update.yml

name: Update

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

# Least privilege: read-only unless a step needs more.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  windows:
    name: Windows
    runs-on: windows-2025
    timeout-minutes: 45
    steps:
      # Actions are pinned to full commit SHAs (tags can be moved).
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # aqtinstall (used to install Qt) needs compression libraries that may not
      # have packages for the very newest Python yet, so pin a known-good one.
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"

      - name: Install Qt
        uses: jurplel/install-qt-action@a9c63c7c123f3069cff414e7e482d95dfa9d8125 # v4.4.1
        with:
          # Exact version for reproducible builds. 6.10.3 is the newest Qt the
          # installer (aqtinstall 3.3) can read; 6.11+ metadata is not
          # supported by it yet.
          version: "6.10.3"
          arch: win64_msvc2022_64
          setup-python: false
          cache: true

      - name: Configure, build and test
        shell: cmd
        run: |
          for /f "usebackq tokens=*" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath`) do set "VSDIR=%%i"
          call "%VSDIR%\VC\Auxiliary\Build\vcvars64.bat" || exit /b 1
          cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release || exit /b 1
          cmake --build build || exit /b 1
          ctest --test-dir build --output-on-failure || exit /b 1

      - name: Assemble app folder
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $ver = (Get-Content VERSION -First 1).Trim()
          $dir = "dist\Rclone Explorer"
          New-Item -ItemType Directory -Force $dir | Out-Null
          Copy-Item build\build\RcloneExplorer.exe "$dir\Rclone Explorer.exe"

          # Qt plugins go into qt\plugins (found via qt.conf) instead of seven
          # folders next to the exe; plugin types the app does not use are
          # skipped. Qt and VC++ DLLs must stay next to the exe: Windows loads
          # them before any app code runs.
          windeployqt --release --no-translations --no-system-d3d-compiler `
                      --no-opengl-sw --no-compiler-runtime `
                      --skip-plugin-types styles,generic,networkinformation `
                      --plugindir "$dir\qt\plugins" "$dir\Rclone Explorer.exe"
          @(
            "[Paths]"
            "Plugins = qt/plugins"
          ) | Set-Content -Encoding ascii "$dir\qt.conf"

          # App-local VC++ runtime: the folder runs on a clean Windows install.
          $vs = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -property installationPath
          $redist = Get-ChildItem "$vs\VC\Redist\MSVC" -Directory | Where-Object { $_.Name -match '^\d' } | Sort-Object Name -Descending | Select-Object -First 1
          $crt = Get-ChildItem "$($redist.FullName)\x64" -Directory -Filter "Microsoft.VC*.CRT" | Select-Object -First 1
          Copy-Item "$($crt.FullName)\*.dll" $dir

          # Bundle the latest official rclone, checksum-verified.
          $tag = (Invoke-WebRequest -Uri https://downloads.rclone.org/version.txt -UseBasicParsing).Content.Trim() -replace '^rclone\s+',''
          $zip = "rclone-$tag-windows-amd64.zip"
          Invoke-WebRequest "https://downloads.rclone.org/$tag/$zip" -OutFile $zip
          Invoke-WebRequest "https://downloads.rclone.org/$tag/SHA256SUMS" -OutFile SHA256SUMS
          $expected = (Select-String -Path SHA256SUMS -Pattern "^([0-9a-f]{64})\s+$([regex]::Escape($zip))$").Matches[0].Groups[1].Value
          $actual = (Get-FileHash $zip -Algorithm SHA256).Hash.ToLower()
          if ($expected -ne $actual) { throw "rclone checksum mismatch" }
          Expand-Archive $zip -DestinationPath rclone-x
          New-Item -ItemType Directory -Force "$dir\rclone" | Out-Null
          Copy-Item (Get-ChildItem rclone-x -Recurse -Filter rclone.exe).FullName "$dir\rclone\"

