Kube

.env.example

@@ -0,0 +1,15 @@
+# Lapdev API configuration
+
+# Required: PostgreSQL connection URL for the Lapdev database.
+# Example: postgres://username:password@db-host:5432/lapdev
+LAPDEV_DB_URL=postgres://username:password@localhost:5432/lapdev
+
+# Optional overrides with sensible defaults.
+LAPDEV_BIND_ADDR=0.0.0.0
+LAPDEV_HTTP_PORT=8080
+LAPDEV_SSH_PROXY_PORT=2222
+LAPDEV_SSH_PROXY_DISPLAY_PORT=2222
+LAPDEV_PREVIEW_URL_PROXY_PORT=8443
+
+# Set to force all workspaces to run under a specific OS user.
+# LAPDEV_FORCE_OSUSER=

.github/workflows/release-cli.yml

@@ -0,0 +1,246 @@
+name: Release Lapdev CLI
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Lapdev CLI version (e.g. 0.1.0). Must match Cargo.toml."
+        required: true
+  push:
+    tags:
+      - "lapdev-cli-v*"
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.vars.outputs.version }}
+      tag_name: ${{ steps.vars.outputs.tag_name }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - id: vars
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            VERSION="${{ github.event.inputs.version }}"
+          else
+            VERSION="${GITHUB_REF_NAME#lapdev-cli-v}"
+          fi
+
+          VERSION="${VERSION#v}"
+          if [[ -z "$VERSION" ]]; then
+            echo "Unable to determine version" >&2
+            exit 1
+          fi
+
+          TAG_NAME="lapdev-cli-v${VERSION}"
+
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"
+
+      - name: Verify Cargo version matches release version
+        run: |
+          FILE_VERSION=$(python - <<'PY'
+          import pathlib, tomllib
+          data = tomllib.loads(pathlib.Path("Cargo.toml").read_text())
+          print(data["workspace"]["package"]["version"])
+          PY
+          )
+          if [[ "$FILE_VERSION" != "${{ steps.vars.outputs.version }}" ]]; then
+            echo "Cargo workspace version ${FILE_VERSION} does not match requested version ${{ steps.vars.outputs.version }}" >&2
+            exit 1
+          fi
+
+  build:
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            archive: tar.gz
+          - os: ubuntu-22.04
+            target: aarch64-unknown-linux-gnu
+            archive: tar.gz
+          - os: macos-13
+            target: x86_64-apple-darwin
+            archive: tar.gz
+          - os: macos-14
+            target: aarch64-apple-darwin
+            archive: tar.gz
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            archive: zip
+          - os: windows-latest
+            target: aarch64-pc-windows-msvc
+            archive: zip
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      TARGET: ${{ matrix.target }}
+      ARCHIVE_NAME: lapdev-cli-${{ matrix.target }}.${{ matrix.archive }}
+      ARTIFACT_NAME: lapdev-cli-${{ matrix.target }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+          components: "clippy,rustfmt"
+
+      - name: Install Linux cross toolchain
+        if: runner.os == 'Linux' && contains(matrix.target, 'aarch64-unknown-linux-gnu')
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes gcc-aarch64-linux-gnu
+
+      - name: Cargo fetch
+        run: cargo fetch --locked
+        if: runner.os != 'Windows'
+
+      - name: Cargo fetch (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: cargo fetch --locked
+
+      - name: Build (Unix)
+        if: runner.os != 'Windows'
+        run: cargo build -p lapdev-cli --release --locked --target "${TARGET}"
+
+      - name: Build (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: cargo build -p lapdev-cli --release --locked --target $env:TARGET
+
+      - name: Import Apple code signing cert
+        if: runner.os == 'macOS'
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.APPLE_CODESIGN_CERT_BASE64 }}
+          p12-password: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+
+      - name: Codesign binary (macOS)
+        if: runner.os == 'macOS'
+        env:
+          APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
+        run: |
+          codesign --force --timestamp --options runtime --sign "${APPLE_CODESIGN_IDENTITY}" "target/${TARGET}/release/lapdev-cli"
+
+      - name: Notarize macOS binary
+        if: runner.os == 'macOS'
+        env:
+          APPLE_ID: ${{ secrets.APPLE_NOTARIZE_APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_NOTARIZE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          mkdir -p notarize
+          cp "target/${TARGET}/release/lapdev-cli" notarize/lapdev
