Launcher

.github/scripts/detect-component-changes.sh

@@ -80,6 +80,8 @@ changed_files="$(git diff --name-only --no-renames "$base_sha" "$head_sha")"
 
 frontend=false
 backend=false
+launcher=false
+launcher_build=false
 
 while IFS= read -r path; do
   [[ -z "$path" ]] && continue
@@ -91,13 +93,27 @@ while IFS= read -r path; do
     backend/*)
       backend=true
       ;;
+    launcher/*)
+      launcher=true
+      launcher_build=true
+      ;;
+    .github/workflows/tests.yml|.github/scripts/detect-component-changes.sh|.github/scripts/should-run-tests-workflow.sh)
+      frontend=true
+      backend=true
+      launcher=true
+      ;;
+    .github/workflows/launcher-release.yml)
+      launcher=true
+      ;;
   esac
 done <<< "$changed_files"
 
 {
   echo "Change detection range: $range_label"
   echo "Frontend changed: $frontend"
   echo "Backend changed: $backend"
+  echo "Launcher changed: $launcher"
+  echo "Launcher build needed: $launcher_build"
   echo "Changed files:"
   if [[ -n "$changed_files" ]]; then
     printf '%s\n' "$changed_files"
@@ -109,4 +125,6 @@ done <<< "$changed_files"
 {
   echo "frontend=$frontend"
   echo "backend=$backend"
+  echo "launcher=$launcher"
+  echo "launcher_build=$launcher_build"
 } >> "${GITHUB_OUTPUT:-/dev/stdout}"

.github/scripts/should-run-tests-workflow.sh

@@ -5,10 +5,6 @@ event_name="${GITHUB_EVENT_NAME:-}"
 repo="${GITHUB_REPOSITORY:-}"
 repo_owner="${GITHUB_REPOSITORY_OWNER:-${repo%%/*}}"
 ref_name="${GITHUB_REF_NAME:-}"
-pr_action="${PR_ACTION:-}"
-pr_head_repo="${PR_HEAD_REPO:-}"
-pr_head_sha="${PR_HEAD_SHA:-}"
-workflow_file="${WORKFLOW_FILE:-tests.yml}"
 
 should_run=true
 reason="This workflow run owns the work."
@@ -24,14 +20,8 @@ open_pr_count_for_branch() {
     --jq 'length'
 }
 
-covering_push_run_for_pr_head() {
-  gh api --method GET "repos/$repo/actions/workflows/$workflow_file/runs" \
-    -f event=push \
-    -f head_sha="$pr_head_sha" \
-    --jq '.workflow_runs[] | select((.status != "completed") or (.conclusion != "cancelled" and .conclusion != "skipped")) | .html_url' |
-    head -n 1
-}
-
+# PR runs always own their tests. A queued push may itself skip because a PR
+# exists, so its presence cannot prove that the commit has test coverage.
 if [[ "$event_name" == "push" ]]; then
   if gh_available && [[ -n "$repo" && -n "$repo_owner" && -n "$ref_name" ]]; then
     if open_pr_count="$(open_pr_count_for_branch)"; then
@@ -45,15 +35,6 @@ if [[ "$event_name" == "push" ]]; then
   else
     echo "::warning::GitHub CLI or token unavailable; running tests to avoid missing coverage."
   fi
-elif [[ "$event_name" == pull_request* ]]; then
-  if [[ "$pr_action" == "opened" || "$pr_action" == "reopened" ]]; then
-    if gh_available && [[ "$pr_head_repo" == "$repo" && -n "$pr_head_sha" ]]; then
-      if push_run_url="$(covering_push_run_for_pr_head)" && [[ -n "$push_run_url" ]]; then
-        should_run=false
-        reason="Skipping PR workflow because an existing push run already covers this commit: $push_run_url"
-      fi
-    fi
-  fi
 fi
 
 echo "$reason"

