick-a11y-native.txt"
          pwsh ./scripts/run-product-quick-a11y-smoke.ps1 -BuildDir build -Backend native 2>&1 | tee -a "$evidence_dir/quick-a11y-native.txt"

      - name: Run product Quick accessibility qualification harness (software)
        working-directory: loop
        run: |
          evidence_dir="$RUNNER_TEMP/loop-package-boundary-linux"
          mkdir -p "$evidence_dir"
          set -o pipefail
          echo "source_sha=$LOOP_SOURCE_SHA" | tee "$evidence_dir/quick-a11y-software.txt"
          pwsh ./scripts/run-product-quick-a11y-smoke.ps1 -BuildDir build -Backend software 2>&1 | tee -a "$evidence_dir/quick-a11y-software.txt"

      - name: Read version
        id: get_version
        run: |
          version=$(cat "loop/build/version.txt")
          echo "Version: $version"
          echo "appimagefilename=Loop-pdf-$version-x86_64.AppImage" >> $GITHUB_ENV
          echo "appimage_update_info=gh-releases-zsync|mberrys|Loop-pdf|latest|Loop-pdf-*-x86_64.AppImage.zsync" >> $GITHUB_ENV
          echo "AppImage file name: Loop-pdf-$version-x86_64.AppImage"

      - name: 'Linux Deploy Qt'
        working-directory: loop/build
        run: |
          evidence_dir="$RUNNER_TEMP/loop-package-boundary-linux"
          mkdir -p "$evidence_dir"
          set -o pipefail
          loop_quick_src="$GITHUB_WORKSPACE/loop/build/LoopEditor/Loop/Quick"
          qml_dest="install/usr/lib/qml/Loop/Quick"
          if [ ! -d "$loop_quick_src" ]; then
            echo "::error::Built Loop.Quick QML module was not found: $loop_quick_src"
            exit 1
          fi
          mkdir -p "$(dirname "$qml_dest")"
          cp -a "$loop_quick_src" "$qml_dest"
          # Qt 6.11 ships optional SQL drivers that linuxdeployqt probes but we do
          # not bundle. Remove them so deploy does not fail on missing vendor libs.
          rm -rf "${QT_ROOT_DIR}/plugins/sqldrivers"
          cp install/usr/share/icons/hicolor/scalable/apps/io.github.mberrys.Loop-pdf.svg install/io.github.mberrys.Loop-pdf.svg
          bash "$GITHUB_WORKSPACE/loop/scripts/ci/download_verified.sh" \
            --gh-asset "probonopd/linuxdeployqt" \
            "$LINUXDEPLOYQT_ASSET_ID" \
            deploy.AppImage \
            "$LINUXDEPLOYQT_SHA256"
          chmod +x deploy.AppImage
          ./deploy.AppImage --appimage-extract-and-run \
            install/usr/share/applications/io.github.mberrys.Loop-pdf.desktop \
            -executable-dir=install/usr/bin \
            -extra-plugins=iconengines,imageformats,texttospeech 2>&1 | tee "$evidence_dir/linuxdeployqt.txt"

      - name: Prepare GPG home
        if: vars.SIGN_APPIMAGE == 'true'
        run: |
          rm -rf "$GNUPGHOME"
          install -d -m 700 "$GNUPGHOME"
          echo "use-agent" >> "$GNUPGHOME/gpg.conf"
          echo "pinentry-mode loopback" >> "$GNUPGHOME/gpg.conf"
          echo "allow-loopback-pinentry" >> "$GNUPGHOME/gpg-agent.conf"
          echo "allow-preset-passphrase" >> "$GNUPGHOME/gpg-agent.conf"
          gpgconf --kill gpg-agent
          echo "${{ secrets.PGP_PRIVATE_KEY }}" | gpg --batch --import
          for keygrip in $(gpg --list-secret-keys --with-keygrip "${{ secrets.PGP_KEY_ID }}" | grep Keygrip | awk '{print $3}'); do
            echo "${{ secrets.PGP_PASSPHRASE }}" | "$(gpgconf --list-dirs libexecdir)/gpg-preset-passphrase" --preset "$keygrip"
          done
        env:
          GNUPGHOME: ${{ env.GNUPGHOME }}

