build-binaries.yml

name: Build Binaries and Deploy

on:
    workflow_dispatch:
        inputs:
            version:
                description: "Version number"
                required: true
                type: string

defaults:
    run:
        working-directory: ./backend

jobs:
    build-and-deploy:
        strategy:
            matrix:
                arch: [x64, arm64]
                os: [linux, win]
                include:
                    - os: linux
                      target: node20-linux
                    - os: win
                      target: node20-win
        runs-on: ${{ (matrix.arch == 'arm64' && matrix.os == 'linux') && 'ubuntu24-arm64' || 'ubuntu-latest' }}

        steps:
            - name: Checkout code
              uses: actions/checkout@v3

            - name: Set up Node.js
              uses: actions/setup-node@v3
              with:
                  node-version: 20

            - name: Install pkg
              run: npm install -g @yao-pkg/pkg

            - name: Install dependencies (backend)
              run: npm install

            - name: Install dependencies (frontend)
              run: npm install --prefix ../frontend

            - name: Prerequisites for pkg
              run: npm run binary:build

            - name: Package into node binary
              run: |
                  if [ "${{ matrix.os }}" != "linux" ]; then
                    pkg --no-bytecode --public-packages "*" --public --target ${{ matrix.target }}-${{ matrix.arch }} --output ./binary/infisical-core-${{ matrix.os }}-${{ matrix.arch }} .
                  else
                    pkg --no-bytecode --public-packages "*" --public --target ${{ matrix.target }}-${{ matrix.arch }} --output ./binary/infisical-core .
                  fi

            # Set up .deb package structure (Debian/Ubuntu only)
            - name: Set up .deb package structure
              if: matrix.os == 'linux'
              run: |
                  mkdir -p infisical-core/DEBIAN
                  mkdir -p infisical-core/usr/local/bin
                  cp ./binary/infisical-core infisical-core/usr/local/bin/
                  chmod +x infisical-core/usr/local/bin/infisical-core

            - name: Create control file
              if: matrix.os == 'linux'
              run: |
                  cat <<EOF > infisical-core/DEBIAN/control
                  Package: infisical-core
                  Version: ${{ github.event.inputs.version }}
                  Section: base
                  Priority: optional
                  Architecture: ${{ matrix.arch == 'x64' && 'amd64' || matrix.arch }}
                  Maintainer: Infisical <daniel@infisical.com>
                  Description: Infisical Core standalone executable (app.infisical.com)
                  EOF

            # Build .deb file (Debian/Ubunutu only)
            - name: Build .deb package
              if: matrix.os == 'linux'
              run: |
                  dpkg-deb --build infisical-core
                  mv infisical-core.deb ./binary/infisical-core-${{matrix.arch}}.deb

            - uses: actions/setup-python@v4
              with:
                  python-version: "3.x" # Specify the Python version you need
            - name: Install Python dependencies
              run: |
                  python -m pip install --upgrade pip
                  pip install --upgrade cloudsmith-cli

            # Publish .deb file to Cloudsmith (Debian/Ubuntu only)
            - name: Publish to Cloudsmith (Debian/Ubuntu)
              if: matrix.os == 'linux'
              working-directory: ./backend
              run: cloudsmith push deb --republish --no-wait-for-sync --api-key=${{ secrets.CLOUDSMITH_API_KEY }} infisical/infisical-core/any-distro/any-version ./binary/infisical-core-${{ matrix.arch }}.deb

            # Publish .exe file to Cloudsmith (Windows only)
            - name: Publish to Cloudsmith (Windows)
              if: matrix.os == 'win'
              working-directory: ./backend
              run: cloudsmith push raw infisical/infisical-core ./binary/infisical-core-${{ matrix.os }}-${{ matrix.arch }}.exe --republish --no-wait-for-sync --version ${{ github.event.inputs.version }} --api-key ${{ secrets.CLOUDSMITH_API_KEY }}