Build the Flatpak in CI and publish it to the Frostyard remote

.github/workflows/flatpak.yml

@@ -0,0 +1,95 @@
+name: Flatpak
+
+# Builds the Flatpak, with its tests, on every push and pull request, and keeps
+# the bundle as an artifact. Pushes to main also publish an OCI image to
+# ghcr.io/frostyard/igloo, which the Frostyard remote serves
+# (https://github.com/frostyard/flatpak-index).
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: flatpak-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  APP_ID: io.github.frostyard.Igloo
+  IMAGE: ghcr.io/frostyard/igloo
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    # flatpak-builder sandboxes builds with bubblewrap, which needs a
+    # privileged container.
+    container:
+      image: ghcr.io/flathub-infra/flatpak-github-actions:gnome-51
+      options: --privileged
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - name: Build and test
+        uses: flatpak/flatpak-github-actions/flatpak-builder@v6.8
+        with:
+          manifest-path: io.github.frostyard.Igloo.json
+          bundle: igloo.flatpak
+          artifact-name: igloo-flatpak
+          run-tests: true
+          # Dependencies such as VTE come from the cache when the manifest
+          # has not changed; Igloo itself always rebuilds.
+          cache-key: flatpak-builder-${{ hashFiles('io.github.frostyard.Igloo.json') }}
+
+      - name: Export the OCI image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: flatpak build-bundle --oci --arch=x86_64 repo igloo.oci "$APP_ID"
+
+      - name: Keep the OCI image for publishing
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: igloo-oci
+          path: igloo.oci
+          retention-days: 1
+
+  publish:
+    name: Publish
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      # Optional: a fine-grained token with Actions write access to
+      # frostyard/flatpak-index, so the remote refreshes right away instead of
+      # at its next hourly run.
+      DISPATCH_TOKEN: ${{ secrets.FLATPAK_INDEX_DISPATCH_TOKEN }}
+    steps:
+      - uses: actions/download-artifact@v8.0.1
+        with:
+          name: igloo-oci
+          path: igloo.oci
+
+      - name: Push to GHCR
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          echo "$GITHUB_TOKEN" | skopeo login ghcr.io --username "$ACTOR" --password-stdin
+          # latest is what the remote serves; the commit tag keeps every build pullable.
+          for tag in latest "sha-${GITHUB_SHA::12}"; do
+            skopeo copy oci:igloo.oci "docker://$IMAGE:$tag"
+          done
+
+      - name: Refresh the Frostyard remote
+        if: env.DISPATCH_TOKEN != ''
+        env:
+          GH_TOKEN: ${{ env.DISPATCH_TOKEN }}
+        run: gh workflow run publish.yml --repo frostyard/flatpak-index

README.md

@@ -14,6 +14,24 @@ Igloo is based on [Ptyxis](https://gitlab.gnome.org/chergert/ptyxis) by
 Christian Hergert, and keeps everything Ptyxis does. It installs as
 `io.github.frostyard.Igloo`, beside Ptyxis, with its own settings.
 
+## Install
+
+Igloo is published to the [Frostyard Flatpak remote](https://github.com/frostyard/flatpak-index).
+Add it once, then install Igloo and update it with `flatpak update`:
+
+```bash
+flatpak remote-add --if-not-exists frostyard https://frostyard.github.io/flatpak-index/frostyard.flatpakrepo
+```
+
+```bash
+flatpak install frostyard io.github.frostyard.Igloo
+```
+
+Igloo uses the GNOME 51 runtime from [Flathub](https://flathub.org/setup).
+Every pull request's [CI run](https://github.com/frostyard/igloo/actions/workflows/flatpak.yml)
+also keeps a bundle, `igloo-flatpak`, to try a change before it merges:
+unzip it and run `flatpak install --user igloo.flatpak`.
+
 ## What it adds to Ptyxis
 
 - **New Tab menu.** The dropdown next to the new tab button lists nsl machines
@@ -81,6 +99,11 @@ flatpak build-bundle repo igloo.flatpak io.github.frostyard.Igloo
 The manifest builds VTE 0.84.1 with fast_float and simdutf on top of the GNOME
 51 runtime, then builds this checkout.
 
+[CI](.github/workflows/flatpak.yml) builds the same manifest with its tests on
+every push and pull request. On `main` it also exports an OCI image with
+`flatpak build-bundle --oci` and pushes it to `ghcr.io/frostyard/igloo`, which
+the Frostyard remote serves.
+
 ### Develop inside the build environment
 
 Build the dependencies once, then use meson inside the SDK: