feat(ci): add semantic-release pipeline, cross-platform builds, and lefthook git hooks

- Replace single wails.yml with three-workflow pipeline: ci.yml (PR checks), release.yml (semantic-release on main), build.yml (versioned builds on tag) - PR pipeline: conventional commit lint, golangci-lint, govulncheck, go test, codegen freshness check, frontend type-check, cross-platform build verification - Release pipeline: semantic-release with auto-changelog and draft GitHub releases - Build pipeline: versioned linux/amd64, darwin/universal, windows/amd64 binaries with version and commit SHA injected via ldflags - Add lefthook as go tool for pre-commit (vet, lint, codegen, tsc) and pre-push (test, mod verify) git hooks - Fix golangci-lint gci config to enforce three-group import style - Upgrade Go to 1.25 - Add version/commit variables to main.go for build-time injection - Add lint, test, vulncheck, and setup targets to Makefile
2026-02-13 21:26:33 -06:00
parent d78c0584e2
commit caf3e843af
12 changed files with 717 additions and 164 deletions
@@ -0,0 +1,169 @@
+name: Build & Publish
+run-name: Build ${{ github.ref_name }}
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: build-${{ github.ref_name }}
+  cancel-in-progress: false
+
+env:
+  GO_VERSION: "1.25"
+  PNPM_VERSION: "10"
+  NODE_VERSION: "22"
+  NODE_OPTIONS: "--max-old-space-size=4096"
+
+jobs:
+  build:
+    name: Build (${{ matrix.name }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Linux (amd64)
+            os: ubuntu-latest
+            platform: linux/amd64
+            binary: yellowjacket
+            artifact: yellowjacket-linux-amd64
+          - name: macOS (universal)
+            os: macos-latest
+            platform: darwin/universal
+            binary: yellowjacket
+            artifact: yellowjacket-darwin-universal
+          - name: Windows (amd64)
+            os: windows-latest
+            platform: windows/amd64
+            binary: yellowjacket.exe
+            artifact: yellowjacket-windows-amd64.exe
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: frontend/pnpm-lock.yaml
+
+      # ── System dependencies ──────────────────────
+      - name: Install Linux dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libasound2-dev libgtk-3-dev libwebkit2gtk-4.1-dev
+
+      # ── Install Wails CLI ────────────────────────
+      - name: Install Wails
+        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest
+
+      # ── Build ────────────────────────────────────
+      - name: Determine version
+        id: version
+        shell: bash
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Building version: $VERSION"
+
+      - name: Build (Linux)
+        if: runner.os == 'Linux'
+        working-directory: ${{ github.workspace }}
+        run: |
+          wails build \
+            --platform ${{ matrix.platform }} \
+            -o ${{ matrix.binary }} \
+            -tags webkit2_41 \
+            -ldflags "-s -w -X 'main.version=${{ steps.version.outputs.version }}' -X 'main.commit=${{ github.sha }}'"
+
+      - name: Build (macOS)
+        if: runner.os == 'macOS'
+        working-directory: ${{ github.workspace }}
+        run: |
+          wails build \
+            --platform ${{ matrix.platform }} \
+            -o ${{ matrix.binary }} \
+            -ldflags "-s -w -X 'main.version=${{ steps.version.outputs.version }}' -X 'main.commit=${{ github.sha }}'"
+
+      - name: Build (Windows)
+        if: runner.os == 'Windows'
+        working-directory: ${{ github.workspace }}
+        shell: bash
+        run: |
+          wails build \
+            --platform ${{ matrix.platform }} \
+            -o ${{ matrix.binary }} \
+            -ldflags "-s -w -X 'main.version=${{ steps.version.outputs.version }}' -X 'main.commit=${{ github.sha }}'"
+
+      # ── Fix permissions ──────────────────────────
+      - name: Set executable permission (Linux)
+        if: runner.os == 'Linux'
+        run: chmod +x build/bin/${{ matrix.binary }}
+
+      - name: Set executable permission (macOS)
+        if: runner.os == 'macOS'
+        run: chmod +x build/bin/${{ matrix.binary }}.app/Contents/MacOS/*
+
+      # ── Zip macOS .app bundle ────────────────────
+      - name: Zip macOS app
+        if: runner.os == 'macOS'
+        working-directory: ${{ github.workspace }}
+        run: |
+          ditto -c -k --keepParent build/bin/${{ matrix.binary }}.app build/bin/${{ matrix.artifact }}.app.zip
+
+      # ── Upload artifacts ─────────────────────────
+      - name: Upload artifact (Linux/Windows)
+        if: runner.os != 'macOS'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact }}
+          path: build/bin/${{ matrix.binary }}
+
+      - name: Upload artifact (macOS)
+        if: runner.os == 'macOS'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact }}
+          path: build/bin/${{ matrix.artifact }}.app.zip
+
+  publish:
+    name: Publish Release
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          merge-multiple: true
+          path: ${{ github.workspace }}/artifacts
+
+      - name: List artifacts
+        run: find ${{ github.workspace }}/artifacts -type f
+
+      - name: Upload assets to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          # The release was already created as a draft by semantic-release.
+          # This step finds it by tag and attaches binaries, then publishes.
+          draft: false
+          tag_name: ${{ github.ref_name }}
+          fail_on_unmatched_files: true
+          files: |
+            artifacts/yellowjacket-linux-amd64
+            artifacts/yellowjacket-darwin-universal.app.zip
+            artifacts/yellowjacket-windows-amd64.exe