feat(CI): build + upload flatpak to gh-pages in build-gui-release-binaries.yml

.github/actions/set-monero-env/action.yml

@@ -9,7 +9,7 @@ runs:
 
         # GUI-specific Ubuntu dependencies
         grep -q noble /etc/os-release && pin==2.44.0-2 || pin=
-        echo "DEPS_GUI_UBUNTU_SPECIFIC=libgtk-3-dev libappindicator3-dev librsvg2-dev" {libwebkit2gtk-4.1-0,libwebkit2gtk-4.1-dev,libjavascriptcoregtk-4.1-0,libjavascriptcoregtk-4.1-dev,gir1.2-javascriptcoregtk-4.1,gir1.2-webkit2-4.1}"$pin" >> $GITHUB_ENV
+        echo "DEPS_GUI_UBUNTU_SPECIFIC=flatpak-builder jq libgtk-3-dev libappindicator3-dev librsvg2-dev" {libwebkit2gtk-4.1-0,libwebkit2gtk-4.1-dev,libjavascriptcoregtk-4.1-0,libjavascriptcoregtk-4.1-dev,gir1.2-javascriptcoregtk-4.1,gir1.2-webkit2-4.1}"$pin" >> $GITHUB_ENV
 
         # Build tooling (Linux)
         echo "DEPS_BUILD_LINUX=autoconf nsis mingw-w64 build-essential pkg-config libtool ccache make cmake gcc g++ git curl lbzip2 gperf g++-mingw-w64-x86-64" >> $GITHUB_ENV

.github/workflows/build-gui-release-binaries.yml

@@ -101,8 +101,7 @@ jobs:
             exit 1
           fi
 
-          export GNUPGHOME="$(mktemp -d)"
-          chmod 700 "$GNUPGHOME"
+          export GNUPGHOME="$(umask 077; mktemp -d)"
 
           # Allow loopback pinentry when passphrase is provided
           echo "allow-loopback-pinentry" >> "$GNUPGHOME/gpg-agent.conf"
@@ -152,15 +151,53 @@ jobs:
           # Find all .asc signature files we just created
           find target/${{ matrix.target }}/release/bundle -type f -name "*.asc" -print0 | while IFS= read -r -d '' sig_file; do
             echo "Uploading signature: $sig_file"
-            # Get just the filename for the asset name
-            asset_name=$(basename "$sig_file")
-
             gh release upload "${{ github.event.release.tag_name }}" \
               "$sig_file" \
               --clobber
           done
 
-      - name: upload to crabnebula release (not for previews)
+      - name: Upload flatpak release
+        if: ${{ github.event_name != 'pull_request' && !contains(github.ref_name, 'preview') && matrix.target == 'x86_64-unknown-linux-gnu' }}
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          deb=$(find "$PWD" -name *.deb -print -quit)
+          read -r sum _ < <(sha256sum "$deb")
+          jq --arg deb_url "file://$deb" --arg deb_sha256 "$sum" '
+            .modules[0].sources = [
+              {
+                "type": "file",
+                "url": $deb_url,
+                "sha256": $deb_sha256
+              }
+            ]
+          ' < flatpak/org.eigenwallet.app.json > target/manifest.json
+
+          outdir=target/flatpak-repo
+          flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+          flatpak-builder build-dir --gpg-sign="$GPG_FPR" --user --install-deps-from=flathub --disable-rofiles-fuse --disable-updates --repo="$outdir" target/manifest.json
+          flatpak build-update-repo --gpg-sign="$GPG_FPR" --generate-static-deltas --prune "$outdir"
+          flatpak build-bundle      --gpg-sign="$GPG_FPR" "$outdir" "$outdir/org.eigenwallet.app.flatpak" org.eigenwallet.app
+
+          ln flatpak/index.html flatpak/*.flatpakre* src-tauri/icons/icon.png README.md "$outdir/"
+          > "$outdir/.nojekyll"
+
+          IFS=/ read -r user repo <<< "$GITHUB_REPOSITORY"
+          sed -e "s|%Url%|https://$user.github.io/$repo|"              \
+              -e "s|%Homepage%|https://github.com/$GITHUB_REPOSITORY|" \
+              -e "s|%GPGKey%|$(gpg --export "$GPG_FPR" | base64 -w0)|" \
+              -i "$outdir"/*.flatpakre*
+
+          git -C "$outdir" init
+          git -C "$outdir" add .
+          git -C "$outdir" config user.name "${{ secrets.BOTTY_NAME }}"
+          git -C "$outdir" config user.email ${{ secrets.BOTTY_EMAIL }}
+          git -C "$outdir" commit -m "Build Flatpak repository from $GITHUB_REF_NAME ($GITHUB_SHA)"
+          git fetch -f "$outdir" HEAD:gh-pages
+          git push -f origin gh-pages
+
+      - name: Upload to crabnebula release (not for previews)
         if: ${{ github.event_name != 'pull_request' && !contains(github.ref_name, 'preview') }}
         uses: crabnebula-dev/cloud-release@v0
         with:
@@ -186,8 +223,8 @@ jobs:
           gh release download "$VERSION" --pattern "*.dmg" --dir /tmp/dmgs
 
           # Calculate SHA256 checksums
-          AARCH64_DMG=$(ls /tmp/dmgs/*_aarch64_darwin.dmg)
-          X64_DMG=$(ls /tmp/dmgs/*_x64_darwin.dmg)
+          AARCH64_DMG=/tmp/dmgs/*_aarch64_darwin.dmg
+          X64_DMG=/tmp/dmgs/*_x64_darwin.dmg
 
           AARCH64_SHA256=$(sha256sum "$AARCH64_DMG" | awk '{print $1}')
           X64_SHA256=$(sha256sum "$X64_DMG" | awk '{print $1}')
@@ -196,12 +233,10 @@ jobs:
           echo "x64 SHA256: $X64_SHA256"
 
           # Generate the Homebrew formula from template
-          cp dev-scripts/homebrew/eigenwallet.rb.template eigenwallet.rb
-          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" eigenwallet.rb
-          sed -i "s/AARCH64_SHA256_PLACEHOLDER/$AARCH64_SHA256/g" eigenwallet.rb
-          sed -i "s/X64_SHA256_PLACEHOLDER/$X64_SHA256/g" eigenwallet.rb
-
-          cat eigenwallet.rb
+          sed -e "s/VERSION_PLACEHOLDER/$VERSION/g"               \
+              -e "s/AARCH64_SHA256_PLACEHOLDER/$AARCH64_SHA256/g" \
+              -e "s/X64_SHA256_PLACEHOLDER/$X64_SHA256/g"         \
+              dev-scripts/homebrew/eigenwallet.rb.template | tee eigenwallet.rb
 
       - name: Upload Homebrew formula to release
         env: