feature: self-hosted support, v2 upload with retry, native release pipeline

Author: BrkYld

.githooks/pre-push

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# shellcheck shell=bash
+set -euo pipefail
+
+# Rejects pushing non-standard tags. Release tags must be SemVer with a 'v' prefix:
+#   vX.Y.Z            (production, e.g. v0.5.0)
+#   vX.Y.Z-<pre>      (pre-release, e.g. v0.5.0-beta.1 — normally created by CI)
+# Examples REJECTED: X.Y.Z, X.Y, vX.Y, 1.0, v1.
+#
+# Enable once per clone:  git config core.hooksPath .githooks
+
+pattern='^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$'
+zero='0000000000000000000000000000000000000000'
+status=0
+
+while read -r _local_ref _local_sha remote_ref remote_sha; do
+  case "$remote_ref" in
+    refs/tags/*)
+      # Allow tag deletions (remote_sha stays, local sha is zero on delete is the other way;
+      # we only validate creations/updates).
+      [ "$remote_sha" = "$zero" ] && continue || true
+      tag="${remote_ref#refs/tags/}"
+      if ! printf '%s' "$tag" | grep -qE "$pattern"; then
+        echo "✖ Refused to push tag '$tag'." >&2
+        echo "  Release tags must be SemVer with a 'v' prefix, e.g. v0.5.0 (or v0.5.0-beta.1)." >&2
+        echo "  Rejected forms: X.Y.Z, X.Y, vX.Y, bare numbers." >&2
+        status=1
+      fi
+      ;;
+  esac
+done
+
+exit $status

.github/workflows/release.yml

@@ -0,0 +1,76 @@
+name: Release
+on:
+  push:
+    branches:
+      - main
+      - 'release/**'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install & build bundle
+        run: |
+          npm ci
+          npm run package
+
+      - name: Verify dist/ is up to date
+        run: |
+          if [ -n "$(git status --porcelain dist)" ]; then
+            echo "::error::dist/ is out of date — run 'npm run package' and commit it."
+            git --no-pager diff --stat dist
+            exit 1
+          fi
+
+      - name: Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          BRANCH="${GITHUB_REF_NAME}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Version source of truth = latest stable tag vX.Y.Z (pushed manually).
+          # Used for BOTH production and beta — the branch only selects the channel.
+          STABLE="$(git tag --list 'v*' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)"
+          if [ -z "$STABLE" ]; then
+            echo "::error::No stable vX.Y.Z tag found. Push the release tag (e.g. v0.5.0) first."
+            exit 1
+          fi
+          echo "Latest stable tag: $STABLE"
+
+          if [ "$BRANCH" = "main" ]; then
+            if gh release view "$STABLE" >/dev/null 2>&1; then
+              echo "Release $STABLE already exists — nothing to do."
+              exit 0
+            fi
+            echo "Production release: $STABLE"
+            gh release create "$STABLE" --title "$STABLE" --generate-notes --latest
+            MAJOR="${STABLE%%.*}"
+            git tag -f "$MAJOR" "$STABLE"
+            git push origin -f "refs/tags/$MAJOR"
+            echo "Moved major alias $MAJOR -> $STABLE"
+          elif [[ "$BRANCH" == release/* ]]; then
+            # Beta of the latest stable tag; auto-increment N from existing beta tags.
+            LAST="$(git tag --list "${STABLE}-beta.*" | sed -E 's/.*-beta\.([0-9]+)$/\1/' | sort -n | tail -1)"
+            N=$(( ${LAST:-0} + 1 ))
+            TAG="${STABLE}-beta.${N}"
+            echo "Beta release: $TAG (base $STABLE)"
+            git tag "$TAG"
+            git push origin "refs/tags/$TAG"
+            gh release create "$TAG" --title "$TAG" --generate-notes --prerelease
+          else
+            echo "Branch '$BRANCH' is not configured for release — skipping."
+          fi

action.yml

@@ -13,6 +13,18 @@ inputs:
     description:
       'Provide Appcircle Personal API Token to authenticate Appcircle services.'
     required: true
+  authEndpoint:
+    description:
+      'Optional: Authentication endpoint URL for self-hosted Appcircle
+      installations. Defaults to the Appcircle cloud.'
+    required: false
+    default: 'https://auth.appcircle.io'
+  apiEndpoint:
+    description:
+      'Optional: API endpoint URL for self-hosted Appcircle installations.
+      Defaults to the Appcircle cloud.'
+    required: false
+    default: 'https://api.appcircle.io'
   profileName:
     description:
       'Enter the profile name of the Appcircle distribution profile. This name

dist/index.js

@@ -1,13 +1,15 @@
 import axios from 'axios'
 
