From a9bfc04cf36cdbe0160f03a328de8fb5ef506e85 Mon Sep 17 00:00:00 2001 From: jwinterm Date: Fri, 15 May 2026 10:21:42 -0400 Subject: [PATCH] Add Linux build CI workflow (Gitea Actions / GitHub Actions compatible) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Single workflow at .github/workflows/build-linux.yml that builds Linux release in Cake's prebuilt Docker image. Skips the simplybs source-toolchain bootstrap (which ate 9GB on jw-laptop before bailing) — uses the prebuilt monero_c .so bundle instead, just like Cake's own CI does. Targets runs-on: ubuntu-latest, which matches both your linux-beast self-hosted runner (per its labels in the Gitea runners panel) AND GitHub-hosted ubuntu-latest, so the same workflow file works whether CI fires from Gitea Actions or GitHub Actions. Triggers on push to dev/main, on PRs, and manual workflow_dispatch. Outputs hash_wallet_linux_.zip as a downloadable artifact (14d retention). Secrets needed on the runner / repo: - TROCADOR_API_KEY - TROCADOR_MONERO_API_KEY (set to same value as TROCADOR_API_KEY for now) - TROCADOR_EXCHANGE_MARKUP (e.g. "1") Add via: GitHub repo Settings > Secrets and variables > Actions, or Gitea repo Settings > Secrets. --- .github/workflows/build-linux.yml | 174 ++++++++++++++++++++++++++++++ 1 file changed, 174 insertions(+) create mode 100644 .github/workflows/build-linux.yml diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml new file mode 100644 index 000000000..fe58093fd --- /dev/null +++ b/.github/workflows/build-linux.yml @@ -0,0 +1,174 @@ +name: Hash Wallet Linux build + +# Triggers: +# - on push to dev/main (validates the foundation each time we land work) +# - on PRs targeting dev/main (gates merges) +# - manual via workflow_dispatch ("Run workflow" button in the UI) +on: + push: + branches: [dev, main] + pull_request: + branches: [dev, main] + workflow_dispatch: + +defaults: + run: + shell: bash + +jobs: + build: + # Both your Gitea linux-beast runner and GitHub-hosted ubuntu runners + # carry the `ubuntu-latest` label, so this works on either platform. + runs-on: ubuntu-latest + container: + # Cake Labs' prebuilt build image with Flutter 3.32.0, Go 1.24.1, NDK r28, + # Rust nightly, and all the C++ build deps (boost, openssl, libsodium, + # libzmq, unbound, icu) preinstalled. Saves us from doing the simplybs + # source-bootstrap dance that ate 9GB on jw-laptop. + image: ghcr.io/cake-tech/cake_wallet:debian13-flutter3.32.0-ndkr28-go1.24.1-ruststablenightly + env: + BRANCH_NAME: ${{ github.head_ref || github.ref_name }} + # cake_wallet build profile name, retained from upstream — internal + # identifier only, doesn't appear in the binary or UI. + APP_LINUX_TYPE: cakewallet + + steps: + - name: Fix Actions HOME pointing at /github/home (breaks ~/.cache writes) + run: echo "HOME=/root" >> $GITHUB_ENV + + - uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Configure git inside the container + run: | + git config --global --add safe.directory '*' + git config --global user.email "ci@suchsoftware.com" + git config --global user.name "Hash Wallet CI" + + # ---- Secrets --------------------------------------------------------- + # tool/.secrets-config.json is the source-of-truth for lib/.secrets.g.dart + # generation. Populate from CI secrets. EMPTY for non-Trocador entries + # because we don't have other affiliate keys yet. + - name: Inject Trocador + Bitcoin secrets + env: + TROCADOR_API_KEY: ${{ secrets.TROCADOR_API_KEY }} + TROCADOR_MONERO_API_KEY: ${{ secrets.TROCADOR_MONERO_API_KEY }} + TROCADOR_EXCHANGE_MARKUP: ${{ secrets.TROCADOR_EXCHANGE_MARKUP }} + run: | + set -e + mkdir -p tool + cat > tool/.secrets-config.json < tool/.bitcoin-secrets-config.json + # Other per-module configs default to empty {} unless we add keys. + echo '{}' > tool/.evm-secrets-config.json + echo '{}' > tool/.solana-secrets-config.json + echo '{}' > tool/.tron-secrets-config.json + echo '{}' > tool/.nano-secrets-config.json + + # ---- External clones (use prebuilt tarballs, NOT prepare_*.sh) ------- + # The prepare_torch.sh / prepare_reown.sh scripts do dev-time clones + # that take forever; CI uses the pre-tagged release tarballs instead. + - name: Fetch prebuilt torch_dart + run: | + set -x -e + pushd scripts + rm -rf torch_dart torch_dart.tar.gz + wget -q https://github.com/MrCyjaneK/torch_dart/releases/download/v1.0.17/torch_dart-v1.0.17.tar.gz -O torch_dart.tar.gz + mkdir torch_dart + tar -xzf torch_dart.tar.gz -C torch_dart + rm torch_dart.tar.gz + popd + + - name: Fetch prebuilt reown_flutter + run: | + set -x -e + pushd scripts + rm -rf reown_flutter reown_flutter.tar.gz + wget -q https://github.com/cake-tech/reown_flutter/releases/download/v0.0.4/reown_flutter-v0.0.4.tar.gz -O reown_flutter.tar.gz + mkdir reown_flutter + tar -xzf reown_flutter.tar.gz -C reown_flutter + rm reown_flutter.tar.gz + popd + + - name: Clone BitBox Flutter (small, builds fast) + run: | + set -x -e + pushd scripts + ./build_bitbox_flutter.sh + popd + + # ---- Native crypto cores (monero_c prebuilt bundle) ------------------ + # Skips the full simplybs toolchain bootstrap. The bundle has libmonero, + # libwownero, AND libzano .so files; CMake only installs the ones we + # ship (monero + wownero). + - name: Fetch prebuilt monero_c .so bundle + run: | + set -x -e + ./scripts/prepare_moneroc.sh + MONERO_C_TAG=$(cd scripts/monero_c && git describe --tags) + echo "monero_c TAG: $MONERO_C_TAG" + mkdir -p "scripts/monero_c/release/$MONERO_C_TAG" + pushd "scripts/monero_c/release/$MONERO_C_TAG" + wget -q https://github.com/MrCyjaneK/monero_c/releases/download/v0.18.4.6-RC1/release-bundle.zip + unzip -q release-bundle.zip + rm release-bundle.zip + ls x86_64-linux-gnu/ + popd + + # ---- Configure: pubspec.yaml, AndroidManifest.xml, env vars ---------- + - name: Run configure (cakewallet build profile) + run: | + pushd scripts/linux + source ./app_env.sh cakewallet + ./app_config.sh + popd + + # ---- Codegen: mobx, hive adapters, FFI bindings ---------------------- + # model_generator.sh is already trimmed to our 8 enabled chains. + # Use `async` flag for parallel build_runner across modules. + - name: Generate per-module secrets.g.dart files + run: dart run tool/generate_new_secrets.dart + + - name: Build generated code (mobx + hive adapters) + run: bash model_generator.sh async + + - name: Generate localization + run: dart run tool/generate_localization.dart + + # ---- Compile + package ---------------------------------------------- + - name: Build Linux app + run: flutter build linux --dart-define-from-file=env.json --release + + - name: Compress release bundle + run: | + pushd build/linux/x64/release + zip -r hash_wallet_linux_${{ github.sha }}.zip bundle + popd + + - name: Upload artifact + uses: actions/upload-artifact@v4 + with: + name: hash-wallet-linux-${{ github.sha }} + path: build/linux/x64/release/hash_wallet_linux_*.zip + retention-days: 14