ci: add release ci

.github/workflows/release.yml

@@ -0,0 +1,65 @@
+name: release-apps
+
+permissions:
+  contents: write
+  id-token: write        # for Azure OIDC
+  pages: write
+  packages: write
+
+on:
+  push:
+    tags:
+      - 'v[0-9]*.[0-9]*.[0-9]*'
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: release-apps
+    runs-on: ubuntu-latest
+
+    env:
+      CONVEYOR_PAT: ${{ secrets.CONVEYOR_PAT }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+          cache: gradle
+
+      - name: Setup .NET SDK (for WinSW)
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '^1.25.5'
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      - name: Install Conveyor
+        run: |
+          wget -q https://downloads.hydraulic.dev/conveyor/conveyor-21.0-linux-amd64.tar.gz
+          tar -xzf conveyor-21.0-linux-amd64.tar.gz
+          sudo install -m 755 conveyor /usr/local/bin/conveyor
+          rm conveyor-21.0-linux-amd64.tar.gz
+
+      - name: Azure Login (OIDC)
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Build & Publish Release
+        run: ./gradlew buildConveyorSiteRelease
+        env:
+          CONVEYOR_SIGNING_KEY: ${{ secrets.CONVEYOR_SIGNING_KEY }}

build.gradle.kts

@@ -60,23 +60,14 @@ subprojects {
 }
 
 
-registerConveyorTask(
-    taskName = "buildLinuxDeb",
-    packageType = "debian-package",
-    subDir = "deb",
-)
+registerConveyorTask("buildLinuxDeb",      "debian-package", "deb")
+registerConveyorTask("buildWindowsMsix",   "windows-msix",   "windows")
+registerConveyorTask("buildConveyorSite",  "site",           "site")
 
-registerConveyorTask(
-    taskName = "buildWindowsMsix",
-    packageType = "windows-msix",
-    subDir = "windows",
-)
 
-registerConveyorTask(
-    taskName = "buildConveyorSite",
-    packageType = "site",
-    subDir = "site"
-)
+registerConveyorTask("buildLinuxDebRelease",      "debian-package", "deb",      "conveyor-release.conf")
+registerConveyorTask("buildWindowsMsixRelease",   "windows-msix",   "windows",  "conveyor-release.conf")
+registerConveyorTask("buildConveyorSiteRelease",  "site",           "site",     "conveyor-release.conf")
 
 
 tasks.register<Delete>("clean") {

buildSrc/src/main/kotlin/Tasks.kt

@@ -2,29 +2,48 @@ import org.gradle.api.Project
 import org.gradle.api.tasks.Exec
 import org.gradle.kotlin.dsl.register
 
-fun Project.registerConveyorTask(taskName: String, packageType: String, subDir: String) {
+fun Project.registerConveyorTask(
+    taskName: String,
+    packageType: String,
+    subDir: String,
+    configFile: String = "conveyor.conf",
+    signingKeyEnv: String? = null,
+) {
     tasks.register<Exec>(taskName) {
         group = "distribution"
         val outputDir = layout.buildDirectory.dir("conveyor/$subDir")
         outputs.dir(outputDir)
 
-        environment(
-            "CONVEYOR_PASSPHRASE",
-            SystemVar.fromEnvironment("CONVEYOR_PASSPHRASE")
-                ?: LocalProperties.get("conveyor.passphrase")
-                ?: "",
-        )
-
         val args =
             mutableListOf(
                 "conveyor",
-                "--passphrase=env:CONVEYOR_PASSPHRASE",
+                "-f",
+                configFile,
                 "make",
                 "--output-dir",
                 outputDir.get().asFile.absolutePath,
                 packageType,
             )
 