.github/tests/workflow-scripts.test.mjs

@@ -0,0 +1,81 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { afterEach, beforeEach, test } from 'node:test';
+
+const scripts = fileURLToPath(new URL('../scripts/', import.meta.url));
+let directory;
+beforeEach(() => {
+  directory = fs.mkdtempSync(path.join(os.tmpdir(), 'modtale-workflow-'));
+});
+afterEach(() => fs.rmSync(directory, { recursive: true, force: true }));
+
+function run(script, overrides = {}) {
+  const output = path.join(directory, 'output');
+  fs.writeFileSync(output, '');
+  const result = spawnSync('bash', [path.join(scripts, script)], {
+    cwd: directory,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      GITHUB_OUTPUT: output,
+      GITHUB_REPOSITORY: 'Modtale/modtale',
+      GITHUB_REPOSITORY_OWNER: 'Modtale',
+      GITHUB_REF_NAME: 'audit',
+      GH_TOKEN: 'test-token',
+      ...overrides,
+    },
+  });
+  assert.equal(result.status, 0, result.stdout + result.stderr);
+  return fs.readFileSync(output, 'utf8');
+}
+
+test('PR creation and synchronization always retain their own test coverage', () => {
+  for (const action of ['opened', 'reopened', 'synchronize']) {
+    const output = run('should-run-tests-workflow.sh', {
+      GITHUB_EVENT_NAME: 'pull_request', PR_ACTION: action,
+    });
+    assert.match(output, /^should_run=true$/m);
+  }
+});
+
+test('push skips only when the GitHub API confirms an open PR', () => {
+  const bin = path.join(directory, 'bin');
+  fs.mkdirSync(bin);
+  const gh = path.join(bin, 'gh');
+  fs.writeFileSync(gh, '#!/bin/sh\nprintf "1\\n"\n', { mode: 0o755 });
+  const env = { GITHUB_EVENT_NAME: 'push', PATH: `${bin}${path.delimiter}${process.env.PATH}` };
+  assert.match(run('should-run-tests-workflow.sh', env), /^should_run=false$/m);
+  fs.writeFileSync(gh, '#!/bin/sh\nexit 1\n', { mode: 0o755 });
+  assert.match(run('should-run-tests-workflow.sh', env), /^should_run=true$/m);
+});
+
+test('test-workflow changes select all components without requesting launcher packaging', () => {
+  const git = (...args) => {
+    const result = spawnSync('git', args, { cwd: directory, encoding: 'utf8' });
+    assert.equal(result.status, 0, result.stderr);
+    return result.stdout.trim();
+  };
+  git('init', '--quiet');
+  git('config', 'user.name', 'Audit Test');
+  git('config', 'user.email', 'audit@example.test');
+  git('config', 'commit.gpgsign', 'false');
+  fs.writeFileSync(path.join(directory, 'README.md'), 'test');
+  git('add', '.');
+  git('commit', '--quiet', '-m', 'Initial fixture');
+  const base = git('rev-parse', 'HEAD');
+  fs.mkdirSync(path.join(directory, '.github/workflows'), { recursive: true });
+  fs.writeFileSync(path.join(directory, '.github/workflows/tests.yml'), 'name: tests');
+  git('add', '.');
+  git('commit', '--quiet', '-m', 'Change test workflow');
+  const output = run('detect-component-changes.sh', {
+    GITHUB_EVENT_NAME: 'push', GITHUB_SHA: git('rev-parse', 'HEAD'), PUSH_BEFORE_SHA: base,
+  });
+  for (const component of ['frontend', 'backend', 'launcher']) {
+    assert.match(output, new RegExp(`^${component}=true$`, 'm'));
+  }
+  assert.match(output, /^launcher_build=false$/m);
+});

