ci: reproducible builds/refactor (#5808)

* ci: reproducible builds/refactor

* ci: fix mac desktop upload

* ci: docker shell abort on error

* scripts: add reproduce script

* ci: add new reproduce workflow

* scripts/reproduce-builds: change repo back to official

.github/actions/prepare-build/action.yml

@@ -0,0 +1,52 @@
+name: "Prebuilt steps for build"
+description: "Reusable steps for multiple jobs"
+inputs:
+   java_ver:
+     required: true
+     description: "Java version to install"
+   ghc_ver:
+     required: true
+     description: "GHC version to install"
+   github_ref:
+     required: true
+     description: "Git reference"
+   os:
+     required: true
+     description: "Target OS"
+   cache_path:
+     required: false
+     default: "~/.cabal/store"
+     description: "Cache path"
+   cabal_ver:
+     required: false
+     default: 3.10.1.0
+     description: "GHC version to install"
+runs:
+  using: "composite"
+  steps:
+    - name: Skip unreliable ghc 8.10.7 build on stable branch
+      shell: bash
+      if: inputs.ghc_ver == '8.10.7' && inputs.github_ref == 'refs/heads/stable'
+      run: exit 0
+
+    - name: Setup Haskell
+      uses: simplex-chat/setup-haskell-action@v2
+      with:
+        ghc-version: ${{ inputs.ghc_ver }}
+        cabal-version: ${{ inputs.cabal_ver }}
+
+    - name: Setup Java
+      if: startsWith(inputs.github_ref, 'refs/tags/v')
+      uses: actions/setup-java@v3
+      with:
+        distribution: 'corretto'
+        java-version: ${{ inputs.java_ver }}
+        cache: 'gradle'
+
+    - name: Restore cached build
+      uses: actions/cache@v4
+      with:
+        path: |
+          ${{ inputs.cache_path }}
+          dist-newstyle
+        key: ${{ inputs.os }}-ghc${{ inputs.ghc_ver }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}

.github/actions/prepare-release/action.yml

@@ -0,0 +1,39 @@
+name: "Upload binary and update hash"
+description: "Reusable steps for multiple jobs"
+inputs:
+   bin_path:
+     required: true
+     description: "Path to binary to upload"
+   bin_name:
+     required: true
+     description: "Name of uploaded binary"
+   bin_hash:
+     required: true
+     description: "Message with SHA to include in release"
+   github_ref:
+     required: true
+     description: "Github reference"
+   github_token:
+     required: true
+     description: "Github token"
+runs:
+  using: "composite"
+  steps:
+    - name: Linux upload AppImage to release
+      if: startsWith(inputs.github_ref, 'refs/tags/v')
+      uses: simplex-chat/upload-release-action@v2
+      with:
+        repo_token: ${{ inputs.github_token }}
+        file: ${{ inputs.bin_path }}
+        asset_name: ${{ inputs.bin_name }}
+        tag: ${{ inputs.github_ref }}
+
+    - name: Linux update AppImage hash
+      if: startsWith(inputs.github_ref, 'refs/tags/v')
+      uses: simplex-chat/action-gh-release@v2
+      env:
+        GITHUB_TOKEN: ${{ inputs.github_token }}
+      with:
+        append_body: true
+        body: |
+          ${{ inputs.bin_hash }}

.github/workflows/build.yml

@@ -22,16 +22,57 @@ on:
       - "README.md"
       - "PRIVACY.md"
 
