Release builds from their tags

markharding · markharding · commit 78430e42cc63 · 2026-05-30T21:30:42.000-05:00
Changelog: enhancement
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -9,12 +9,14 @@ include:
   - local: '.gitlab/ci/deploy_server.yml'
   - local: '.gitlab/ci/deploy_pages.yml'
   - local: '.gitlab/ci/scan_dependencies.yml'
+  - local: '.gitlab/ci/release.yml'
 stages:
   - setup
   - check
   - build
   - publish
   - deploy
+  - release
   - test
 variables:
   CARGO_HOME: ${CI_PROJECT_DIR}/.cargo
diff --git a/.gitlab/changelog_config.yml b/.gitlab/changelog_config.yml
@@ -0,0 +1,26 @@
+# Match the SemVer tags this project releases on (v2.0.0, v2.0.0-alpha.1, ...).
+tag_regex: '^v\d+\.\d+\.\d+'
+
+categories:
+  feature: 🚀 Features
+  fix: 🐛 Bug fixes
+  enhancement: ⚡ Enhancements
+  security: 🔒 Security
+  deprecated: ⚠️ Deprecated
+  breaking-change: 🚨 Breaking Changes
+  documentation: 📚 Documentation
+  other: 📦 Other
+
+template: |
+  {% if categories %}
+  {% each categories %}
+  #### {{ title }}
+
+  {% each entries %}
+  - {{ title }} ({{ commit.reference }}){% if author.contributor %} by {{ author.reference }}{% end %}{% if commit.trailers.MR %} ([merge request]({{ commit.trailers.MR }})){% end %}
+
+  {% end %}
+  {% end %}
+  {% else %}
+  No changes.
+  {% end %}
diff --git a/.gitlab/ci/build_app.yml b/.gitlab/ci/build_app.yml
@@ -28,6 +28,9 @@
 
 app-web-image:
   extends: .app-build-base
+  rules:
+    - !reference [.app-workflow, rules]
+    - !reference [.release-workflow, rules]
   image:
     name: moby/buildkit:rootless
     entrypoint: ['']
@@ -43,6 +46,8 @@ app-web-image:
         --local dockerfile=./apps/polycentric \
         --opt build-arg:EXPO_PUBLIC_POLYCENTRIC_SEED_SERVERS=$EXPO_PUBLIC_POLYCENTRIC_SEED_SERVERS \
         --opt build-arg:SKIP_WORKSPACE_BUILD=1 \
+        --import-cache type=registry,ref=$CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA-cache \
+        --export-cache type=registry,ref=$CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA-cache,mode=max \
         --output type=image,name=$CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA,push=true
 
 .app-build-expo:
@@ -56,18 +61,44 @@ app-web-image:
     - apt-get update && apt-get install -y --no-install-recommends git
     - cd ./apps/polycentric
 
-app-android-apk:
+# EAS builds run: manual on merge requests, automatic on the default branch and
+# on tags. Only the APK waits for completion (we download it); the others are
+# fire-and-forget.
+.app-eas-build:
   extends: .app-build-expo
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      changes:
+        - apps/**/*
+        - .gitlab/ci/build_app.yml
+        - .gitlab/ci/deploy_app.yml
+      when: manual
+      allow_failure: true
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      changes:
+        - apps/**/*
+        - .gitlab/ci/build_app.yml
+        - .gitlab/ci/deploy_app.yml
+    - if: $CI_COMMIT_TAG =~ /^(v\d+\.\d+\.\d+|app-)/
+
+app-android-apk:
+  extends: .app-eas-build
   script:
-    - npx eas-cli build --platform android --profile preview --non-interactive --no-wait
+    - npx eas-cli build --platform android --profile preview --non-interactive --wait --json > eas-build.json
+    # eas only builds remotely; download the resulting APK so it is a CI artifact.
+    - node "$CI_PROJECT_DIR/tools/expo/download-apk.js" eas-build.json polycentric.apk
+  artifacts:
+    paths:
+      - apps/polycentric/polycentric.apk
+      - apps/polycentric/eas-build.json
+    expire_in: 1 week
 
