ci: add Jenkinsfile and shell.nix for builds

Signed-off-by: Jakub Sokołowski <jakub@status.im>

ci/Jenkinsfile.build

@@ -0,0 +1,81 @@
+#!/usr/bin/env groovy
+// vim:ft=Jenkinsfile
+library 'status-jenkins-lib@v1.7.11'
+
+pipeline {
+  /* Allows to run the same Jenkinsfile on different platforms. */
+  agent { label params.AGENT_LABEL }
+
+  parameters {
+    string(
+      name: 'AGENT_LABEL',
+      description: 'Label for targetted CI slave host: linux/macos/windows',
+      defaultValue: params.AGENT_LABEL ?: getAgentLabel(),
+    )
+  }
+
+  options {
+    timestamps()
+    ansiColor('xterm')
+    /* This also includes wait time in the queue. */
+    timeout(time: 10, unit: 'MINUTES')
+    /* Abort old builds for non-main branches. */
+    disableConcurrentBuilds()
+    /* Allows combined build to copy */
+    copyArtifactPermission('/keycard-certify/*')
+    /* Limit builds retained. */
+    buildDiscarder(logRotator(
+      numToKeepStr: '5',
+      daysToKeepStr: '30',
+      artifactNumToKeepStr: '3',
+    ))
+  }
+
+  environment {
+    /* Disable MacOS app signing.
+     * https://www.electron.build/code-signing */
+    CSC_IDENTITY_AUTO_DISCOVERY = "false"
+  }
+
+  stages {
+    stage('Deps') {
+      steps { script {
+        nix.shell('npm install', pure: true)
+      } }
+    }
+
+    stage('Build') {
+      steps { script {
+        nix.shell('npm run dist', pure: false)
+      } }
+    }
+
+    stage('Upload') {
+      steps {
+        archiveArtifacts(
+          artifacts: 'dist/keycard-certify*',
+          excludes: 'dist/*.blockmap'
+        )
+      }
+    }
+  } // stages
+
+  post {
+    always { cleanWs() }
+  } // post
+} // pipeline
+
+/* This allows us to use one Jenkinsfile and run
+ * jobs on different platforms based on job name. */
+def getAgentLabel() {
+    if (params.AGENT_LABEL) { return params.AGENT_LABEL }
+    /* We extract the name of the job from currentThread because
+     * before an agent is picked env is not available. */
+    def tokens = Thread.currentThread().getName().split('/')
+    def labels = []
+    /* Check if the job path contains any of the valid labels. */
+    ['linux', 'macos', 'windows', 'x86_64', 'aarch64', 'arm64'].each {
+        if (tokens.contains(it)) { labels.add(it) }
+    }
+    return labels.join(' && ')
+}

ci/Jenkinsfile.release

@@ -0,0 +1,83 @@
+#!/usr/bin/env groovy
+// vim:ft=Jenkinsfile
+library 'status-jenkins-lib@github-add-verbose'
+
+pipeline {
+  /* Allows to run the same Jenkinsfile on different platforms. */
+  agent { label 'linux' }
+
+  parameters {
+    booleanParam(
+      name: 'PUBLISH',
+      description: 'Trigger publishing of build results to GitHub.',
+      defaultValue: getPublishDefault(params.PUBLISH),
+    )
+  }
+
+  options {
+    timestamps()
+    ansiColor('xterm')
+    /* This also includes wait time in the queue. */
+    timeout(time: 20, unit: 'MINUTES')
+    /* Abort old builds for non-main branches. */
+    disableConcurrentBuilds()
+    /* Limit builds retained. */
+    buildDiscarder(logRotator(
+      numToKeepStr: '10',
+      daysToKeepStr: '30',
+    ))
+  }
+
+  stages {
+    stage('Build') {
+      parallel {
+        stage('Linux') { steps { script {
+          linux = jenkins.Build('keycard-certify/platforms/linux/x86_64')
+        } } }
+        stage('MacOS') { steps { script {
+          macos = jenkins.Build('keycard-certify/platforms/macos/x86_64')
+        } } }
+      }
+    }
+
+    stage('Archive') {
+      steps { script {
+        sh('rm -f pkg/*')
+        jenkins.copyArts(linux)
+        jenkins.copyArts(macos)
+        version = readJSON(file: 'package.json')['version']
+        dir('pkg') {
+          /* generate sha256 checksums for upload */
+          sh "sha256sum * | tee ../pkg/keycard-certify_${version}.sha256"
+          archiveArtifacts('*')
+        }
+      } }
+    }
+
+    stage('Publish') {
+      when { expression { params.PUBLISH } }
+      steps { script {
+        github.publishReleaseFiles(
+          repo: 'keycard-certify',
+          version: "v${version}",
+          desc: ':warning: __Please fill me in!__',
+          verbose: true
+        )
+      } }
+    }
+  } // stages
+
+  post {
+    always { cleanWs() }
+  } // post
+} // pipeline
+
+/* Helper that makes PUBLISH default to 'false' unless:
+ * - The build is for a release branch
+ * - A user explicitly specified a value
+ * Since release builds create and re-create GitHub drafts every time. */
+def Boolean getPublishDefault(Boolean previousValue) {
+  if (env.JOB_NAME.startsWith('keycard-certify/release')) { return true }
+  if (previousValue != null) { return previousValue }
+  return false
+}

package.json

@@ -12,7 +12,8 @@
   },
   "build": {
     "appId": "com.github.choppu.keycard-certify",
-    "productName": "Keycard Certify",
+    "productName": "keycard-certify",
+    "artifactName": "${productName}_${version}_${arch}.${ext}",
     "publish": false,
     "files": [
       "**/*",

shell.nix

@@ -0,0 +1,20 @@
+{
+  source ? builtins.fetchTarball {
+    url = "https://github.com/NixOS/nixpkgs/archive/e7603eba51f2c7820c0a182c6bbb351181caa8e7.tar.gz";
+    sha256 = "sha256:0mwck8jyr74wh1b7g6nac1mxy6a0rkppz8n12andsffybsipz5jw";
+  },
+  pkgs ? import source {}
+}:
+
+let
+  inherit (pkgs) lib stdenv darwin;
+  inherit (darwin.apple_sdk_11_0.frameworks) PCSC;
+in pkgs.mkShell {
+  name = "keycard-certify-shell";
+
+  buildInputs = with pkgs; [ nodejs-18_x python310 ];
+  propagatedBuildInputs = if stdenv.isDarwin then [ PCSC ] else [ pkgs.pcsclite ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.isDarwin)
+    "-I ${lib.getDev pkgs.pcsclite}/include/PCSC";
+}

tsconfig.json

@@ -1,10 +1,10 @@
 {
   "compilerOptions": {
-      "target": "es5",         
-      "module": "commonjs",    
-      "strict": true,          
-      "esModuleInterop": true,    
-      "outDir": "./out",
-      "rootDir": "./src"
+    "target": "es5",
+    "module": "commonjs",
+    "strict": true,
+    "esModuleInterop": true,
+    "outDir": "./out",
+    "rootDir": "./src"
   }
-}
+}