From 3d27ddf677ce98de9f8668e8bd21754c3db60473 Mon Sep 17 00:00:00 2001 From: Breadway Date: Wed, 5 Aug 2026 19:16:28 +0800 Subject: [PATCH] ci: build on bread-ecosystem's shared Arch container Route dev/beta/release build steps through ci/build.sh, pinned to bread-ecosystem@147cfbb, instead of installing toolchain/libraries directly on the bare runner. Adds ci/deps.txt for the build-time-only packages breadcast needs beyond the shared image's base set (jsoncpp and libcrypto for breadcast-caststream-sys's build.rs; gstreamer and gst-plugins-base-libs for the gstreamer-app/-video sys crates) -- deliberately excludes bakery.toml's runtime-only plugin deps (pipewire/bad/hlssink3/va), which are loaded dynamically by name and never linked at compile time. Also adds check.yml to run clippy/test on feature/fix branches ahead of a release build, matching breadpad's already-migrated pattern. --- .forgejo/workflows/beta-release.yml | 2 +- .forgejo/workflows/check.yml | 24 ++++++++++++++++++ .forgejo/workflows/dev-release.yml | 2 +- .forgejo/workflows/release.yml | 2 +- ci/bread-ecosystem.rev | 1 + ci/build.sh | 21 ++++++++++++++++ ci/deps.txt | 39 +++++++++++++++++++++++++++++ 7 files changed, 88 insertions(+), 3 deletions(-) create mode 100644 .forgejo/workflows/check.yml create mode 100644 ci/bread-ecosystem.rev create mode 100755 ci/build.sh create mode 100644 ci/deps.txt diff --git a/.forgejo/workflows/beta-release.yml b/.forgejo/workflows/beta-release.yml index 56f53fe..578cae6 100644 --- a/.forgejo/workflows/beta-release.yml +++ b/.forgejo/workflows/beta-release.yml @@ -20,7 +20,7 @@ jobs: "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src - name: build - run: cd src && cargo build --release --locked + run: cd src && bash ci/build.sh cargo build --release --locked - name: compute beta version run: | diff --git a/.forgejo/workflows/check.yml b/.forgejo/workflows/check.yml new file mode 100644 index 0000000..b547c34 --- /dev/null +++ b/.forgejo/workflows/check.yml @@ -0,0 +1,24 @@ +name: check + +# Fast-fail lint/test on short-lived work branches, before it ever reaches +# main and triggers a dev-track release build. +on: + push: + branches: ['feature/**', 'fix/**'] + +jobs: + check: + runs-on: [self-hosted, hestia] + steps: + - name: checkout + run: | + set -euo pipefail + rm -rf src && mkdir src + git clone --branch "${GITHUB_REF_NAME}" --depth 1 \ + "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src + + - name: clippy + run: cd src && bash ci/build.sh cargo clippy --workspace --all-targets --locked -- -D warnings + + - name: test + run: cd src && bash ci/build.sh cargo test --workspace --locked diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml index d8509ee..0631be8 100644 --- a/.forgejo/workflows/dev-release.yml +++ b/.forgejo/workflows/dev-release.yml @@ -20,7 +20,7 @@ jobs: "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src - name: build - run: cd src && cargo build --release --locked + run: cd src && bash ci/build.sh cargo build --release --locked - name: compute dev version run: | diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml index 79a9960..9d08de9 100644 --- a/.forgejo/workflows/release.yml +++ b/.forgejo/workflows/release.yml @@ -16,7 +16,7 @@ jobs: "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src - name: build - run: cd src && cargo build --release --locked + run: cd src && bash ci/build.sh cargo build --release --locked - name: prepare artifacts run: | diff --git a/ci/bread-ecosystem.rev b/ci/bread-ecosystem.rev new file mode 100644 index 0000000..34e7aa9 --- /dev/null +++ b/ci/bread-ecosystem.rev @@ -0,0 +1 @@ +147cfbbf96ae4b171027defa1130d2caddb934b1 diff --git a/ci/build.sh b/ci/build.sh new file mode 100755 index 0000000..f3b15ca --- /dev/null +++ b/ci/build.sh @@ -0,0 +1,21 @@ +#!