feat: improve GitHub actions

.github/workflows/linux-aarch64.yml

@@ -1,52 +0,0 @@
-name: Linux aarch64
-
-on: [ push, pull_request ]
-
-jobs:
-  build:
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      # download jdk
-      - run: wget -q -O $RUNNER_TEMP/java_package.tar.gz https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-21.0.7-linux-aarch64-b1034.51.tar.gz
-
-      # appimagetool
-      - run: sudo apt install libfuse2
-
-      # install jdk
-      - name: Installing Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'jdkfile'
-          jdkFile: ${{ runner.temp }}/java_package.tar.gz
-          java-version: '21.0.7'
-          architecture: aarch64
-
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-${{ runner.arch }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
-          restore-keys: |
-            ${{ runner.os }}-${{ runner.arch }}-gradle-
-
-      # test build
-      - run: |
-          ./gradlew classes -x test --no-daemon
-          ./gradlew clean --no-daemon
-
-      # dist
-      - run: |
-          ./gradlew dist --no-daemon
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: termora-linux-aarch64
-          path: |
-            build/distributions/*.tar.gz
-            build/distributions/*.AppImage

.github/workflows/linux-x86-64.yml

@@ -1,52 +0,0 @@
-name: Linux x86-64
-
-on: [ push, pull_request ]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      # download jdk
-      - run: wget -q -O $RUNNER_TEMP/java_package.tar.gz https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-21.0.7-linux-x64-b1034.51.tar.gz
-
-      # appimagetool
-      - run: sudo apt install libfuse2
-
-      # install jdk
-      - name: Installing Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'jdkfile'
-          jdkFile: ${{ runner.temp }}/java_package.tar.gz
-          java-version: '21.0.7'
-          architecture: x64
-
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-${{ runner.arch }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
-          restore-keys: |
-            ${{ runner.os }}-${{ runner.arch }}-gradle-
-
-      # test build
-      - run: |
-          ./gradlew classes -x test --no-daemon
-          ./gradlew clean --no-daemon
-
-      # dist
-      - run: |
-          ./gradlew dist --no-daemon
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: termora-linux-x86-64
-          path: |
-            build/distributions/*.tar.gz
-            build/distributions/*.AppImage

.github/workflows/linux.yml

@@ -0,0 +1,64 @@
+name: Linux
+
+on: [ push, pull_request ]
+
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ ubuntu-24.04-arm, ubuntu-latest ]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-${{ runner.arch }}-gradlexyz-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-gradlexyz-
+
+      - name: Build Docker image
+        run: docker build -t debianjbr src/test/resources/deb/
+
+      - name: Create docker-run.sh helper script
+        shell: bash
+        run: |
+          cat <<'EOF' > docker-run.sh
+          #!/bin/bash
+          docker run --rm -v $HOME/.gradle:/root/.gradle -v "$(pwd)":/app -w /app "$@"
+          EOF
+          chmod +x docker-run.sh
+
+      - name: Compile
+        shell: bash
+        run: ./docker-run.sh debianjbr bash -c './gradlew :check-license && ./gradlew classes -x test'
+
+      - name: JLink
+        shell: bash
+        run: ./docker-run.sh debianjbr bash -c './gradlew :jar :copy-dependencies :plugins:migration:build :jlink'
+
+      - name: Package Deb
+        shell: bash
+        run: ./docker-run.sh -e TERMORA_TYPE=deb debianjbr bash -c './gradlew :jpackage && ./gradlew :dist'
+
+      - name: Package AppImage
+        shell: bash
+        run: ./docker-run.sh --device /dev/fuse --cap-add SYS_ADMIN --security-opt apparmor:unconfined debianjbr bash -c 'rm -rf build/jpackage && ./gradlew :jpackage && ./gradlew :dist'
+
+      - name: Make ~/.gradle world-writable
+        shell: bash
+        run: sudo chmod -R 777 ~/.gradle
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: termora-linux-${{ runner.arch }}
+          path: |
+            build/distributions/*.tar.gz
+            build/distributions/*.AppImage
+            build/distributions/*.deb

