SchildiChat
diff --git a/‎.github/workflows/build_and_deploy.yaml‎
Lines changed: 17 additions & 2 deletions b/‎.github/workflows/build_and_deploy.yaml‎
Lines changed: 17 additions & 2 deletions
diff --git a/‎.github/workflows/build_and_test.yaml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/build_and_test.yaml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.github/workflows/build_linux.yaml‎
Lines changed: 54 additions & 6 deletions b/‎.github/workflows/build_linux.yaml‎
Lines changed: 54 additions & 6 deletions
diff --git a/‎.github/workflows/build_macos.yaml‎
Lines changed: 2 additions & 2 deletions b/‎.github/workflows/build_macos.yaml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.github/workflows/build_prepare.yaml‎
Lines changed: 3 additions & 2 deletions b/‎.github/workflows/build_prepare.yaml‎
Lines changed: 3 additions & 2 deletions
diff --git a/‎.github/workflows/build_windows.yaml‎
Lines changed: 2 additions & 2 deletions b/‎.github/workflows/build_windows.yaml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.github/workflows/codeql.yml‎
Lines changed: 51 additions & 0 deletions b/‎.github/workflows/codeql.yml‎
Lines changed: 51 additions & 0 deletions
diff --git a/‎.github/workflows/dockerbuild.yaml‎
Lines changed: 43 additions & 0 deletions b/‎.github/workflows/dockerbuild.yaml‎
Lines changed: 43 additions & 0 deletions
diff --git a/‎.github/workflows/static_analysis.yaml‎
Lines changed: 2 additions & 2 deletions b/‎.github/workflows/static_analysis.yaml‎
Lines changed: 2 additions & 2 deletions
@@ -90,22 +90,37 @@ jobs:
             base-url: https://packages.element.io/${{ inputs.mode == 'release' && 'desktop' || 'nightly' }}
             version: ${{ needs.prepare.outputs.macos-version }}
 
+    # We do not put this call into deploy-mode as we do not want it to add to the packages.element.io artifact
+    # We ship this build via reprepro only
     linux:
         if: github.event_name != 'workflow_dispatch' || inputs.linux
         needs: prepare
-        name: Linux
+        name: Linux (sqlcipher system)
         uses: ./.github/workflows/build_linux.yaml
         with:
             config: element.io/${{ inputs.mode || 'nightly' }}
             sqlcipher: system
             version: ${{ needs.prepare.outputs.linux-version }}
 
-    # This deploy job only handles Windows & macOS as those are stateless and static.
+    # We ship the static build via static tarball only
+    linux_static:
+        if: github.event_name != 'workflow_dispatch' || inputs.linux
+        needs: prepare
+        name: Linux (sqlcipher static)
+        uses: ./.github/workflows/build_linux.yaml
+        with:
+            deploy-mode: true
+            config: element.io/${{ inputs.mode || 'nightly' }}
+            sqlcipher: static
+            version: ${{ needs.prepare.outputs.linux-version }}
+
+    # This deploy job only handles Windows, macOS & linux_static as those are stateless and static.
     # Linux will be deployed via reprepro after it, but we list it as a dependency to abort if it fails.
     deploy:
         needs:
             - macos
             - linux
+            - linux_static
             - windows_32bit
             - windows_64bit
         runs-on: ubuntu-latest
 
@@ -80,7 +80,7 @@ jobs:
                   cache: "yarn"
 
             - name: Install Deps
-              run: "yarn install --pure-lockfile"
+              run: "yarn install --frozen-lockfile"
 
             - uses: actions/download-artifact@v3
               with:
 
@@ -16,11 +16,15 @@ on:
                 type: string
                 required: true
                 description: "How to link sqlcipher, one of 'system' | 'static'"
+            deploy-mode:
+                type: boolean
+                required: false
+                description: "Whether to arrange artifacts in the arrangement needed for deployment, skipping unrelated ones"
 jobs:
     build:
         runs-on: ubuntu-latest
         container:
-            image: ghcr.io/vector-im/element-desktop-dockerbuild:t3chguy-dockerbuild
+            image: ghcr.io/vector-im/element-desktop-dockerbuild:${{ github.ref_name == 'master' && 'master' || 'develop' }}
         defaults:
             run:
                 shell: bash
@@ -35,7 +39,7 @@ jobs:
               id: cache
               uses: actions/cache@v3
               with:
-                  key: ${{ runner.os }}-${{ hashFiles('hakDependencies.json', 'electronVersion') }}
+                  key: ${{ runner.os }}-${{ inputs.sqlcipher }}-${{ hashFiles('hakDependencies.json', 'electronVersion') }}
                   path: |
                       ./.hak
 
