feat(KAN-58): add macOS actions and Hetzner release pipeline

native/publish-macos.mjs

@@ -0,0 +1,218 @@
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
+import {
+    appendFileSync,
+    mkdtempSync,
+    readFileSync,
+    rmSync,
+    writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import process from 'node:process';
+import { pathToFileURL } from 'node:url';
+import { execute, releaseMetadata } from './macos-ci.mjs';
+
+export function storageConfiguration(env = process.env) {
+    const region = env.S3_REGION;
+    const bucket = env.S3_BUCKET;
+    const prefix = env.S3_PREFIX || 'releases/macos';
+    if (!['nbg1', 'fsn1', 'hel1'].includes(region)) {
+        throw new Error('S3_REGION must be nbg1, fsn1 or hel1.');
+    }
+    if (!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(bucket || '')) {
+        throw new Error('Set S3_BUCKET to the Hetzner release bucket name.');
+    }
+    if (!/^[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)*$/.test(prefix)) {
+        throw new Error(
+            'S3_PREFIX must contain plain path segments without leading or trailing slashes.',
+        );
+    }
+    const endpoint = `https://${region}.your-objectstorage.com`;
+    const publicBase =
+        env.S3_PUBLIC_BASE_URL ||
+        `https://${bucket}.${region}.your-objectstorage.com`;
+    const url = new URL(publicBase);
+    if (
+        url.protocol !== 'https:' ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        /[\s]/.test(publicBase)
+    ) {
+        throw new Error(
+            'S3_PUBLIC_BASE_URL must be a public HTTPS URL without credentials or query parameters.',
+        );
+    }
+    return {
+        region,
+        bucket,
+        prefix,
+        endpoint,
+        publicBase: publicBase.replace(/\/$/, ''),
+    };
+}
+
+const sha256 = (data) => createHash('sha256').update(data).digest('hex');
+
+export async function publishMacos({
+    env = process.env,
+    directory,
+    metadata,
+    run = execute,
+    fetchPublic = fetch,
+} = {}) {
+    const storage = storageConfiguration(env);
+    if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) {
+        throw new Error(
+            'Set the dedicated S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY release secrets.',
+        );
+    }
+    const archive = readFileSync(join(directory, metadata.filename));
+    const checksum = sha256(archive);
+    const checksumFile = readFileSync(
+        join(directory, `${metadata.filename}.sha256`),
+    );
+    if (checksumFile.toString() !== `${checksum}  ${metadata.filename}\n`) {
+        throw new Error('Release archive does not match its SHA-256 file.');
+    }
+    const common = [
+        '--endpoint-url',
+        storage.endpoint,
+        '--region',
+        storage.region,
+        '--no-cli-pager',
+        's3api',
+    ];
+    function s3(operation, args) {
+        return run('aws', [
+            ...common,
+            operation,
+            '--bucket',
+            storage.bucket,
+            ...args,
+        ]);
+    }
+    const versioning = JSON.parse(s3('get-bucket-versioning', []));
+    if (versioning.Status) {
+        throw new Error(
+            'Use an unversioned release bucket: Hetzner does not support conditional writes on versioned buckets.',
+        );
+    }
+    const staging = mkdtempSync(join(tmpdir(), 'kanbangit-s3-'));
+    const keyPrefix = `${storage.prefix}/${metadata.target}/${metadata.version}`;
+    const publicPrefix = `${storage.publicBase}/${keyPrefix}`;
+    async function verifyPublic(name, contents) {
+        const response = await fetchPublic(`${publicPrefix}/${name}`, {
+            redirect: 'error',
+            signal: AbortSignal.timeout(60000),
+        });
+        if (
+            !response.ok ||
+            sha256(Buffer.from(await response.arrayBuffer())) !==
+                sha256(contents)
+        ) {
+            throw new Error(`Public download verification failed for ${name}.`);
+        }
+    }
+    function putImmutable(name, contents, contentType) {
+        const file = join(staging, name);
+        writeFileSync(file, contents);
+        try {
+            s3('put-object', [
+                '--key',
+                `${keyPrefix}/${name}`,
+                '--body',
+                file,
+                '--if-none-match',
+                '*',
+                '--content-type',
+                contentType,
+                '--cache-control',
+                'public, max-age=31536000, immutable',
+                '--content-md5',
+                createHash('md5').update(contents).digest('base64'),
+                '--metadata',
+                `sha256=${sha256(contents)}`,
+            ]);
+        } catch (error) {
+            if (!/\(PreconditionFailed\)|\(412\)/.test(error.message)) {
+                throw error;
+            }
+            const existing = join(staging, `existing-${name}`);
+            s3('get-object', ['--key', `${keyPrefix}/${name}`, existing]);
+            if (sha256(readFileSync(existing)) !== sha256(contents)) {
+                throw new Error(
+                    `Published ${name} differs; bump the app version. Existing objects were not overwritten.`,
+                );
+            }
+        }
+    }
+    try {
+        const files = [
+            [metadata.filename, archive, 'application/zip'],
+            [
+                `${metadata.filename}.sha256`,
+                checksumFile,
+                'text/plain; charset=utf-8',
+            ],
+        ];
+        for (const [name, contents, type] of files) {
+            putImmutable(name, contents, type);
+            await verifyPublic(name, contents);
+        }
+        // This completion record is written only after both public downloads match.
+        const manifest = Buffer.from(
+            JSON.stringify(
+                {
+                    version: metadata.version,
+                    target: metadata.target,
+                    url: `${publicPrefix}/${metadata.filename}`,
+                    sha256: checksum,
+                    checksumUrl: `${publicPrefix}/${metadata.filename}.sha256`,
+                },
+                null,
+                2,
+            ) + '\n',
+        );
+        putImmutable('release.json', manifest, 'application/json');
+        await verifyPublic('release.json', manifest);
+        return `${publicPrefix}/${metadata.filename}`;
+    } finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+}
+
+if (
+    process.argv[1] &&
+    import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+    try {
+        if (process.argv[2] === 'config') {
+            console.log(JSON.stringify(storageConfiguration()));
+        } else if (
+            process.argv[2] === 'upload' &&
+            process.env.RELEASE_DIRECTORY
+        ) {
+            const url = await publishMacos({
+                directory: process.env.RELEASE_DIRECTORY,
+                metadata: releaseMetadata(),
+            });
+            console.log(`Verified public release: ${url}`);
+            if (process.env.GITHUB_STEP_SUMMARY) {
+                appendFileSync(
+                    process.env.GITHUB_STEP_SUMMARY,
+                    `Download: [KanbanGit](${url})\n`,
+                );
+            }
+        } else {
+            throw new Error(
+                'Use config or upload; upload requires RELEASE_DIRECTORY.',
+            );
+        }
+    } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+    }
+}