+# This workflow uses custom actions (prepare-build and prepare-release) defined in:
+# 
+# .github/actions/
+# ├── prepare-build
+# │   └── action.yml
+# └── prepare-release
+#     └── action.yml
+
+# Important!
+# Do not use always(), it makes build unskippable.
+# See: https://github.com/actions/runner/issues/1846#issuecomment-1246102753
+
 jobs:
-  prepare-release:
-    if: startsWith(github.ref, 'refs/tags/v')
+
+# =============================
+#       Global variables
+# =============================
+
+# That is the only and less hacky way to setup global variables
+# to use in strategy matrix (env:/YAML anchors doesn't work).
+# See: https://github.com/orgs/community/discussions/56787#discussioncomment-6041789
+#      https://github.com/actions/runner/issues/1182
+#      https://stackoverflow.com/a/77549656
+
+  variables:
+    runs-on: ubuntu-latest
+    outputs:
+      GHC_VER: 9.6.3
+      JAVA_VER: 17
+    steps:
+      - name: Dummy job when we have just simple variables
+        if: false
+        run: echo
+
+# =============================
+#       Create release
+# =============================
+
+# Create release, but only if it's triggered by tag push.
+# On pull requests/commits push, this job will always complete.
+
+  maybe-release:
     runs-on: ubuntu-latest
     steps:
       - name: Clone project
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: actions/checkout@v3
 
       - name: Build changelog
         id: build_changelog
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: simplex-chat/release-changelog-builder-action@v4
         with:
           configuration: .github/changelog_conf.json
@@ -42,6 +83,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create release
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: simplex-chat/action-gh-release@v1
         with:
           body: ${{ steps.build_changelog.outputs.changelog }}
@@ -52,183 +94,259 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  build:
-    name: build-${{ matrix.os }}-${{ matrix.ghc }}
-    if: always()
-    needs: prepare-release
-    runs-on: ${{ matrix.os }}
+# =========================
+#        Linux Build
+# =========================
+
+  build-linux:
+    name: "ubuntu-${{ matrix.os }} (CLI,Desktop), GHC: ${{ matrix.ghc }}"
+    needs: [maybe-release, variables]
+    runs-on: ubuntu-${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-20.04
+          - os: 20.04
             ghc: "8.10.7"
-            cache_path: ~/.cabal/store
-          - os: ubuntu-20.04
-            ghc: "9.6.3"
-            cache_path: ~/.cabal/store
-            asset_name: simplex-chat-ubuntu-20_04-x86-64
+          - os: 20.04
+            ghc: ${{ needs.variables.outputs.GHC_VER }}
+            cli_asset_name: simplex-chat-ubuntu-20_04-x86-64
             desktop_asset_name: simplex-desktop-ubuntu-20_04-x86_64.deb
-          - os: ubuntu-22.04
-            ghc: "9.6.3"
-            cache_path: ~/.cabal/store
-            asset_name: simplex-chat-ubuntu-22_04-x86-64
+          - os: 22.04
+            ghc: ${{ needs.variables.outputs.GHC_VER }}
+            cli_asset_name: simplex-chat-ubuntu-22_04-x86-64
             desktop_asset_name: simplex-desktop-ubuntu-22_04-x86_64.deb
-          - os: macos-latest
-            ghc: "9.6.3"
-            cache_path: ~/.cabal/store
-            asset_name: simplex-chat-macos-aarch64
-            desktop_asset_name: simplex-desktop-macos-aarch64.dmg
-          - os: macos-13
-            ghc: "9.6.3"
-            cache_path: ~/.cabal/store
-            asset_name: simplex-chat-macos-x86-64
-            desktop_asset_name: simplex-desktop-macos-x86_64.dmg
-          - os: windows-latest
-            ghc: "9.6.3"
-            cache_path: C:/cabal
-            asset_name: simplex-chat-windows-x86-64
-            desktop_asset_name: simplex-desktop-windows-x86_64.msi
-
     steps:
-      - name: Skip unreliable ghc 8.10.7 build on stable branch
-        if: matrix.ghc == '8.10.7' && github.ref == 'refs/heads/stable'
-        run: exit 0
-
-      - name: Configure pagefile (Windows)
-        if: matrix.os == 'windows-latest'
-        uses: simplex-chat/configure-pagefile-action@v1.3
-        with:
-          minimum-size: 16GB
-          maximum-size: 16GB
-          disk-root: "C:"
-
-      - name: Clone project
+      - name: Checkout Code
         uses: actions/checkout@v3
 
-      - name: Setup Haskell
-        uses: simplex-chat/setup-haskell-action@v2
-        with:
-          ghc-version: ${{ matrix.ghc }}
-          cabal-version: "3.10.1.0"
+      # Otherwise we run out of disk space with Docker build
+      - name: Free disk space
+        shell: bash
+        run: ./scripts/ci/linux_util_free_space.sh
 
