simplex-chat/.github/workflows/desktop-linux.yml

name: desktop-linux

# A push runs the jobs only when its head commit's message asks for them: see scripts/ci/desktop-linux/README.md.
on:
  push:
    branches:
      - "**"
      # a squash merge's message lists the merged commits' subjects, with their tags
      - "!master"
      - "!stable"
  workflow_dispatch:
    inputs:
      claude:
        description: Also run the Claude job, which spends the Claude subscription's usage limits
        type: boolean
        default: false
      backend:
        description: Also start the test backend
        type: boolean
        default: false
      release:
        description: Also test the latest released app, to tell a branch's failure from the runner's
        type: boolean
        default: false

permissions:
  contents: read
  actions: read

concurrency:
  # a push that asks for no run must not cancel one that does
  group: desktop-linux-${{ github.ref }}-${{ (github.event_name == 'workflow_dispatch' || contains(github.event.head_commit.message, '[app-ci]') || contains(github.event.head_commit.message, '[app-ci:desktop]') || contains(github.event.head_commit.message, '[claude-test]') || contains(github.event.head_commit.message, '[claude-test:desktop]')) && 'requested' || github.run_id }}
  cancel-in-progress: true

env:
  GHC_VER: 9.6.3
  CABAL_VER: 3.10.2.0
  JAVA_VER: 17
  CORE_PKG: desktop-core-linux-x86_64.tar.gz
  BACKEND_PKG: desktop-linux-backend.tar.gz

jobs:
  plan:
    name: choose jobs, find earlier builds
    # the concurrency group repeats this test, as it can't read job outputs
    if: >-
      github.event_name == 'workflow_dispatch' ||
      contains(github.event.head_commit.message, '[app-ci]') ||
      contains(github.event.head_commit.message, '[app-ci:desktop]') ||
      contains(github.event.head_commit.message, '[claude-test]') ||
      contains(github.event.head_commit.message, '[claude-test:desktop]')
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    outputs:
      run-claude: ${{ steps.jobs.outputs.claude }}
      run-backend: ${{ steps.jobs.outputs.backend }}
      run-release: ${{ steps.jobs.outputs.release }}
      claude-backend: ${{ steps.scope.outputs.backend }}
      core: ${{ steps.names.outputs.core }}
      core-run: ${{ steps.core.outputs.run-id }}
      backend: ${{ steps.names.outputs.backend }}
      backend-run: ${{ steps.backend.outputs.run-id }}
    steps:
      - name: Choose jobs
        id: jobs
        env:
          CLAUDE: ${{ inputs.claude || contains(github.event.head_commit.message, '[claude-test]') || contains(github.event.head_commit.message, '[claude-test:desktop]') }}
          BACKEND: ${{ inputs.backend || contains(github.event.head_commit.message, '[ci-backend]') }}
          RELEASE: ${{ inputs.release || contains(github.event.head_commit.message, '[ci-release]') }}
        run: |
          echo "claude=$CLAUDE" | tee -a "$GITHUB_OUTPUT"
          echo "backend=$BACKEND" | tee -a "$GITHUB_OUTPUT"
          echo "release=$RELEASE" | tee -a "$GITHUB_OUTPUT"

      - name: Checkout code
        uses: actions/checkout@v6

      - name: Claude scope
        id: scope
        if: steps.jobs.outputs.claude == 'true'
        env:
          BACKEND: ${{ steps.jobs.outputs.backend }}
        run: |
          backend=$(sed -n 's/^backend: *//p' scripts/ci/desktop-linux/claude-scope)
          case "$backend" in
            yes | no) echo "backend=$backend" | tee -a "$GITHUB_OUTPUT" ;;
            *)
              echo "::error::claude-scope must say backend: yes or backend: no"
              exit 1
              ;;
          esac
          if [ "$backend" = yes ] && [ "$BACKEND" != true ]; then
            echo "::error::claude-scope says the Claude session uses the test backend: ask for it too"
            exit 1
          fi

