Files
voculinux/.github/workflows/nightly.yml
T
Sergey SilaevandGitHub 582d494633 chore(build): uv tooling, a Python 3.11 floor, and verified model downloads (epic #701, phases 2.5 & 5) (#713)
* chore(build): migrate justfile tooling to uv

All recipes now run through 'uv run' against .venv, with a shared
DEV_EXTRAS variable (dev + vad) because uv syncs the environment
exactly and would otherwise uninstall the dev tools between
recipes. 'deps' installs dev+vad; new 'deps-all' covers every
extra. 'build' switches to 'uv build'; 'version' uses --no-sync.

Bump [tool.uv] required-version to >=0.12,<0.13 for uv 0.12.x, and
raise the mypy python_version target to 3.12: mypy 1.19 in the lock
cannot target 3.9 and numpy 2.x stubs need a 3.12 target to parse
(mypy is not run in CI or pre-commit; this only affects 'just
typecheck').

* fix(tests): isolate test runs from real XDG state; fix Arch model-path crash

Local test runs failed en masse (185 failures) while CI stayed
green: tests picked up the developer's real ~/.local/share/vocalinux
models via the default XDG paths and switched IBus/keyboard code
paths through the desktop session env (XDG_CURRENT_DESKTOP/
XDG_SESSION_TYPE on GNOME/Wayland, issue #478 branches). conftest
now points XDG base dirs at a throwaway session-wide directory and
clears session variables at import time, mirroring a fresh CI
runner (paths like MODELS_DIR freeze at first import during
collection, so fixture-time isolation is too late).

Also guard the Arch branch of _get_system_model_paths(): it removed
/usr/local/share/vocalinux/models unconditionally and crashed with
ValueError on Arch hosts when a custom XDG_DATA_DIRS never added
that path. Add regression tests, and make the lock-file test assert
the actual $XDG_DATA_HOME/vocalinux contract instead of the
hardcoded ~/.local/share default.

* fix(tests): keep the IBus engine double a plain class

Python 3.14's unittest.mock re-instantiates a user subclass when it builds
child mocks (klass(name=...)). VocalinuxEngine inherits from whatever
IBus.Engine resolves to, and the test module bound that to the MagicMock
class itself, so every engine instantiation raised

    TypeError: VocalinuxEngine.__init__() got an unexpected keyword argument 'name'

on 3.14 while passing on 3.13. Replace it with a plain stand-in class that
still hands out per-instance MagicMocks for the IBus API surface the engine
touches.

The same pattern remains in test_ibus_engine.py, test_ibus_engine_utils.py,
test_ibus_active_engine_guard.py and test_ibus_xkb_wayland.py; those never
instantiate the engine, so they are unaffected for now.

* fix(install): build the venv from the system Python

install.sh looked up a bare `python3` from PATH. Started from an activated
virtualenv — a shell left in uv's .venv after `just deps` — it built venv/
from that interpreter, where distro PyGObject is invisible even with
--system-site-packages, and the run aborted with

    Distro PyGObject (python3-gi / python3-gobject) is not importable in the venv.

A mismatched venv/ then survived every retry, because the installer reuses
whatever venv it finds.

- drop an inherited VIRTUAL_ENV (and its bin from PATH) before any
  interpreter lookup
- select the interpreter explicitly: $SYSTEM_PYTHON (default
  /usr/bin/python3) or PATH python3, preferring one that can import gi,
  and create the venv with it instead of `python3`
- recreate venv/ when it was built by a different interpreter
- name the interpreter in the PyGObject guard's error

Documents the two environments (uv's .venv for tooling, venv/ for the
installed app) in CONTRIBUTING, the justfile header and AGENTS.md, and adds
the mismatch symptom to the INSTALL troubleshooting section.

* chore(python): raise the supported floor to 3.11

requires-python promised 3.9 while the CI matrix ran 3.9/3.10/3.11/3.13,
the classifiers advertised up to 3.14, mypy targeted 3.12 and install.sh
enforced 3.9 — five different answers to "which Python does this support".

Settle on 3.11 everywhere: pyproject (requires-python, classifiers, black
targets), install.sh's MIN_VERSION, check-system-deps.sh, the distro package
map, the CI matrix (now 3.11-3.14, matching the classifiers), the release and
nightly workflows, and the docs.

mypy now targets the floor instead of 3.12, so type checking covers what we
promise; numpy 2.x ships stubs in 3.12 syntax that a 3.11 target cannot
parse, so its imports are skipped. (mypy has 71 pre-existing errors either
way; no CI job gates on it.)

uv.lock and the requirements/* exports are regenerated — dropping 3.9/3.10
removes most of the version-conditional resolution branches.

tests/test_python_version_policy.py pins the invariant: install.sh's floor,
requires-python, the classifiers and the CI matrix must agree.

* ci: run lint and tests from uv.lock

The lock file and the hash-pinned exports were not enforced anywhere: CI
still built a venv by hand and installed unpinned `PyGObject` plus
`-e ".[dev,vad]"`, so the tool versions it checked against had nothing to do
with the ones `just lint` uses locally.

Both Python jobs now use astral-sh/setup-uv and run through `uv sync
--locked` / `uv run --locked`, which also fails the build when uv.lock drifts
from pyproject.toml.

Partially covers phase 5 of #701 (tests install from the lock, lock freshness
gate); trusted publishing, artifact checksums and action SHA pinning are
still open there.

* ci: lint from a dedicated dependency group

The lint job failed on this branch: `uv run --extra dev` syncs the whole
project, so it tried to build pyaudio from source on a runner that installs
no system dependencies.

    src/pyaudio/device_api.c:9:10: fatal error: portaudio.h: No such file or directory

Move black/isort/flake8 out of the `dev` extra into a `lint` dependency
group. CI runs `uv run --locked --only-group lint`, which installs the three
pure-Python tools and skips the project entirely — no portaudio or
girepository headers needed. `just deps` and DEV_EXTRAS request the group
alongside the dev extras, so the local environment still carries test and
lint tooling at once and `just lint` matches CI version for version.

pre-commit is unaffected: its hooks pin their own tool versions upstream.

* fix(install): never configure an engine the venv cannot import

vosk became an optional extra in #705, but the installer still writes
`"engine": "vosk"` into config.json on the whisper.cpp fallback path even
when installing the extra only produced a warning. config.json also survives
reinstalls — every writer guards on "file does not exist" — so an engine
picked by an earlier attempt outlives the venv that supported it. Either way
Vocalinux dies at startup:

    ModuleNotFoundError: No module named 'vosk'

- the fallback now writes the vosk config only when `import vosk` actually
  succeeds, and otherwise leaves the engine configuration alone
- a new verify_configured_engine() runs near the end of the install: if
  config.json selects vosk and the venv cannot import it, it says so and
  prints both fixes instead of leaving a broken install behind

* feat(models): verify every model download against a pinned digest

Pins a sha256/md5 per downloadable speech model in
src/vocalinux/utils/model_checksums.txt and verifies against it in both
install.sh and the runtime downloaders, before the file is moved into place.
Verification fails closed. Covers phase 2.5 of #701; see the PR for details.

* docs(agents): rebase AGENTS.md onto the #727 rewrite

* fix(install): hash models that are already on disk instead of trusting them

* refactor(models): one download path per engine, and fix Whisper's

* docs(install): drop distros that cannot meet the 3.11 floor

* docs: retire the distros and Python versions the 3.11 floor rules out

* fix(install): abort instead of warning when Python is below the floor

* fix(install): fall back to the system Python, not the one on PATH

* fix(install): match an existing venv by installation, not by X.Y

* fix(install): repair a config naming an engine the venv cannot import

* fix(models): pin VOSK by the sha256 of bytes we fetched, not upstream's md5

* fix(justfile): request the dev set in every recipe that syncs

* test(version): scan the docs and website trees for a stale Python floor

* docs: correct the stale model-checksum and distro claims

* fix(models): stamp the VOSK tree the app extracts, as the installer does

* fix(install): replace an unverified VOSK model only once its successor is ready

