Drone to GARM by tobiasKaminsky · Pull Request #9622 · nextcloud/desktop

tobiasKaminsky · 2026-03-13T11:15:03Z

No description provided.

mgallien

@tobiasKaminsky
thanks
can you fix the DCO check ?
see https://github.com/nextcloud/desktop/pull/9622/checks?check_run_id=66942968543
also we want to use conventional commit messages, can you have a look ?
see https://github.com/nextcloud/desktop/actions/runs/23048340558/job/66942971883?pr=9622

tobiasKaminsky · 2026-03-16T07:35:55Z

Done ✔

I do not have the secrets for debian, thus I could not update them for GitHub Actions.
(But it also seems to still build?)

tobiasKaminsky · 2026-03-16T07:37:21Z

Hm. Actually it fails:

+ git fetch origin debian/dist/jammy/
fatal: invalid refspec 'debian/dist/jammy/'
Warning:  Debian build failed but this is a non-blocking CI event

--> working on it

mgallien

thanks

tobiasKaminsky · 2026-03-16T09:07:42Z

@mgallien this works now.
But I do not see if/where those secrets are being used.

mgallien · 2026-03-17T16:38:26Z

@mgallien this works now. But I do not see if/where those secrets are being used.

they are being used there https://github.com/nextcloud/desktop/blob/master/admin/linux/debian/drone-build.sh#L45-L52

@ivaradi I guess from the CI point of view, we do not make use of them ?
I will wait for your feedback before merging the PR

ivaradi · 2026-03-17T18:25:05Z

@ivaradi I guess from the CI point of view, we do not make use of them ? I will wait for your feedback before merging the PR

We actually do. They are needed to decode the keys for uploading the source packages to the PPA and the openSUSE build service. I think the current setup is such that the secrets are set for the master branch only, so that only builds performed on that are uploaded.

mgallien · 2026-03-19T09:29:14Z

@ivaradi I guess from the CI point of view, we do not make use of them ? I will wait for your feedback before merging the PR

We actually do. They are needed to decode the keys for uploading the source packages to the PPA and the openSUSE build service. I think the current setup is such that the secrets are set for the master branch only, so that only builds performed on that are uploaded.

@ivaradi I indeed can confirm that our drone Nextcloud run instance has the secrets but not recoverable (the whole point of having secrets)
we do want to merge this PR
so if the maintenance of your PPA needs the secrets to be valid, we will have to arrange a way to get them sent by you
I am checking internally if we would have other ideas or solutions

tobiasKaminsky · 2026-03-19T12:14:43Z

@ivaradi
I added the keys/secrets:

+ test -f /github/home/.has_ppa_keys
+ debsign -k2265D8767D14AA7B -S
long key IDs are discouraged; please use key fingerprints instead
 signfile dsc ../nextcloud-desktop_33.0.50-20260319.120140.ce2ec846fc-1.0~jammy1.dsc 2265D8767D14AA7B

 fixup_changes dsc ../nextcloud-desktop_33.0.50-20260319.120140.ce2ec846fc-1.0~jammy1.dsc ../nextcloud-desktop_33.0.50-20260319.120140.ce2ec846fc-1.0~jammy1_source.changes
 signfile changes ../nextcloud-desktop_33.0.50-20260319.120140.ce2ec846fc-1.0~jammy1_source.changes 2265D8767D14AA7B

Successfully signed dsc, changes files

Full logs are here:
https://github.com/nextcloud/desktop/actions/runs/23135940643/job/67735771075

For me this looks good?

tobiasKaminsky · 2026-03-19T12:15:33Z

+ dput ppa:nextcloud-devs/client-alpha nextcloud-desktop_33.0.50-20260319.120140.ce2ec846fc-1.0~jammy1_source.changes
gpg: /__w/desktop/nextcloud-desktop_33.0.50-20260319.120140.ce2ec846fc-1.0~jammy1_source.changes: Error checking signature from 2265D8767D14AA7B: SignatureVerifyError: 0

this is not that good 🙈

tobiasKaminsky · 2026-03-19T12:18:10Z

Here they are used:
https://github.com/nextcloud/desktop/blob/master/admin/linux/debian/drone-build.sh#L46

Both work locally quite fine.

Signed-off-by: tobiasKaminsky <tobias@kaminsky.me>

github-actions · 2026-03-19T13:00:55Z

Artifact containing the AppImage: nextcloud-appimage-pr-9622.zip

Digest: sha256:b87a4e895e7e98232ace3978753db65c14dbb50df0eecd20b499949d778d135e

To test this change/fix you can download the above artifact file, unzip it, and run it.

Please make sure to quit your existing Nextcloud app and backup your data.

nilsding · 2026-03-19T14:14:50Z

.github/workflows/debian-build.yml

+on:
+  pull_request:
+    branches: [ master, stable-* ]


Shouldn't this also include the push trigger? if so the run command would need to be updated to make use of e.g. env.GITHUB_SHA (or set DRONE_COMMIT="$GITHUB_SHA" in the script)

(I'm not sure if drone-build.sh should also be run on PRs targeting any stable-* branch, the .drone.yml at least did not include that)

Suggested change

on:

pull_request:

branches: [ master, stable-* ]

on:

push:

branches: [ master ]

pull_request:

branches: [ master, stable-* ]

(I'm not sure if drone-build.sh should also be run on PRs targeting any stable-* branch, the .drone.yml at least did not include that)

I agree with this.

Also, when running for a pull request, it should not set the secrets, so that those are not uploaded to the PPA. It should set the secrets only when pushing to the master branch.

@ivaradi so this workflow needs to be changed to only run on.push.branches: [master] then, correct?

Yes, but it could also run on pull requests.

But for pull requests, the secrets should not be set, so that the source packages are not uploaded to the PPA, if it can be solved. If there is no way to set the secrets selectively, it should not be run for pull requests. (Running on pull requests can be useful to check if I modify something in the Debian scripts.)

That said, I have been thinking for a while of setting up a repository specifically for the Ubuntu/Debian builds, that would periodically check the this repository for new commits and perform the build if one is found. Then this workflow will not be needed at all. So if it is difficult to selectively set the secrets, there should not be too much effort put into it, and we should just settle for building on pushing to the master branch only.

thanks for the clarification!

I think the easiest way to not pass the secrets to the workflow would be to duplicate the workflow file: one for push events to master which sets those secrets in ENV, and another one for pull_request ones which doesn't.

I also just found another place in the script that needs to be adapted to GitHub Actions: pull_request=${DRONE_PULL_REQUEST:=master}. As DRONE_PULL_REQUEST is not set this variable would always end up as master, which is one condition to update the build on OBS ...

sonarqubecloud · 2026-03-19T14:27:56Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

nilsding · 2026-03-19T15:28:40Z

.github/workflows/debian-build.yml

+on:
+  pull_request:
+    branches: [ master, stable-* ]


thanks for the clarification!

I think the easiest way to not pass the secrets to the workflow would be to duplicate the workflow file: one for push events to master which sets those secrets in ENV, and another one for pull_request ones which doesn't.

I also just found another place in the script that needs to be adapted to GitHub Actions: pull_request=${DRONE_PULL_REQUEST:=master}. As DRONE_PULL_REQUEST is not set this variable would always end up as master, which is one condition to update the build on OBS ...

tobiasKaminsky requested review from Aiiaiiio, camilasan, i2h3, mgallien and nilsding as code owners March 13, 2026 11:15

mgallien requested changes Mar 13, 2026

View reviewed changes

tobiasKaminsky force-pushed the drone2garm branch 2 times, most recently from aa835cd to a4cca2d Compare March 16, 2026 07:34

tobiasKaminsky requested a review from mgallien March 16, 2026 07:36

tobiasKaminsky force-pushed the drone2garm branch 5 times, most recently from e170a11 to 8f2fe2d Compare March 16, 2026 08:17

mgallien approved these changes Mar 16, 2026

View reviewed changes

tobiasKaminsky force-pushed the drone2garm branch 5 times, most recently from f0fddba to f6064f3 Compare March 16, 2026 09:07

mgallien enabled auto-merge March 19, 2026 12:51

chore: Drone to GARM

17a54c5

Signed-off-by: tobiasKaminsky <tobias@kaminsky.me>

mgallien force-pushed the drone2garm branch from f6064f3 to 17a54c5 Compare March 19, 2026 12:51

nilsding reviewed Mar 19, 2026

View reviewed changes

nilsding requested changes Mar 19, 2026

View reviewed changes

Conversation

tobiasKaminsky commented Mar 13, 2026

Uh oh!

mgallien left a comment

Choose a reason for hiding this comment

Uh oh!

tobiasKaminsky commented Mar 16, 2026

Uh oh!

tobiasKaminsky commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mgallien left a comment

Choose a reason for hiding this comment

Uh oh!

tobiasKaminsky commented Mar 16, 2026

Uh oh!

mgallien commented Mar 17, 2026

Uh oh!

ivaradi commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mgallien commented Mar 19, 2026

Uh oh!

tobiasKaminsky commented Mar 19, 2026

Uh oh!

tobiasKaminsky commented Mar 19, 2026

Uh oh!

tobiasKaminsky commented Mar 19, 2026

Uh oh!

github-actions bot commented Mar 19, 2026

Uh oh!

nilsding Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

ivaradi Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

nilsding Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

ivaradi Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

nilsding Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Mar 19, 2026

Quality Gate passed

Uh oh!

nilsding Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tobiasKaminsky commented Mar 16, 2026 •

edited

Loading

ivaradi commented Mar 17, 2026 •

edited

Loading