       - name: Restore cached build
-        id: restore_cache
-        uses: actions/cache/restore@v3
+        uses: actions/cache@v4
         with:
           path: |
-            ${{ matrix.cache_path }}
+            ~/.cabal/store
             dist-newstyle
-          key: ${{ matrix.os }}-ghc${{ matrix.ghc }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}
+          key: ubuntu-${{ matrix.os }}-ghc${{ matrix.ghc }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}
 
-      # / Unix
+      - name: Set up Docker Buildx
+        uses: simplex-chat/docker-setup-buildx-action@v3
 
-      - name: Unix prepare cabal.project.local for Mac
-        if: matrix.os == 'macos-latest'
+      - name: Build and cache Docker image
+        uses: simplex-chat/docker-build-push-action@v6
+        with:
+          context: .
+          load: true
+          file: Dockerfile.build
+          tags: build/${{ matrix.os }}:latest
+          build-args: |
+            TAG=${{ matrix.os }}
+            GHC=${{ matrix.ghc }}
+
+      # Docker needs these flags for AppImage build:
+      # --device /dev/fuse
+      # --cap-add SYS_ADMIN
+      # --security-opt apparmor:unconfined
+      - name: Start container
         shell: bash
         run: |
-          echo "ignore-project: False"                                         >> cabal.project.local
-          echo "package simplexmq"                                             >> cabal.project.local
-          echo "    extra-include-dirs: /opt/homebrew/opt/openssl@3.0/include" >> cabal.project.local
-          echo "    extra-lib-dirs: /opt/homebrew/opt/openssl@3.0/lib"         >> cabal.project.local
-          echo ""                                                              >> cabal.project.local
-          echo "package direct-sqlcipher"                                      >> cabal.project.local
-          echo "    extra-include-dirs: /opt/homebrew/opt/openssl@3.0/include" >> cabal.project.local
-          echo "    extra-lib-dirs: /opt/homebrew/opt/openssl@3.0/lib"         >> cabal.project.local
-          echo "    flags: +openssl"                                           >> cabal.project.local
+          docker run -t -d \
+            --device /dev/fuse \
+            --cap-add SYS_ADMIN \
+            --security-opt apparmor:unconfined \
+            --name builder \
+            -v ~/.cabal:/root/.cabal \
+            -v /home/runner/work/_temp:/home/runner/work/_temp \
+            -v ${{ github.workspace }}:/project \
+            build/${{ matrix.os }}:latest
 
-      - name: Unix prepare cabal.project.local for Mac
-        if: matrix.os == 'macos-13'
-        shell: bash
-        run: |
-          echo "ignore-project: False"                                         >> cabal.project.local
-          echo "package simplexmq"                                             >> cabal.project.local
-          echo "    extra-include-dirs: /usr/local/opt/openssl@3.0/include"    >> cabal.project.local
-          echo "    extra-lib-dirs: /usr/local/opt/openssl@3.0/lib"            >> cabal.project.local
-          echo ""                                                              >> cabal.project.local
-          echo "package direct-sqlcipher"                                      >> cabal.project.local
-          echo "    extra-include-dirs: /usr/local/opt/openssl@3.0/include"    >> cabal.project.local
-          echo "    extra-lib-dirs: /usr/local/opt/openssl@3.0/lib"            >> cabal.project.local
-          echo "    flags: +openssl"                                           >> cabal.project.local
-
-      - name: Install AppImage dependencies
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name && matrix.os == 'ubuntu-20.04'
-        run: sudo apt install -y desktop-file-utils
-
-      - name: Install openssl for Mac
-        if: matrix.os == 'macos-latest' || matrix.os == 'macos-13'
-        run: brew install openssl@3.0
-
-      - name: Unix prepare cabal.project.local for Ubuntu
-        if: matrix.os == 'ubuntu-20.04' || matrix.os == 'ubuntu-22.04'
+      - name: Prepare cabal.project.local
         shell: bash
         run: |
           echo "ignore-project: False"    >> cabal.project.local
           echo "package direct-sqlcipher" >> cabal.project.local
           echo "    flags: +openssl"      >> cabal.project.local
 