* docs(install): align the Fedora floor with the rest of the tree

* test(install): drop an f-string with no placeholders

* test(models): stub the downloader probe the VOSK installer test relies on

* docs: drop the long dashes from two model-checksum comments

* fix(install): gate on the interpreter, not on the distro release label

* fix(justfile): export the lint group into requirements/dev.txt

* fix(models): unpack the VOSK tree into staging and stamp it before the swap

* fix(whisper): adopt a checkpoint an earlier release stored under the catalog name

* docs(settings): state what a stray Whisper copy really means for deletion

* fix(models): hash a whisper.cpp model found on disk before it reaches ctypes

* docs(contributing): stop telling readers to uninstall their linters

* fix(install): stop warning off distros the project documents as supported

* docs(distros): file the supported derivatives under supported
2026-08-24 00:25:06 -07:00

343 lines
12 KiB
YAML

name: Nightly Build
on:
schedule:
- cron: '0 2 * * *'
workflow_dispatch: # Allow manual triggering for testing
permissions:
contents: write # Required to create/update releases
jobs:
nightly:
name: Build and Publish Nightly
runs-on: ubuntu-latest
outputs:
version: ${{ steps.version.outputs.version }}
release_tag: ${{ steps.create_release.outputs.tag }}
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
ref: main
fetch-depth: 0
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
cache: 'pip'
- name: Install system dependencies
run: |
sudo apt-get update
sudo apt-get install -y \
portaudio19-dev \
python3-dev \
libgirepository1.0-dev \
libgirepository-2.0-dev \
pkg-config \
libcairo2-dev \
gobject-introspection \
gir1.2-gtk-3.0 \
gir1.2-appindicator3-0.1 \
gir1.2-ayatanaappindicator3-0.1 \
gir1.2-notify-0.7 \
gir1.2-dbusmenu-glib-0.4 \
gir1.2-ibus-1.0 \
gir1.2-rsvg-2.0 \
librsvg2-common \
libdbusmenu-gtk3-4 \
libnotify4 \
cmake \
ninja-build \
build-essential \
libvulkan-dev \
glslc \
spirv-headers \
spirv-tools
- name: Install build dependencies
run: |
python -m pip install --upgrade pip setuptools wheel build twine
- name: Build package
run: |
python -m build
ls -la dist/
- name: Generate nightly version
id: version
run: |
BASE_VERSION=$(grep -oP '__version__\s*=\s*"\K[^"]+' src/vocalinux/version.py)
DATE=$(date +%Y%m%d)
SHORT_SHA=$(git rev-parse --short HEAD)
NIGHTLY_VERSION="${BASE_VERSION}.dev${DATE}+${SHORT_SHA}"
echo "version=${NIGHTLY_VERSION}" >> $GITHUB_OUTPUT
echo "base_version=${BASE_VERSION}" >> $GITHUB_OUTPUT
echo "date=${DATE}" >> $GITHUB_OUTPUT
echo "sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
echo "Built version: ${NIGHTLY_VERSION}"
- name: Rename artifacts for nightly
run: |
for file in dist/*; do
base=$(basename "$file")
if [[ "$base" == vocalinux-* ]]; then
# Extract the file extension
if [[ "$base" == *.whl ]]; then
# vocalinux-0.5.0b0-py3-none-any.whl -> vocalinux-0.5.0b0.dev20250211+g1234567-py3-none-any.whl
newname="vocalinux-${{ steps.version.outputs.version }}-py3-none-any.whl"
elif [[ "$base" == *.tar.gz ]]; then
# vocalinux-0.5.0b0.tar.gz -> vocalinux-0.5.0b0.dev20250211+g1234567.tar.gz
newname="vocalinux-${{ steps.version.outputs.version }}.tar.gz"
else
# Fallback: replace version in filename
newname=$(echo "$base" | sed 's/vocalinux-[^[:space:]]*/vocalinux-${{ steps.version.outputs.version }}/')
fi
if [[ "$base" != "$newname" ]]; then
mv "$file" "dist/$newname"