+          ditto -c -k --keepParent notarize/lapdev notarize.zip
+          xcrun notarytool submit notarize.zip --apple-id "${APPLE_ID}" --team-id "${APPLE_TEAM_ID}" --password "${APPLE_PASSWORD}" --wait
+          xcrun stapler staple "target/${TARGET}/release/lapdev-cli"
+          rm -rf notarize notarize.zip
+
+      - name: Sign Windows binary
+        if: runner.os == 'Windows'
+        shell: pwsh
+        env:
+          WINDOWS_SIGNING_CERT: ${{ secrets.WINDOWS_SIGNING_CERT_BASE64 }}
+          WINDOWS_SIGNING_CERT_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERT_PASSWORD }}
+        run: |
+          if (-not $env:WINDOWS_SIGNING_CERT) {
+            throw "WINDOWS_SIGNING_CERT_BASE64 secret is required"
+          }
+          if (-not $env:WINDOWS_SIGNING_CERT_PASSWORD) {
+            throw "WINDOWS_SIGNING_CERT_PASSWORD secret is required"
+          }
+          $pfxPath = Join-Path $env:RUNNER_TEMP "codesign.pfx"
+          [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WINDOWS_SIGNING_CERT))
+          $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Filter signtool.exe -Recurse | Sort-Object FullName -Descending | Select-Object -First 1
+          if (-not $signtool) {
+            throw "signtool.exe not found"
+          }
+          & $signtool.FullName sign /fd SHA256 /td SHA256 /tr http://timestamp.digicert.com /f $pfxPath /p $env:WINDOWS_SIGNING_CERT_PASSWORD "target\${env:TARGET}\release\lapdev-cli.exe"
+          Remove-Item $pfxPath -Force
+
+      - name: Prepare artifact (Unix)
+        if: runner.os != 'Windows'
+        run: |
+          BIN="target/${TARGET}/release/lapdev-cli"
+          install -Dm755 "${BIN}" pack/lapdev
+          tar -C pack -czf "${ARCHIVE_NAME}" lapdev
+
+      - name: Prepare artifact (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $bin = "target\${env:TARGET}\release\lapdev-cli.exe"
+          New-Item -ItemType Directory -Path pack -Force | Out-Null
+          Copy-Item $bin "pack\lapdev.exe" -Force
+          Compress-Archive -Path "pack\lapdev.exe" -DestinationPath $env:ARCHIVE_NAME -Force
+
+      - uses: sigstore/[email protected]
+
+      - name: Sign artifact (Unix)
+        if: runner.os != 'Windows'
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          cosign sign-blob --yes --output-signature "${ARCHIVE_NAME}.sig" --output-certificate "${ARCHIVE_NAME}.pem" "${ARCHIVE_NAME}"
+
+      - name: Sign artifact (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          cosign sign-blob --yes --output-signature "$env:ARCHIVE_NAME.sig" --output-certificate "$env:ARCHIVE_NAME.pem" "$env:ARCHIVE_NAME"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.ARTIFACT_NAME }}
+          path: |
+            ${{ env.ARCHIVE_NAME }}
+            ${{ env.ARCHIVE_NAME }}.sig
+            ${{ env.ARCHIVE_NAME }}.pem
+
+  publish:
+    needs: [prepare, build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: release
+
+      - name: List artifacts
+        run: ls -R release
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ needs.prepare.outputs.tag_name }}
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          FILES=()
+          while IFS= read -r -d '' file; do
+            FILES+=("$file")
+          done < <(find release -type f -print0)
+
+          if [[ ${#FILES[@]} -eq 0 ]]; then
+            echo "No artifacts found to upload" >&2
+            exit 1
+          fi
+
+          FILES+=("pkg/installers/lapdev-cli.sh" "pkg/installers/lapdev-cli.ps1")
+
+          gh release create "${TAG_NAME}" "${FILES[@]}" \
+            --title "Lapdev CLI v${VERSION}" \
+            --notes "Prebuilt Lapdev CLI binaries for version v${VERSION}."

.github/workflows/release.yml

@@ -76,6 +76,8 @@ jobs:
             ./target/debian/lapdev-ws_${{ github.event.inputs.lapdev_version }}-1_amd64.deb
             ./pkg/common/install.sh
             ./pkg/common/install-ws.sh
+            ./pkg/installers/lapdev-cli.sh
+            ./pkg/installers/lapdev-cli.ps1
           retention-days: 1
 
   publish:
@@ -100,4 +102,6 @@ jobs:
         if: github.event_name != 'pull_request'
         run: |
           gh release create $TAG_NAME --title "$TAG_NAME" --target $GITHUB_SHA \
-            lapdev-linux/*/*/*
+            lapdev-linux/*/*/* \
+            pkg/installers/lapdev-cli.sh \
+            pkg/installers/lapdev-cli.ps1

.gitignore

@@ -2,3 +2,4 @@
 /lapdev-dashboard/dist
 .lapce
 .env
+.git-credentials