[dev] [carhartlewis] lewis/comp-device-agent-overhaul

.github/workflows/device-agent-release.yml

@@ -0,0 +1,259 @@
+name: Device Agent Release
+
+on:
+  push:
+    branches: ['**']
+    paths:
+      - 'packages/device-agent/**'
+
+permissions:
+  contents: write
+
+jobs:
+  detect-version:
+    name: Detect Version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      tag_name: ${{ steps.version.outputs.tag_name }}
+      is_prerelease: ${{ steps.version.outputs.is_prerelease }}
+      portal_url: ${{ steps.version.outputs.portal_url }}
+      release_name: ${{ steps.version.outputs.release_name }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Compute next version
+        id: version
+        run: |
+          # Get the latest production tag (ignore -staging suffixes)
+          LATEST_TAG=$(git tag -l 'device-agent-v*' --sort=-v:refname | grep -v '\-staging' | head -1)
+
+          if [ -z "$LATEST_TAG" ]; then
+            # No existing tags - start at 1.0.0
+            NEXT_VERSION="1.0.0"
+          else
+            # Extract version and bump patch
+            CURRENT_VERSION="${LATEST_TAG#device-agent-v}"
+            IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT_VERSION"
+            NEXT_VERSION="$MAJOR.$MINOR.$((PATCH + 1))"
+          fi
+
+          BRANCH="${GITHUB_REF_NAME}"
+
+          if [ "$BRANCH" = "release" ]; then
+            TAG_NAME="device-agent-v${NEXT_VERSION}"
+            IS_PRERELEASE="false"
+            PORTAL_URL="https://app.trycomp.ai"
+            RELEASE_NAME="Device Agent v${NEXT_VERSION}"
+          else
+            TAG_NAME="device-agent-v${NEXT_VERSION}-staging.${GITHUB_RUN_NUMBER}"
+            IS_PRERELEASE="true"
+            PORTAL_URL="https://app.staging.trycomp.ai"
+            RELEASE_NAME="Device Agent v${NEXT_VERSION} (Staging #${GITHUB_RUN_NUMBER})"
+          fi
+
+          echo "version=$NEXT_VERSION" >> $GITHUB_OUTPUT
+          echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
+          echo "is_prerelease=$IS_PRERELEASE" >> $GITHUB_OUTPUT
+          echo "portal_url=$PORTAL_URL" >> $GITHUB_OUTPUT
+          echo "release_name=$RELEASE_NAME" >> $GITHUB_OUTPUT
+
+          echo "--- Version Info ---"
+          echo "Latest tag: $LATEST_TAG"
+          echo "Next version: $NEXT_VERSION"
+          echo "Tag name: $TAG_NAME"
+          echo "Pre-release: $IS_PRERELEASE"
+          echo "Portal URL: $PORTAL_URL"
+
+  build-macos:
+    name: Build macOS (.dmg)
+    needs: detect-version
+    runs-on: macos-latest
+    defaults:
+      run:
+        working-directory: packages/device-agent
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build
+        env:
+          PORTAL_URL: ${{ needs.detect-version.outputs.portal_url }}
+          AGENT_VERSION: ${{ needs.detect-version.outputs.version }}
+        run: bun run build
+
+      - name: Package macOS
+        env:
+          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bun run package:mac
+
+      - name: Upload macOS artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: device-agent-macos
+          path: packages/device-agent/release/*.dmg
+          if-no-files-found: error
+
+  build-windows:
+    name: Build Windows (.exe)
+    needs: detect-version
+    runs-on: windows-latest
+    defaults:
+      run:
+        working-directory: packages/device-agent
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build
+        env:
+          PORTAL_URL: ${{ needs.detect-version.outputs.portal_url }}
+          AGENT_VERSION: ${{ needs.detect-version.outputs.version }}
+        run: bun run build
+
+      - name: Package Windows
+        env:
+          CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bun run package:win
+
+      - name: Upload Windows artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: device-agent-windows
+          path: packages/device-agent/release/*.exe
+          if-no-files-found: error
+
+  build-linux:
+    name: Build Linux (.AppImage, .deb)
+    needs: detect-version
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/device-agent
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build
+        env:
+          PORTAL_URL: ${{ needs.detect-version.outputs.portal_url }}
+          AGENT_VERSION: ${{ needs.detect-version.outputs.version }}
+        run: bun run build
+
+      - name: Package Linux
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bun run package:linux
+
+      - name: Upload Linux artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: device-agent-linux
+          path: |
+            packages/device-agent/release/*.AppImage
+            packages/device-agent/release/*.deb
+          if-no-files-found: error
+
+  release:
+    name: Create GitHub Release
+    needs: [detect-version, build-macos, build-windows, build-linux]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download macOS artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: device-agent-macos
+          path: artifacts/
+
+      - name: Download Windows artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: device-agent-windows
+          path: artifacts/
+
+      - name: Download Linux artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: device-agent-linux
+          path: artifacts/
+
+      - name: Create git tag
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag "${{ needs.detect-version.outputs.tag_name }}" -m "${{ needs.detect-version.outputs.release_name }}"
+          git push origin "${{ needs.detect-version.outputs.tag_name }}"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ needs.detect-version.outputs.tag_name }}
+          name: ${{ needs.detect-version.outputs.release_name }}
+          body: |
+            ## ${{ needs.detect-version.outputs.release_name }}
+
+            **Environment:** ${{ needs.detect-version.outputs.is_prerelease == 'true' && 'Staging' || 'Production' }}
+            **Portal:** ${{ needs.detect-version.outputs.portal_url }}
+
+            ### Downloads
+            - **macOS**: Download the `.dmg` file below (universal binary, Apple Silicon + Intel)
+            - **Windows**: Download the `.exe` installer below
+            - **Linux**: Download the `.AppImage` (portable) or `.deb` (Debian/Ubuntu) below
+
+            ### What's included
+            - Disk encryption check (FileVault / BitLocker / LUKS)
+            - Antivirus detection (XProtect / Windows Defender / ClamAV + AppArmor/SELinux)
+            - Password policy enforcement (minimum 8 characters)
+            - Screen lock verification (5 minutes or less)
+            - Auto-remediation for fixable settings with guided instructions
+
+            ### Installation
+            1. Download the installer for your operating system
+            2. Run the installer and follow the prompts
+            3. Sign in with your Comp AI portal credentials
+            4. The agent will run in your system tray and check compliance automatically
+          draft: false
+          prerelease: ${{ needs.detect-version.outputs.is_prerelease == 'true' }}
+          files: artifacts/*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

apps/api/package.json

@@ -27,6 +27,7 @@
     "@trigger.dev/build": "4.0.6",
     "@trigger.dev/sdk": "4.0.6",
     "@trycompai/db": "1.3.22",
+    "@trycompai/utils": "1.0.0",
     "@trycompai/email": "workspace:*",
     "@upstash/redis": "^1.34.2",
     "@upstash/vector": "^1.2.2",