electron-builder overwrites latest-mac.yml when parallel arm64/x64
builds publish independently — whichever finishes last wins, leaving
the other architecture's users downloading the wrong binary.
Add a finalize-mac-manifest job that runs after both macOS builds
complete, merges their per-arch manifest artifacts into a single
latest-mac.yml containing all files, and uploads it to the release.
The website fetches the latest release version at build time, so it
needs to redeploy when a new release is published to pick up updated
download links.
The fallback was "release", so pushing a tag without pre-creating a
draft release on GitHub caused electron-builder to create a published
release instead of a draft.
Hash mismatch was hidden by continue-on-error. Now the Nix Build
workflow fails visibly, and fix-nix-hash runs on every push/PR that
touches the lockfile (not just Dependabot).
* fix: add missing resolved/integrity fields to package-lock.json
npm omits resolved URLs and integrity hashes for workspace-local
node_modules overrides. This breaks offline installers like Nix's
npm ci. Add the missing fields for 25 workspace-hoisted packages.
* feat: add Nix flake with package and NixOS module
Add a Nix flake that builds the Paseo daemon (server + CLI) and
provides a NixOS module for declarative deployment.
Package (nix/package.nix):
- Builds relay, server, and CLI workspaces
- Skips onnxruntime-node install script (sandbox-incompatible)
- Rebuilds only node-pty for native terminal support
- Source filter excludes app/website/desktop workspaces
NixOS module (nix/module.nix):
- Systemd service with configurable user, port, listen address
- allowedHosts for DNS rebinding protection
- relay.enable to toggle remote access via app.paseo.sh
- inheritUserEnvironment to expose user tools (git, ssh) to agents
- openFirewall and extra environment variables
ci: add Nix hash maintenance scripts and workflows
scripts/fix-lockfile.mjs:
Adds missing resolved/integrity fields to package-lock.json for
workspace-local overrides. Idempotent, uses `npm view`.
scripts/update-nix.sh:
Runs fix-lockfile.mjs, prefetches deps, computes NAR hash, and
updates npmDepsHash in nix/package.nix. Supports --check for CI.
.github/workflows/nix-build.yml:
Builds the Nix package on push/PR and verifies the lockfile and
hash are up to date.
.github/workflows/fix-nix-hash.yml:
Auto-fixes lockfile signatures and Nix hash on dependabot PRs.
fix: update npmDepsHash after upstream sync
nix: allowlist workspace symlinks instead of blocklist
Prevents build failures when upstream adds new workspace packages.
* don't block PRs on nix failures
* better document npm workaround
* fix hash update script, and update hash
* integrate with npm run build:daemon
* ci: trigger nix build on highlight changes
* fix(nix): update npmDepsHash
---------
Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
The NODE_OPTIONS --require patch for metro config was being applied
during build:workspace-deps, causing expo-module-build (a bash script)
to be loaded through Node's JS loader on Windows.
- Change electron-builder publish owner from anthropics to getpaseo
- Remove CSC_NAME (auto-discovered from cert, secret had rejected prefix)
- Remove CSC_IDENTITY_AUTO_DISCOVERY=false from build script (breaks Windows cmd.exe)
Fix desktop-release workflow to reference correct package path after
Tauri→Electron migration. Add macOS entitlements and notarization config
for electron-builder.
The linuxdeploy-plugin-gtk hook forces GDK_BACKEND=x11, which
prevents GTK initialization on Wayland-only systems. The bundled
libgdk-3.so already has Wayland support built in.
Add a post-build step that extracts the AppImage, comments out the
GDK_BACKEND=x11 line, and repackages with appimagetool.
Tauri notarizes the .app but not the .dmg container. When users
download the DMG from GitHub Releases, macOS quarantines everything
and Gatekeeper doesn't clear quarantine on embedded helper binaries
(like the bundled Node runtime), causing SIGTRAP on first launch.
Add a post-build step that signs, notarizes, and staples the DMG,
then re-uploads it to the release.
The linuxdeploy failure was caused by CUDA shared library references in
onnxruntime-node, not by linuxdeploy itself. The CUDA stripping step
added in the previous commit fixes the root cause, so AppImage bundling
should work now.
linuxdeploy-plugin-appimage's "continuous" release on GitHub is broken,
causing every AppImage build to fail. The downloaded binary is actually
an HTML error page. Switch to deb format which doesn't depend on
linuxdeploy at all.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
linuxdeploy is an AppImage itself and needs FUSE to run. GitHub Actions
runners don't always have working FUSE support. Setting this env var
tells AppImage tools to extract-and-run instead, avoiding the FUSE
dependency.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
linuxdeploy scans all ELF binaries in the AppDir and fails when it
can't find libcublasLt.so.12 (a CUDA library referenced by the
onnxruntime native module). Use patchelf to remove these optional
CUDA dependencies since we only need CPU inference.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The build script fix only applies to future tags. For v0.1.24 (and any
tag built before that fix), we need the workflow itself to remove the
CUDA .so files after building the managed runtime.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
linuxdeploy is distributed as an AppImage and may need libfuse2 to
execute even with APPIMAGE_EXTRACT_AND_RUN=1. ubuntu-22.04 runners
don't have it by default.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Need to see the actual linuxdeploy error output instead of the opaque
"failed to run linuxdeploy" message.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ubuntu-latest switched to 24.04 which has libraries with .relr.dyn
sections that linuxdeploy's bundled eu-strip cannot handle, causing
consistent "failed to run linuxdeploy" errors.
Pin to ubuntu-22.04 (also better glibc compat for AppImage) and set
NO_STRIP=true as a safety net.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Smoke tags have non-numeric pre-release identifiers (e.g. gha-smoke.1)
which MSI bundler rejects. Since smoke builds only need to prove Rust
compilation succeeds, skip bundling entirely.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the 855-line managed-daemon-smoke.mjs (which spawned relay
servers, daemons, and tested E2E connectivity in CI) with a fast
validate-managed-runtime.mjs that checks the bundle is correctly
assembled without launching any processes.
Structural changes:
- Eliminate double-build: removed the pre-build step that compiled the
Tauri app just for smoke testing before tauri-action rebuilt it
- Move version-setting before the build so there's no version confusion
- Sign managed runtime before tauri-action build (macOS)
- Smoke tags now do a real tauri build instead of --no-bundle, giving
actual signal about whether the release would succeed
- Reduce each platform job from ~15 steps to ~12
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