-      - name: Unix build CLI
-        id: unix_cli_build
-        if: matrix.os != 'windows-latest'
+      # chmod/git commands are used to workaround permission issues when cache is restored
+      - name: Build CLI
+        shell: docker exec -t builder sh -eu {0}
+        run: |
+          chmod -R 777 dist-newstyle ~/.cabal && git config --global --add safe.directory '*'
+          cabal clean
+          cabal update
+          cabal build -j --enable-tests
+          mkdir -p /out
+          for i in simplex-chat simplex-chat-test; do
+            bin=$(find /project/dist-newstyle -name "$i" -type f -executable)
+            chmod +x "$bin"
+            mv "$bin" /out/
+          done
+          strip /out/simplex-chat
+
+      - name: Copy tests from container
         shell: bash
         run: |
-          cabal build --enable-tests
-          path=$(cabal list-bin simplex-chat)
-          echo "bin_path=$path" >> $GITHUB_OUTPUT
-          echo "bin_hash=$(echo SHA2-512\(${{ matrix.asset_name }}\)= $(openssl sha512 $path | cut -d' ' -f 2))" >> $GITHUB_OUTPUT
+          docker cp builder:/out/simplex-chat-test .
 
-      - name: Unix upload CLI binary to release
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name && matrix.os != 'windows-latest'
-        uses: simplex-chat/upload-release-action@v2
-        with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          file: ${{ steps.unix_cli_build.outputs.bin_path }}
-          asset_name: ${{ matrix.asset_name }}
-          tag: ${{ github.ref }}
-
-      - name: Unix update CLI binary hash
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name && matrix.os != 'windows-latest'
-        uses: simplex-chat/action-gh-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          append_body: true
-          body: |
-            ${{ steps.unix_cli_build.outputs.bin_hash }}
-
-      - name: Setup Java
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name
-        uses: actions/setup-java@v3
-        with:
-          distribution: 'corretto'
-          java-version: '17'
-          cache: 'gradle'
-
-      - name: Linux build desktop
-        id: linux_desktop_build
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name && (matrix.os == 'ubuntu-20.04' || matrix.os == 'ubuntu-22.04')
+      - name: Copy CLI from container and prepare it
+        id: linux_cli_prepare
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.cli_asset_name
         shell: bash
+        run: |
+          docker cp builder:/out/simplex-chat ./${{ matrix.cli_asset_name }}
+          path="${{ github.workspace }}/${{ matrix.cli_asset_name }}"
+          echo "bin_path=$path" >> $GITHUB_OUTPUT
+          echo "bin_hash=$(echo SHA2-512\(${{ matrix.cli_asset_name }}\)= $(openssl sha512 $path | cut -d' ' -f 2))" >> $GITHUB_OUTPUT
+
+      - name: Upload CLI
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.cli_asset_name
+        uses: ./.github/actions/prepare-release
+        with:
+          bin_path: ${{ steps.linux_cli_prepare.outputs.bin_path }}
+          bin_name: ${{ matrix.cli_asset_name }}
+          bin_hash: ${{ steps.linux_cli_prepare.outputs.bin_hash }}
+          github_ref: ${{ github.ref }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build Desktop
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.desktop_asset_name
+        shell: docker exec -t builder sh -eu {0}
         run: |
           scripts/desktop/build-lib-linux.sh
           cd apps/multiplatform
           ./gradlew packageDeb
-          path=$(echo $PWD/release/main/deb/simplex_*_amd64.deb)
+
+      - name: Prepare Desktop
+        id: linux_desktop_build
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.desktop_asset_name
+        shell: bash
+        run: |
+          path=$(echo ${{ github.workspace }}/apps/multiplatform/release/main/deb/simplex_*_amd64.deb )
           echo "package_path=$path" >> $GITHUB_OUTPUT
           echo "package_hash=$(echo SHA2-512\(${{ matrix.desktop_asset_name }}\)= $(openssl sha512 $path | cut -d' ' -f 2))" >> $GITHUB_OUTPUT
 
