ci: automatically bump node parts and use remote build

[jnsgruk]

Fixes #180. This PR is dependent on #179 and should be merged after.

Because we now have multiple parts, which are dependent on the version of Signal, we need to augment the CI to ensure that when we bump the Signal version, we also bump the parts versions if required.

This PR also switches the build process to using snapcraft remote-build in a matrix that creates a job per architecture.

This will be hard to review until #179 is merged, but the diff can be seen cleanly here: https://github.com/snapcrafters/signal-desktop/commit/7eb0bffd90d2efbe609283e47e6504a493fea9b7

[jnsgruk]

@kenvandine :)

[jnsgruk]

@merlijn-sebrechts I've added the Launchpad build stuff here.

[merlijn-sebrechts]

Ah, and one final thing; we might also need to update the test-snap-can-build workflow, so we can find issues with the arm64 build before we push: https://github.com/snapcrafters/signal-desktop/blob/3697c2ae5b88e8d38072646fa8f5b3b67d67fec9/.github/workflows/test-snap-can-build.yml#L18

[merlijn-sebrechts]

FYI: added an issue in action-build to support remote-build. https://github.com/snapcore/action-build/issues/68

[jnsgruk]

@merlijn-sebrechts I think that's all done.

Unfortunately it seems that remote-build --build-for doesn't like being used to just pick a particular arch to be built when they're already specified in the snapcraft.yaml, so I've made some changes there. I'll also have a chat with the starcraft team about making that behave a bit more nicely, and then we should be able to tidy this up.

The /promote command now also supports taking multiple revisions.

The only thing we now need is a new Github Secret setting called LP_BUILD_SECRET, then it should all go green!

[merlijn-sebrechts]

FYI: LP_BUILD_SECRET is now set org-wide, BTW. For a new, clean LP user snapcrafters-bot.

[jnsgruk]

Okay - I've reverted the build action for now to use the Github Action as before. FWIW I don't think using the LP secret in a PR workflow is an issue, provided the repo is configured such that workflows only run after a review from a maintainer (that way the reviewer can check there is no funny business). I did some looking at the conditions for running workflows, and I think checking user membership in a group might be beyond what's possible - but I'll circle back to it later.

The other point here is that in reality the LP credential is somewhat "invaluable" because literally anyone can generate one with the same privileges, but I agree we shouldn't be flippent about that.

Let me know if you'd like any further changes.

[jnsgruk]

@merlijn-sebrechts can we get this merged and check it all works?

If you could add me as a collaborator on the signal-desktop snap I can keep an eye on the builds?

[merlijn-sebrechts]

@jnsgruk Are you asking to become a maintainer of this repo? All snapcrafters are, so do you want to join snapcrafters? :)

[jnsgruk]

@merlijn-sebrechts correct - happy to become a maintainer of this :) (and thus a snapcrafter!)

[merlijn-sebrechts]

Done, welcome to the fold!

We also have a telegram channel. Send me your telegram handle if you want to join that.

[jnsgruk]

Perfect thanks! My telegram handle is the same as here: @jnsgruk

Can you make me a collaborator on signal-desktop on snapcraft.io?

[soumyaDghosh]

@jnsgruk @merlijn-sebrechts How can we get the launchpad build secret?

[merlijn-sebrechts]

@soumyaDghosh I add it to your repo once you have a PR with the GitHub actions ready

For more info on how i create these secrets, and what they are, take a look at https://github.com/snapcrafters/.github/wiki/Permissions-and-Secrets