/usr/bin/env bash +# Delegates to bread-ecosystem's shared CI build image/script, pinned to +# the commit in ci/bread-ecosystem.rev — not `main`. bread-ecosystem's CI +# files now affect every product's release pipeline, so bumping the pin +# is a deliberate act instead of silent drift (see the bread-theme test +# that broke here for exactly that reason, before it was pinned by rev). +# +# Usage: ci/build.sh cargo build --release --locked +set -euo pipefail + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +REV="$(cat "${ROOT}/ci/bread-ecosystem.rev")" + +CACHE_DIR="/tmp/bread-ecosystem-ci-${REV}" +if [ ! -d "$CACHE_DIR" ]; then + rm -rf /tmp/bread-ecosystem-ci-* + git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "$CACHE_DIR" + git -C "$CACHE_DIR" checkout --quiet "$REV" +fi + +bash "${CACHE_DIR}/ci/build.sh" breadcast "$ROOT" "$@" diff --git a/ci/deps.txt b/ci/deps.txt new file mode 100644 index 0000000..9a22480 --- /dev/null +++ b/ci/deps.txt @@ -0,0 +1,39 @@ +# Build-time deps layered onto the shared bread-ci image on top of its base +# set (base-devel git pkgconf rust gtk4 libadwaita gtk4-layer-shell graphene +# -- see bread-ecosystem's ci/Containerfile). This is NOT bakery.toml's +# system_deps list (that's runtime: what an end-user machine needs to run +# breadcast/breadcastd) -- it's what's actually pkg-config-probed or linked +# against while *compiling* the crate, verified against: +# +# - breadcast-caststream-sys/build.rs, which calls +# pkg_config::probe_library("jsoncpp") and +# pkg_config::probe_library("libcrypto") to build+link the vendored +# openscreen Cast Streaming C++ sources. `pacman -Fl jsoncpp` / +# `pacman -Fl openssl` confirm both ship their headers AND .pc files in +# the same package (jsoncpp.pc, libcrypto.pc) -- no separate -dev split +# on Arch, so the runtime package name is also the build-time one. +# +# - Cargo.lock, which pulls in gstreamer-sys/-base-sys (breadcast-core, +# breadcastd depend on the `gstreamer` crate directly) and +# gstreamer-app-sys/-video-sys (breadcast-core's `gstreamer-app` / +# `gstreamer-video` deps, used by the capture/encode pipeline). Their +# .pc files (gstreamer-1.0.pc, gstreamer-base-1.0.pc from the +# `gstreamer` package; gstreamer-app-1.0.pc, gstreamer-video-1.0.pc from +# `gst-plugins-base-libs`) come from these two packages, not from +# `gtk4`'s own transitive pull of them -- listed explicitly here so the +# build doesn't silently depend on an incidental side effect of gtk4's +# dependency graph. +# +# Deliberately NOT included: gst-plugin-pipewire, gst-plugins-bad, +# gst-plugin-hlssink3, gst-plugin-va (all in bakery.toml's system_deps). +# These are GStreamer elements referenced only by factory-name string at +# runtime (e.g. "vah264enc", "hlssink3" -- see breadcast-core/src/pipeline/ +# mod.rs), loaded dynamically via the plugin registry, never linked by any +# Rust sys crate in Cargo.lock. `pacman -Fl` on all four ships no headers +# breadcast compiles against (gst-plugin-hlssink3 has one .pc file, +# gsthlssink3.pc, but nothing in Cargo.lock binds to it) -- pure runtime +# dependencies, correctly excluded from the build image. +gstreamer +gst-plugins-base-libs +jsoncpp +openssl