@@ -48,7 +52,7 @@ jobs:
 
             # Does not need branch matching as only analyses this layer
             - name: Install Deps
-              run: "yarn install --pure-lockfile"
+              run: "yarn install --frozen-lockfile"
 
             - name: Build Natives
               if: steps.cache.outputs.cache-hit != 'true'
@@ -68,7 +72,7 @@ jobs:
                   if [ -f changelog.Debian ]; then
                       echo "config-args=--deb-changelog changelog.Debian" >> $GITHUB_OUTPUT
                   fi
-                  
+
                   cp "$DIR/control.template" debcontrol
                   VERSION=${INPUT_VERSION:-$(cat package.json | jq -r .version)}
                   echo "Version: $VERSION" >> debcontrol
@@ -78,12 +82,56 @@ jobs:
 
             - name: Build App
               run: |
-                  npx ts-node scripts/generate-builder-config.ts ${{ steps.nightly.outputs.config-args }} --deb-custom-control=debcontrol
+                  npx ts-node scripts/generate-builder-config.ts \
+                      ${{ steps.nightly.outputs.config-args }} \
+                      ${{ steps.debian.outputs.config-args }} \
+                      --deb-custom-control=debcontrol
                   yarn build --publish never -l --config electron-builder.json
 
+            - name: Check ldd
+              run: |
+                  ldd dist/linux-unpacked/resources/app.asar.unpacked/node_modules/matrix-seshat/native/index.node
+                  if [ "$SQLCIPHER_STATIC" == "1" ]; then
+                      ldd dist/linux-unpacked/resources/app.asar.unpacked/node_modules/matrix-seshat/native/index.node | grep -v libsqlcipher.so.0
+                      ldd dist/linux-unpacked/resources/app.asar.unpacked/node_modules/matrix-seshat/native/index.node | grep libcrypto.so.1.1
+                  else
+                      ldd dist/linux-unpacked/resources/app.asar.unpacked/node_modules/matrix-seshat/native/index.node | grep libsqlcipher.so.0
+                      ldd dist/linux-unpacked/resources/app.asar.unpacked/node_modules/matrix-seshat/native/index.node | grep -v libcrypto.so.1.1
+                  fi
+              env:
+                  SQLCIPHER_STATIC: ${{ inputs.sqlcipher == 'static' && '1' || '' }}
+
+            - name: Stash deb package
+              if: inputs.deploy-mode
+              uses: actions/upload-artifact@v3
+              with:
+                  name: linux-sqlcipher-${{ inputs.sqlcipher }}-deb
+                  path: dist/*.deb
+                  retention-days: 1
+
+            - name: Prepare artifacts for deployment
+              if: inputs.deploy-mode
+              run: |
+                  mv dist _dist
+                  mkdir -p "dist/install/linux/glibc-x86-64/"
+                  mv _dist/*.tar.gz "dist/install/linux/glibc-x86-64"
+
+            # We don't wish to store the tarball for every nightly ever, so we only keep the latest
+            - name: "[Nightly] Strip version from tarball"
+              if: inputs.deploy-mode && inputs.version != ''
+              run: |
+                  mv dist/install/linux/glibc-x86-64/*.tar.gz "dist/install/linux/glibc-x86-64/element-desktop-nightly.tar.gz"
+
+            - name: "[Release] Prepare release latest symlink"
+              if: inputs.deploy-mode && inputs.version == ''
+              shell: bash
+              run: |
+                  ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
+              working-directory: "dist/install/linux/glibc-x86-64"
+
             - name: Upload Artifacts
               uses: actions/upload-artifact@v3
               with:
-                  name: linux-sqlcipher-${{ inputs.sqlcipher }}
+                  name: ${{ inputs.deploy-mode && 'packages.element.io' || format('linux-sqlcipher-{0}', inputs.sqlcipher) }}
                   path: dist
                   retention-days: 1
@@ -24,7 +24,7 @@ on:
                 required: false
                 description: "Whether to sign & notarise the build, requires 'packages.element.io' environment"
             deploy-mode:
-                type: string
+                type: boolean
                 required: false
                 description: "Whether to arrange artifacts in the arrangement needed for deployment, skipping unrelated ones"
             base-url:
@@ -64,7 +64,7 @@ jobs:
 