+        // to prevent resources issues on runners
+        if (configFile.contains("release")) {
+            args.add("--parallelism=3")
+        }
+
+        if (signingKeyEnv == null) {
+            // dev builds use passphrase
+            environment(
+                "CONVEYOR_PASSPHRASE",
+                System.getenv("CONVEYOR_PASSPHRASE")
+                    ?: LocalProperties.get("conveyor.passphrase")
+                    ?: "",
+            )
+            args.add(1, "--passphrase=env:CONVEYOR_PASSPHRASE")
+        } else {
+            // release builds use raw signing key
+            environment("CONVEYOR_SIGNING_KEY", System.getenv(signingKeyEnv) ?: "")
+        }
+
         commandLine(args)
 
         dependsOn(

composeApp/src/jvmMain/kotlin/com/zaneschepke/wireguardautotunnel/desktop/Main.kt

@@ -79,7 +79,7 @@ fun main() = application {
         val appName = stringResource(Res.string.app_name)
 
         val isMenuBarDark = isMenuBarInDarkMode()
-        val windowState = rememberWindowState(size = DpSize(1200.dp, 800.dp))
+        val windowState = rememberWindowState(size = DpSize(800.dp, 650.dp))
         val toaster = rememberToasterState()
 
         Tray(

conveyor-release.conf

@@ -1,19 +1,22 @@
 include required("conveyor.conf")
 
+app.signing-key = ${env.CONVEYOR_SIGNING_KEY}
+
+conveyor.billing-email = "dev@zaneschepke.com"
+
 app {
-  site.base-url = "https://download.wgtunnel.com"
+  // will overwrite base-url
+  github {
+    oauth-token = ${env.CONVEYOR_PAT}
+    pages-branch = "gh-pages"
+  }
 
   windows {
     signing-key {
       azure-trusted-signing {
-        account-name = "wgtunnel-prod"
-        profile-name = "wgtunnel-profile"
-        endpoint = "https://eus.codesigning.azure.net"
-
-        tenant-id = ${env.AZURE_TENANT_ID}
-        client-id = ${env.AZURE_CLIENT_ID}
-        client-secret = ${env.AZURE_CLIENT_SECRET}
+        endpoint = "eus.codesigning.azure.net"
       }
     }
+    signing-key-alias = "WG-Tunnel/WG-Tunnel"
   }
 }

conveyor.conf

@@ -7,13 +7,20 @@ app {
   description = "WG Tunnel: WireGuard and AmneziaWG VPN client with auto-tunneling, lockdown and proxying."
   license = MIT
   homepage = "https://wgtunnel.com"
-
-  site.base-url = "http://localhost"
+  vcs-url = "https://github.com/wgtunnel/desktop"
 
   updates = manual
 
   icons = ["icon.png"]
 
+  site {
+    display-name = "WG Tunnel"
+    base-url = "http://localhost"
+
+    show-conveyor-badge = true
+    theme = "dark"
+  }
+
   jvm {
     # for performance
     options += "-XX:+UseG1GC"
@@ -28,7 +35,6 @@ app {
 
     # for high-res displays
     system-properties {
-      "sun.java2d.uiScale" = "1.0"
       "apple.laf.useScreenMenuBar" = "true"
     }
 
@@ -59,14 +65,19 @@ app {
     linux.amd64.glibc,
     windows.amd64,
 //    windows.aarch64,
-    mac.amd64,
-    mac.aarch64
+//    mac.amd64,
+//    mac.aarch64
   ]
 
   linux {
     deb.depends = ["systemd"]
     rpm.requires = ["systemd"]
 
+    gpg {
+      name  = "WG Tunnel"
+      email = "support@wgtunnel.com"
+    }
+
     desktop-file {
       "Desktop Entry" {
         Categories = "Network;Security;Settings;Utility;"
@@ -200,10 +211,9 @@ app {
             </desktop6:Extension>
           """
 
+        // TODO figure out how to remove daemon state to prevent sync issues on uninstall
         virtualization {
           excluded-directories += "LocalAppData/Temp"
-          excluded-directories += "CommonAppData/wgtunnel"
-          excluded-directories += "CommonAppData/wgtunnel/logs"
         }
       }
     }