      - name: Pack AppImage (unsigned — V1 default)
        if: vars.SIGN_APPIMAGE != 'true'
        working-directory: loop/build
        run: |
          appimagetool \
            --runtime-file "$GITHUB_WORKSPACE/runtime-x86_64" \
            -u "${{ env.appimage_update_info }}" \
            install/ ${{ env.appimagefilename }}

      - name: Sign and Repack AppImage
        if: vars.SIGN_APPIMAGE == 'true'
        working-directory: loop/build
        run: |
          appimagetool \
            --runtime-file "$GITHUB_WORKSPACE/runtime-x86_64" \
            -u "${{ env.appimage_update_info }}" \
            -s --sign-key "${{ secrets.PGP_KEY_ID }}" \
            install/ ${{ env.appimagefilename }}
        env:
          GNUPGHOME: ${{ env.GNUPGHOME }}

      - name: Manual signature
        if: vars.SIGN_APPIMAGE == 'true'
        run: |
          gpg --batch --yes --verbose --pinentry-mode loopback --detach-sign --passphrase "${{ secrets.PGP_PASSPHRASE }}" --local-user "${{ secrets.PGP_KEY_ID }}" --output loop/build/${{ env.appimagefilename }}.sig loop/build/${{ env.appimagefilename }}
        env:
          GNUPGHOME: ${{ env.GNUPGHOME }}

      - name: Verify AppImage Detached Signature
        if: vars.SIGN_APPIMAGE == 'true'
        run: |
          echo "${{ secrets.PGP_PUBLIC_KEY }}" | gpg --batch --import
          gpg --verify loop/build/${{ env.appimagefilename }}.sig loop/build/${{ env.appimagefilename }}
        env:
          GNUPGHOME: ${{ env.GNUPGHOME }}

      - name: Run AppImage smoke test
        working-directory: loop
        env:
          QT_QPA_PLATFORM: offscreen
        run: |
          chmod +x "build/${{ env.appimagefilename }}"
          evidence_dir="$RUNNER_TEMP/loop-package-boundary-linux"
          mkdir -p "$evidence_dir"
          set -o pipefail
          bash ./scripts/smoke-test-appimage.sh "build/${{ env.appimagefilename }}" "loop-preflight/testdata/fixtures/bleed-adequate.pdf" 2>&1 | tee "$evidence_dir/appimage-smoke.txt"

      - name: Inspect AppImage package boundary
        working-directory: loop
        run: |
          evidence_dir="$RUNNER_TEMP/loop-package-boundary-linux"
          mkdir -p "$evidence_dir"
          set -o pipefail
          python3 scripts/ci/inspect_package_dependencies.py \
            --platform linux \
            --package "build/${{ env.appimagefilename }}" \
            --source-sha "$LOOP_SOURCE_SHA" \
            --expected-architecture x86-64 \
            --work-dir "$RUNNER_TEMP/loop-package-boundary-linux-work" \
            --output "$evidence_dir/evidence.json" \
            --report "$evidence_dir/inspection.txt" 2>&1 | tee "$evidence_dir/inspector.txt"

      - name: Upload Linux package boundary evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: loop-package-boundary-linux-evidence
          path: ${{ runner.temp }}/loop-package-boundary-linux
          if-no-files-found: error
          retention-days: 30
          compression-level: 0

      - name: Upload AppImage Package
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: ${{ env.appimagefilename }}
          path: ./loop/build/${{ env.appimagefilename }}
          retention-days: 30
          compression-level: 0

      - name: Upload AppImage Signature File
        if: vars.SIGN_APPIMAGE == 'true'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: ${{ env.appimagefilename }}.sig
          path: ./loop/build/${{ env.appimagefilename }}.sig
          retention-days: 30
          if-no-files-found: warn
          compression-level: 0

      - name: Upload AppImage zsync File
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: ${{ env.appimagefilename }}.zsync
          path: ./loop/build/${{ env.appimagefilename }}.zsync
          retention-days: 30
          if-no-files-found: warn
          compression-level: 0

      - name: Cleanup GPG home
        if: always() && vars.SIGN_APPIMAGE == 'true'
        run: |
          rm -rf "$GNUPGHOME"
        env:
          GNUPGHOME: ${{ env.GNUPGHOME }}