.github/workflows/ci-cd.yml

@@ -25,6 +25,12 @@ jobs:
     permissions:
       contents: 'read'
       id-token: 'write'
+    outputs:
+      launcher_build: ${{ steps.filter.outputs.launcher_build }}
+      launcher_site_base_url: ${{ steps.launcher_metadata.outputs.site_base_url }}
+      launcher_api_base_url: ${{ steps.launcher_metadata.outputs.api_base_url }}
+      launcher_version: ${{ steps.launcher_metadata.outputs.version }}
+      launcher_artifact_prefix: ${{ steps.launcher_metadata.outputs.artifact_prefix }}
 
     steps:
       - uses: actions/checkout@v4
@@ -491,7 +497,8 @@ jobs:
             ARGS+=("--update-secrets" "WIKI_API_KEY=WIKI_API_KEY:latest")
             ARGS+=("--update-secrets" "DISCORD_WEBHOOK_URL=DISCORD_WEBHOOK_URL:latest")
             ARGS+=("--update-secrets" "ADMIN_DISCORD_WEBHOOK_URL=ADMIN_DISCORD_WEBHOOK_URL:latest")
-            ARGS+=("--update-secrets" "STATUS_DISCORD_WEBHOOK_URL=STATUS_DISCORD_WEBHOOK_URL:latest")
+            # Only the detached status service owns the persistent #status message.
+            ARGS+=("--remove-secrets" "STATUS_DISCORD_WEBHOOK_URL")
           elif [ "${{ env.ENV_TYPE }}" = "dev" ]; then
             ARGS+=("--cpu" "1")
             ARGS+=("--min-instances" "0")
@@ -515,7 +522,7 @@ jobs:
             ARGS+=("--update-secrets" "BLUESKY_CLIENT_ID=BLUESKY_CLIENT_ID:latest")
             ARGS+=("--update-secrets" "WARDEN_API_KEY=${{ env.WARDEN_SECRET_NAME }}:latest")
             ARGS+=("--update-secrets" "WIKI_API_KEY=WIKI_API_KEY:latest")
-            ARGS+=("--remove-env-vars" "STATUS_DISCORD_WEBHOOK_URL")
+            ARGS+=("--remove-secrets" "STATUS_DISCORD_WEBHOOK_URL")
           else
             : "${RUNTIME_SERVICE_ACCOUNT:?Set environment variable GCP_BRANCH_PREVIEW_RUNTIME_SERVICE_ACCOUNT in the branch-preview GitHub environment.}"
             # Preview services are usually idle. Request-based CPU billing avoids
@@ -535,7 +542,8 @@ jobs:
             ARGS+=("--update-secrets" "APP_SEEDING_SOURCE_R2_ACCESS_KEY=${{ env.SEEDING_SOURCE_R2_ACCESS_KEY_SECRET_NAME }}:latest")
             ARGS+=("--update-secrets" "APP_SEEDING_SOURCE_R2_SECRET_KEY=${{ env.SEEDING_SOURCE_R2_SECRET_KEY_SECRET_NAME }}:latest")
             ARGS+=("--update-secrets" "APP_SEEDING_SOURCE_R2_ENDPOINT=${{ env.SEEDING_SOURCE_R2_ENDPOINT_SECRET_NAME }}:latest")
-            ARGS+=("--remove-env-vars" "SMTP_HOST,SMTP_PORT,SMTP_USERNAME,SMTP_PASSWORD,PRE_AUTH_SECRET,GITHUB_CLIENT_ID,GITHUB_CLIENT_SECRET,GOOGLE_CLIENT_ID,GOOGLE_CLIENT_SECRET,GITLAB_CLIENT_ID,GITLAB_CLIENT_SECRET,DISCORD_CLIENT_ID,DISCORD_CLIENT_SECRET,TWITTER_CLIENT_ID,TWITTER_CLIENT_SECRET,BLUESKY_CLIENT_ID,BLUESKY_CLIENT_SECRET,WARDEN_URL,WARDEN_API_KEY,WIKI_API_KEY,WEBHOOK_URL,HYTALEMODDING_KEY,DISCORD_WEBHOOK_URL,ADMIN_DISCORD_WEBHOOK_URL,STATUS_DISCORD_WEBHOOK_URL")
+            ARGS+=("--remove-env-vars" "SMTP_HOST,SMTP_PORT,SMTP_USERNAME,SMTP_PASSWORD,PRE_AUTH_SECRET,GITHUB_CLIENT_ID,GITHUB_CLIENT_SECRET,GOOGLE_CLIENT_ID,GOOGLE_CLIENT_SECRET,GITLAB_CLIENT_ID,GITLAB_CLIENT_SECRET,DISCORD_CLIENT_ID,DISCORD_CLIENT_SECRET,TWITTER_CLIENT_ID,TWITTER_CLIENT_SECRET,BLUESKY_CLIENT_ID,BLUESKY_CLIENT_SECRET,WARDEN_URL,WARDEN_API_KEY,WIKI_API_KEY,WEBHOOK_URL,HYTALEMODDING_KEY,DISCORD_WEBHOOK_URL,ADMIN_DISCORD_WEBHOOK_URL")
+            ARGS+=("--remove-secrets" "STATUS_DISCORD_WEBHOOK_URL")
           fi
 
