nix (#7)

npm
cargo

.github/workflows/ci.yml

@@ -13,7 +13,6 @@ on:
 
 permissions:
   contents: write
-  packages: write
 
 jobs:
   changes:
@@ -37,7 +36,11 @@ jobs:
               - 'tests/**'
               - 'Cargo.toml'
               - 'Cargo.lock'
+              - 'npm/**'
+              - 'flake.nix'
+              - 'flake.lock'
               - 'docker/**'
+              - '.github/workflows/**'
               - 'Makefile'
 
       - name: Set outputs
@@ -137,72 +140,36 @@ jobs:
       - name: Xvfb integration tests
         run: make test-integration
 
-  build:
-    name: Build (${{ matrix.target }})
-    needs: [changes, validate, integration]
-    if: github.event_name != 'pull_request' && needs.changes.outputs.rust == 'true'
+  distribution:
+    name: Distribution Validate
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: true
-      matrix:
-        target: [cargo, docker]
     steps:
       - uses: actions/checkout@v4
 
-      # --- Cargo steps ---
       - uses: dtolnay/rust-toolchain@stable
-        if: matrix.target == 'cargo'
-        with:
-          components: clippy
 
       - uses: Swatinem/rust-cache@v2
-        if: matrix.target == 'cargo'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - uses: cachix/install-nix-action@v30
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
 
       - name: Install system dependencies
-        if: matrix.target == 'cargo'
         run: sudo apt-get update && sudo apt-get install -y libx11-dev libxtst-dev
 
-      - name: Clippy
-        if: matrix.target == 'cargo'
-        run: cargo clippy -- -D warnings
-
-      - name: Build
-        if: matrix.target == 'cargo'
-        run: cargo build --release --locked
-
-      - uses: actions/upload-artifact@v4
-        if: matrix.target == 'cargo'
-        with:
-          name: deskctl-linux-x86_64
-          path: target/release/deskctl
-          retention-days: 7
-
-      # --- Docker steps ---
-      - uses: docker/setup-buildx-action@v3
-        if: matrix.target == 'docker'
-
-      - uses: docker/login-action@v3
-        if: matrix.target == 'docker'
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: docker/build-push-action@v6
-        if: matrix.target == 'docker'
-        with:
-          context: .
-          file: docker/Dockerfile
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository }}:latest
-            ghcr.io/${{ github.repository }}:${{ needs.changes.outputs.tag }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Distribution validation
+        run: make dist-validate
 
   update-manifests:
     name: Update Manifests
-    needs: [changes, build]
+    needs: [changes, validate, integration, distribution]
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
@@ -212,12 +179,17 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
 
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - name: Update version in Cargo.toml
         run: |
           CURRENT=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
           NEW="${{ needs.changes.outputs.version }}"
           if [ "$CURRENT" != "$NEW" ]; then
             sed -i "0,/^version = \"${CURRENT}\"/s//version = \"${NEW}\"/" Cargo.toml
+            node -e 'const fs=require("node:fs"); const path="npm/deskctl-cli/package.json"; const pkg=JSON.parse(fs.readFileSync(path,"utf8")); pkg.version=process.argv[1]; fs.writeFileSync(path, JSON.stringify(pkg, null, 2)+"\n");' "$NEW"
             cargo generate-lockfile
           fi
 
@@ -227,7 +199,7 @@ jobs:
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
           if ! git diff --quiet; then
-            git add Cargo.toml Cargo.lock
+            git add Cargo.toml Cargo.lock npm/deskctl-cli/package.json
             git commit -m "release: ${{ needs.changes.outputs.tag }} [skip ci]"
           fi
 
