feat(KAN-58): add macOS actions and Hetzner release pipeline

native/tests/macos-ci.test.js

@@ -0,0 +1,193 @@
+import assert from 'node:assert/strict';
+import {
+    existsSync,
+    mkdirSync,
+    mkdtempSync,
+    readFileSync,
+    rmSync,
+    writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import {
+    packageNotarizedApp,
+    releaseMetadata,
+    verifyNotarizedApp,
+} from '../macos-ci.mjs';
+
+function fixture(t) {
+    const directory = mkdtempSync(join(tmpdir(), 'kanbangit-ci-test-'));
+    t.after(() => rmSync(directory, { recursive: true, force: true }));
+    mkdirSync(join(directory, 'src-tauri'));
+    const config = {
+        version: '1.2.3',
+        productName: 'KanbanGit',
+        identifier: 'de.kanbangit.desktop',
+    };
+    writeFileSync(
+        join(directory, 'src-tauri/tauri.conf.json'),
+        JSON.stringify(config),
+    );
+    writeFileSync(
+        join(directory, 'package.json'),
+        JSON.stringify({ version: '1.2.3' }),
+    );
+    writeFileSync(
+        join(directory, 'src-tauri/Cargo.toml'),
+        '[package]\nname = "kanbangit-native"\nversion = "1.2.3"\n[dependencies]\nother = "2"\n',
+    );
+    const env = {
+        RELEASE_TAG: 'macos-v1.2.3',
+        APPLE_SIGNING_IDENTITY:
+            'Developer ID Application: Example (ZZX2KZGTHU)',
+    };
+    const calls = [];
+    const run = (command, args) => {
+        calls.push({ command, args });
+        if (command === 'codesign' && args.includes('--display')) {
+            return 'CodeDirectory flags=0x10000(runtime)\nCDHash=abcdef123456';
+        }
+        if (command === 'plutil') {
+            return '1.2.3';
+        }
+        if (command === 'lipo') {
+            return 'arm64';
+        }
+        if (command === 'ditto' && args.includes('-c')) {
+            writeFileSync(args.at(-1), 'notarized archive');
+        }
+        return '';
+    };
+    return { directory, env, config, run, calls };
+}
+
+test('release metadata binds tag, all app versions, identity and architecture', (t) => {
+    const f = fixture(t);
+    assert.deepEqual(releaseMetadata(f.env, f.directory), {
+        version: '1.2.3',
+        target: 'aarch64-apple-darwin',
+        arch: 'arm64',
+        filename: 'KanbanGit-1.2.3-aarch64-apple-darwin.zip',
+    });
+    assert.equal(
+        releaseMetadata(
+            { ...f.env, MACOS_RELEASE_TARGET: 'x86_64-apple-darwin' },
+            f.directory,
+        ).arch,
+        'x86_64',
+    );
+});
+
+for (const env of [
+    { RELEASE_TAG: 'v1.2.3' },
+    { RELEASE_TAG: 'macos-v1.2.4' },
+    { RELEASE_TAG: 'macos-v1.2.3; echo bad' },
+    { MACOS_RELEASE_TARGET: 'x86_64-unknown-linux-gnu' },
+    { APPLE_SIGNING_IDENTITY: '-' },
+    { APPLE_SIGNING_IDENTITY: 'Apple Development: Example (ZZX2KZGTHU)' },
+    {
+        APPLE_SIGNING_IDENTITY:
+            'Developer ID Application: Example (OLDTEAM123)',
+    },
+]) {
+    test(`rejects invalid release inputs ${JSON.stringify(env)}`, (t) => {
+        const f = fixture(t);
+        assert.throws(() => releaseMetadata({ ...f.env, ...env }, f.directory));
+    });
+}
+
+for (const [file, contents] of [
+    ['package.json', '{"version":"1.2.4"}'],
+    ['src-tauri/Cargo.toml', '[package]\nversion = "1.2.4"'],
+    ['src-tauri/tauri.conf.json', '{"version":"01.2.3"}'],
+    [
+        'src-tauri/tauri.conf.json',
+        '{"version":"1.2.3","identifier":"other","productName":"KanbanGit"}',
+    ],
+]) {
+    test(`rejects inconsistent metadata in ${file}: ${contents}`, (t) => {
+        const f = fixture(t);
+        writeFileSync(join(f.directory, file), contents);
+        assert.throws(() => releaseMetadata(f.env, f.directory));