 app-android-aab:
-  extends: .app-build-expo
+  extends: .app-eas-build
   script:
-    - npx eas-cli build --platform android --non-interactive --no-wait
-  when: manual
+    - npx eas-cli build --platform android --non-interactive --no-wait ${CI_COMMIT_TAG:+--auto-submit}
 
 app-ios:
-  extends: .app-build-expo
+  extends: .app-eas-build
   script:
-    - npx eas-cli build --platform ios --non-interactive --no-wait
+    - npx eas-cli build --platform ios --non-interactive --no-wait ${CI_COMMIT_TAG:+--auto-submit}
diff --git a/.gitlab/ci/build_js_sdks.yml b/.gitlab/ci/build_js_sdks.yml
@@ -45,6 +45,7 @@ js-sdks-build:
     - !reference [.rs-core-workflow, rules]
     - !reference [.rn-sdk-workflow, rules]
     - !reference [.app-workflow, rules]
+    - !reference [.release-workflow, rules]
 
 .js-sdks-publish-npm:
   rules:
diff --git a/.gitlab/ci/build_rn_sdk.yml b/.gitlab/ci/build_rn_sdk.yml
@@ -21,6 +21,7 @@ rn-android-build:
     - !reference [.rn-sdk-workflow, rules]
     - !reference [.rs-core-workflow, rules]
     - !reference [.app-workflow, rules]
+    - !reference [.release-workflow, rules]
   cache:
     - key:
         files:
@@ -59,6 +60,7 @@ rn-android-build:
     - !reference [.rn-sdk-workflow, rules]
     - !reference [.rs-core-workflow, rules]
     - !reference [.app-workflow, rules]
+    - !reference [.release-workflow, rules]
   tags:
     - macscript
   variables:
@@ -124,3 +126,4 @@ rn-sdk-build:
     - !reference [.rn-sdk-workflow, rules]
     - !reference [.rs-core-workflow, rules]
     - !reference [.app-workflow, rules]
+    - !reference [.release-workflow, rules]
diff --git a/.gitlab/ci/build_rs_core.yml b/.gitlab/ci/build_rs_core.yml
@@ -87,6 +87,7 @@ rs-core-uniffi-web-build:
     - !reference [.js-sdk-workflow, rules]
     - !reference [.rn-sdk-workflow, rules]
     - !reference [.app-workflow, rules]
+    - !reference [.release-workflow, rules]
   cache:
     - key:
         files:
diff --git a/.gitlab/ci/build_server.yml b/.gitlab/ci/build_server.yml
@@ -47,6 +47,9 @@ server-build:
 