fi
fi
done
ls -la dist/
- name: Build AppImage (x86_64)
env:
VOCALINUX_APPIMAGE_REQUIRE_VULKAN: "1"
run: |
bash packaging/appimage/build.sh dist/*.whl "${{ steps.version.outputs.version }}" dist
ls -la dist/*.AppImage
- name: Cleanup old nightly releases
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
# Calculate the cutoff date (3 days ago) in seconds since epoch
CUTOFF_DATE=$(date -d '3 days ago' +%s)
echo "Cutoff date: $(date -d @$CUTOFF_DATE -u +"%Y-%m-%d %H:%M:%S UTC") (3 days ago)"
# Get nightly releases with their actual creation timestamps using JSON output
# Filter for releases older than 3 days and delete them
gh release list --repo ${{ github.repository }} --json tagName,createdAt --limit 100 | \
jq -r '.[] | select(.tagName | startswith("nightly-")) | [.tagName, .createdAt] | @tsv' | \
while IFS=$'\t' read -r tag created_at; do
# Parse the ISO 8601 date to seconds since epoch
RELEASE_DATE=$(date -d "$created_at" +%s 2>/dev/null || echo "0")
if [ "$RELEASE_DATE" != "0" ] && [ "$RELEASE_DATE" -lt "$CUTOFF_DATE" ]; then
echo "Deleting old nightly release: $tag (created: $(date -d @$RELEASE_DATE -u +"%Y-%m-%d %H:%M:%S UTC"))"
gh release delete "$tag" --yes --repo ${{ github.repository }} 2>/dev/null || true
git push origin :refs/tags/"$tag" 2>/dev/null || true
git tag -d "$tag" 2>/dev/null || true
else
echo "Keeping nightly release: $tag (created: $(date -d @$RELEASE_DATE -u +"%Y-%m-%d %H:%M:%S UTC"))"
fi
done
- name: Generate release notes
id: release_notes
run: |
COMMIT_MSG=$(git log -1 --pretty=format:"%s" HEAD)
COMMIT_AUTHOR=$(git log -1 --pretty=format:"%an" HEAD)
COMMIT_DATE=$(git log -1 --pretty=format:"%ci" HEAD)
COMMIT_BODY=$(git log -1 --pretty=format:"%b" HEAD)
# Get recent commits (last 10) for changelog
RECENT_COMMITS=$(git log --oneline -10 --no-decorate | sed 's/^/- /')
# Get changes since last tag (if exists)
LAST_TAG=$(git describe --tags --abbrev=0 --match "nightly-*" 2>/dev/null || echo "")
if [ -n "$LAST_TAG" ]; then
CHANGES_SINCE=$(git log --oneline "$LAST_TAG"..HEAD --no-decorate | sed 's/^/- /')
CHANGES_SECTION="### Changes Since Last Nightly
${CHANGES_SINCE:-"*No new commits since last nightly*"}"
else
CHANGES_SECTION="### Recent Commits
${RECENT_COMMITS}"
fi
cat > /tmp/release_notes.md << EOF
## Nightly Build ${{ steps.version.outputs.version }}
**This is a nightly development build. It may contain bugs or incomplete features. Use at your own risk.**
---
### What's in This Build
**Commit Details:**
- **SHA:** \`${{ steps.version.outputs.sha }}\`
- **Message:** ${COMMIT_MSG}
- **Author:** ${COMMIT_AUTHOR}
- **Date:** ${COMMIT_DATE}
${CHANGES_SECTION}
---
### Installation
#### Quick Install (Recommended)
Download the wheel file below and install:
\`\`\`bash
pip install vocalinux-${{ steps.version.outputs.version }}-py3-none-any.whl
\`\`\`
#### From PyPI (Stable)
For the latest stable release:
\`\`\`bash
pip install vocalinux
\`\`\`
#### Using Install Script
\`\`\`bash
curl -fsSL https://raw.githubusercontent.com/VocaHQ/vocalinux/main/install.sh | bash
\`\`\`
#### AppImage (no install, no root)
Download the \`.AppImage\` matching your CPU (\`x86_64\` or \`aarch64\`) below:
\`\`\`bash
chmod +x Vocalinux-${{ steps.version.outputs.version }}-x86_64.AppImage
./Vocalinux-${{ steps.version.outputs.version }}-x86_64.AppImage
\`\`\`
Requires \`xdotool\`/\`wtype\`/\`ydotool\` on the host for text injection, same as the PyPI install path.
---