-      - name: Linux make AppImage
-        id: linux_appimage_build
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name && matrix.os == 'ubuntu-20.04'
-        shell: bash
+      - name: Upload Desktop
+        uses: ./.github/actions/prepare-release
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.desktop_asset_name
+        with:
+          bin_path: ${{ steps.linux_desktop_build.outputs.package_path }}
+          bin_name: ${{ matrix.desktop_asset_name }}
+          bin_hash: ${{ steps.linux_desktop_build.outputs.package_hash }}
+          github_ref: ${{ github.ref }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build AppImage
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.desktop_asset_name && matrix.os == '20.04'
+        shell: docker exec -t builder sh -eu {0}
         run: |
           scripts/desktop/make-appimage-linux.sh
-          path=$(echo $PWD/apps/multiplatform/release/main/*imple*.AppImage)
+
+      - name: Prepare AppImage
+        id: linux_appimage_build
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.desktop_asset_name && matrix.os == '20.04'
+        shell: bash
+        run: |
+          path=$(echo ${{ github.workspace }}/apps/multiplatform/release/main/*imple*.AppImage)
           echo "appimage_path=$path" >> $GITHUB_OUTPUT
           echo "appimage_hash=$(echo SHA2-512\(simplex-desktop-x86_64.AppImage\)= $(openssl sha512 $path | cut -d' ' -f 2))" >> $GITHUB_OUTPUT
 
-      - name: Mac build desktop
+      - name: Upload AppImage
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.desktop_asset_name && matrix.os == '20.04'
+        uses: ./.github/actions/prepare-release
+        with:
+          bin_path: ${{ steps.linux_appimage_build.outputs.appimage_path }}
+          bin_name: "simplex-desktop-x86_64.AppImage"
+          bin_hash: ${{ steps.linux_appimage_build.outputs.appimage_hash }}
+          github_ref: ${{ github.ref }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Fix permissions for cache
+        shell: bash
+        run: |
+          sudo chmod -R 777 dist-newstyle ~/.cabal
+          sudo chown -R $(id -u):$(id -g) dist-newstyle ~/.cabal
+
+      - name: Run tests
+        shell: bash
+        run: |
+          ./simplex-chat-test
+
+# =========================
+#        MacOS Build
+# =========================
+
+  build-macos:
+    name: "${{ matrix.os }} (CLI,Desktop), GHC: ${{ matrix.ghc }}"
+    needs: [maybe-release, variables]
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            ghc: ${{ needs.variables.outputs.GHC_VER }}
+            cli_asset_name: simplex-chat-macos-aarch64
+            desktop_asset_name: simplex-desktop-macos-aarch64.dmg
+            openssl_dir: "/opt/homebrew/opt"
+          - os: macos-13
+            ghc: ${{ needs.variables.outputs.GHC_VER }}
+            cli_asset_name: simplex-chat-macos-x86-64
+            desktop_asset_name: simplex-desktop-macos-x86_64.dmg
+            openssl_dir: "/usr/local/opt"
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+
+      - name: Prepare build
+        uses: ./.github/actions/prepare-build
+        with:
+          java_ver: ${{ needs.variables.outputs.JAVA_VER }}
+          ghc_ver: ${{ matrix.ghc }}
+          os: ${{ matrix.os }}
+          github_ref: ${{ github.ref }}
+
+      - name: Install OpenSSL
+        run: brew install openssl@3.0
+
+      - name: Prepare cabal.project.local
+        shell: bash
+        run: |
+          echo "ignore-project: False"                                                    >> cabal.project.local
+          echo "package simplexmq"                                                        >> cabal.project.local
+          echo "    extra-include-dirs: ${{ matrix.opnessl_dir }}/openssl@3.0/include"    >> cabal.project.local
+          echo "    extra-lib-dirs: ${{ matrix.openssl_dir}}/openssl@3.0/lib"             >> cabal.project.local
+          echo ""                                                                         >> cabal.project.local
+          echo "package direct-sqlcipher"                                                 >> cabal.project.local
+          echo "    extra-include-dirs: ${{ matrix.openssl_dir }}/openssl@3.0/include"    >> cabal.project.local
+          echo "    extra-lib-dirs: ${{ matrix.openssl_dir }}/openssl@3.0/lib"            >> cabal.project.local
+          echo "    flags: +openssl"                                                      >> cabal.project.local
+
+      - name: Build CLI
+        id: mac_cli_build
+        shell: bash
+        run: |
+          cabal build -j --enable-tests
+          path=$(cabal list-bin simplex-chat)
+          echo "bin_path=$path" >> $GITHUB_OUTPUT
+          echo "bin_hash=$(echo SHA2-512\(${{ matrix.cli_asset_name }}\)= $(openssl sha512 $path | cut -d' ' -f 2))" >> $GITHUB_OUTPUT
+
+      - name: Upload CLI
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: ./.github/actions/prepare-release
+        with:
+          bin_path: ${{ steps.mac_cli_build.outputs.bin_path }}
+          bin_name: ${{ matrix.cli_asset_name }}
+          bin_hash: ${{ steps.mac_cli_build.outputs.bin_hash }}
+          github_ref: ${{ github.ref }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build Desktop
         id: mac_desktop_build
-        if: startsWith(github.ref, 'refs/tags/v') && (matrix.os == 'macos-latest' || matrix.os == 'macos-13')
+        if: startsWith(github.ref, 'refs/tags/v')
         shell: bash
         env:
           APPLE_SIMPLEX_SIGNING_KEYCHAIN: ${{ secrets.APPLE_SIMPLEX_SIGNING_KEYCHAIN }}
@@ -240,85 +358,58 @@ jobs:
           echo "package_path=$path" >> $GITHUB_OUTPUT
           echo "package_hash=$(echo SHA2-512\(${{ matrix.desktop_asset_name }}\)= $(openssl sha512 $path | cut -d' ' -f 2))" >> $GITHUB_OUTPUT
 