      # artifacts are named after the sources they are built from, so a run uses one that an earlier run uploaded
      - name: Artifact names
        id: names
        run: |
          echo "core=desktop-linux-core-${{ hashFiles('src/**', 'cabal.project', 'simplex-chat.cabal', 'PRIVACY.md', 'scripts/desktop/build-lib-linux.sh', 'scripts/ci/desktop-linux/build-core.sh') }}" >> "$GITHUB_OUTPUT"
          echo "backend=desktop-linux-backend-${{ hashFiles('src/**', 'apps/simplex-chat/**', 'apps/simplex-directory-service/Main.hs', 'apps/simplex-directory-service/src/**', 'cabal.project', 'simplex-chat.cabal', 'scripts/ci/desktop-linux/build-backend.sh') }}" >> "$GITHUB_OUTPUT"

      - name: Find core library
        id: core
        env:
          GH_TOKEN: ${{ github.token }}
        run: scripts/ci/desktop-linux/earlier-run.sh "${{ steps.names.outputs.core }}"

      - name: Find backend
        id: backend
        if: steps.jobs.outputs.backend == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: scripts/ci/desktop-linux/earlier-run.sh "${{ steps.names.outputs.backend }}"

  backend:
    name: test backend for the app
    needs: plan
    if: needs.plan.outputs.run-backend == 'true' && needs.plan.outputs.backend-run == ''
    runs-on: ubuntu-24.04
    timeout-minutes: 150
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Show runner
        run: |
          lsb_release -ds
          nproc
          free -h
          df -h /

      - name: Setup Haskell
        uses: simplex-chat/setup-haskell-action@v2
        with:
          ghc-version: ${{ env.GHC_VER }}
          cabal-version: ${{ env.CABAL_VER }}

      - name: Install libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libffi-dev libgmp-dev libnuma-dev libssl-dev zlib1g-dev

      - name: Build backend
        run: scripts/ci/desktop-linux/build-backend.sh ~/backend/${{ env.BACKEND_PKG }}

      - name: Upload backend
        uses: actions/upload-artifact@v7
        with:
          name: ${{ needs.plan.outputs.backend }}
          path: ~/backend/${{ env.BACKEND_PKG }}
          compression-level: 0
          retention-days: 30
          if-no-files-found: error

  core:
    name: core library for Linux
    needs: plan
    if: needs.plan.outputs.core-run == ''
    runs-on: ubuntu-24.04
    timeout-minutes: 150
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Show runner
        run: |
          lsb_release -ds
          nproc
          free -h
          df -h /

      - name: Setup Haskell
        uses: simplex-chat/setup-haskell-action@v2
        with:
          ghc-version: ${{ env.GHC_VER }}
          cabal-version: ${{ env.CABAL_VER }}

      - name: Install libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libffi-dev libgmp-dev libnuma-dev libssl-dev zlib1g-dev patchelf

      - name: Build core library
        run: scripts/ci/desktop-linux/build-core.sh ~/core/${{ env.CORE_PKG }}

      - name: Upload core library
        uses: actions/upload-artifact@v7
        with:
          name: ${{ needs.plan.outputs.core }}
          path: ~/core/${{ env.CORE_PKG }}
          compression-level: 0
          retention-days: 30
          if-no-files-found: error

  app:
    name: desktop app under Xvfb
    needs: [plan, core, backend]
    # core and backend are skipped when an earlier run built them, and backend also when the run doesn't start it
    if: ${{ !cancelled() && !failure() && needs.plan.result == 'success' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          submodules: recursive

      - name: Show runner
        run: |
          lsb_release -ds
          nproc
          free -h
          df -h /
          echo "ANDROID_HOME=$ANDROID_HOME"
          ls "$ANDROID_HOME/platforms" "$ANDROID_HOME/build-tools" || true

      - name: Install tools
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb xdotool openbox imagemagick tesseract-ocr sqlite3 fonts-dejavu-core
          dpkg-query -W xvfb xdotool openbox imagemagick tesseract-ocr sqlite3 fonts-dejavu-core