.github/workflows/osx-aarch64.yml

@@ -1,89 +0,0 @@
-name: macOS aarch64
-
-on: [ push, pull_request ]
-
-jobs:
-  build:
-    runs-on: macos-15
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install the Apple certificate
-        if: github.event_name == 'push' && github.repository == 'TermoraDev/termora' && env.BUILD_CERTIFICATE_BASE64 != ''
-        env:
-          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
-          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-        run: |
-          # create variables
-          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          
-          # import certificate from secrets
-          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
-          
-          # create temporary keychain
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          
-          # import certificate to keychain
-          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-
-      - name: Setup the Notary information
-        if: "startsWith(github.event.head_commit.message, 'release: ') && github.repository == 'TermoraDev/termora' && env.APPLE_ID != ''"
-        env:
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          STORE_CREDENTIALS: ${{ secrets.TERMORA_MAC_NOTARY_KEYCHAIN_PROFILE }}
-        run: |
-          xcrun notarytool store-credentials "$STORE_CREDENTIALS" --apple-id "$APPLE_ID" --team-id "$TEAM_ID" --password "$APPLE_PASSWORD"
-
-      # download jdk
-      - run: wget -q -O $RUNNER_TEMP/java_package.tar.gz https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-21.0.7-osx-aarch64-b1034.51.tar.gz
-
-      # install jdk
-      - name: Installing Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'jdkfile'
-          jdkFile: ${{ runner.temp }}/java_package.tar.gz
-          java-version: '21.0.7'
-          architecture: aarch64
-
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-${{ runner.arch }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
-          restore-keys: |
-            ${{ runner.os }}-${{ runner.arch }}-gradle-
-
-      # test build
-      - run: |
-          ./gradlew classes -x test --no-daemon
-          ./gradlew clean --no-daemon
-
-      # dist
-      - name: Dist
-        env:
-          TERMORA_MAC_SIGN: ${{ github.event_name == 'push' && github.repository == 'TermoraDev/termora' }}
-          TERMORA_MAC_SIGN_USER_NAME: ${{ secrets.TERMORA_MAC_SIGN_USER_NAME }}
-          # 只有发布版本时才需要公证
-          TERMORA_MAC_NOTARY: "${{ startsWith(github.event.head_commit.message, 'release: ') && github.repository == 'TermoraDev/termora' }}"
-          TERMORA_MAC_NOTARY_KEYCHAIN_PROFILE: ${{ secrets.TERMORA_MAC_NOTARY_KEYCHAIN_PROFILE }}
-        run: |
-          ./gradlew dist --no-daemon
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: termora-osx-aarch64
-          path: |
-            build/distributions/*.zip
-            build/distributions/*.dmg

.github/workflows/osx.yml

@@ -1,17 +1,27 @@
-name: macOS x86-64
+name: macOS
 
 on: [ push, pull_request ]
 
+env:
+  TERMORA_MAC_SIGN: ${{ github.event_name == 'push' && github.repository == 'TermoraDev/termora' }}
+  TERMORA_MAC_SIGN_USER_NAME: ${{ secrets.TERMORA_MAC_SIGN_USER_NAME }}
+  # 只有发布版本时才需要公证
+  TERMORA_MAC_NOTARY: "${{ startsWith(github.event.head_commit.message, 'release: ') && github.repository == 'TermoraDev/termora' }}"
+  TERMORA_MAC_NOTARY_KEYCHAIN_PROFILE: ${{ secrets.TERMORA_MAC_NOTARY_KEYCHAIN_PROFILE }}
+
 jobs:
   build:
-    runs-on: macos-13
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ macos-15, macos-13 ]
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Install the Apple certificate
-        if: github.event_name == 'push' && github.repository == 'TermoraDev/termora' && env.BUILD_CERTIFICATE_BASE64 != ''
+        if: "startsWith(github.event.head_commit.message, 'release: ') && github.repository == 'TermoraDev/termora' && env.BUILD_CERTIFICATE_BASE64 != ''"
         env:
           BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
           P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
@@ -43,8 +53,14 @@ jobs:
         run: |
           xcrun notarytool store-credentials "$STORE_CREDENTIALS" --apple-id "$APPLE_ID" --team-id "$TEAM_ID" --password "$APPLE_PASSWORD"
 
-      # download jdk
-      - run: wget -q -O $RUNNER_TEMP/java_package.tar.gz https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-21.0.7-osx-x64-b1034.51.tar.gz
+      - name: Download Java
+        run: |
+          if [[ "$(uname -m)" == "arm64" ]]; then
+            ARCH="aarch64"
+          else
+            ARCH="x64"
+          fi
+          wget -q -O $RUNNER_TEMP/java_package.tar.gz https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-21.0.7-osx-$ARCH-b1034.51.tar.gz
 