-      - name: Linux upload desktop package to release
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name && (matrix.os == 'ubuntu-20.04' || matrix.os == 'ubuntu-22.04')
-        uses: simplex-chat/upload-release-action@v2
+      - name: Upload Desktop
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: ./.github/actions/prepare-release
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          file: ${{ steps.linux_desktop_build.outputs.package_path }}
-          asset_name: ${{ matrix.desktop_asset_name }}
-          tag: ${{ github.ref }}
+          bin_path: ${{ steps.mac_desktop_build.outputs.package_path }}
+          bin_name: ${{ matrix.desktop_asset_name }}
+          bin_hash: ${{ steps.mac_desktop_build.outputs.package_hash }}
+          github_ref: ${{ github.ref }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Linux update desktop package hash
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name && (matrix.os == 'ubuntu-20.04' || matrix.os == 'ubuntu-22.04')
-        uses: simplex-chat/action-gh-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          append_body: true
-          body: |
-            ${{ steps.linux_desktop_build.outputs.package_hash }}
-
-      - name: Linux upload AppImage to release
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name && matrix.os == 'ubuntu-20.04'
-        uses: simplex-chat/upload-release-action@v2
-        with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          file: ${{ steps.linux_appimage_build.outputs.appimage_path }}
-          asset_name: simplex-desktop-x86_64.AppImage
-          tag: ${{ github.ref }}
-
-      - name: Linux update AppImage hash
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.asset_name && matrix.os == 'ubuntu-20.04'
-        uses: simplex-chat/action-gh-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          append_body: true
-          body: |
-            ${{ steps.linux_appimage_build.outputs.appimage_hash }}
-
-      - name: Mac upload desktop package to release
-        if: startsWith(github.ref, 'refs/tags/v') && (matrix.os == 'macos-latest' || matrix.os == 'macos-13')
-        uses: simplex-chat/upload-release-action@v2
-        with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          file: ${{ steps.mac_desktop_build.outputs.package_path }}
-          asset_name: ${{ matrix.desktop_asset_name }}
-          tag: ${{ github.ref }}
-
-      - name: Mac update desktop package hash
-        if: startsWith(github.ref, 'refs/tags/v') && (matrix.os == 'macos-latest' || matrix.os == 'macos-13')
-        uses: simplex-chat/action-gh-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          append_body: true
-          body: |
-            ${{ steps.mac_desktop_build.outputs.package_hash }}
-
-      - name: Cache unix build
-        uses: actions/cache/save@v3
-        if: matrix.os != 'windows-latest'
-        with:
-          path: |
-            ${{ matrix.cache_path }}
-            dist-newstyle
-          key: ${{ steps.restore_cache.outputs.cache-primary-key }}
-
-      - name: Unix test
-        if: matrix.os != 'windows-latest'
+      - name: Run tests
         timeout-minutes: 40
         shell: bash
         run: cabal test --test-show-details=direct
 
