appimage.yml

name: AppImage

on:
  push:
    tags:
      - "v*"
      - "[0-9]*.[0-9]*.[0-9]*"
  workflow_dispatch:

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  # Pinned tool releases + digests — update both together when upgrading.
  # The old pins pointed at the upstream `continuous` tags, whose assets are
  # re-published and silently change checksum (broke the 0.1.0 release).
  # Immutable version tags keep download URL and digest in agreement.
  # Recompute: sha256sum <downloaded-file>
  LINUXDEPLOY_VERSION: 1-alpha-20251107-1
  LINUXDEPLOY_SHA256: c20cd71e3a4e3b80c3483cef793cda3f4e990aca14014d23c544ca3ce1270b4d
  APPIMAGETOOL_VERSION: 1.9.1
  APPIMAGETOOL_SHA256: ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0

jobs:
  build-appimage:
    name: Build AppImage (Ubuntu 22.04)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Install system dependencies
        run: |
          sudo apt-get -o Acquire::Retries=3 update
          sudo apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
            libpipewire-0.3-dev libwayland-dev pkg-config imagemagick file

      - name: Cache cargo registry and build
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Install cargo-deny
        run: cargo install cargo-deny --version 0.19.4 --locked

      - name: Audit dependencies
        run: cargo deny check

      - name: Validate AppImage prerequisites
        run: bash tests/packaging/appimage_validate.sh

      - name: Build release binary
        run: cargo build --release

      - name: Stage binary into AppDir
        run: cp target/release/honkhonk packaging/appimage/HonkHonk.AppDir/usr/bin/honkhonk

      - name: Download and verify linuxdeploy
        run: |
          curl -fsSL -o linuxdeploy \
            "https://github.com/linuxdeploy/linuxdeploy/releases/download/${LINUXDEPLOY_VERSION}/linuxdeploy-x86_64.AppImage"
          echo "${LINUXDEPLOY_SHA256}  linuxdeploy" | sha256sum --check --strict
          chmod +x linuxdeploy

      - name: Bundle shared libraries with linuxdeploy
        run: |
          ./linuxdeploy \
            --appdir packaging/appimage/HonkHonk.AppDir \
            --executable packaging/appimage/HonkHonk.AppDir/usr/bin/honkhonk \
            --desktop-file assets/honkhonk.desktop \
            --icon-file assets/icons/hicolor/256x256/apps/honkhonk.png

      - name: Download and verify appimagetool
        run: |
          curl -fsSL -o appimagetool \
            "https://github.com/AppImage/appimagetool/releases/download/${APPIMAGETOOL_VERSION}/appimagetool-x86_64.AppImage"
          echo "${APPIMAGETOOL_SHA256}  appimagetool" | sha256sum --check --strict
          chmod +x appimagetool

      - name: Build AppImage
        env:
          ARCH: x86_64
        run: |
          ./appimagetool \
            packaging/appimage/HonkHonk.AppDir \
            HonkHonk-x86_64.AppImage

      - name: Upload AppImage artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: honkhonk-appimage-${{ github.ref_name }}
          path: HonkHonk-x86_64.AppImage

      - name: Attach AppImage to GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          for i in $(seq 1 30); do
            gh release view "$TAG_NAME" >/dev/null 2>&1 && break
            echo "Waiting for release to be created... ($i/30)"
            sleep 10
          done
          gh release view "$TAG_NAME" >/dev/null 2>&1 || { echo "Release not found after 5 minutes"; exit 1; }
          gh release upload "$TAG_NAME" HonkHonk-x86_64.AppImage --clobber