ee12510ef1
- apps/cli/ is now the canonical CLI (was apps/cli-v2/). - apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag 'cli-v0-legacy-final' before deletion; git history preserves it too. - .github/workflows/release-cli.yml paths updated. - pnpm-lock.yaml regenerated. Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities): - 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member. - handleSend in broker fetches recipient grant maps once per send, drops messages silently when sender lacks the required capability. - POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric. - CLI grant/revoke/block now mirror to broker via syncToBroker. Auto-migrate on broker startup: - apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock before the HTTP server binds. Exits non-zero on failure so Coolify healthcheck fails closed. - Dockerfile copies packages/db/migrations into /app/migrations. - postgres 3.4.5 added as direct broker dep. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
116 lines
3.9 KiB
YAML
116 lines
3.9 KiB
YAML
name: Release CLI binaries
|
|
|
|
# Fires on any push of a tag shaped like `cli-v1.2.3` (prerelease `-alpha.N` OK).
|
|
# Builds self-contained `bun build --compile` binaries for darwin/linux/win
|
|
# (x64 + arm64) and attaches them to a GitHub Release. The `install.sh`
|
|
# fallback path curls these when Node isn't available.
|
|
#
|
|
# Publishing to npm is still a manual step (pnpm publish from apps/cli) —
|
|
# this workflow only handles binary distribution.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "cli-v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: "Release tag to build (e.g. cli-v1.0.0-alpha.28)"
|
|
required: true
|
|
|
|
permissions:
|
|
contents: write # to upload release assets
|
|
|
|
jobs:
|
|
build:
|
|
name: ${{ matrix.target }}
|
|
runs-on: ${{ matrix.runner }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { target: darwin-x64, bun_target: bun-darwin-x64, runner: macos-latest, ext: "" }
|
|
- { target: darwin-arm64, bun_target: bun-darwin-arm64, runner: macos-latest, ext: "" }
|
|
- { target: linux-x64, bun_target: bun-linux-x64, runner: ubuntu-latest, ext: "" }
|
|
- { target: linux-arm64, bun_target: bun-linux-arm64, runner: ubuntu-latest, ext: "" }
|
|
- { target: windows-x64, bun_target: bun-windows-x64, runner: windows-latest, ext: ".exe" }
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: "1.2"
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- name: Install workspace deps
|
|
run: pnpm install --frozen-lockfile --ignore-scripts
|
|
|
|
- name: Compile binary
|
|
working-directory: apps/cli
|
|
shell: bash
|
|
run: |
|
|
mkdir -p dist/bin
|
|
VERSION=$(node -p "require('./package.json').version")
|
|
bun build --compile --minify \
|
|
--target=${{ matrix.bun_target }} \
|
|
--define "__CLAUDEMESH_VERSION__=\"$VERSION\"" \
|
|
src/entrypoints/cli.ts \
|
|
--outfile dist/bin/claudemesh-${{ matrix.target }}${{ matrix.ext }}
|
|
|
|
# Smoke test only on native arch. macos-latest runners are ARM64 (Apple
|
|
# Silicon); ubuntu-latest is x64. Cross-compiled binaries can't execute
|
|
# on the build host, so skip them.
|
|
- name: Smoke test (native only)
|
|
if: matrix.target == 'darwin-arm64' || matrix.target == 'linux-x64'
|
|
working-directory: apps/cli
|
|
run: |
|
|
./dist/bin/claudemesh-${{ matrix.target }} --version
|
|
./dist/bin/claudemesh-${{ matrix.target }} --help | head -5
|
|
|
|
- name: Upload artefact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: claudemesh-${{ matrix.target }}
|
|
path: apps/cli/dist/bin/claudemesh-${{ matrix.target }}${{ matrix.ext }}
|
|
|
|
release:
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/download-artifact@v4
|
|
with:
|
|
path: artifacts
|
|
|
|
- name: Stage binaries
|
|
run: |
|
|
mkdir -p release
|
|
find artifacts -type f -exec cp {} release/ \;
|
|
cd release && sha256sum claudemesh-* > SHA256SUMS
|
|
|
|
- name: Publish release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
tag_name: ${{ github.ref_name }}
|
|
files: |
|
|
release/claudemesh-*
|
|
release/SHA256SUMS
|
|
generate_release_notes: true
|
|
fail_on_unmatched_files: true
|
|
|
|
update-homebrew:
|
|
needs: release
|
|
runs-on: macos-latest
|
|
if: github.event_name == 'push' && !contains(github.ref_name, 'alpha')
|
|
steps:
|
|
- name: Bump Homebrew tap formula
|
|
env:
|
|
HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
|
|
run: |
|
|
brew tap alezmad/claudemesh || true
|
|
brew bump-formula-pr --no-browse --no-fork \
|
|
--tag "${{ github.ref_name }}" \
|
|
--revision "${{ github.sha }}" \
|
|
alezmad/claudemesh/claudemesh || echo "formula bump skipped (no tap yet)"
|