-      # Unix /
+# =========================
+#      Windows Build
+# =========================
 
-      # / Windows
-      # rm -rf dist-newstyle/src/direct-sq* is here because of the bug in cabal's dependency which prevents second build from finishing
+  build-windows:
+    name: "${{ matrix.os }} (CLI,Desktop), GHC: ${{ matrix.ghc }}"
+    needs: [maybe-release, variables]
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: windows-latest
+            ghc: ${{ needs.variables.outputs.GHC_VER }}
+            cli_asset_name: simplex-chat-windows-x86-64
+            desktop_asset_name: simplex-desktop-windows-x86_64.msi
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
 
+      - name: Prepare build
+        uses: ./.github/actions/prepare-build
+        with:
+          java_ver: ${{ needs.variables.outputs.JAVA_VER }}
+          ghc_ver: ${{ matrix.ghc }}
+          os: ${{ matrix.os }}
+          cache_path: "C:/cabal"
+          github_ref: ${{ github.ref }}
+
+      - name: Configure pagefile (Windows)
+        uses: simplex-chat/configure-pagefile-action@v1.4
+        with:
+          minimum-size: 16GB
+          maximum-size: 16GB
+          disk-root: "C:"
+  
       - name: 'Setup MSYS2'
-        if: matrix.os == 'windows-latest'
         uses: simplex-chat/setup-msys2@v2
         with:
           msystem: ucrt64
@@ -331,10 +422,9 @@ jobs:
             toolchain:p
             cmake:p
 
-
-      - name: Windows build
-        id: windows_build
-        if: matrix.os == 'windows-latest'
+      # rm -rf dist-newstyle/src/direct-sq* is here because of the bug in cabal's dependency which prevents second build from finishing
+      - name: Build CLI
+        id: windows_cli_build
         shell: msys2 {0}
         run: |
           export PATH=$PATH:/c/ghcup/bin:$(echo /c/tools/ghc-*/bin || echo)
@@ -349,70 +439,42 @@ jobs:
 
           rm -rf dist-newstyle/src/direct-sq*
           sed -i "s/, unix /--, unix /" simplex-chat.cabal
-          cabal build --enable-tests
+          cabal build -j --enable-tests
           rm -rf dist-newstyle/src/direct-sq*
           path=$(cabal list-bin simplex-chat | tail -n 1)
           echo "bin_path=$path" >> $GITHUB_OUTPUT
-          echo "bin_hash=$(echo SHA2-512\(${{ matrix.asset_name }}\)= $(openssl sha512 $path | cut -d' ' -f 2))" >> $GITHUB_OUTPUT
+          echo "bin_hash=$(echo SHA2-512\(${{ matrix.cli_asset_name }}\)= $(openssl sha512 $path | cut -d' ' -f 2))" >> $GITHUB_OUTPUT
 
