Skip to content

Commit 4f21583

Browse files
ralyodioralyodio
committed
Merge branch 'main' of github.com:profullstack/tronbrowser.dev
# Conflicts: # package.json
2 parents 4090ce1 + c25c1a0 commit 4f21583

302 files changed

Lines changed: 27200 additions & 1169 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.env.example‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,32 @@ COINPAY_REDIRECT_URI=tronbrowser://oauth/coinpay
3535
# Override only for self-hosted CoinPay:
3636
# COINPAY_AUTHORIZE_URL=https://coinpayportal.com/api/oauth/authorize
3737
# COINPAY_TOKEN_URL=https://coinpayportal.com/api/oauth/token
38+
39+
# --- Extension store (tronbrowser.dev/store) -------------------------------
40+
APP_URL=https://tronbrowser.dev
41+
# The $1 listing fee — Stripe (card):
42+
STRIPE_SECRET_KEY=
43+
STRIPE_WEBHOOK_SECRET= # for /api/store/payments/stripe/webhook
44+
# The $1 listing fee — CoinPay / x402 (1 USDC):
45+
STORE_X402_NETWORK=base
46+
STORE_X402_PAY_TO= # your USDC receiving address
47+
# COINPAY_SETTLEMENT_URL=https://coinpayportal.com/api/settlements
48+
# STORE_X402_TRUST_CLIENT=1 # DEV ONLY: accept client-reported settlement
49+
# vu1nz.com security scan (non-gating; recorded 'skipped' if unset):
50+
VU1NZ_API_URL=
51+
VU1NZ_API_KEY=
52+
# Git registry mirror (audit trail). Repo + token; no-op if unset:
53+
STORE_REGISTRY_REPO= # e.g. profullstack/tronbrowsers.dev
54+
# STORE_REGISTRY_BRANCH=main
55+
# STORE_REGISTRY_PREFIX=apps/extensions/registry
56+
GITHUB_TOKEN=
57+
# Bundle hosting on files.profullstack.com (AgentBBS Files over SFTP):
58+
FILES_PUBLIC_BASE=https://files.profullstack.com
59+
FILES_SCP_TARGET=files@files.profullstack.com
60+
# Full-auto publisher provisioning: the store SSHes the BBS host and runs
61+
# `agentbbs provision-user`. Unset = keys saved, operator provisions manually.
62+
BBS_SSH_HOST= # e.g. bbs.profullstack.com
63+
BBS_SSH_USER= # operator login with the agentbbs CLI
64+
BBS_SSH_KEY= # path to the operator private key (mounted secret)
65+
# BBS_SSH_PORT=22
66+
# AGENTBBS_BIN=agentbbs

