Merge main to 2.1

.github/workflows/build-macos.yaml

@@ -12,6 +12,8 @@ on:
       - v*.*.*
 
 env:
+  CARGO_TERM_COLOR: always
+  # sccache
   SCCACHE_GHA_ENABLED: "true"
   RUSTC_WRAPPER: "sccache"
   SQLX_OFFLINE: "1"
@@ -39,7 +41,8 @@ jobs:
             echo "DEFGUARD_CLIENT_BUILD_VERSION=${GITHUB_REF_NAME#v}" >> ${GITHUB_ENV}
           fi
 
-      - uses: actions/setup-node@v6
+      - name: Install NodeJS
+        uses: actions/setup-node@v6
         with:
           node-version-file: new-ui/.nvmrc
 

.github/workflows/nightly-build-1x.yaml

@@ -0,0 +1,205 @@
+name: "Nightly build (main layout)"
+
+on:
+  workflow_call:
+    inputs:
+      branch:
+        required: true
+        type: string
+      s3_bucket:
+        required: true
+        type: string
+      s3_prefix:
+        required: true
+        type: string
+      aws_region:
+        required: true
+        type: string
+
+    outputs:
+      version:
+        value: ${{ jobs.build-linux.outputs.version }}
+
+env:
+  S3_BUCKET: ${{ inputs.s3_bucket }}
+  S3_PREFIX: ${{ inputs.s3_prefix }}
+  AWS_DEFAULT_REGION: ${{ inputs.aws_region }}
+
+jobs:
+  build-linux:
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    env:
+      CARGO_TERM_COLOR: always
+      # sccache
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: "sccache"
+    runs-on:
+      - self-hosted
+      - Linux
+      - ${{ matrix.architecture }}
+    strategy:
+      fail-fast: false
+      matrix:
+        architecture: [ARM64, X64]
+        include:
+          - architecture: ARM64
+            deb_arch: arm64
+            binary_arch: aarch64
+          - architecture: X64
+            deb_arch: amd64
+            binary_arch: x86_64
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.branch }}
+          submodules: recursive
+
+      - name: Install NodeJS
+        uses: actions/setup-node@v6
+        with:
+          node-version: 26
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          cache: true
+          version: 11
+          run_install: false
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> ${GITHUB_ENV}
+
+      # Change to '--frozen-lockfile' once this gets fixed:
+      # https://github.com/pnpm/action-setup/issues/40
+      - name: Install Node dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@v0.0.10
+
+      - name: Install Linux dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libssl-dev libxdo-dev unzip protobuf-compiler libprotobuf-dev rpm awscli jq
+
+      - name: Write build version
+        id: version
+        run: |
+          VERSION=$(jq -r .version src-tauri/tauri.conf.json)
+          echo Version: $VERSION
+          echo "VERSION=$VERSION" >> ${GITHUB_ENV}
+          echo "version=$VERSION" >> ${GITHUB_OUTPUT}
+          BRANCH="${{ inputs.branch }}"
+          echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV}
+          echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV}
+
+      - name: Build packages
+        uses: tauri-apps/tauri-action@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          args: --bundles deb,rpm --ignore-version-mismatches
+
+      - name: Upload DEB and RPM to S3
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }}
+        run: |
+          NAME="defguard-client-${{ matrix.binary_arch }}-${SHA}"
+          aws s3 cp --acl public-read \
+            "src-tauri/target/release/bundle/deb/defguard-client_${VERSION}_${{ matrix.deb_arch }}.deb" \
+            "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.deb"
+          aws s3 cp --acl public-read \
+            "src-tauri/target/release/bundle/rpm/defguard-client-${VERSION}-1.${{ matrix.binary_arch }}.rpm" \
+            "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/${NAME}.rpm"
+
+  build-macos-pkg:
+    env:
+      CARGO_TERM_COLOR: always
+      # sccache
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: "sccache"
+      APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)"
+      APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)"
+      APPLE_PROVIDER_SHORT_NAME: "82GZ7KN29J"
+      APPLE_ID: "kamil@defguard.net"
+      APPLE_TEAM_ID: "82GZ7KN29J"
+    runs-on:
+      - self-hosted
+      - macOS
+      - native
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.branch }}
+          submodules: recursive
+
+      - name: Write build version
+        run: |
+          VERSION=$(jq -r .version src-tauri/tauri.conf.json)
+          echo Version: $VERSION
+          echo "VERSION=$VERSION" >> ${GITHUB_ENV}
+          BRANCH="${{ inputs.branch }}"
+          echo "BRANCH=${BRANCH//\//-}" >> ${GITHUB_ENV}
+          echo "SHA=$(git rev-parse --short HEAD)" >> ${GITHUB_ENV}
+
+      - name: Install NodeJS
+        uses: actions/setup-node@v6
+        with:
+          node-version: 26
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          cache: true
+          version: 11
+
+      # Change to '--frozen-lockfile' once this gets fixed:
+      # https://github.com/pnpm/action-setup/issues/40
+      - name: Install Node dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-darwin,x86_64-apple-darwin
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@v0.0.10
+
+      - name: Set build number
+        run: |
+          sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.conf.json
+          sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj
+
+      - name: Unlock keychain
+        run: security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain
+
+      - name: Build app
+        uses: tauri-apps/tauri-action@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          args: --target universal-apple-darwin --ignore-version-mismatches
+
+      - name: Build installation package
+        run: |
+          xcrun productbuild --keychain build.keychain \
+            --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \
+            --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \
+            /Applications defguard-client.pkg
+
+      - name: Upload PKG to S3
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_NIGHTLY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY_NIGHTLY }}
+        run: |
+          export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH}"
+          aws s3 cp --acl public-read defguard-client.pkg \
+            "s3://${S3_BUCKET}/${S3_PREFIX}/${BRANCH}/defguard-client-universal-${SHA}.pkg"