@@ -236,6 +208,38 @@ jobs:
           fi
           git push origin main --tags
 
+  build:
+    name: Build Release Asset
+    needs: [changes, update-manifests]
+    if: github.event_name != 'pull_request' && needs.changes.outputs.rust == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.changes.outputs.tag }}
+          fetch-depth: 0
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libx11-dev libxtst-dev
+
+      - name: Clippy
+        run: cargo clippy -- -D warnings
+
+      - name: Build
+        run: cargo build --release --locked
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: deskctl-linux-x86_64
+          path: target/release/deskctl
+          retention-days: 7
+
   release:
     name: Release
     needs: [changes, build, update-manifests]
@@ -256,9 +260,15 @@ jobs:
           chmod +x artifacts/deskctl
           mv artifacts/deskctl artifacts/deskctl-linux-x86_64
           cd artifacts && sha256sum deskctl-linux-x86_64 > checksums.txt && cd ..
-
-          gh release create "${{ needs.changes.outputs.tag }}" \
-            --title "${{ needs.changes.outputs.tag }}" \
-            --generate-notes \
-            artifacts/deskctl-linux-x86_64 \
-            artifacts/checksums.txt
+          if gh release view "${{ needs.changes.outputs.tag }}" >/dev/null 2>&1; then
+            gh release upload "${{ needs.changes.outputs.tag }}" \
+              artifacts/deskctl-linux-x86_64 \
+              artifacts/checksums.txt \
+              --clobber
+          else
+            gh release create "${{ needs.changes.outputs.tag }}" \
+              --title "${{ needs.changes.outputs.tag }}" \
+              --generate-notes \
+              artifacts/deskctl-linux-x86_64 \
+              artifacts/checksums.txt
+          fi

.github/workflows/publish.yml

@@ -0,0 +1,102 @@
+name: Publish Registries
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to publish (for example v0.1.5)
+        required: true
+        type: string
+      publish_npm:
+        description: Publish deskctl-cli to npm
+        required: true
+        type: boolean
+        default: false
+      publish_crates:
+        description: Publish deskctl to crates.io
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libx11-dev libxtst-dev
+
+      - name: Verify release exists and contains canonical assets
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release view "${{ inputs.tag }}" --json assets --jq '.assets[].name' > /tmp/release-assets.txt
+          grep -Fx "deskctl-linux-x86_64" /tmp/release-assets.txt >/dev/null
+          grep -Fx "checksums.txt" /tmp/release-assets.txt >/dev/null
+
+      - name: Verify versions align with tag
+        run: |
+          TAG="${{ inputs.tag }}"
+          VERSION="${TAG#v}"
+          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
+          NPM_VERSION=$(node -p 'require("./npm/deskctl-cli/package.json").version')
+
+          test "$VERSION" = "$CARGO_VERSION"
+          test "$VERSION" = "$NPM_VERSION"
+
+      - name: Check current published state
+        id: published
+        run: |
+          VERSION="${{ inputs.tag }}"
+          VERSION="${VERSION#v}"
+
+          if npm view "deskctl-cli@${VERSION}" version >/dev/null 2>&1; then
+            echo "npm=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "npm=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          if curl -fsSL "https://crates.io/api/v1/crates/deskctl/${VERSION}" >/dev/null 2>&1; then
+            echo "crates=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "crates=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Validate npm package
+        run: |
+          mkdir -p ./tmp/npm-pack
+          node npm/deskctl-cli/scripts/validate-package.js
+          npm pack ./npm/deskctl-cli --pack-destination ./tmp/npm-pack >/dev/null
+
+      - name: Validate crate publish path
+        run: cargo publish --dry-run --locked
+
+      - name: Publish npm
+        if: inputs.publish_npm && steps.published.outputs.npm != 'true'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish ./npm/deskctl-cli --access public
+
+      - name: Publish crates.io
+        if: inputs.publish_crates && steps.published.outputs.crates != 'true'
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: cargo publish --locked
+
+      - name: Summary
+        run: |
+          echo "tag=${{ inputs.tag }}"
+          echo "npm_already_published=${{ steps.published.outputs.npm }}"
+          echo "crates_already_published=${{ steps.published.outputs.crates }}"