From 4ba11af383d6dcc0d4e3354e14d4fc0b8cf22da5 Mon Sep 17 00:00:00 2001
From: Aly Raffauf <aly@aly.codes>
Date: Sat, 20 Jun 2026 10:18:37 -0400
Subject: [PATCH] ci: build appimages with nix

---
 .github/workflows/release.yml | 80 +++++++++++++++++++++++------------
 package.nix                   | 34 ++++++++-------
 2 files changed, 73 insertions(+), 41 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 70d9709..aa4a992 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,31 +15,57 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v5
 
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
+      - name: Set up Nix
+        uses: DeterminateSystems/nix-installer-action@main
 
       - name: Install release tools
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq zsync
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq binutils zsync
 
-      - name: Build AppDir
+      - name: Build release payload
         run: |
+          set -euo pipefail
+
+          export APPHERDER_RELEASE_VERSION="$GITHUB_REF_NAME"
+          export APPHERDER_RELEASE_SYSTEM="x86_64-linux"
+
+          nix build --impure --out-link result-appherder --expr '
+          let
+            flake = builtins.getFlake (toString ./.);
+            pkgs = import flake.inputs.nixpkgs {
+              system = builtins.getEnv "APPHERDER_RELEASE_SYSTEM";
+              config.allowUnfree = true;
+            };
+          in
+            pkgs.callPackage ./package.nix {
+              version = builtins.getEnv "APPHERDER_RELEASE_VERSION";
+            }
+          '
+
           mkdir -p AppDir/usr/bin
 
-          # Binary with tagged version
-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
-            go build -trimpath \
-            -ldflags "-s -w -X main.version=$GITHUB_REF_NAME" \
-            -o AppDir/usr/bin/appherder ./cmd/appherder
+          # Copy the real Go binary, not the Nix PATH wrapper.
+          if [ -x result-appherder/bin/.appherder-wrapped ]; then
+            install -Dm755 result-appherder/bin/.appherder-wrapped AppDir/usr/bin/appherder
+            install -Dm755 result-appherder/bin/.appherder-wrapped appherder-linux-amd64
+          else
+            install -Dm755 result-appherder/bin/appherder AppDir/usr/bin/appherder
+            install -Dm755 result-appherder/bin/appherder appherder-linux-amd64
+          fi
+
+          ./appherder-linux-amd64 --version | grep -F "appherder version $GITHUB_REF_NAME"
 
           # Bundle dwarfsextract so DwarFS AppImages do not need host tools.
-          DWARFS_VERSION=0.14.0
-          DWARFS_DIR="dwarfs-$DWARFS_VERSION-Linux-x86_64"
-          wget -q -O /tmp/dwarfs.tar.xz \
-            "https://github.com/mhx/dwarfs/releases/download/v$DWARFS_VERSION/$DWARFS_DIR.tar.xz"
-          tar -xf /tmp/dwarfs.tar.xz -C /tmp
-          install -Dm755 "/tmp/$DWARFS_DIR/bin/dwarfsextract" AppDir/usr/bin/dwarfsextract
+          nix build --impure --out-link result-dwarfs --expr '
+          let
+            flake = builtins.getFlake (toString ./.);
+            pkgs = import flake.inputs.nixpkgs {
+              system = builtins.getEnv "APPHERDER_RELEASE_SYSTEM";
+              config.allowUnfree = true;
+            };
+          in
+            pkgs.dwarfs
+          '
+          install -Dm755 result-dwarfs/bin/dwarfsextract AppDir/usr/bin/dwarfsextract
           test "$(PATH="$PWD/AppDir/usr/bin:$PATH" command -v dwarfsextract)" = "$PWD/AppDir/usr/bin/dwarfsextract"
           AppDir/usr/bin/dwarfsextract --help >/dev/null
 
@@ -86,23 +112,25 @@ jobs:
 
           chmod +x AppDir/AppRun
 
-      - name: Build plain binary
-        run: |
-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
-            go build -trimpath \
-            -ldflags "-s -w -X main.version=$GITHUB_REF_NAME" \
-            -o appherder-linux-amd64 ./cmd/appherder
-
       - name: Build AppImage
         run: |
+          set -euo pipefail
+
           APPIMAGE="appherder-$GITHUB_REF_NAME-x86_64.AppImage"
+          UPDATE_INFO="gh-releases-zsync|alyraffauf|appherder|latest|appherder-*x86_64.AppImage.zsync"
+
           wget -q -O /tmp/appimagetool.AppImage \
             https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
           chmod +x /tmp/appimagetool.AppImage
-          /tmp/appimagetool.AppImage \
-            -u "gh-releases-zsync|alyraffauf|appherder|latest|appherder-*x86_64.AppImage.zsync" \
+
+          APPIMAGE_EXTRACT_AND_RUN=1 /tmp/appimagetool.AppImage \
+            -u "$UPDATE_INFO" \
             AppDir "$APPIMAGE"
 
+          test -f "$APPIMAGE"
+          test -f "$APPIMAGE.zsync"
+          readelf -p .upd_info "$APPIMAGE" | grep -F "$UPDATE_INFO"
+
       - name: Publish release
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/package.nix b/package.nix
index 5913379..77a9955 100644
--- a/package.nix
+++ b/package.nix
@@ -3,18 +3,22 @@
   dwarfs,
   lib,
   makeWrapper,
-}: let
-  version = "dev";
-in
-  buildGoModule {
-    pname = "appherder";
-    inherit version;
-    src = ./.;
-    vendorHash = "sha256-hrqRutMJw96V61AKoyt4Oqya8STeGYlF5phb6O35L8Q=";
-    subPackages = ["cmd/appherder"];
-    ldflags = ["-X main.version=${version}"];
-    nativeBuildInputs = [makeWrapper];
-    postInstall = ''
-      wrapProgram $out/bin/appherder --prefix PATH : ${lib.makeBinPath [dwarfs]}
-    '';
-  }
+  version ? "dev",
+}:
+buildGoModule {
+  pname = "appherder";
+  inherit version;
+  src = ./.;
+  vendorHash = "sha256-hrqRutMJw96V61AKoyt4Oqya8STeGYlF5phb6O35L8Q=";
+  subPackages = ["cmd/appherder"];
+  env.CGO_ENABLED = "0";
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ];
+  nativeBuildInputs = [makeWrapper];
+  postInstall = ''
+    wrapProgram $out/bin/appherder --prefix PATH : ${lib.makeBinPath [dwarfs]}
+  '';
+}
-- 
2.51.2