 server-image:
   extends: .server-workflow
+  rules:
+    - !reference [.server-workflow, rules]
+    - !reference [.release-workflow, rules]
   image:
     name: moby/buildkit:rootless
     entrypoint: ['']
@@ -60,4 +63,6 @@ server-image:
         --frontend dockerfile.v0 \
         --local context=. \
         --local dockerfile=./services/server \
+        --import-cache type=registry,ref=$CI_REGISTRY_IMAGE/server:$CI_COMMIT_SHA-cache \
+        --export-cache type=registry,ref=$CI_REGISTRY_IMAGE/server:$CI_COMMIT_SHA-cache,mode=max \
         --output type=image,name=$CI_REGISTRY_IMAGE/server:$CI_COMMIT_SHA,push=true
diff --git a/.gitlab/ci/release.yml b/.gitlab/ci/release.yml
@@ -0,0 +1,201 @@
+.release-workflow:
+  rules:
+    # Only fire on SemVer release tags, e.g. v2.0.0 or v2.0.0-alpha.1.
+    # NOTE: intentionally has no trailing `when: never` so it can be safely
+    # `!reference`d into the build jobs' rule lists without short-circuiting them.
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+/
+      when: always
+
+################
+# Android APK  #
+################
+
+release-android-apk:
+  extends: .release-workflow
+  stage: publish
+  image: alpine:latest
+  needs:
+    - job: app-android-apk
+      artifacts: true
+  before_script:
+    - apk add --no-cache curl
+  script:
+    - |
+      APK_PACKAGE_URL="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/polycentric-android/${CI_COMMIT_TAG}/polycentric-${CI_COMMIT_TAG}.apk"
+      echo "Uploading APK to ${APK_PACKAGE_URL}"
+      curl -fsSL --header "JOB-TOKEN: ${CI_JOB_TOKEN}" --upload-file apps/polycentric/polycentric.apk "$APK_PACKAGE_URL"
+      echo "APK_PACKAGE_URL=${APK_PACKAGE_URL}" > apk.env
+  artifacts:
+    reports:
+      dotenv: apk.env
+
+####################
+# Container images #
+####################
+
+.release-tag-image:
+  extends: .release-workflow
+  stage: release
+  image:
+    name: gcr.io/go-containerregistry/crane:debug
+    entrypoint: ['']
+  script:
+    - crane auth login $CI_REGISTRY -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD
+    - crane tag $CI_REGISTRY_IMAGE/$IMAGE:$CI_COMMIT_SHA $CI_COMMIT_TAG
+
+release-tag-app-image:
+  extends: .release-tag-image
+  variables:
+    IMAGE: app
+  needs:
+    - job: app-web-image
+      artifacts: false
+
+release-tag-server-image:
+  extends: .release-tag-image
+  variables:
+    IMAGE: server
+  needs:
+    - job: server-image
+      artifacts: false
+
+##########################
+# JS SDKs + React Native #
+##########################
+
+release-publish-npm:
+  extends: .release-workflow
+  stage: publish
+  image: node:24-slim
+  needs:
+    - job: rs-core-uniffi-web-build
+      artifacts: true
+    - job: js-sdks-build
+      artifacts: true
+    - job: rn-sdk-build
+      artifacts: true
+  before_script:
+    - apt-get update && apt-get install -y --no-install-recommends git
+    - npm install -g pnpm@10.19.0
+    - pnpm config set @polycentric:registry https://${CI_SERVER_HOST}/api/v4/projects/${CI_PROJECT_ID}/packages/npm/
+    - echo "//${CI_SERVER_HOST}/api/v4/projects/${CI_PROJECT_ID}/packages/npm/:_authToken=${CI_JOB_TOKEN}" >> ~/.npmrc
+    - echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
+    - pnpm install --frozen-lockfile
+  script:
+    - VERSION="${CI_COMMIT_TAG#v}"
+    - echo "Publishing @polycentric packages at version ${VERSION}"
+    # Keep prereleases (e.g. 2.0.0-alpha.1) off the `latest` dist-tag.
+    - |
+      DIST_TAG=latest
+      if echo "$VERSION" | grep -q '-'; then
+        DIST_TAG=$(echo "$VERSION" | sed -E 's/.*-([a-zA-Z]+).*/\1/')
+        [ "$DIST_TAG" = "$VERSION" ] && DIST_TAG=next
+      fi
+      echo "Using npm dist-tag: ${DIST_TAG}"
+    # Bump every @polycentric package to the release version.
+    - pnpm -r --filter "@polycentric/*" exec npm version "${VERSION}" --no-git-tag-version --allow-same-version
+    # Publish to the GitLab registry and to public npm. pnpm topologically
+    # orders the packages and rewrites workspace:* -> ${VERSION} on publish.
+    - |
+      FILTERS="--filter @polycentric/rs-core-uniffi-web --filter @polycentric/js-storage-sqlite --filter @polycentric/js-core --filter @polycentric/js-browser --filter @polycentric/js-node --filter @polycentric/react-native"
+
+      echo "Publishing to the GitLab package registry"
+      pnpm config set @polycentric:registry "https://${CI_SERVER_HOST}/api/v4/projects/${CI_PROJECT_ID}/packages/npm/"
+      pnpm $FILTERS -r publish --no-git-checks --access public --tag "$DIST_TAG"
+
+      if [ -n "$NPM_TOKEN" ]; then
+        echo "Publishing to public npm (registry.npmjs.org)"
+        pnpm config set @polycentric:registry "https://registry.npmjs.org/"
+        pnpm $FILTERS -r publish --no-git-checks --access public --tag "$DIST_TAG"
+      else
+        echo "NPM_TOKEN is not set; skipping public npm publish" >&2
+      fi
+
+#################
+# rs-core crate #
+#################
+
+release-publish-rs-core:
+  extends: .release-workflow
+  stage: publish
+  image: $RUST_IMAGE
+  variables:
+    GIT_DEPTH: '1'
+  script:
+    - VERSION="${CI_COMMIT_TAG#v}"
+    # Bump the crate versions and give the path dependency a version so the
+    # crates package cleanly.
+    - sed -i "s/^version = \".*\"/version = \"${VERSION}\"/" packages/rs-common/Cargo.toml packages/rs-core/Cargo.toml
+    - sed -i "s#path = \"../rs-common\" }#path = \"../rs-common\", version = \"${VERSION}\" }#" packages/rs-core/Cargo.toml
+    - mkdir -p target/package
+    - cargo package -p polycentric-common --no-verify --allow-dirty || true
+    - cargo package -p polycentric-core --no-verify --allow-dirty || true
+    # Fall back to a source tarball if cargo could not package the crate.
+    - |
+      if ! ls target/package/*.crate >/dev/null 2>&1; then
+        echo "cargo package produced no .crate; falling back to a source tarball" >&2
+        tar czf "target/package/polycentric-core-${VERSION}.crate" packages/rs-core packages/rs-common
+      fi
+    - |
+      BASE_URL="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/polycentric-rs-core/${VERSION}"
+      for crate in target/package/*.crate; do
+        fname=$(basename "$crate")
+        echo "Uploading ${fname}"
+        curl -fsSL --header "JOB-TOKEN: ${CI_JOB_TOKEN}" --upload-file "$crate" "${BASE_URL}/${fname}"
+      done
+      echo "RS_CORE_PACKAGE_URL=${BASE_URL}/polycentric-core-${VERSION}.crate" > rs-core.env
+  artifacts:
+    reports:
+      dotenv: rs-core.env
+
+#############
+# Changelog #
+#############
+
+release-changelog:
+  extends: .release-workflow
+  stage: publish
+  image: alpine:latest
+  before_script:
+    - apk add --no-cache curl jq
+  script:
+    - 'curl -H "PRIVATE-TOKEN: $CI_API_TOKEN" "$CI_API_V4_URL/projects/$CI_PROJECT_ID/repository/changelog?version=$CI_COMMIT_TAG" | jq -r .notes > release_notes.md'
+    - cat release_notes.md
+  artifacts:
+    paths:
+      - release_notes.md
+    expire_in: 1 week
+
+#############################
+# Create the GitLab Release #
+#############################
+
+release:
+  extends: .release-workflow
+  stage: release
+  image: registry.gitlab.com/gitlab-org/release-cli:latest
+  script:
+    - echo "Creating release"
+  needs:
+    - job: release-changelog
+      artifacts: true
+    - job: release-android-apk
+      artifacts: true
+    - job: release-publish-rs-core
+      artifacts: false
+    - job: release-publish-npm
+      artifacts: false
+    - job: release-tag-app-image
+      artifacts: false
+    - job: release-tag-server-image
+      artifacts: false
+  release:
+    tag_name: $CI_COMMIT_TAG
+    name: '$CI_COMMIT_TAG'
+    ref: '$CI_COMMIT_SHA'
+    description: release_notes.md
+    assets:
+      links:
+        - name: 'Android APK ($CI_COMMIT_TAG)'
+          url: '$APK_PACKAGE_URL'
+          link_type: package
diff --git a/apps/polycentric/eas.json b/apps/polycentric/eas.json
@@ -16,6 +16,13 @@
     }
   },
   "submit": {
-    "production": {}
+    "production": {
+      "ios": {
+        "ascAppId": "6504881935"
+      },
+      "android": {
+        "track": "internal"
+      }
+    }
   }
-}
+}
diff --git a/tools/expo/download-apk.js b/tools/expo/download-apk.js
