fix(ci): publish desktop binaries to the private package registry #110

Merged

David merged 2 commits from fix/desktop-workflows-publish-to-packages into main

2026-05-15 02:57:19 +02:00

David commented

2026-05-15 02:53:51 +02:00

Owner

Summary

Same gap PR #107 (publish-release.yml) and #109 (build-oci-image.yml) closed, this time on the desktop workflows. build-desktop-linux.yml and build-desktop-windows.yml were uploading the built binary via forgejo/upload-artifact@v4, which attaches it to the workflow run UI for 90 days but never publishes it anywhere a consumer can fetch from. The last runs landed at actions/runs/3281/artifacts/72 and actions/runs/3282/artifacts/71 instead of in the Generic Packages namespace, which is what the desktop self-updater (#103) reads when checking for updates.

Both workflows now match the org pattern (see da-os/.forgejo/workflows/build-{linux,windows}.yml).

Changes (mirrored across both desktop workflows)

permissions: packages: write added.
Job env block: FORGEJO_TOKEN = secrets.A8N_TOOLS_PRIVATE_PACKAGE_PAT, PACKAGE_OWNER = vars.A8N_TOOLS_PRIVATE_PACKAGE_OWNER, PACKAGE_NAME = lets-chat.
Upload artifact step (forgejo/upload-artifact@v4) replaced with Upload binary to Generic Packages that DELETE-then-PUTs against ${GITHUB_SERVER_URL}/api/packages/${owner}/generic/lets-chat/${version}/lets-chat-desktop-{linux|windows}-x86_64[.exe] with Authorization: token ${FORGEJO_TOKEN}.

Upload URL uses the stable filename lets-chat-desktop-{linux|windows}-x86_64[.exe] (version is already in the URL path), matching what the self-updater's manifest in publish-release.yml references. The local extract step still names the file with the version for readability when poking around on the runner; only the upload-time filename is stable.

Audit

Re-grepped every workflow under .forgejo/workflows/ for upload-artifact and the old auth pattern: zero remaining references to forgejo/upload-artifact@v4, zero remaining secrets.FORGEJO_PAT, zero remaining GITHUB_REPOSITORY_OWNER driving a registry push.

publish-release.yml's build+upload steps duplicate work with these two workflows on v* tag pushes (it rebuilds both binaries and uploads them to the same URL). The DELETE-then-PUT pattern makes the duplication harmless but is wasted CI time and should be deduplicated in a follow-up - the manifest generation in publish-release.yml is what is uniquely needed.

Test plan

Next push to main produces ${ORG}/generic/lets-chat/latest/lets-chat-desktop-linux-x86_64 and ...windows-x86_64.exe in the Generic Packages UI, and actions/runs/.../artifacts/... no longer contains the desktop binary.
Next v* tag push produces ${ORG}/generic/lets-chat/v.../lets-chat-desktop-{linux,windows}-x86_64[.exe] plus the existing latest/latest.json manifest, and the desktop self-updater's --check-update against the deployed URL sees the new version.