‎.github/workflows/android-engine.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: Android engine
2+
3+
# Track 3 (docs/mobile-architecture.md): native de-googled Chromium APK.
4+
# The `validate` job proves the build skeleton is wired on every push. The real
5+
# compile is a ~50GB checkout + hours on a large/self-hosted Linux runner, so
6+
# it is manual (workflow_dispatch) and opt-in.
7+
on:
8+
push:
9+
branches: [main]
10+
paths:
11+
- 'apps/android-engine/**'
12+
- '.github/workflows/android-engine.yml'
13+
pull_request:
14+
paths:
15+
- 'apps/android-engine/**'
16+
- '.github/workflows/android-engine.yml'
17+
workflow_dispatch:
18+
inputs:
19+
real_build:
20+
description: 'Run the REAL Chromium build (needs a large/self-hosted Linux runner)'
21+
type: boolean
22+
default: false
23+
runner:
24+
description: 'Runner label for the real build'
25+
type: string
26+
default: ubuntu-latest
27+
target_cpu:
28+
description: 'Target CPU'
29+
type: choice
30+
options: [arm64, arm, x64]
31+
default: arm64
32+
33+
defaults:
34+
run:
35+
working-directory: apps/android-engine/chromium
36+
37+
jobs:
38+
validate:
39+
runs-on: ubuntu-latest
40+
steps:
41+
- uses: actions/checkout@v5
42+
43+
- name: version.json parses + has required keys
44+
run: |
45+
node -e "const c=require('./config/version.json');
46+
for (const k of ['chromiumVersion','ungoogledChromiumTag','targetOs','ninjaTargets'])
47+
if (c[k]===undefined) { console.error('missing key:',k); process.exit(1); }
48+
console.log('version.json OK — chromium', c.chromiumVersion, '→', c.ninjaTargets.join(', '));"
49+
50+
- name: GN arg files present
51+
run: test -f config/gn-args/common.gni && test -f config/gn-args/android.gni
52+
53+
- name: Shell scripts parse (bash -n)
54+
run: |
55+
for s in scripts/*.sh; do bash -n "$s" && echo "ok $s"; done
56+
57+
- name: Scripts dry-run without TB_RUN (guard works)
58+
run: |
59+
for s in fetch sync apply-patches build package tor; do
60+
out="$(./scripts/$s.sh)"
61+
echo "$out" | grep -q 'dry-run' || { echo "guard failed: $s did not dry-run"; exit 1; }
62+
echo "guard ok: $s"
63+
done
64+
65+
build-apk:
66+
# Real, heavy build — opt-in via workflow_dispatch with real_build=true.
67+
if: github.event_name == 'workflow_dispatch' && inputs.real_build
68+
runs-on: ${{ inputs.runner }}
69+
timeout-minutes: 720
70+
steps:
71+
- uses: actions/checkout@v5
72+
- name: Toolchain note
73+
run: |
74+
echo "Building native Android Chromium (cpu=${{ inputs.target_cpu }})."
75+
echo "Requires ~50GB+ disk, many GB RAM, hours. GitHub-hosted runners"
76+
echo "will run out of disk — use a large self-hosted Linux runner."
77+
- name: fetch
78+
env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' }
79+
run: ./scripts/fetch.sh
80+
- name: sync
81+
env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' }
82+
run: ./scripts/sync.sh
83+
- name: apply-patches
84+
env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' }
85+
run: ./scripts/apply-patches.sh
86+
- name: build
87+
env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' }
88+
run: ./scripts/build.sh
89+
- name: package
90+
env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' }
91+
run: ./scripts/package.sh
92+
- uses: actions/upload-artifact@v4
93+
with:
94+
name: tronbrowser-android-${{ inputs.target_cpu }}
95+
path: ~/.cache/tronbrowser-android-chromium/dist/*
96+
if-no-files-found: warn

‎.github/workflows/ci.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,19 @@ jobs:
2525
- name: Lint
2626
run: pnpm lint
2727

28+
# Build first: packages that import another workspace package (e.g.
29+
# @tronbrowser/sdk -> @tronbrowser/browser-core) resolve it via its built
30+
# dist, so typecheck/test need the dist present. pnpm builds in topological
31+
# order, so dependencies compile before their dependents.
32+
- name: Build
33+
run: pnpm build
34+
2835
- name: Typecheck
2936
run: pnpm typecheck
3037

3138
- name: Test
3239
run: pnpm test
3340

34-
- name: Build
35-
run: pnpm build
36-
3741
# package + release jobs are stubbed until the Chromium build lands in CI.
3842
package:
3943
runs-on: ubuntu-latest

