thwap/thwap-pagesd

Watch

Fork 0

chore(packaging): package tpagectl for distribution #620

Merged

fuzzy merged 1 commit from chore/tpagectl-packaging into main

2026-08-09 19:18:33 +00:00

automation commented

2026-08-09 19:00:34 +00:00

Owner

What

Implements Phase 9 packaging for distribution (roadmap #302).

Docker (#300) — new cmd/tpagectl/Dockerfile (multi-stage, static CGO_ENABLED=0 build on alpine), and the CI docker job now builds/pushes the git.lan.thwap.org/thwap/tpagectl image via thwap-actions/docker-build (linux/amd64+arm64) alongside the existing daemon image.
Debian .deb (#301) — new packaging/deb/nfpm.yaml; the release workflow installs nfpm, builds tpagectl_<ver>_amd64.deb + _arm64.deb from the linux binaries, and uploads them to the release.
Homebrew (#298) — new packaging/homebrew/tpagectl.rb (darwin arm64/amd64 formula); the release finalize step now also publishes a tarballs.sha256 asset so the formula's sha256 values are fillable per release.
Snap (#299) — new packaging/snap/snapcraft.yaml (core22, go plugin); build/publish requires snapcraft + a Snapcraft account and is documented as outside CI.
Documented the packaging matrix in cmd/tpagectl/README.md.

Why

Roadmap task #302.

Testing

Workflow YAML + nfpm.yaml/snapcraft.yaml parse; pre-commit "Validate Forgejo Actions files" and "check yaml" pass
Homebrew formula ruby -c clean
Both release-workflow python blocks py_compile clean
nfpm .deb build simulated locally — amd64+arm64 packages with correct Package/Version/Architecture/Description (verified via dpkg-deb -I)
Tarball archive + tarballs.sha256 checksum logic simulated against fake dist dirs
go test ./... passes (30 packages); no Go changes

Breaking Changes

None. ci.yml/release.yml additions are additive.

Notes

Only the Docker image uses a thwap-actions action (as requested); Homebrew/Snap are committed manifests and the .deb is built in-repo via nfpm.

Closes #298
Closes #299
Closes #300
Closes #301
Closes #302

## What Implements Phase 9 packaging for distribution (roadmap #302). - **Docker (#300)** — new `cmd/tpagectl/Dockerfile` (multi-stage, static `CGO_ENABLED=0` build on `alpine`), and the CI `docker` job now builds/pushes the `git.lan.thwap.org/thwap/tpagectl` image via `thwap-actions/docker-build` (linux/amd64+arm64) alongside the existing daemon image. - **Debian `.deb` (#301)** — new `packaging/deb/nfpm.yaml`; the release workflow installs `nfpm`, builds `tpagectl_<ver>_amd64.deb` + `_arm64.deb` from the linux binaries, and uploads them to the release. - **Homebrew (#298)** — new `packaging/homebrew/tpagectl.rb` (darwin arm64/amd64 formula); the release `finalize` step now also publishes a `tarballs.sha256` asset so the formula's `sha256` values are fillable per release. - **Snap (#299)** — new `packaging/snap/snapcraft.yaml` (core22, go plugin); build/publish requires snapcraft + a Snapcraft account and is documented as outside CI. - Documented the packaging matrix in `cmd/tpagectl/README.md`. ## Why Roadmap task #302. ## Testing - [x] Workflow YAML + `nfpm.yaml`/`snapcraft.yaml` parse; pre-commit "Validate Forgejo Actions files" and "check yaml" pass - [x] Homebrew formula `ruby -c` clean - [x] Both release-workflow python blocks `py_compile` clean - [x] nfpm `.deb` build simulated locally — amd64+arm64 packages with correct `Package`/`Version`/`Architecture`/`Description` (verified via `dpkg-deb -I`) - [x] Tarball archive + `tarballs.sha256` checksum logic simulated against fake dist dirs - [x] `go test ./...` passes (30 packages); no Go changes ## Breaking Changes None. `ci.yml`/`release.yml` additions are additive. ## Notes Only the Docker image uses a `thwap-actions` action (as requested); Homebrew/Snap are committed manifests and the `.deb` is built in-repo via nfpm. Closes #298 Closes #299 Closes #300 Closes #301 Closes #302

automation added 1 commit

2026-08-09 19:00:34 +00:00

chore(packaging): package tpagectl for distribution

CI / build (pull_request) Successful in 9s

Details

CI / test (pull_request) Successful in 5m9s

Details

CI / docker (pull_request) Successful in 2m46s

Details

CI / lint (pull_request) Successful in 5m31s

Details

CI / build (push) Successful in 6m53s

Details

CI / test (push) Successful in 12m38s

Details

CI / lint (push) Successful in 13m21s

Details

CI / docker (push) Successful in 26m5s

Details

6c68695f4d

- #300 Docker: add cmd/tpagectl/Dockerfile (multi-stage, static binary)
  and build the git.lan.thwap.org/thwap/tpagectl image on main/PR via
  thwap-actions/docker-build alongside the daemon image.
- #301 Debian: add packaging/deb/nfpm.yaml and build amd64/arm64 .deb
  packages in the release workflow, uploading them to the release.
- #298 Homebrew: add packaging/homebrew/tpagectl.rb (darwin/linux formula)
  and publish a tarballs.sha256 asset so the formula shas are fillable.
- #299 Snap: add packaging/snap/snapcraft.yaml (build via snapcraft
  outside CI).
- Documented the packaging matrix in cmd/tpagectl/README.md.

Closes #298
Closes #299
Closes #300
Closes #301
Closes #302

the.auditor referenced this pull request

2026-08-09 19:18:06 +00:00

snapcraft.yaml missing network plug: strict snap cannot reach the daemon #621

the.auditor approved these changes

2026-08-09 19:18:18 +00:00

the.auditor left a comment

Solid packaging pass. Naming is consistent end-to-end (the .deb step's cp from cmd/tpagectl/dist/tpagectl_${TAG}_linux_amd64 confirms golang-release names artifacts <bin>_<tag>_<os>_<arch>, which matches both nfpm's contents.src and the Homebrew tarball URLs), the Dockerfile is a clean static multi-stage build, and the .deb path fails loudly rather than silently. Approving; one snap manifest defect filed.

Suggestions

packaging/snap/snapcraft.yaml – Strict confinement with no declared plugs means the snap cannot use the network; tpagectl is a pure HTTP client, so the built snap would be non-functional. Declare plugs: [network, home] (plus dbus for Secret Service keychain use). Filed as #621.

Notes

nfpm is installed unpinned (@latest) and version/arch are substituted via sed placeholders rather than nfpm's native {{.Version}}/{{.Arch}} templating — fine for vX.Y.Z tags, fragile for tags containing regex-special characters.
The Docker image isn't built with version ldflags, so tpagectl version reports dev/none/unknown in the container; running a client CLI as a container is an unusual design worth confirming.
The docker job (un-gated on Go changes) now builds two multi-arch images on every push.
#615 (@main refs) also applies to the new docker-build usages.

Praise

Multi-stage Dockerfile with CGO_ENABLED=0, vendored build, and a non-root user; ca-certificates included.
Homebrew formula correctly branches darwin arm64/amd64 with per-URL sha256, and the release publishes tarballs.sha256 to fill them.
The .deb build is fail-fast (missing source binary aborts the job), unlike the silent-skip risk tracked in #619.

Solid packaging pass. Naming is consistent end-to-end (the `.deb` step's `cp` from `cmd/tpagectl/dist/tpagectl_${TAG}_linux_amd64` confirms `golang-release` names artifacts `<bin>_<tag>_<os>_<arch>`, which matches both nfpm's `contents.src` and the Homebrew tarball URLs), the Dockerfile is a clean static multi-stage build, and the `.deb` path fails loudly rather than silently. Approving; one snap manifest defect filed. ## Suggestions 1. `packaging/snap/snapcraft.yaml` – Strict confinement with no declared plugs means the snap cannot use the network; `tpagectl` is a pure HTTP client, so the built snap would be non-functional. Declare `plugs: [network, home]` (plus `dbus` for Secret Service keychain use). Filed as #621. ## Notes - `nfpm` is installed unpinned (`@latest`) and version/arch are substituted via `sed` placeholders rather than nfpm's native `{{.Version}}`/`{{.Arch}}` templating — fine for `vX.Y.Z` tags, fragile for tags containing regex-special characters. - The Docker image isn't built with version ldflags, so `tpagectl version` reports `dev/none/unknown` in the container; running a client CLI as a container is an unusual design worth confirming. - The `docker` job (un-gated on Go changes) now builds two multi-arch images on every push. - #615 (`@main` refs) also applies to the new `docker-build` usages. ## Praise - Multi-stage Dockerfile with `CGO_ENABLED=0`, vendored build, and a non-root user; `ca-certificates` included. - Homebrew formula correctly branches darwin arm64/amd64 with per-URL sha256, and the release publishes `tarballs.sha256` to fill them. - The `.deb` build is fail-fast (missing source binary aborts the job), unlike the silent-skip risk tracked in #619.

fuzzy merged commit 6c68695f4d into main

2026-08-09 19:18:33 +00:00

fuzzy deleted branch chore/tpagectl-packaging

2026-08-09 19:18:33 +00:00