          # Presence of "Rclone Explorer.ini" switches on portable mode. Paths are
          # relative to the exe, so the folder can live anywhere (USB stick...).
          @(
            "[Settings]"
            "rclone=rclone/rclone.exe"
            "checkRcloneUpdates=true"
          ) | Set-Content -Encoding ascii "$dir\Rclone Explorer.ini"

          # remote logos shipped by default (users can add or replace files)
          New-Item -ItemType Directory -Force "$dir\icons\remotes" | Out-Null
          Copy-Item icons\remotes\*.png "$dir\icons\remotes\"
          Copy-Item docs\remote-icons.md "$dir\icons\remotes\README.md"
          New-Item -ItemType Directory -Force "$dir\docs" | Out-Null
          Copy-Item README.md, LICENSE, CHANGELOG.md, docs\Rclone-Explorer-Guide.pdf "$dir\docs\"

          # Smoke test of the packaged folder: the app must start with this
          # layout (platform plugin via qt.conf, image formats, TLS).
          $p = Start-Process -FilePath "$dir\Rclone Explorer.exe" -ArgumentList "--selftest" `
                 -PassThru -NoNewWindow -RedirectStandardOutput selftest.txt
          if (-not $p.WaitForExit(90000)) { $p.Kill(); throw "self-test timed out" }
          $out = (Get-Content selftest.txt -Raw)
          Write-Host $out
          if ($p.ExitCode -ne 0) { throw "self-test failed ($($p.ExitCode)): $($out -replace '\s+',' ')" }
          Compress-Archive "$dir" "dist\RcloneExplorer-$ver-windows-x64.zip"
          "VERSION=$ver" | Out-File -Append $env:GITHUB_ENV

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: RcloneExplorer-${{ env.VERSION }}-windows-x64
          path: dist/Rclone Explorer

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-windows
          path: dist/*.zip
          if-no-files-found: error

  linux:
    name: Linux
    # oldest supported Ubuntu LTS: the AppImage bundles libraries from the
    # build system, so it only runs where glibc is at least this new (2.35)
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"

      - name: Install Qt
        uses: jurplel/install-qt-action@a9c63c7c123f3069cff414e7e482d95dfa9d8125 # v4.4.1
        with:
          version: "6.10.3"
          host: linux
          target: desktop
          arch: linux_gcc_64
          setup-python: false
          cache: true

      - name: Build dependencies
        run: |
          sudo apt-get update -q
          sudo apt-get install -y -q ninja-build libgl1-mesa-dev libegl1 libxkbcommon-x11-0 \
            libxcb-cursor0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 libxcb-randr0 \
            libxcb-render-util0 libxcb-shape0 libxcb-xinerama0 libxcb-xkb1 libfontconfig1 \
            libdbus-1-3 xvfb file appstream

      - name: Configure, build and test
        run: |
          cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release
          cmake --build build
          ctest --test-dir build --output-on-failure

      - name: Build AppImage
        env:
          APPIMAGE_EXTRACT_AND_RUN: "1"
        run: |
          set -euo pipefail
          ver=$(head -1 VERSION | tr -d '[:space:]')
          echo "VERSION=$ver" >> "$GITHUB_ENV"

          # AppImage tooling, pinned to releases and verified by checksum
          curl -fsSLo linuxdeploy https://github.com/linuxdeploy/linuxdeploy/releases/download/1-alpha-20251107-1/linuxdeploy-x86_64.AppImage
          curl -fsSLo linuxdeploy-plugin-qt https://github.com/linuxdeploy/linuxdeploy-plugin-qt/releases/download/1-alpha-20250213-1/linuxdeploy-plugin-qt-x86_64.AppImage
          echo "c20cd71e3a4e3b80c3483cef793cda3f4e990aca14014d23c544ca3ce1270b4d  linuxdeploy" | sha256sum -c -
          echo "15106be885c1c48a021198e7e1e9a48ce9d02a86dd0a1848f00bdbf3c1c92724  linuxdeploy-plugin-qt" | sha256sum -c -
          mv linuxdeploy linuxdeploy-x86_64.AppImage
          mv linuxdeploy-plugin-qt linuxdeploy-plugin-qt-x86_64.AppImage
          chmod +x linuxdeploy*.AppImage