      - name: Download core library
        uses: actions/download-artifact@v8
        with:
          name: ${{ needs.plan.outputs.core }}
          path: ~/core
          run-id: ${{ needs.plan.outputs.core-run || github.run_id }}
          github-token: ${{ github.token }}

      - name: Install core library
        id: core
        run: scripts/ci/desktop-linux/install-core.sh ~/core/${{ env.CORE_PKG }}

      - name: Download backend
        if: needs.plan.outputs.run-backend == 'true'
        uses: actions/download-artifact@v8
        with:
          name: ${{ needs.plan.outputs.backend }}
          path: ~/backend
          run-id: ${{ needs.plan.outputs.backend-run || github.run_id }}
          github-token: ${{ github.token }}

      - name: Start test backend
        id: backend
        if: needs.plan.outputs.run-backend == 'true'
        timeout-minutes: 30
        run: scripts/ci/desktop-linux/backend.sh start ~/backend/${{ env.BACKEND_PKG }} "$RUNNER_TEMP/backend"

      - name: Point the app at the test directory
        id: link
        if: steps.backend.outcome == 'success'
        run: |
          link=$(cat "$RUNNER_TEMP/backend/directory-link")
          file=apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/DirectorySearch.kt
          sed -i "s|^const val DIRECTORY_SERVICE_LINK = \".*\"$|const val DIRECTORY_SERVICE_LINK = \"$link\"|" "$file"
          grep -F "const val DIRECTORY_SERVICE_LINK = \"$link\"" "$file"

      # the app and its tests are still built when the backend fails
      - name: Setup Java
        if: ${{ !cancelled() && steps.core.outcome == 'success' }}
        uses: actions/setup-java@v5
        with:
          distribution: corretto
          java-version: ${{ env.JAVA_VER }}

      # the Kotlin compiler daemon otherwise gets gradle.properties' 2 GB, which compiling :common runs out of
      - name: Build app
        id: build
        if: ${{ !cancelled() && steps.core.outcome == 'success' }}
        working-directory: apps/multiplatform
        run: |
          ./gradlew --no-daemon --console=plain -Psimplex.assets.dir=../../assets -Pkotlin.daemon.jvmargs=-Xmx4g :desktop:createDistributable
          app=release/main/app/simplex
          ls -la "$app/bin" "$app/lib/app/resources"
          du -sh "$app"
          LD_LIBRARY_PATH="$app/lib/app/resources" ldd "$app/lib/app/resources/libapp-lib.so"

      # for the Claude job; a tarball keeps the app's file modes, which an artifact drops
      - name: Pack app
        if: ${{ !cancelled() && steps.build.outcome == 'success' && needs.plan.outputs.run-claude == 'true' }}
        run: tar -czf "$RUNNER_TEMP/desktop-app.tar.gz" -C apps/multiplatform/release/main/app simplex

      - name: Upload app
        if: ${{ !cancelled() && steps.build.outcome == 'success' && needs.plan.outputs.run-claude == 'true' }}
        uses: actions/upload-artifact@v7
        with:
          name: desktop-app
          path: ${{ runner.temp }}/desktop-app.tar.gz
          compression-level: 0
          retention-days: 1
          if-no-files-found: error

      - name: Run desktop tests
        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
        working-directory: apps/multiplatform
        run: ./gradlew --no-daemon --console=plain -Psimplex.assets.dir=../../assets -Pkotlin.daemon.jvmargs=-Xmx4g :common:desktopTest

      - name: Report desktop tests
        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
        run: scripts/ci/desktop-linux/test-summary.py apps/multiplatform/common/build/test-results/desktopTest

      - name: Run smoke test
        if: ${{ !cancelled() && steps.build.outcome == 'success' && steps.backend.outcome != 'failure' && steps.link.outcome != 'failure' }}
        env:
          BACKEND: ${{ steps.backend.outcome }}
        run: |
          if [ "$BACKEND" = success ]; then
            export NAMES_SERVER=$(cat "$RUNNER_TEMP/backend/names-server")
            cases=search
          fi
          scripts/ci/desktop-linux/smoke-test.sh apps/multiplatform/release/main/app/simplex "$RUNNER_TEMP/smoke-test" ${cases:-}