           gcloud run deploy ${{ env.BACKEND_SERVICE }} "${ARGS[@]}" --format="value(status.url)" > backend_url.txt
@@ -719,6 +727,21 @@ jobs:
             fi
           fi
 
+      - name: Export launcher build metadata
+        id: launcher_metadata
+        run: |
+          short_sha="${GITHUB_SHA:0:7}"
+          suffix="${TAG:-preview}-$short_sha"
+          suffix="$(printf '%s' "$suffix" | sed 's/[^A-Za-z0-9.-]/-/g' | sed 's/--*/-/g' | cut -c 1-50 | sed 's/^[.-]*//;s/[.-]*$//')"
+          if [ -z "$suffix" ]; then
+            suffix="preview-$short_sha"
+          fi
+
+          echo "site_base_url=$FINAL_FRONTEND_URL" >> "$GITHUB_OUTPUT"
+          echo "api_base_url=$API_URL" >> "$GITHUB_OUTPUT"
+          echo "version=0.1.0-$suffix" >> "$GITHUB_OUTPUT"
+          echo "artifact_prefix=launcher-$suffix" >> "$GITHUB_OUTPUT"
+
       - name: Notify Admin Bot of Backend Production Deploy
         if: env.ENV_TYPE == 'prod' && (steps.update_backend_self_awareness.outputs.revision != '' || steps.deploy_backend.outputs.revision != '')
         env:
@@ -833,6 +856,154 @@ jobs:
           echo "---" >> $GITHUB_STEP_SUMMARY
           echo "*View deployment details in [Google Cloud Console](https://console.cloud.google.com/run?project=${{ env.PROJECT_ID }}).* " >> $GITHUB_STEP_SUMMARY
 