             # Does not need branch matching as only analyses this layer
             - name: Install Deps
-              run: "yarn install --pure-lockfile"
+              run: "yarn install --frozen-lockfile"
 
             - name: Build Natives
               if: steps.cache.outputs.cache-hit != 'true'
 
@@ -56,7 +56,7 @@ jobs:
                   cache: "yarn"
 
             - name: Install Deps
-              run: "yarn install --pure-lockfile"
+              run: "yarn install --frozen-lockfile"
 
             - name: Fetch Element Web
               run: yarn run fetch --noverify -d ${{ inputs.config }} ${{ inputs.version }}
@@ -108,8 +108,9 @@ jobs:
                   echo "element-desktop ($VERSION) default; urgency=medium" >> changelog.Debian
                   echo "$BODY" | sed 's/^##/\n  */g;s/^\*/  */g' | perl -pe 's/\[.+?]\((.+?)\)/\1/g' >> changelog.Debian
                   echo "" >> changelog.Debian
-                  echo " -- ${{ github.actor }} <support@element.io>  $TIME" >> changelog.Debian
+                  echo " -- $ACTOR <support@element.io>  $TIME" >> changelog.Debian
               env:
+                  ACTOR: ${{ github.actor }}
                   VERSION: v${{ steps.package.outputs.version }}
                   BODY: ${{ steps.release.outputs.body }}
                   PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
 
@@ -24,7 +24,7 @@ on:
                 required: false
                 description: "Whether to sign & notarise the build, requires 'packages.element.io' environment"
             deploy-mode:
-                type: string
+                type: boolean
                 required: false
                 description: "Whether to arrange artifacts in the arrangement needed for deployment, skipping unrelated ones"
 jobs:
@@ -107,7 +107,7 @@ jobs:
 
             # Does not need branch matching as only analyses this layer
             - name: Install Deps
-              run: "yarn install --pure-lockfile"
+              run: "yarn install --frozen-lockfile"
 
             - name: Build Natives
               if: steps.cache.outputs.cache-hit != 'true'
 
@@ -0,0 +1,51 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "develop", master, staging ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "develop" ]
+  schedule:
+    - cron: '19 9 * * 6'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # We have a single C file for the rebrand_stub which we don't want/need to analyse
+        # but it prevents us from using the built-in CodeQL scanner
+        language: [ 'javascript' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Use only 'java' to analyze code written in Java, Kotlin or both
+        # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"
@@ -0,0 +1,43 @@
+name: Dockerbuild
+on:
+    workflow_dispatch: {}
+    push:
+        branches: [master, develop]
+        paths:
+            - "dockerbuild/**"
+concurrency: ${{ github.workflow }}-${{ github.ref_name }}
+env:
+    REGISTRY: ghcr.io
+    IMAGE_NAME: ${{ github.repository }}-dockerbuild
+jobs:
+    build:
+        name: Docker Build
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            packages: write
+        steps:
+            - uses: actions/checkout@v3
+
+            - name: Log in to the Container registry
+              uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Extract metadata for Docker
+              id: meta
+              uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+              with:
+                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+                  tags: |
+                      type=ref,event=branch
+
+            - name: Build and push Docker image
+              uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+              with:
+                  context: dockerbuild
+                  push: true
+                  tags: ${{ steps.meta.outputs.tags }}
+                  labels: ${{ steps.meta.outputs.labels }}
@@ -16,7 +16,7 @@ jobs:
 
             # Does not need branch matching as only analyses this layer
             - name: Install Deps
-              run: "yarn install --pure-lockfile"
+              run: "yarn install --frozen-lockfile"
 
             - name: Typecheck
               run: "yarn run lint:types"
@@ -37,7 +37,7 @@ jobs:
 
             # Does not need branch matching as only analyses this layer
             - name: Install Deps
-              run: "yarn install --pure-lockfile"
+              run: "yarn install --frozen-lockfile"
 
             - name: Run Linter
               run: "yarn run lint:js"