      - name: Stop test backend
        id: stop-backend
        if: ${{ !cancelled() && steps.backend.outcome != 'skipped' }}
        run: scripts/ci/desktop-linux/backend.sh stop "$RUNNER_TEMP/backend"

      # the app points at this backend's directory, so the Claude job starts this backend again rather than a new one
      - name: Pack backend state
        if: ${{ !cancelled() && steps.backend.outcome == 'success' && steps.stop-backend.outcome == 'success' && needs.plan.outputs.claude-backend == 'yes' }}
        run: tar -czf "$RUNNER_TEMP/backend-state.tar.gz" --exclude=./bin -C "$RUNNER_TEMP/backend" .

      - name: Upload backend state
        if: ${{ !cancelled() && steps.backend.outcome == 'success' && steps.stop-backend.outcome == 'success' && needs.plan.outputs.claude-backend == 'yes' }}
        uses: actions/upload-artifact@v7
        with:
          name: desktop-backend-state
          path: ${{ runner.temp }}/backend-state.tar.gz
          compression-level: 0
          retention-days: 1
          if-no-files-found: error

      - name: Upload smoke test results
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: desktop-smoke-test
          path: ${{ runner.temp }}/smoke-test
          retention-days: 3
          if-no-files-found: warn

      - name: Upload desktop test report
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: desktop-test-report
          path: |
            apps/multiplatform/common/build/reports/tests/desktopTest
            apps/multiplatform/common/build/test-results/desktopTest
          retention-days: 3
          if-no-files-found: warn

      - name: Upload backend logs
        if: ${{ !cancelled() && steps.backend.outcome != 'skipped' }}
        uses: actions/upload-artifact@v7
        with:
          name: desktop-backend-logs
          path: ${{ runner.temp }}/backend/*.log
          retention-days: 3
          if-no-files-found: warn

  # Claude Code repeats the smoke test with the ui helper. Each run spends the Claude subscription's usage
  # limits, so it runs only when asked for. The app-sim-claude environment's branch rule decides which branches
  # may use the token.
  claude:
    name: Claude tests the desktop app
    needs: [plan, app]
    if: ${{ !cancelled() && needs.plan.outputs.run-claude == 'true' && needs.app.result == 'success' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    environment:
      name: app-sim-claude
      deployment: false
    concurrency:
      group: desktop-linux-claude-${{ github.ref }}
      cancel-in-progress: true
    env:
      # the same in both app workflows
      CLAUDE_CODE_VERSION: 2.1.300
      CLAUDE_MODEL: claude-haiku-5-5
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install tools
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb xdotool openbox imagemagick tesseract-ocr sqlite3 fonts-dejavu-core
          dpkg-query -W xvfb xdotool openbox imagemagick tesseract-ocr sqlite3 fonts-dejavu-core

      - name: Download app
        uses: actions/download-artifact@v8
        with:
          name: desktop-app
          path: ${{ runner.temp }}

      - name: Unpack app
        run: |
          mkdir -p "$RUNNER_TEMP/app"
          tar -xzf "$RUNNER_TEMP/desktop-app.tar.gz" -C "$RUNNER_TEMP/app"

      - name: Download backend
        if: needs.plan.outputs.claude-backend == 'yes'
        uses: actions/download-artifact@v8
        with:
          name: ${{ needs.plan.outputs.backend }}
          path: ~/backend
          run-id: ${{ needs.plan.outputs.backend-run || github.run_id }}
          github-token: ${{ github.token }}

      - name: Download backend state
        if: needs.plan.outputs.claude-backend == 'yes'
        uses: actions/download-artifact@v8
        with:
          name: desktop-backend-state
          path: ${{ runner.temp }}

      - name: Start the app job's test backend again
        id: backend
        if: needs.plan.outputs.claude-backend == 'yes'
        timeout-minutes: 10
        run: |
          mkdir -p "$RUNNER_TEMP/backend"
          tar -xzf "$RUNNER_TEMP/backend-state.tar.gz" -C "$RUNNER_TEMP/backend"
          scripts/ci/desktop-linux/backend.sh resume ~/backend/${{ env.BACKEND_PKG }} "$RUNNER_TEMP/backend"