‎.github/workflows/extension-scan.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# vu1nz.com security scan for extensions submitted via PR.
2+
#
3+
# Runs on PRs that add/modify a registry listing. This is the PR half of the
4+
# store's "scan + community flagging" model — the upload-form half runs the same
5+
# scan asynchronously inside the API (services/api/src/store/vu1nz.ts).
6+
name: extension-scan
7+
8+
on:
9+
pull_request:
10+
paths:
11+
- 'apps/extensions/registry/**/listing.json'
12+
13+
permissions:
14+
contents: read
15+
pull-requests: write
16+
17+
jobs:
18+
scan:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v4
22+
with:
23+
# Full history so the three-dot diff below has a merge base with the
24+
# base branch (a shallow --depth=1 fetch leaves them with no common
25+
# ancestor: "fatal: origin/<base>...HEAD: no merge base").
26+
fetch-depth: 0
27+
28+
- name: Find changed listings
29+
id: changed
30+
run: |
31+
git fetch origin "${{ github.base_ref }}"
32+
files=$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" -- 'apps/extensions/registry/**/listing.json')
33+
echo "files<<EOF" >> "$GITHUB_OUTPUT"
34+
echo "$files" >> "$GITHUB_OUTPUT"
35+
echo "EOF" >> "$GITHUB_OUTPUT"
36+
37+
# vu1nz publishes a composite action; we invoke it per changed listing.
38+
# Configure VU1NZ_API_URL / VU1NZ_API_KEY as repo secrets to enable.
39+
- name: vu1nz scan
40+
if: ${{ steps.changed.outputs.files != '' }}
41+
env:
42+
VU1NZ_API_URL: ${{ secrets.VU1NZ_API_URL }}
43+
VU1NZ_API_KEY: ${{ secrets.VU1NZ_API_KEY }}
44+
run: |
45+
if [ -z "$VU1NZ_API_URL" ]; then
46+
echo "::warning::VU1NZ_API_URL not set — skipping scan (set it to enable the gate)"
47+
exit 0
48+
fi
49+
fail=0
50+
while IFS= read -r f; do
51+
[ -z "$f" ] && continue
52+
echo "Scanning $f"
53+
payload=$(cat "$f")
54+
resp=$(curl -sS -X POST "$VU1NZ_API_URL/scan/extension" \
55+
-H "content-type: application/json" \
56+
${VU1NZ_API_KEY:+-H "authorization: Bearer $VU1NZ_API_KEY"} \
57+
-d "{\"target\":\"browser-extension\",\"listing\":$payload}")
58+
echo "$resp"
59+
sev=$(echo "$resp" | python3 -c "import sys,json;print(json.load(sys.stdin).get('severity',''))" 2>/dev/null || echo "")
60+
if [ "$sev" = "critical" ] || [ "$sev" = "high" ]; then
61+
echo "::error::$f flagged $sev by vu1nz"
62+
fail=1
63+
fi
64+
done <<< "${{ steps.changed.outputs.files }}"
65+
exit $fail

‎.github/workflows/linux-phones.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Linux phones
2+
3+
# Builds/validates the Linux-phone packaging (arm64 .deb/.rpm + Ubuntu Touch
4+
# click) on every relevant push — the release workflow attaches these to a
5+
# tagged release, this one just proves they build. See docs/mobile-architecture.md.
6+
on:
7+
push:
8+
branches: [main]
9+
paths:
10+
- 'distribution/deb-rpm/**'
11+
- 'distribution/ubuntu-touch/**'
12+
- 'apps/desktop/**'
13+
- '.github/workflows/linux-phones.yml'
14+
pull_request:
15+
paths:
16+
- 'distribution/deb-rpm/**'
17+
- 'distribution/ubuntu-touch/**'
18+
- 'apps/desktop/**'
19+
- '.github/workflows/linux-phones.yml'
20+
workflow_dispatch:
21+
22+
jobs:
23+
package:
24+
runs-on: ubuntu-latest
25+
steps:
26+
- uses: actions/checkout@v5
27+
28+
- name: Version
29+
id: v
30+
run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
31+
32+
- name: Install nfpm
33+
run: |
34+
curl -sSfL "https://github.com/goreleaser/nfpm/releases/download/v2.41.0/nfpm_2.41.0_amd64.deb" -o /tmp/nfpm.deb
35+
sudo dpkg -i /tmp/nfpm.deb
36+
37+
- name: Build noarch tarball
38+
run: bash apps/desktop/scripts/build-release.sh "v${{ steps.v.outputs.version }}" linux
39+
40+
- name: Build deb + rpm (amd64 + arm64)
41+
run: bash distribution/deb-rpm/build.sh "v${{ steps.v.outputs.version }}"
42+
43+
- name: Verify arm64 .deb (phones)
44+
run: |
45+
deb="dist/tronbrowser_${{ steps.v.outputs.version }}_arm64.deb"
46+
test -f "$deb" || { echo "missing $deb"; exit 1; }
47+
arch="$(dpkg-deb -f "$deb" Architecture)"
48+
[ "$arch" = "arm64" ] || { echo "bad arch: $arch"; exit 1; }
49+
dpkg-deb -c "$deb" | grep -q 'usr/share/applications/tronbrowser.desktop' \
50+
|| { echo "missing desktop entry"; exit 1; }
51+
echo "arm64 .deb OK: $deb"
52+
53+
- name: Stage + validate Ubuntu Touch click
54+
run: bash distribution/ubuntu-touch/build.sh "v${{ steps.v.outputs.version }}" arm64
55+
56+
- uses: actions/upload-artifact@v4
57+
with:
58+
name: linux-phone-packages
59+
path: |
60+
dist/*.deb
61+
dist/*.rpm
62+
dist/*.click
63+
if-no-files-found: warn