-      - name: Windows upload CLI binary to release
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'windows-latest'
-        uses: simplex-chat/upload-release-action@v2
+      - name: Upload CLI
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: ./.github/actions/prepare-release
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          file: ${{ steps.windows_build.outputs.bin_path }}
-          asset_name: ${{ matrix.asset_name }}
-          tag: ${{ github.ref }}
+          bin_path: ${{ steps.windows_cli_build.outputs.bin_path }}
+          bin_name: ${{ matrix.cli_asset_name }}
+          bin_hash: ${{ steps.windows_cli_build.outputs.bin_hash }}
+          github_ref: ${{ github.ref }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Windows update CLI binary hash
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'windows-latest'
-        uses: simplex-chat/action-gh-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          append_body: true
-          body: |
-            ${{ steps.windows_build.outputs.bin_hash }}
-
-      - name: Windows build desktop
+      - name: Build Desktop
         id: windows_desktop_build
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'windows-latest'
+        if: startsWith(github.ref, 'refs/tags/v')
         shell: msys2 {0}
         run: |
           export PATH=$PATH:/c/ghcup/bin:$(echo /c/tools/ghc-*/bin || echo)
           scripts/desktop/build-lib-windows.sh
           cd apps/multiplatform
           ./gradlew packageMsi
+          rm -rf dist-newstyle/src/direct-sq*
           path=$(echo $PWD/release/main/msi/*imple*.msi | sed 's#/\([a-z]\)#\1:#' | sed 's#/#\\#g')
           echo "package_path=$path" >> $GITHUB_OUTPUT
           echo "package_hash=$(echo SHA2-512\(${{ matrix.desktop_asset_name }}\)= $(openssl sha512 $path | cut -d' ' -f 2))" >> $GITHUB_OUTPUT
 
-      - name: Windows upload desktop package to release
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'windows-latest'
-        uses: simplex-chat/upload-release-action@v2
+      - name: Upload Desktop
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: ./.github/actions/prepare-release
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          file: ${{ steps.windows_desktop_build.outputs.package_path }}
-          asset_name: ${{ matrix.desktop_asset_name }}
-          tag: ${{ github.ref }}
-
-      - name: Windows update desktop package hash
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'windows-latest'
-        uses: simplex-chat/action-gh-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          append_body: true
-          body: |
-            ${{ steps.windows_desktop_build.outputs.package_hash }}
-
-      - name: Cache windows build
-        uses: actions/cache/save@v3
-        if: matrix.os == 'windows-latest'
-        with:
-          path: |
-            ${{ matrix.cache_path }}
-            dist-newstyle
-          key: ${{ steps.restore_cache.outputs.cache-primary-key }}
-
-      # Windows /
+          bin_path: ${{ steps.windows_desktop_build.outputs.package_path }}
+          bin_name: ${{ matrix.desktop_asset_name }}
+          bin_hash: ${{ steps.windows_desktop_build.outputs.package_hash }}
+          github_ref: ${{ github.ref }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/reproduce-schedule.yml

@@ -0,0 +1,45 @@
+name: Reproduce latest release
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 2 * * *' # every day at 02:00 night
+
+jobs:
+  reproduce:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Get latest release
+        shell: bash
+        run: |
+          curl --proto '=https' \
+               --tlsv1.2 \
+               -sSf -L \
+               'https://api.github.com/repos/simplex-chat/simplex-chat/releases/latest' \
+               2>/dev/null | \
+          grep -i "tag_name" | \
+          awk -F \" '{print "TAG="$4}' >> $GITHUB_ENV
+
+      - name: Execute reproduce script
+        run: |
+          ${GITHUB_WORKSPACE}/scripts/reproduce-builds.sh "$TAG"
+
+      - name: Check if build has been reproduced
+        env:
+          url: ${{ secrets.STATUS_SIMPLEX_WEBHOOK_URL }}
+          user: ${{ secrets.STATUS_SIMPLEX_WEBHOOK_USER }}
+          pass: ${{ secrets.STATUS_SIMPLEX_WEBHOOK_PASS }}
+        run: |
+          if [ -f "${GITHUB_WORKSPACE}/$TAG/_sha256sums" ]; then
+            exit 0
+          else
+            curl --proto '=https' --tlsv1.2 -sSf \
+              -u "${user}:${pass}" \
+              -H 'Content-Type: application/json' \
+              -d '{"title": "👾 GitHub: Runner", "description": "⛔️ '"$TAG"' did not reproduce."}' \
+              "$url"
+            exit 1
+          fi