      # ui goes on every shell's PATH, where Claude's Bash tool finds it whatever environment it builds
      - name: Install Claude Code and the ui command
        run: |
          npm install --prefix "$RUNNER_TEMP/claude-code" "@anthropic-ai/claude-code@$CLAUDE_CODE_VERSION"
          echo "$RUNNER_TEMP/claude-code/node_modules/.bin" >> "$GITHUB_PATH"
          printf '#!/bin/sh\nexec %s/scripts/ci/desktop-linux/ui "$@"\n' "$PWD" | sudo tee /usr/local/bin/ui
          sudo chmod +x /usr/local/bin/ui

      - name: Start the app
        env:
          BACKEND: ${{ steps.backend.outcome }}
        run: |
          if [ "$BACKEND" = success ]; then
            export NAMES_SERVER=$(cat "$RUNNER_TEMP/backend/names-server")
            cases=setup
          fi
          scripts/ci/desktop-linux/smoke-test.sh "$RUNNER_TEMP/app/simplex" "$RUNNER_TEMP/claude-test/screens" ${cases:-start}

      # Claude's Bash is limited to single ui commands by the guard hook in claude-test.sh. Claude Code's credential
      # scrub stays off: on Linux it forces its whole Bash sandbox (bubblewrap, socat), which ui isn't set up for.
      - name: Run Claude
        id: claude
        env:
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: 1
          TEST_PROMPT: scripts/ci/desktop-linux/${{ needs.plan.outputs.claude-backend == 'yes' && 'claude-search.md' || 'claude-test.md' }}
        run: scripts/ci/desktop-linux/claude-test.sh "$RUNNER_TEMP/claude-test" "$RUNNER_TEMP/claude-transcript.jsonl" "$TEST_PROMPT"

      - name: Report Claude usage
        if: ${{ !cancelled() && steps.claude.outcome != 'skipped' }}
        run: scripts/ci/desktop-linux/claude-usage.py "$RUNNER_TEMP/claude-transcript.jsonl" "$RUNNER_TEMP/claude-usage.json"

      - name: Stop test backend
        if: ${{ !cancelled() && steps.backend.outcome != 'skipped' }}
        run: scripts/ci/desktop-linux/backend.sh stop "$RUNNER_TEMP/backend"

      - name: Upload Claude test results
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: desktop-claude-test
          path: |
            ${{ runner.temp }}/claude-test
            ${{ runner.temp }}/claude-transcript.jsonl
            ${{ runner.temp }}/claude-transcript.jsonl.stderr
            ${{ runner.temp }}/claude-transcript.jsonl.guard.log
            ${{ runner.temp }}/claude-usage.json
          retention-days: 7
          if-no-files-found: warn

      - name: Upload backend logs
        if: ${{ !cancelled() && steps.backend.outcome != 'skipped' }}
        uses: actions/upload-artifact@v7
        with:
          name: desktop-claude-backend-logs
          path: ${{ runner.temp }}/backend/*.log
          retention-days: 3
          if-no-files-found: warn

  # the latest release's onboarding, to tell a branch's own failure from the runner's
  release:
    name: released app under Xvfb
    needs: plan
    if: needs.plan.outputs.run-release == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          filter: tree:0

      - name: Download released app
        run: scripts/ci/desktop-linux/release-app.sh "$RUNNER_TEMP/release"

      - name: Install UI tools
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb xdotool openbox imagemagick tesseract-ocr
          dpkg-query -W xvfb xdotool openbox imagemagick tesseract-ocr

      - name: Run smoke test
        run: scripts/ci/desktop-linux/smoke-test.sh "$RUNNER_TEMP/release/app/opt/simplex" "$RUNNER_TEMP/smoke-test" onboarding

      - name: Upload smoke test results
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: desktop-release-smoke-test
          path: ${{ runner.temp }}/smoke-test
          retention-days: 3
          if-no-files-found: warn