### Build Information
| Property | Value |
|----------|-------|
| **Version** | ${{ steps.version.outputs.version }} |
| **Base Version** | ${{ steps.version.outputs.base_version }} |
| **Build Date** | ${{ steps.version.outputs.date }} |
| **Python** | 3.11+ |
| **OS** | Linux (X11 & Wayland) |
---
### Files
- **\`vocalinux-${{ steps.version.outputs.version }}-py3-none-any.whl\`** - Python wheel (recommended)
- **\`vocalinux-${{ steps.version.outputs.version }}.tar.gz\`** - Source distribution
- **\`Vocalinux-${{ steps.version.outputs.version }}-x86_64.AppImage\`** - Self-contained, no install (Intel/AMD)
- **\`Vocalinux-${{ steps.version.outputs.version }}-aarch64.AppImage\`** - Self-contained, no install (ARM64, added shortly after this release is published)
---
### Links
- [Documentation](https://vocalinux.com)
- [Report Issues](https://github.com/VocaHQ/vocalinux/issues)
- [Other Releases](https://github.com/VocaHQ/vocalinux/releases)
---
*Only the 3 most recent nightly builds are kept. This build will be automatically deleted when newer nightlies are created.*
*Generated on $(date -u +"%Y-%m-%d %H:%M:%S UTC")*
EOF
echo "notes_file=/tmp/release_notes.md" >> $GITHUB_OUTPUT
- name: Create nightly release
id: create_release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
# Create release with dated tag: nightly-2025-02-11
RELEASE_TAG="nightly-$(date +%Y-%m-%d)"
# If a release for today already exists, delete it first
gh release delete "$RELEASE_TAG" --yes --repo ${{ github.repository }} 2>/dev/null || true
git push origin :refs/tags/"$RELEASE_TAG" 2>/dev/null || true
git tag -d "$RELEASE_TAG" 2>/dev/null || true
gh release create "$RELEASE_TAG" \
--title "Nightly Build - ${{ steps.version.outputs.version }}" \
--notes-file ${{ steps.release_notes.outputs.notes_file }} \
--prerelease \
dist/*
echo "tag=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
- name: Upload artifacts (backup)
uses: actions/upload-artifact@v4
with:
name: vocalinux-nightly-${{ steps.version.outputs.version }}
path: dist/
retention-days: 7
nightly-appimage-arm64:
name: Build and Attach Nightly AppImage (aarch64)
runs-on: ubuntu-24.04-arm
needs: nightly
if: needs.nightly.result == 'success'
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
ref: main
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
cache: 'pip'
- name: Install system dependencies
run: |
sudo apt-get update
sudo apt-get install -y \
portaudio19-dev \
python3-dev \
libgirepository1.0-dev \
libgirepository-2.0-dev \
pkg-config \
libcairo2-dev \
gobject-introspection \
gir1.2-gtk-3.0 \
gir1.2-appindicator3-0.1 \
gir1.2-ayatanaappindicator3-0.1 \
gir1.2-notify-0.7 \
gir1.2-dbusmenu-glib-0.4 \
gir1.2-ibus-1.0 \
gir1.2-rsvg-2.0 \
librsvg2-common \
libdbusmenu-gtk3-4 \
libnotify4 \
cmake \
ninja-build \
build-essential \
libvulkan-dev \
glslc \
spirv-headers \
spirv-tools
- name: Install build dependencies
run: |
python -m pip install --upgrade pip setuptools wheel build
- name: Build package
run: |
python -m build
ls -la dist/
- name: Build AppImage (aarch64)
env:
VOCALINUX_APPIMAGE_REQUIRE_VULKAN: "1"
run: |
bash packaging/appimage/build.sh dist/*.whl "${{ needs.nightly.outputs.version }}" dist
ls -la dist/*.AppImage
- name: Attach to nightly release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh release upload "${{ needs.nightly.outputs.release_tag }}" \
dist/*.AppImage \
--repo ${{ github.repository }} \
--clobber