+    });
+}
+
+test('packages only a verified app and checks the extracted download again', (t) => {
+    const f = fixture(t);
+    const output = packageNotarizedApp(f);
+    assert.equal(
+        readFileSync(join(output.directory, output.filename), 'utf8'),
+        'notarized archive',
+    );
+    assert.equal(
+        readFileSync(
+            join(output.directory, `${output.filename}.sha256`),
+            'utf8',
+        ),
+        `${output.checksum}  ${output.filename}\n`,
+    );
+    assert.equal(f.calls.filter((call) => call.command === 'spctl').length, 2);
+    assert.equal(f.calls.filter((call) => call.command === 'xcrun').length, 2);
+    assert.match(
+        f.calls.findLast((call) => call.command === 'spctl').args.at(-1),
+        /extracted\/KanbanGit\.app$/,
+    );
+    assert.throws(() => packageNotarizedApp(f), /already exists/);
+});
+
+for (const failure of ['codesign', 'lipo', 'xcrun', 'spctl', 'ditto']) {
+    test(`does not publish local output when ${failure} verification fails`, (t) => {
+        const f = fixture(t);
+        const run = f.run;
+        f.run = (command, args) => {
+            if (command === failure) {
+                throw new Error('verification failed');
+            }
+            return run(command, args);
+        };
+        assert.throws(() => packageNotarizedApp(f), /verification failed/);
+        assert.equal(
+            existsSync(
+                join(
+                    f.directory,
+                    'src-tauri/target/macos-release/1.2.3-aarch64-apple-darwin',
+                ),
+            ),
+            false,
+        );
+    });
+}
+
+test('rejects an app built for a different architecture', (t) => {
+    const f = fixture(t);
+    const metadata = releaseMetadata(f.env, f.directory);
+    assert.throws(
+        () =>
+            verifyNotarizedApp('KanbanGit.app', metadata, (command, args) =>
+                command === 'lipo' ? 'x86_64' : f.run(command, args),
+            ),
+        /architecture/,
+    );
+});
+
+test('failed validation of the extracted app discards staged download', (t) => {
+    const f = fixture(t);
+    const run = f.run;
+    f.run = (command, args) => {
+        if (command === 'spctl' && args.at(-1).includes('extracted/')) {
+            throw new Error('roundtrip invalid');
+        }
+        return run(command, args);
+    };
+    assert.throws(() => packageNotarizedApp(f), /roundtrip invalid/);
+    assert.equal(
+        existsSync(
+            join(
+                f.directory,
+                'src-tauri/target/macos-release/1.2.3-aarch64-apple-darwin',
+            ),
+        ),
+        false,
+    );
+});

native/tests/publish-macos.test.js

@@ -0,0 +1,231 @@
+import assert from 'node:assert/strict';
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { publishMacos, storageConfiguration } from '../publish-macos.mjs';
+
+function fixture(t) {
+    const directory = mkdtempSync(join(tmpdir(), 'kanbangit-upload-test-'));
+    t.after(() => rmSync(directory, { recursive: true, force: true }));
+    const metadata = {
+        version: '1.2.3',
+        target: 'aarch64-apple-darwin',
+        filename: 'KanbanGit-1.2.3-aarch64-apple-darwin.zip',
+    };
+    const archive = Buffer.from('verified release');
+    const checksum = createHash('sha256').update(archive).digest('hex');
+    writeFileSync(join(directory, metadata.filename), archive);
+    writeFileSync(
+        join(directory, `${metadata.filename}.sha256`),
+        `${checksum}  ${metadata.filename}\n`,
+    );
+    const env = {
+        S3_BUCKET: 'release-bucket',
+        S3_REGION: 'nbg1',
+        AWS_ACCESS_KEY_ID: 'test-key',
+        AWS_SECRET_ACCESS_KEY: 'test-secret',
+    };
+    const objects = new Map();
+    const events = [];
+    const run = (command, args) => {
+        assert.equal(command, 'aws');
+        assert.equal(args[1], 'https://nbg1.your-objectstorage.com');
+        const operation = args[args.indexOf('s3api') + 1];
+        const value = (name) => args[args.indexOf(name) + 1];
+        const key = value('--key');
+        events.push({ operation, key });
+        if (operation === 'get-bucket-versioning') {
+            return '{}';
+        }
+        if (operation === 'put-object') {
+            assert.equal(value('--if-none-match'), '*');
+            if (objects.has(key)) {
+                throw new Error(
+                    'aws failed: (PreconditionFailed) object exists',
+                );
+            }
+            objects.set(key, readFileSync(value('--body')));
+            return '{}';
+        }
+        if (operation === 'get-object') {
+            writeFileSync(args.at(-1), objects.get(key));
+            return '{}';
+        }
+        throw new Error(`Unexpected S3 operation: ${operation}`);
+    };
+    const fetchPublic = async (url, options) => {
+        assert.equal(options.redirect, 'error');
+        assert.equal(
+            new URL(url).hostname,
+            'release-bucket.nbg1.your-objectstorage.com',
+        );
+        const key = new URL(url).pathname.slice(1);
+        events.push({ operation: 'public-get', key });
+        return {
+            ok: objects.has(key),
+            arrayBuffer: async () => objects.get(key),
+        };
+    };
+    return { directory, metadata, env, objects, events, run, fetchPublic };
+}
+
+test('uploads immutable files and writes completion record after public verification', async (t) => {
+    const f = fixture(t);
+    const url = await publishMacos(f);
+    assert.equal(
+        url,
+        `https://release-bucket.nbg1.your-objectstorage.com/releases/macos/aarch64-apple-darwin/1.2.3/${f.metadata.filename}`,
+    );
+    assert.deepEqual(
+        f.events.map((event) => event.operation),
+        [
+            'get-bucket-versioning',
+            'put-object',
+            'public-get',
+            'put-object',
+            'public-get',
+            'put-object',
+            'public-get',
+        ],
+    );
+    assert.equal(f.objects.size, 3);
+    assert(f.events.at(-1).key.endsWith('/release.json'));
+    assert(![...f.objects.keys()].some((key) => key.includes('latest')));
+    assert.deepEqual(JSON.parse(f.objects.get(f.events.at(-1).key)), {
+        version: '1.2.3',
+        target: f.metadata.target,
+        url,
+        sha256: createHash('sha256').update('verified release').digest('hex'),
+        checksumUrl: `${url}.sha256`,
+    });
+});
+
+test('retry accepts byte-identical objects without replacing them', async (t) => {
+    const f = fixture(t);
+    await publishMacos(f);
+    const originals = [...f.objects.entries()];
+    await publishMacos(f);
+    assert.deepEqual([...f.objects.entries()], originals);
+    assert.equal(
+        f.events.filter((event) => event.operation === 'get-object').length,
+        3,
+    );
+});
+
+test('different existing release is never overwritten', async (t) => {
+    const f = fixture(t);
+    const key = `releases/macos/${f.metadata.target}/1.2.3/${f.metadata.filename}`;
+    f.objects.set(key, Buffer.from('previous version content'));
+    await assert.rejects(publishMacos(f), /bump the app version/);
+    assert.equal(f.objects.get(key).toString(), 'previous version content');
+    assert.equal(f.objects.size, 1);
+});
+
+test('checksum mismatch aborts before contacting S3', async (t) => {
+    const f = fixture(t);