+  package-launcher:
+    name: Package Staging Launcher (${{ matrix.name }})
+    needs: deploy
+    if: github.repository == 'Modtale/modtale' && needs.deploy.outputs.launcher_build == 'true'
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Linux Packages
+            os: ubuntu-latest
+            artifact: linux
+          - name: Windows Installer
+            os: windows-latest
+            artifact: windows
+          - name: macOS DMG
+            os: macos-latest
+            artifact: macos
+    defaults:
+      run:
+        working-directory: launcher
+        shell: bash
+    env:
+      LAUNCHER_SITE_BASE_URL: ${{ needs.deploy.outputs.launcher_site_base_url }}
+      LAUNCHER_API_BASE_URL: ${{ needs.deploy.outputs.launcher_api_base_url }}
+      LAUNCHER_VERSION: ${{ needs.deploy.outputs.launcher_version }}
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Validate launcher target URLs
+        run: |
+          : "${LAUNCHER_SITE_BASE_URL:?Launcher site URL was not produced by the deploy job.}"
+          : "${LAUNCHER_API_BASE_URL:?Launcher API URL was not produced by the deploy job.}"
+          : "${LAUNCHER_VERSION:?Launcher version was not produced by the deploy job.}"
+
+          echo "Launcher site URL: $LAUNCHER_SITE_BASE_URL"
+          echo "Launcher API URL: $LAUNCHER_API_BASE_URL"
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v3
+
+      - name: Set up Linux packaging tooling
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            binutils \
+            flatpak \
+            rpm \
+            tar \
+            xz-utils \
+            zstd
+          sudo apt-get install -y libfuse2 || sudo apt-get install -y libfuse2t64 || true
+          sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+          sudo flatpak install -y flathub org.freedesktop.Platform//25.08 org.freedesktop.Sdk//25.08
+          curl -L \
+            -o "$RUNNER_TEMP/appimagetool" \
+            https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage
+          chmod +x "$RUNNER_TEMP/appimagetool"
+          echo "APPIMAGETOOL=$RUNNER_TEMP/appimagetool" >> "$GITHUB_ENV"
+          echo "APPIMAGE_EXTRACT_AND_RUN=1" >> "$GITHUB_ENV"
+
+      - name: Set up Windows installer tooling
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          choco install wixtoolset -y --no-progress
+          $wix = Get-ChildItem "C:\Program Files (x86)" -Directory -Filter "WiX Toolset*" |
+            Sort-Object Name -Descending |
+            Select-Object -First 1
+          if ($null -eq $wix) {
+            throw "WiX Toolset was not installed."
+          }
+          "$($wix.FullName)\bin" | Out-File -FilePath $env:GITHUB_PATH -Append
+
+      - name: Ensure Gradle wrapper is executable
+        run: chmod +x gradlew
+
+      - name: Build staging launcher package
+        run: |
+          package_task="packageAll"
+          if [ "$RUNNER_OS" = "Linux" ]; then
+            package_task="packageLinuxAll"
+          fi
+
+          ./gradlew clean "$package_task" \
+            -PlauncherVersion="$LAUNCHER_VERSION" \
+            -PmodtaleSiteBaseUrl="$LAUNCHER_SITE_BASE_URL" \
+            -PmodtaleApiBaseUrl="$LAUNCHER_API_BASE_URL"
+
+      - name: Upload Linux AppImage package
+        if: runner.os == 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ needs.deploy.outputs.launcher_artifact_prefix }}-linux-appimage
+          path: launcher/build/distributions/*.AppImage
+          if-no-files-found: error
+
+      - name: Upload Linux Debian package
+        if: runner.os == 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ needs.deploy.outputs.launcher_artifact_prefix }}-linux-deb
+          path: launcher/build/distributions/*.deb
+          if-no-files-found: error
+
+      - name: Upload Linux RPM package
+        if: runner.os == 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ needs.deploy.outputs.launcher_artifact_prefix }}-linux-rpm
+          path: launcher/build/distributions/*.rpm
+          if-no-files-found: error
+
+      - name: Upload Linux Flatpak package
+        if: runner.os == 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ needs.deploy.outputs.launcher_artifact_prefix }}-linux-flatpak
+          path: launcher/build/distributions/*.flatpak
+          if-no-files-found: error
+
+      - name: Upload Linux pacman package
+        if: runner.os == 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ needs.deploy.outputs.launcher_artifact_prefix }}-linux-pacman
+          path: launcher/build/distributions/*.pkg.tar.zst
+          if-no-files-found: error
+
+      - name: Upload staging launcher package
+        if: runner.os != 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ needs.deploy.outputs.launcher_artifact_prefix }}-${{ matrix.artifact }}
+          path: launcher/build/distributions/*
+          if-no-files-found: error
+
   cleanup-branch-preview:
     name: Clean Up Deleted Branch Preview
     if: github.repository == 'Modtale/modtale' && github.event.deleted == true && startsWith(github.ref, 'refs/heads/') && github.ref_name != 'main' && github.ref_name != 'develop'