       # install jdk
       - name: Installing Java
@@ -53,8 +69,6 @@ jobs:
           distribution: 'jdkfile'
           jdkFile: ${{ runner.temp }}/java_package.tar.gz
           java-version: '21.0.7'
-          architecture: x64
-
 
       - uses: actions/cache@v4
         with:
@@ -65,27 +79,22 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-${{ runner.arch }}-gradle-
 
+      - name: Compile
+        shell: bash
+        run: ./gradlew :check-license && ./gradlew classes -x test
 
-      # test build
-      - run: |
-          ./gradlew classes -x test --no-daemon
-          ./gradlew clean --no-daemon
+      - name: JLink
+        shell: bash
+        run: ./gradlew :jar :copy-dependencies :plugins:migration:build :jlink
 
-      # dist
-      - name: Dist
-        env:
-          TERMORA_MAC_SIGN: ${{ github.event_name == 'push' && github.repository == 'TermoraDev/termora' }}
-          TERMORA_MAC_SIGN_USER_NAME: ${{ secrets.TERMORA_MAC_SIGN_USER_NAME }}
-          # 只有发布版本时才需要公证
-          TERMORA_MAC_NOTARY: "${{ startsWith(github.event.head_commit.message, 'release: ') && github.repository == 'TermoraDev/termora' }}"
-          TERMORA_MAC_NOTARY_KEYCHAIN_PROFILE: ${{ secrets.TERMORA_MAC_NOTARY_KEYCHAIN_PROFILE }}
-        run: |
-          ./gradlew dist --no-daemon
+      - name: Package
+        shell: bash
+        run: ./gradlew :jpackage && ./gradlew :dist
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
-          name: termora-osx-x86-64
+          name: termora-osx-${{ runner.arch }}
           path: |
             build/distributions/*.zip
             build/distributions/*.dmg

.github/workflows/windows-x86-64.yml

@@ -34,15 +34,17 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-${{ runner.arch }}-gradle-
 
-      # test build
-      - run: |
-          .\gradlew classes -x test --no-daemon
-          .\gradlew clean --no-daemon
+      - name: Compile
+        run: .\gradlew :check-license && .\gradlew classes -x test
 
-      # dist
-      - run: |
-          .\gradlew.bat dist --no-daemon
-          .\gradlew.bat --stop
+      - name: JLink
+        run: .\gradlew :jar :copy-dependencies :plugins:migration:build :jlink
+
+      - name: Package
+        run: .\gradlew :jpackage && .\gradlew :dist
+
+      - name: Stop Gradle
+        run: .\gradlew.bat --stop
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4

build.gradle.kts

@@ -28,7 +28,7 @@ version = rootProject.projectDir.resolve("VERSION").readText().trim()
 val os: OperatingSystem = DefaultNativePlatform.getCurrentOperatingSystem()
 val arch: ArchitectureInternal = DefaultNativePlatform.getCurrentArchitecture()
 val appVersion = project.version.toString().split("-")[0]
-val isDeb = os.isLinux && System.getProperty("type") == "deb"
+val isDeb = os.isLinux && System.getenv("TERMORA_TYPE") == "deb"
 
 // macOS 签名信息
 val macOSSignUsername = System.getenv("TERMORA_MAC_SIGN_USER_NAME") ?: StringUtils.EMPTY
@@ -185,7 +185,7 @@ tasks.register<Copy>("copy-dependencies") {
 
     // 对 JNA 和 PTY4J 的本地库提取
     // 提取出来是为了单独签名，不然无法通过公证
-    if (os.isMacOsX && macOSSign) {
+    if (os.isMacOsX) {
         doLast {
             val archName = if (arch.isArm) "aarch64" else "x86_64"
             val dylib = dir.get().dir("dylib").asFile
@@ -519,31 +519,20 @@ tasks.register<Exec>("jpackage") {
 
 tasks.register("dist") {
     doLast {
+        val osName = if (os.isMacOsX) "osx" else if (os.isWindows) "windows" else "linux"
+        val distributionDir = layout.buildDirectory.dir("distributions").get()
+        val finalFilenameWithoutExtension = "${project.name}-${project.version}-${osName}-${arch.name}"
+        val projectName = project.name.uppercaseFirstChar()
 