+    writeFileSync(join(f.directory, f.metadata.filename), 'tampered');
+    await assert.rejects(publishMacos(f), /SHA-256/);
+    assert.equal(f.events.length, 0);
+});
+
+for (const status of ['Enabled', 'Suspended']) {
+    test(`rejects ${status} bucket versioning before any write`, async (t) => {
+        const f = fixture(t);
+        f.run = () => JSON.stringify({ Status: status });
+        await assert.rejects(publishMacos(f), /unversioned/);
+        assert.equal(f.objects.size, 0);
+    });
+}
+
+for (const operation of ['get-bucket-versioning', 'put-object', 'get-object']) {
+    test(`${operation} access or network failure cannot be mistaken for a missing object`, async (t) => {
+        const f = fixture(t);
+        await publishMacos(f);
+        const run = f.run;
+        f.events.length = 0;
+        f.run = (command, args) => {
+            if (args.includes(operation)) {
+                throw new Error('AccessDenied');
+            }
+            return run(command, args);
+        };
+        await assert.rejects(publishMacos(f), /AccessDenied/);
+        assert(!f.events.some((event) => event.key.endsWith('/release.json')));
+    });
+}
+
+for (const failure of ['private', 'wrong-content', 'network']) {
+    test(`public download ${failure} prevents completion record`, async (t) => {
+        const f = fixture(t);
+        f.fetchPublic = async () => {
+            if (failure === 'network') {
+                throw new Error('network failure');
+            }
+            return {
+                ok: failure !== 'private',
+                arrayBuffer: async () => Buffer.from('wrong'),
+            };
+        };
+        await assert.rejects(publishMacos(f));
+        assert(
+            ![...f.objects.keys()].some((key) => key.endsWith('/release.json')),
+        );
+    });
+}
+
+test('a partial upload can resume with the same files', async (t) => {
+    const f = fixture(t);
+    const run = f.run;
+    f.run = (command, args) => {
+        if (
+            args.includes('put-object') &&
+            args[args.indexOf('--key') + 1].endsWith('.sha256')
+        ) {
+            throw new Error('upload interrupted');
+        }
+        return run(command, args);
+    };
+    await assert.rejects(publishMacos(f), /interrupted/);
+    assert.equal(f.objects.size, 1);
+    f.run = run;
+    await publishMacos(f);
+    assert.equal(f.objects.size, 3);
+});
+
+for (const overrides of [
+    { S3_REGION: '' },
+    { S3_REGION: 'eu-central-1' },
+    { S3_BUCKET: '' },
+    { S3_BUCKET: 'other/../bucket' },
+    { S3_PREFIX: '../other' },
+    { S3_PUBLIC_BASE_URL: 'http://downloads.example.com' },
+    { S3_PUBLIC_BASE_URL: 'https://secret@downloads.example.com' },
+    { S3_PUBLIC_BASE_URL: 'https://downloads.example.com?token=secret' },
+    { AWS_ACCESS_KEY_ID: '' },
+    { AWS_SECRET_ACCESS_KEY: '' },
+]) {
+    test(`invalid storage configuration is rejected before S3 access: ${JSON.stringify(overrides)}`, async (t) => {
+        const f = fixture(t);
+        f.env = { ...f.env, ...overrides };
+        await assert.rejects(publishMacos(f));
+        assert.equal(f.events.length, 0);
+    });
+}
+
+test('derives Hetzner endpoints and supports an explicit public proxy URL', () => {
+    for (const region of ['nbg1', 'fsn1', 'hel1']) {
+        const config = storageConfiguration({
+            S3_REGION: region,
+            S3_BUCKET: 'release-bucket',
+            S3_PUBLIC_BASE_URL: 'https://downloads.example.com/',
+        });
+        assert.equal(
+            config.endpoint,
+            `https://${region}.your-objectstorage.com`,
+        );
+        assert.equal(config.publicBase, 'https://downloads.example.com');
+    }
+});