feat: establish NekoNest Cloud control and relay

2026-08-12 23:25:43 +08:00
commit f27606b709
222 changed files with 71456 additions and 0 deletions
@@ -0,0 +1,114 @@
+name: Build pinned Cloud PWA
+
+on:
+  workflow_dispatch:
+    inputs:
+      nekonest_commit:
+        description: Immutable 40-character NekoNest commit SHA
+        required: true
+        type: string
+      connect_origin:
+        description: Stable HTTPS Connect origin
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cloud-pwa-${{ inputs.nekonest_commit }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate immutable inputs
+        shell: pwsh
+        env:
+          NEKONEST_COMMIT: ${{ inputs.nekonest_commit }}
+          CONNECT_ORIGIN: ${{ inputs.connect_origin }}
+        run: |
+          if ($env:NEKONEST_COMMIT -notmatch '^[0-9a-f]{40}$') {
+            throw 'nekonest_commit must be a full immutable SHA'
+          }
+          $origin = [Uri]$env:CONNECT_ORIGIN
+          if ($origin.Scheme -ne 'https' -or $origin.AbsoluteUri.TrimEnd('/') -ne $env:CONNECT_ORIGIN.TrimEnd('/')) {
+            throw 'connect_origin must be an exact HTTPS origin'
+          }
+          if ($origin.UserInfo -or $origin.PathAndQuery -ne '/' -or $origin.Fragment) {
+            throw 'connect_origin must not contain credentials, path, query, or fragment'
+          }
+
+      - name: Check out exact NekoNest source
+        uses: actions/checkout@v7
+        with:
+          repository: klarkxy/nekonest
+          ref: ${{ inputs.nekonest_commit }}
+          fetch-depth: 0
+          path: nekonest
+
+      - name: Verify checked-out source did not move
+        shell: pwsh
+        working-directory: nekonest
+        env:
+          EXPECTED_SHA: ${{ inputs.nekonest_commit }}
+        run: |
+          $actual = (git rev-parse HEAD).Trim()
+          if ($actual -ne $env:EXPECTED_SHA) { throw "expected $env:EXPECTED_SHA, got $actual" }
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10.29.2
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: pnpm
+          cache-dependency-path: nekonest/pwa/pnpm-lock.yaml
+
+      - name: Install, test, and build managed PWA
+        working-directory: nekonest/pwa
+        env:
+          VITE_NEKONEST_MANAGED: 'true'
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm test
+          pnpm type-check
+          pnpm build
+
+      - name: Write deploy-time stable endpoint config
+        shell: pwsh
+        env:
+          CONNECT_ORIGIN: ${{ inputs.connect_origin }}
+        run: |
+          $config = [ordered]@{
+            api_base = $env:CONNECT_ORIGIN.TrimEnd('/')
+            ws_base = $env:CONNECT_ORIGIN.TrimEnd('/').Replace('https://', 'wss://')
+            attachment_base = $env:CONNECT_ORIGIN.TrimEnd('/')
+            push_base = $env:CONNECT_ORIGIN.TrimEnd('/')
+            managed = $true
+            handoff_exchange_path = '/api/pwa/handoff/exchange'
+          }
+          $config | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM nekonest/pwa/dist/runtime-config.json
+
+      - name: Record source provenance
+        shell: pwsh
+        env:
+          SOURCE_SHA: ${{ inputs.nekonest_commit }}
+        run: |
+          [ordered]@{
+            repository = 'https://github.com/klarkxy/nekonest'
+            commit = $env:SOURCE_SHA
+            built_at = (Get-Date).ToUniversalTime().ToString('o')
+          } | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM nekonest/pwa/dist/source-provenance.json
+
+      - name: Upload exact-build artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: nekonest-cloud-pwa-${{ inputs.nekonest_commit }}
+          path: nekonest/pwa/dist
+          if-no-files-found: error
+          retention-days: 7