          # app files
          mkdir -p AppDir/usr/bin AppDir/usr/share/applications AppDir/usr/share/metainfo \
                   AppDir/usr/share/icons/hicolor/256x256/apps AppDir/usr/share/rclone-browser
          cp build/build/rclone-explorer AppDir/usr/bin/
          cp packaging/linux/rclone-explorer.desktop AppDir/usr/share/applications/
          cp packaging/linux/rclone-explorer.png AppDir/usr/share/icons/hicolor/256x256/apps/
          cp packaging/linux/io.github.jackpison.RcloneExplorer.metainfo.xml AppDir/usr/share/metainfo/
          # add this version to the AppStream metadata, then validate it
          python3 - "$ver" AppDir/usr/share/metainfo/io.github.jackpison.RcloneExplorer.metainfo.xml <<'PY'
          import datetime, sys
          ver, path = sys.argv[1], sys.argv[2]
          today = datetime.date.today().isoformat()
          xml = open(path, encoding="utf-8").read()
          rel = (f'  <releases>\n    <release version="{ver}" date="{today}">\n'
                 f'      <url>https://github.com/Jackpison/RcloneExplorer/releases/tag/v{ver}</url>\n'
                 f'    </release>\n  </releases>\n')
          xml = xml.replace("</component>", rel + "</component>")
          open(path, "w", encoding="utf-8").write(xml)
          PY
          appstreamcli validate --no-net AppDir/usr/share/metainfo/io.github.jackpison.RcloneExplorer.metainfo.xml
          mkdir -p AppDir/usr/share/rclone-browser/icons/remotes
          cp icons/remotes/*.png AppDir/usr/share/rclone-browser/icons/remotes/

          # latest official rclone, checksum-verified
          tag=$(curl -fsSL https://downloads.rclone.org/version.txt | sed 's/^rclone //' | tr -d '[:space:]')
          zip="rclone-$tag-linux-amd64.zip"
          curl -fsSLO "https://downloads.rclone.org/$tag/$zip"
          curl -fsSLO "https://downloads.rclone.org/$tag/SHA256SUMS"
          grep -E "^[0-9a-f]{64}  $zip\$" SHA256SUMS | sha256sum -c -
          python3 -m zipfile -e "$zip" rclone-x
          install -m 755 "$(find rclone-x -name rclone -type f | head -1)" AppDir/usr/bin/rclone

          # Final file name set here (not renamed afterwards) so the .zsync file
          # refers to the right AppImage. The update information lets
          # AppImageUpdate and similar tools fetch new releases.
          app="RcloneExplorer-$ver-x86_64.AppImage"
          QMAKE="$QT_ROOT_DIR/bin/qmake" LINUXDEPLOY_OUTPUT_VERSION="$ver" \
          LDAI_OUTPUT="$app" \
          LDAI_UPDATE_INFORMATION="gh-releases-zsync|Jackpison|RcloneExplorer|latest|RcloneExplorer-*-x86_64.AppImage.zsync" \
            ./linuxdeploy-x86_64.AppImage --appdir AppDir --plugin qt --output appimage
          mkdir -p dist
          mv "$app" "$app.zsync" dist/
          chmod +x "dist/$app"

          # update information must be embedded and the .zsync must match
          if ! grep -aq 'gh-releases-zsync|Jackpison|RcloneExplorer|latest|' "dist/$app"; then
            echo "::error::update information missing from the AppImage"
            exit 1
          fi
          if ! head -c 512 "dist/$app.zsync" | grep -aq "^URL: $app\$"; then
            echo "::error::.zsync file does not refer to $app"
            exit 1
          fi

