build-binaries.yml

name: Build Binaries and Deploy

on:
    push:
        branches:
            - daniel/rpm-binary

defaults:
    run:
        working-directory: ./backend

jobs:
    build-and-deploy:
        strategy:
            matrix:
                arch: [x64, arm64]
                os: [linux, win]
                include:
                    - os: linux
                      target: node20-linux
                    - os: win
                      target: node20-win
        runs-on: ${{ (matrix.arch == 'arm64' && matrix.os == 'linux') && 'ubuntu24-arm64' || 'ubuntu-latest' }}

        steps:
            - name: Checkout code
              uses: actions/checkout@v3

            - name: Set up Node.js
              uses: actions/setup-node@v3
              with:
                  node-version: 20

            - name: Install pkg
              run: npm install -g @yao-pkg/pkg

            - name: Install dependencies (backend)
              run: npm install

            - name: Install dependencies (frontend)
              run: npm install --prefix ../frontend

            - name: Prerequisites for pkg
              run: npm run binary:build

            - name: Package into node binary
              run: |
                  if [ "${{ matrix.os }}" != "linux" ]; then
                    pkg --no-bytecode --public-packages "*" --public --target ${{ matrix.target }}-${{ matrix.arch }} --output ./binary/infisical-core-${{ matrix.os }}-${{ matrix.arch }} .
                  else
                    pkg --no-bytecode --public-packages "*" --public --target ${{ matrix.target }}-${{ matrix.arch }} --output ./binary/infisical-core .
                  fi

            # Set up .deb package structure (Debian/Ubuntu only)
            - name: Set up .deb package structure
              if: matrix.os == 'linux'
              run: |
                  mkdir -p infisical-core/DEBIAN
                  mkdir -p infisical-core/usr/local/bin
                  cp ./binary/infisical-core infisical-core/usr/local/bin/
                  chmod +x infisical-core/usr/local/bin/infisical-core

            - name: Create control file
              if: matrix.os == 'linux'
              run: |
                  cat <<EOF > infisical-core/DEBIAN/control
                  Package: infisical-core
                  Version: 1.1.2
                  Section: base
                  Priority: optional
                  Architecture: ${{ matrix.arch == 'x64' && 'amd64' || matrix.arch }}
                  Maintainer: Infisical <daniel@infisical.com>
                  Description: Infisical Core standalone executable (app.infisical.com)
                  EOF

            # Build .deb file (Debian/Ubunutu only)
            - name: Build .deb package
              if: matrix.os == 'linux'
              run: |
                  dpkg-deb --build infisical-core
                  mv infisical-core.deb ./binary/infisical-core-${{matrix.arch}}.deb

            ### RPM

            - name: Set up .rpm package structure
              if: matrix.os == 'linux'
              run: |
                  mkdir -p infisical-core-rpm/usr/local/bin
                  cp ./binary/infisical-core infisical-core-rpm/usr/local/bin/
                  chmod +x infisical-core-rpm/usr/local/bin/infisical-core

            # Install RPM build tools
            - name: Install RPM build tools
              if: matrix.os == 'ubuntu-latest'
              run: sudo apt-get update && sudo apt-get install -y rpm

              # Create .spec file for RPM
            - name: Create .spec file for RPM
              if: matrix.os == 'linux'
              run: |
                  cat <<EOF > infisical-core.spec
                  Name:           infisical-core
                  Version:        1.1.2
                  Release:        1%{?dist}
                  Summary:        Infisical Core standalone executable
                  License:        Proprietary
                  URL:            https://app.infisical.com

                  %description
                  Infisical Core standalone executable (app.infisical.com)

                  %install
                  mkdir -p %{buildroot}/usr/local/bin
                  cp %{_sourcedir}/infisical-core-rpm/usr/local/bin/infisical-core %{buildroot}/usr/local/bin/

                  %files
                  /usr/local/bin/infisical-core
                  EOF

              # Build .rpm file (Red Hat-based systems only)
            - name: Build .rpm package
              if: matrix.os == 'linux'
              run: |
                  rpmbuild -bb \
                    --define "_topdir $(pwd)/rpmbuild" \
                    --define "_sourcedir $(pwd)" \
                    --define "_rpmdir $(pwd)/binary" \
                    --target ${{ matrix.arch == 'x64' && 'x86_64' || 'aarch64' }} \
                    infisical-core.spec
                  mv rpmbuild/RPMS/${{ matrix.arch == 'x64' && 'x86_64' || 'aarch64' }}/infisical-core-1.1.2-1.*.${{ matrix.arch == 'x64' && 'x86_64' || 'aarch64' }}.rpm ./binary/infisical-core-${{matrix.arch}}.rpm

            - uses: actions/setup-python@v4
              with:
                  python-version: "3.x" # Specify the Python version you need
            - name: Install Python dependencies
              run: |
                  python -m pip install --upgrade pip
                  pip install --upgrade cloudsmith-cli

            # Publish .deb file to Cloudsmith (Debian/Ubuntu only)
            - name: Publish to Cloudsmith (Debian/Ubuntu)
              if: matrix.os == 'linux'
              working-directory: ./backend
              run: cloudsmith push deb --republish --no-wait-for-sync --api-key=${{ secrets.CLOUDSMITH_API_KEY }} infisical/infisical-core/any-distro/any-version ./binary/infisical-core-${{ matrix.arch }}.deb

            # Publish .rpm file to Cloudsmith (Red Hat-based systems only)
            - name: Publish .rpm to Cloudsmith
              if: matrix.os == 'linux'
              working-directory: ./backend
              run: cloudsmith push rpm --republish --no-wait-for-sync --api-key=${{ secrets.CLOUDSMITH_API_KEY }} infisical/infisical-core/any-distro/any-version ./binary/infisical-core-${{ matrix.arch }}.rpm

            # Publish .exe file to Cloudsmith (Windows only)
            - name: Publish to Cloudsmith (Windows)
              if: matrix.os == 'win'
              working-directory: ./backend
              run: cloudsmith push raw infisical/infisical-core ./binary/infisical-core-${{ matrix.os }}-${{ matrix.arch }}.exe --republish --no-wait-for-sync --version 1.1.2 --api-key ${{ secrets.CLOUDSMITH_API_KEY }}