-        val gradlew = File(projectDir, if (os.isWindows) "gradlew.bat" else "gradlew").absolutePath
-
-        // 清空目录
-        exec { commandLine(gradlew, "clean") }
-
-        // 构建自带的插件
-        exec { commandLine(gradlew, ":plugins:migration:build") }
-
-        // 打包并复制依赖
-        exec {
-            commandLine(gradlew, ":jar", ":copy-dependencies")
+        if (os.isWindows) {
+            packOnWindows(distributionDir, finalFilenameWithoutExtension, projectName)
+        } else if (os.isLinux) {
+            packOnLinux(distributionDir, finalFilenameWithoutExtension, projectName)
+        } else if (os.isMacOsX) {
+            packOnMac(distributionDir, finalFilenameWithoutExtension, projectName)
+        } else {
+            throw GradleException("${os.name} is not supported")
         }
-
-        // 检查依赖的开源协议
-        exec { commandLine(gradlew, ":check-license") }
-
-        // jlink
-        exec { commandLine(gradlew, ":jlink") }
-
-        // 打包
-        exec { commandLine(gradlew, ":jpackage", "-Dtype=${System.getProperty("type")}") }
-
-        // 根据不同的系统构建不同的二进制包
-        pack()
     }
 }
 
@@ -574,26 +563,6 @@ tasks.register("check-license") {
     }
 }
 
-/**
- * 构建包
- */
-fun pack() {
-    val osName = if (os.isMacOsX) "osx" else if (os.isWindows) "windows" else "linux"
-    val distributionDir = layout.buildDirectory.dir("distributions").get()
-    val finalFilenameWithoutExtension = "${project.name}-${project.version}-${osName}-${arch.name}"
-    val projectName = project.name.uppercaseFirstChar()
-
-    if (os.isWindows) {
-        packOnWindows(distributionDir, finalFilenameWithoutExtension, projectName)
-    } else if (os.isLinux) {
-        packOnLinux(distributionDir, finalFilenameWithoutExtension, projectName)
-    } else if (os.isMacOsX) {
-        packOnMac(distributionDir, finalFilenameWithoutExtension, projectName)
-    } else {
-        throw GradleException("${os.name} is not supported")
-    }
-
-}
 
 /**
  * 创建 zip、msi
@@ -654,7 +623,7 @@ fun packOnMac(distributionDir: Directory, finalFilenameWithoutExtension: String,
     // @formatter:on
 
     // sign dmg
-    if (macOSSign) signMacOSLocalFile(dmgFile)
+    signMacOSLocalFile(dmgFile)
 
     // 找到 .app
     val imageFile = layout.buildDirectory.dir("jpackage/images/").get().asFile
@@ -667,7 +636,7 @@ fun packOnMac(distributionDir: Directory, finalFilenameWithoutExtension: String,
     // @formatter:on
 
     // sign zip
-    if (macOSSign) signMacOSLocalFile(zipFile)
+    signMacOSLocalFile(zipFile)
 
     // 公证
     if (macOSNotary) {

src/test/resources/deb/Dockerfile

@@ -0,0 +1,20 @@
+FROM debian:12.11
+
+RUN apt-get clean && apt-get update && apt-get install -y curl tar zip binutils fakeroot wget libfuse2 fuse libglib2.0-0 file ca-certificates libstdc++6
+
+RUN ARCH=$(dpkg --print-architecture) && \
+    if [ "$ARCH" = "amd64" ]; then \
+        URL="https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-21.0.7-linux-x64-b1034.51.tar.gz"; \
+    elif [ "$ARCH" = "arm64" ]; then \
+        URL="https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-21.0.7-linux-aarch64-b1034.51.tar.gz"; \
+    else \
+        echo "Unsupported architecture: $ARCH" && exit 1; \
+    fi && \
+    curl -L "$URL" -o jbr.tar.gz && \
+    mkdir -p /opt/jbr && \
+    tar -xzf jbr.tar.gz -C /opt/jbr --strip-components=1 && \
+    rm jbr.tar.gz
+
+ENV JAVA_HOME=/opt/jbr
+ENV PATH="${JAVA_HOME}/bin:${PATH}"
+