Merge branch 'main' into harden/pin-thirdparty-actions

Author: antsgar

.github/workflows/desktop.release.reuse.yml

@@ -330,7 +330,9 @@ jobs:
 
       - name: Install Snapcraft
         run: |
-          sudo snap install snapcraft --classic
+          # Pin to 8.x: electron-builder's legacy core22 snap target calls `snapcraft snap`,
+          # which was removed in snapcraft 9.0 (renamed to `pack`).
+          sudo snap install snapcraft --classic --channel=8.x/stable
 
       - name: Setup LXD
         uses: canonical/setup-lxd@v0.1.1
@@ -414,5 +416,5 @@ jobs:
 
       - name: Publish Snap
         run: |
-          sudo snap install snapcraft --classic
+          sudo snap install snapcraft --classic --channel=8.x/stable
           snapcraft upload dist/standard-notes-${{ env.APP_VERSION }}-linux-amd64.snap --release stable,candidate,beta,edge

.github/workflows/mobile.release.closed-beta.yml

@@ -0,0 +1,59 @@
+name: Mobile Release Closed Beta
+
+on:
+  workflow_dispatch:
+    inputs:
+      beta_label:
+        description: Feature label for this beta build (e.g. offline-sync)
+        required: true
+        type: string
+
+jobs:
+  android:
+    defaults:
+      run:
+        working-directory: packages/mobile
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Setup Java version
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'zulu'
+          java-version: '17'
+      - name: Export version for closed beta
+        run: |
+          BASE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)
+          BETA_LABEL=$(echo "${{ inputs.beta_label }}" | tr '[:upper:]' '[:lower:]' | tr ' ' '-' | sed 's/[^a-z0-9-]//g')
+          if [ -z "$BETA_LABEL" ]; then
+            echo "beta_label must contain at least one alphanumeric character"
+            exit 1
+          fi
+          echo "PACKAGE_VERSION=${BASE_VERSION}-beta-${BETA_LABEL}" >> $GITHUB_ENV
+      - name: Setup react-native kernel and increase watchers
+        run: echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p
+      - name: Decode Production Android keystore
+        run: |
+          echo "${{ secrets.ANDROID_KEYSTORE }}" > keystore.keystore.asc
+          gpg -d --passphrase "${{ secrets.KEYSTORE_PASSPHRASE }}" --batch keystore.keystore.asc > android/app/keystore.keystore
+      - name: Install dependencies
+        run: yarn install --immutable
+      - run: yarn build:mobile
+      - name: Ruby Setup for Fastlane
+        uses: ruby/setup-ruby@v1
+        with:
+          working-directory: 'packages/mobile'
+      - name: fastlane
+        uses: maierj/fastlane-action@v1.4.0
+        env:
+          PACKAGE_VERSION: ${{ env.PACKAGE_VERSION }}
+          BUILD_NUMBER: ${{ github.run_number }}
+          ANDROID_KEYSTORE_ALIAS: ${{ secrets.ANDROID_KEYSTORE_ALIAS }}
+          ANDROID_KEYSTORE_PRIVATE_KEY_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PRIVATE_KEY_PASSWORD }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          GOOGLE_PLAY_JSON_KEY_DATA: ${{ secrets.GOOGLE_PLAY_JSON_KEY_DATA }}
+        with:
+          lane: 'android closed_beta'
+          subdirectory: 'packages/mobile'

.github/workflows/publish.yml

@@ -3,16 +3,23 @@ name: Publish Packages
 on:
   push:
     branches: [main]
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Package to publish (e.g. @standardnotes/releases)'
+        required: true
+        type: string
 
 # Use commit message "[snjs docker only]" to build/push only standardnotes/snjs (:sha + :latest) for E2E; skips full build, web image, and NPM.
+# Manual dispatch publishes tagged packages from an existing release commit without bumping versions.
 
 permissions:
   id-token: write
 
 jobs:
   build:
     name: Build & Test
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -39,7 +46,7 @@ jobs:
 
   build-docker:
     name: Build Docker Image
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -110,7 +117,7 @@ jobs:
 
   publish-web-docker:
     name: Build and publish Docker Image for Web App
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -148,7 +155,7 @@ jobs:
 
   publish:
     name: Publish to NPM
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -186,10 +193,95 @@ jobs:
       - name: Publish
         run: yarn publish:prod
 
+  publish-from-git-tags:
+    name: Publish to NPM from Git Tags
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.CI_PAT_TOKEN }}
+          ref: main
+          fetch-depth: 0
+
+      - name: Resolve release commit
+        id: release-commit
+        run: |
+          COMMIT="$(git log main --grep='chore(release): publish' -n 1 --format=%H)"
+
+          if [ -z "$COMMIT" ]; then
+            echo "No release commit found on main."
+            exit 1
+          fi
+
+          if ! git cat-file -e "${COMMIT}^{commit}" 2>/dev/null; then
+            echo "Commit ${COMMIT} does not exist."
+            exit 1
+          fi
+
+          TAG_COUNT="$(git tag --points-at "$COMMIT" | wc -l | tr -d ' ')"
+          if [ "$TAG_COUNT" -eq 0 ]; then
+            echo "Commit ${COMMIT} has no release tags."
+            exit 1
+          fi
+
+          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"
+          echo "Using release commit ${COMMIT}"
+          git tag --points-at "$COMMIT"
+
+      - name: Checkout release commit
+        run: git checkout "${{ steps.release-commit.outputs.commit }}"
+
+      - name: Set up Node
+        uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+
+      - name: Upgrade npm (trusted publishing requirement)
+        run: npm install -g npm@^11.5.1
+
+      - name: Enable Corepack (Yarn)
+        run: corepack enable
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Build
+        run: yarn build:all
+
+      - name: Publish tagged package
+        env:
+          PACKAGE: ${{ inputs.package }}
+        run: |
+          set -euo pipefail
+
+          PACKAGE="$(echo "$PACKAGE" | xargs)"
+          if [ -z "$PACKAGE" ]; then
+            echo "Package name is required."
+            exit 1
+          fi
+
+          mapfile -t TAGS < <(git tag --points-at HEAD --list "${PACKAGE}@*")
+          if [ "${#TAGS[@]}" -eq 0 ]; then
+            echo "No release tag found for ${PACKAGE} at the release commit."
+            exit 1
+          fi
+
+          if [ "${#TAGS[@]}" -gt 1 ]; then
+            echo "Multiple release tags found for ${PACKAGE}: ${TAGS[*]}"
+            exit 1
+          fi
+
+          echo "Publishing ${PACKAGE} (${TAGS[0]})..."
+          yarn workspace "$PACKAGE" npm publish --access public
+
   publish-docker:
     name: Publish to Docker Hub
     needs: build-docker
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Login to Docker Hub