-const AUTH_HOSTNAME = 'https://auth.appcircle.io'
-
-export async function getToken(pat: string): Promise<any> {
+export async function getToken(
+  pat: string,
+  authEndpoint = 'https://auth.appcircle.io'
+): Promise<any> {
   const params = new URLSearchParams()
   params.append('pat', pat)
 
+  const authHostname = authEndpoint.replace(/\/+$/, '')
   const response = await axios.post(
-    `${AUTH_HOSTNAME}/auth/v1/token`,
+    `${authHostname}/auth/v1/token`,
     params.toString(),
     {
       headers: {

dist/index.js.map

@@ -3,11 +3,44 @@ import fs from 'fs'
 import FormData from 'form-data'
 import path from 'path';
 
-const API_HOSTNAME = 'https://api.appcircle.io'
+let apiHostname = 'https://api.appcircle.io'
 export const appcircleApi = axios.create({
-  baseURL: API_HOSTNAME.endsWith('/') ? API_HOSTNAME : `${API_HOSTNAME}/`
+  baseURL: `${apiHostname}/`
 })
 
+export function setApiEndpoint(endpoint: string): void {
+  if (!endpoint) return
+  apiHostname = endpoint.replace(/\/+$/, '')
+  appcircleApi.defaults.baseURL = `${apiHostname}/`
+}
+
+async function uploadWithRetry(
+  doUpload: () => Promise<any>,
+  maxRetries = 5
+): Promise<any> {
+  let attempt = 0
+  let delay = 1000
+  while (true) {
+    try {
+      return await doUpload()
+    } catch (error: any) {
+      const status = error?.response?.status
+      const retryable =
+        status === 503 ||
+        error?.code === 'ECONNRESET' ||
+        (typeof error?.message === 'string' &&
+          error.message.includes('socket hang up'))
+      if (!retryable || attempt >= maxRetries) {
+        throw error
+      }
+      attempt++
+      const jitter = Math.floor(Math.random() * 300)
+      await new Promise(resolve => setTimeout(resolve, delay + jitter))
+      delay *= 2
+    }
+  }
+}
+
 export class UploadServiceHeaders {
   static token = ''
 
@@ -37,6 +70,10 @@ export async function uploadArtifact(options: {
   const uploadInfoResponse = await appcircleApi.get<{
     fileId: string;
     uploadUrl: string;
+    configuration?: {
+      httpMethod: string;
+      signParameters: Record<string, string>;
+    };
   }>(
     `distribution/v1/profiles/${options.distProfileId}/app-versions`,
     {
@@ -53,18 +90,31 @@ export async function uploadArtifact(options: {
   }
   console.log("File upload information retrieved successfully with status code:", uploadInfoResponse.status)
 
-  const { fileId, uploadUrl } = uploadInfoResponse.data;
-
-  const fileContent = fs.readFileSync(filePath);
+  const { fileId, uploadUrl, configuration } = uploadInfoResponse.data;
+  const httpMethod = configuration?.httpMethod?.toUpperCase() ?? 'PUT'
+  const signParameters = configuration?.signParameters ?? {}
 
   console.log("Uploading file to Appcircle...")
-  const uploadResponse = await axios.put(uploadUrl, fileContent, {
-    headers: {
-      'Content-Type': 'application/octet-stream'
-    },
-    maxContentLength: Infinity,
-    maxBodyLength: Infinity
-  });
+  const uploadResponse = await uploadWithRetry(() => {
+    if (httpMethod === 'POST') {
+      // Presigned POST (e.g. MinIO on self-hosted): sign params first, file LAST.
+      const form = new FormData()
+      for (const [key, value] of Object.entries(signParameters)) {
+        form.append(key, value)
+      }
+      form.append('file', fs.createReadStream(filePath), fileName)
+      return axios.post(uploadUrl, form, {
+        maxContentLength: Infinity,
+        maxBodyLength: Infinity,
+        headers: { ...form.getHeaders() }
+      })
+    }
+    return axios.put(uploadUrl, fs.readFileSync(filePath), {
+      headers: { 'Content-Type': 'application/octet-stream' },
+      maxContentLength: Infinity,
+      maxBodyLength: Infinity
+    })
+  })
   if (uploadResponse.status < 200 || uploadResponse.status >= 300) {
     throw new Error("Failed to upload file with status code: " + uploadResponse.status)
   }
@@ -158,7 +208,7 @@ export async function checkTaskStatus(
   taskId: string,
   currentAttempt = 0
 ) {
-  const response = await fetch(`${API_HOSTNAME}/task/v1/tasks/${taskId}`, {
+  const response = await fetch(`${apiHostname}/task/v1/tasks/${taskId}`, {
     method: 'GET',
     headers: {
       'Content-Type': 'application/json',