‎.github/workflows/mobile.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Mobile
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- 'apps/mobile/**'
8+
- '.github/workflows/mobile.yml'
9+
pull_request:
10+
paths:
11+
- 'apps/mobile/**'
12+
- '.github/workflows/mobile.yml'
13+
# EAS cloud builds / store submits are manual so they don't burn build
14+
# credits on every push. Trigger from the Actions tab → "Run workflow".
15+
workflow_dispatch:
16+
inputs:
17+
platform:
18+
description: 'EAS build platform'
19+
type: choice
20+
options: [android, ios, all]
21+
default: android
22+
profile:
23+
description: 'EAS build profile (see apps/mobile/eas.json)'
24+
type: choice
25+
options: [preview, production, development]
26+
default: preview
27+
submit:
28+
description: 'Submit the build to the store after it finishes'
29+
type: boolean
30+
default: false
31+
32+
defaults:
33+
run:
34+
working-directory: apps/mobile
35+
36+
jobs:
37+
# Fast, free check on every push/PR: typecheck, lint, and prove the JS bundle
38+
# builds via `expo export` (no device, no EAS minutes).
39+
ci:
40+
runs-on: ubuntu-latest
41+
steps:
42+
- uses: actions/checkout@v5
43+
44+
- uses: pnpm/action-setup@v6
45+
46+
- uses: actions/setup-node@v5
47+
with:
48+
node-version: lts/*
49+
cache: pnpm
50+
51+
- name: Install
52+
working-directory: .
53+
run: pnpm install --frozen-lockfile
54+
55+
- name: Typecheck
56+
run: pnpm typecheck
57+
58+
- name: Lint
59+
run: pnpm lint
60+
61+
- name: Bundle (expo export)
62+
run: pnpm exec expo export --platform android --output-dir dist-export
63+
64+
# Cloud build + optional store submit via EAS. Requires the EXPO_TOKEN repo
65+
# secret (Expo account access token). iOS/Android signing credentials are
66+
# managed by EAS (`eas credentials`) — not stored here.
67+
eas-build:
68+
if: github.event_name == 'workflow_dispatch'
69+
runs-on: ubuntu-latest
70+
steps:
71+
- uses: actions/checkout@v5
72+
73+
- uses: pnpm/action-setup@v6
74+
75+
- uses: actions/setup-node@v5
76+
with:
77+
node-version: lts/*
78+
cache: pnpm
79+
80+
- name: Install
81+
working-directory: .
82+
run: pnpm install --frozen-lockfile
83+
84+
- uses: expo/expo-github-action@v8
85+
with:
86+
eas-version: latest
87+
token: ${{ secrets.EXPO_TOKEN }}
88+
89+
- name: EAS build
90+
run: eas build --platform ${{ inputs.platform }} --profile ${{ inputs.profile }} --non-interactive --no-wait
91+
92+
- name: EAS submit
93+
if: ${{ inputs.submit }}
94+
run: eas submit --platform ${{ inputs.platform }} --profile ${{ inputs.profile }} --non-interactive --latest

0 commit comments

Comments
 (0)