          # compatibility guard: nothing bundled may need a newer glibc than 2.35
          max=$(find AppDir -type f -exec sh -c 'file -b "$1" | grep -q ELF && objdump -T "$1" 2>/dev/null' _ {} \; \
                | grep -o 'GLIBC_[0-9][0-9.]*' | sed 's/GLIBC_//' | sort -uV | tail -1)
          echo "highest glibc symbol version used: $max"
          if [ "$(printf '%s\n2.35\n' "$max" | sort -V | tail -1)" != "2.35" ]; then
            echo "::error::AppImage needs glibc $max, more than 2.35 (Ubuntu 22.04)"
            exit 1
          fi

          # smoke test of the finished AppImage on an X11 display
          if ! out=$(xvfb-run -a "dist/RcloneExplorer-$ver-x86_64.AppImage" --selftest 2>&1); then
            echo "::error::self-test failed: $(echo "$out" | tr '\n' ' ')"
            exit 1
          fi
          echo "$out"

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-linux
          path: |
            dist/*.AppImage
            dist/*.AppImage.zsync
          if-no-files-found: error

  release:
    name: Release
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [windows, linux]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write # publish the release
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: release-*
          path: dist
          merge-multiple: true

      - name: Checksums and release notes
        run: |
          set -euo pipefail
          ver=$(head -1 VERSION | tr -d '[:space:]')
          echo "VERSION=$ver" >> "$GITHUB_ENV"
          (cd dist && sha256sum *.zip *.AppImage *.zsync > SHA256SUMS.txt && cat SHA256SUMS.txt)
          python3 - "$ver" <<'PY'
          import re, sys
          ver = sys.argv[1]
          log = open("CHANGELOG.md", encoding="utf-8").read()
          m = re.search(r"(?ms)^## \[" + re.escape(ver) + r"\][^\n]*\n(.*?)(?=^## |\Z)", log)
          notes = m.group(1).strip() if m else "See CHANGELOG.md for details."
          notes += (
              "\n\n---\n**Downloads**\n\n"
              f"- **Windows 10/11:** `RcloneExplorer-{ver}-windows-x64.zip`, extract anywhere and run `Rclone Explorer.exe`.\n"
              f"- **Linux (x86_64):** `RcloneExplorer-{ver}-x86_64.AppImage`, make it executable (`chmod +x`) and run it.\n\n"
              "SHA-256 checksums are in `SHA256SUMS.txt`."
          )
          open("dist/release-notes.md", "w", encoding="utf-8").write(notes)
          PY

      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          name: Rclone Explorer ${{ env.VERSION }}
          body_path: dist/release-notes.md
          files: |
            dist/*.zip
            dist/*.AppImage
            dist/*.zsync
            dist/SHA256SUMS.txt

      # winget manifests for this release (submitted to microsoft/winget-pkgs by hand)
      - name: winget manifests
        run: |
          set -euo pipefail
          sha=$(grep -- '-windows-x64.zip$' dist/SHA256SUMS.txt | cut -d' ' -f1)
          python3 packaging/winget/make_manifests.py "$VERSION" "$sha" winget

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: winget-manifests-${{ env.VERSION }}
          path: winget

      # The repository doubles as a Scoop bucket:
      #   scoop bucket add rclone-explorer https://github.com/Jackpison/RcloneExplorer
      - name: Update Scoop manifest
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          sha=$(grep -- '-windows-x64.zip$' dist/SHA256SUMS.txt | cut -d' ' -f1)
          git fetch --depth=1 origin main
          git checkout -B main FETCH_HEAD
          python3 packaging/scoop/make_manifest.py "$VERSION" "$sha"
          git add bucket/rclone-explorer.json
          if git diff --cached --quiet; then echo "manifest unchanged"; exit 0; fi
          git -c user.name="github-actions[bot]" \
              -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
              commit -m "Scoop: rclone-explorer $VERSION [skip ci]"
          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" main