Bjorn Blomberg
98c4d13360
Feature: strukturerade verktygsgodkännanden
- shared: protokoll för approval (daemon:approval, server:approval[-resolved],
web:approval-decision, server:approval-decision)
- daemon: hook-läge ('agent-helm hook' — samma binär), lokal 127.0.0.1-endpoint
som hooken POST:ar till, long-poll tills beslut; graceful default (allow) när
ingen UI; timeout-fallback; skickar AGENT_HELM_HOOK_PORT till agentens env
- server: routar daemon:approval -> prenumeranter, beslut -> daemon + döljer kort
- web: reaktiv approvals-lista + kort-overlay (Tillåt/Neka), mobilanpassad
CI:
- release.yaml triggar nu även på master-push -> rullande 'latest'-release
(versionerade releaser kvar på v*-taggar); install.sh hämtar 'latest'
Docs: hook-konfig (gemini settings.json) + hook-env i .env.example + DEPLOY.md.
Säkerhet: hook-endpoint binder endast 127.0.0.1; inga hemligheter i repot.
Verifierat lokalt: hook->daemon->server->kort->beslut->hook ger {"decision":"allow"};
alla paket typecheckar; web bygger.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
76 lines
3.7 KiB
YAML
76 lines
3.7 KiB
YAML
name: release-client
|
|
|
|
# Bygger självständiga klient-binärer (Node + node-pty inbäddat) för
|
|
# linux-x64 OCH linux-arm64 på Pi-runnern (prebuilt-multiarch shippar båda
|
|
# arkitekturernas prebuilds, så pkg cross-bygger utan QEMU), och publicerar
|
|
# dem som assets på en Gitea-release.
|
|
on:
|
|
push:
|
|
branches: [master, main] # varje master-push -> rullande 'latest'-release
|
|
tags: ["v*"] # vX.Y.Z -> versionerad release
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: "Release-tag (lämna tom för 'latest')"
|
|
required: false
|
|
|
|
jobs:
|
|
build-release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Bestäm tag
|
|
id: t
|
|
run: |
|
|
case "$GITHUB_REF" in
|
|
refs/tags/*) T="$GITHUB_REF_NAME" ;;
|
|
*) T="${{ inputs.tag }}"; [ -z "$T" ] && T="latest" ;;
|
|
esac
|
|
echo "tag=$T" >> "$GITHUB_OUTPUT"
|
|
echo "bygger release: $T"
|
|
|
|
- name: Bundla daemonen
|
|
run: |
|
|
npm install -g pnpm@11.3.0
|
|
pnpm install --frozen-lockfile --filter "@agent-helm/daemon..."
|
|
pnpm --filter @agent-helm/daemon bundle
|
|
|
|
- name: Bygg binärer (x64 + arm64) med pkg
|
|
run: |
|
|
B=/tmp/clientbuild
|
|
mkdir -p "$B/out"
|
|
cp packages/daemon/dist/daemon.cjs "$B/daemon.cjs"
|
|
cp deploy/client-build/package.json "$B/package.json"
|
|
cd "$B"
|
|
npm install --ignore-scripts --no-audit --no-fund @homebridge/node-pty-prebuilt-multiarch@0.13.1 @yao-pkg/pkg@6.20.0
|
|
# --no-bytecode: skeppa JS-källa i st.f. arch-specifik V8-bytecode, så att
|
|
# BÅDA arkitekturerna kan cross-byggas på samma (arm64) runner utan QEMU.
|
|
./node_modules/.bin/pkg daemon.cjs --no-bytecode --public --public-packages '*' --targets node22-linux-x64 --output out/agent-helm-linux-x64
|
|
./node_modules/.bin/pkg daemon.cjs --no-bytecode --public --public-packages '*' --targets node22-linux-arm64 --output out/agent-helm-linux-arm64
|
|
cp "$GITHUB_WORKSPACE/install.sh" out/install.sh
|
|
cd out && sha256sum agent-helm-linux-* install.sh > checksums.txt && ls -la
|
|
|
|
- name: Skapa Gitea-release + ladda upp assets
|
|
env:
|
|
API: http://gitea-d:3000/api/v1
|
|
REPO: ${{ github.repository }}
|
|
TAG: ${{ steps.t.outputs.tag }}
|
|
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
B=/tmp/clientbuild/out
|
|
BODY="agent-helm klient $TAG — sjalvstandiga binarer (linux x64/arm64). Installera: curl -fsSL https://gitea.brasse-pc.eu/brasse/agent-helm/raw/branch/main/install.sh | sh"
|
|
rid=$(curl -s -X POST "$API/repos/$REPO/releases" -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"$BODY\"}" | jq -r '.id // empty')
|
|
[ -z "$rid" ] && rid=$(curl -s "$API/repos/$REPO/releases/tags/$TAG" -H "Authorization: token $TOKEN" | jq -r '.id')
|
|
echo "release id: $rid"
|
|
for f in agent-helm-linux-x64 agent-helm-linux-arm64 install.sh checksums.txt; do
|
|
aid=$(curl -s "$API/repos/$REPO/releases/$rid/assets" -H "Authorization: token $TOKEN" | jq -r ".[] | select(.name==\"$f\") | .id")
|
|
if [ -n "$aid" ] && [ "$aid" != "null" ]; then
|
|
echo "ersätter befintlig $f (id $aid)"
|
|
curl -s -X DELETE "$API/repos/$REPO/releases/$rid/assets/$aid" -H "Authorization: token $TOKEN" -o /dev/null
|
|
fi
|
|
echo "laddar upp $f ..."
|
|
curl -s -X POST "$API/repos/$REPO/releases/$rid/assets?name=$f" -H "Authorization: token $TOKEN" -F "attachment=@$B/$f" -o /dev/null -w " -> HTTP %{http_code}\n"
|
|
done
|