## Summary Same gap PR #107 (publish-release.yml) and #109 (build-oci-image.yml) closed, this time on the desktop workflows. `build-desktop-linux.yml` and `build-desktop-windows.yml` were uploading the built binary via `forgejo/upload-artifact@v4`, which attaches it to the workflow run UI for 90 days but never publishes it anywhere a consumer can fetch from. The last runs landed at `actions/runs/3281/artifacts/72` and `actions/runs/3282/artifacts/71` instead of in the Generic Packages namespace, which is what the desktop self-updater (#103) reads when checking for updates. Both workflows now match the org pattern (see da-os/.forgejo/workflows/build-{linux,windows}.yml). ## Changes (mirrored across both desktop workflows) - `permissions: packages: write` added. - Job env block: `FORGEJO_TOKEN = secrets.A8N_TOOLS_PRIVATE_PACKAGE_PAT`, `PACKAGE_OWNER = vars.A8N_TOOLS_PRIVATE_PACKAGE_OWNER`, `PACKAGE_NAME = lets-chat`. - `Upload artifact` step (forgejo/upload-artifact@v4) replaced with `Upload binary to Generic Packages` that DELETE-then-PUTs against `${GITHUB_SERVER_URL}/api/packages/${owner}/generic/lets-chat/${version}/lets-chat-desktop-{linux|windows}-x86_64[.exe]` with `Authorization: token ${FORGEJO_TOKEN}`. Upload URL uses the stable filename `lets-chat-desktop-{linux|windows}-x86_64[.exe]` (version is already in the URL path), matching what the self-updater's manifest in `publish-release.yml` references. The local extract step still names the file with the version for readability when poking around on the runner; only the upload-time filename is stable. ## Audit Re-grepped every workflow under `.forgejo/workflows/` for `upload-artifact` and the old auth pattern: zero remaining references to `forgejo/upload-artifact@v4`, zero remaining `secrets.FORGEJO_PAT`, zero remaining `GITHUB_REPOSITORY_OWNER` driving a registry push. `publish-release.yml`'s build+upload steps duplicate work with these two workflows on `v*` tag pushes (it rebuilds both binaries and uploads them to the same URL). The DELETE-then-PUT pattern makes the duplication harmless but is wasted CI time and should be deduplicated in a follow-up - the manifest generation in publish-release.yml is what is uniquely needed. ## Test plan - [ ] Next push to `main` produces `${ORG}/generic/lets-chat/latest/lets-chat-desktop-linux-x86_64` and `...windows-x86_64.exe` in the Generic Packages UI, and `actions/runs/.../artifacts/...` no longer contains the desktop binary. - [ ] Next `v*` tag push produces `${ORG}/generic/lets-chat/v.../lets-chat-desktop-{linux,windows}-x86_64[.exe]` plus the existing `latest/latest.json` manifest, and the desktop self-updater's `--check-update` against the deployed URL sees the new version.

David added 1 commit

2026-05-15 02:53:51 +02:00

fix(ci): publish desktop binaries to the private package registry

Check / clippy + fmt + tests (pull_request) Successful in 1m5s

Details

1602316737

The desktop workflows were uploading the built binary via `forgejo/upload-artifact@v4`, which attaches it to the workflow run UI for 90 days but never publishes it anywhere a consumer (including the desktop self-updater added in #103) can fetch from. Last `build-desktop-linux.yml` and `build-desktop-windows.yml` runs uploaded to /actions/runs/3281/artifacts/72 and /actions/runs/3282/artifacts/71 respectively, which is exactly the failure mode publish-release.yml was already fixed to avoid in #107.

Align both desktop workflows with the same org pattern every other build in `~/projects/a8n-run/` uses (see da-os/.forgejo/workflows/build-{linux,windows}.yml):

- Add `permissions: packages: write`.
- Add job env block with `FORGEJO_TOKEN = secrets.A8N_TOOLS_PRIVATE_PACKAGE_PAT`, `PACKAGE_OWNER = vars.A8N_TOOLS_PRIVATE_PACKAGE_OWNER`, `PACKAGE_NAME = lets-chat`.
- Replace the `Upload artifact` step with `Upload binary to Generic Packages` that runs DELETE-then-PUT against `${GITHUB_SERVER_URL}/api/packages/${owner}/generic/lets-chat/${version}/lets-chat-desktop-{linux|windows}-x86_64[.exe]` with `Authorization: token ${FORGEJO_TOKEN}`. Best-effort DELETE lets re-runs of the same version overwrite cleanly; failed PUT fails the workflow.

The upload URL uses the stable filename `lets-chat-desktop-{linux|windows}-x86_64[.exe]` (version is already in the path), matching what the desktop self-updater's manifest in `publish-release.yml` references. The local extract step still names the file `lets-chat-desktop-($version)-{linux|windows}-x86_64[.exe]` for readability when poking around the runner; only the upload-time filename is stable. The previous `forgejo/upload-artifact` step is gone; if the workflow-run artifact UI is wanted back for CI debugging on a non-tag push, that's a follow-up.

Audit: every workflow under `.forgejo/workflows/` was rechecked; this leaves no remaining `upload-artifact` calls in the repo and no remaining references to `secrets.FORGEJO_PAT` or `GITHUB_REPOSITORY_OWNER` as an authority for a registry push. `publish-release.yml`'s build+upload steps duplicate work with these two workflows on `v*` tag pushes (it rebuilds both binaries and uploads them to the same URL); the DELETE-then-PUT pattern makes the duplication harmless but it is wasted CI time and should get deduplicated in a follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

David added 1 commit

2026-05-15 02:57:13 +02:00

Merge branch 'main' into fix/desktop-workflows-publish-to-packages

Check / clippy + fmt + tests (pull_request) Successful in 1m5s

Details

9100e5970f