Nightly: remote daemon, Tailscale setup, and PWA client

.dockerignore

@@ -0,0 +1,8 @@
+**
+!deploy/
+!deploy/remote-pwa/
+!deploy/remote-pwa/Dockerfile
+!deploy/remote-pwa/nginx.conf
+!frontend/
+!frontend/dist/
+!frontend/dist/**

.github/workflows/deploy-remote-pwa-preview.yml

@@ -0,0 +1,96 @@
+name: Deploy Remote PWA Preview
+
+on:
+  push:
+    branches: [nightly]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID || 'pane-pwa-preview' }}
+  GCP_REGION: ${{ vars.GCP_REGION || 'us-central1' }}
+  GAR_REPOSITORY: ${{ vars.GAR_REPOSITORY || 'pane-preview' }}
+  CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE || 'pane-remote-pwa-preview' }}
+  CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT: ${{ vars.CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT || '' }}
+
+jobs:
+  deploy:
+    name: Build and deploy preview
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.15.1'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build remote PWA assets
+        run: pnpm run build:frontend
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ vars.GCP_DEPLOY_SERVICE_ACCOUNT }}
+
+      - name: Setup Google Cloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Configure Artifact Registry Docker auth
+        run: gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev" --quiet --project="${GCP_PROJECT_ID}"
+
+      - name: Build and push container
+        env:
+          IMAGE_TAG: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+
+          image="${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GAR_REPOSITORY}/${CLOUD_RUN_SERVICE}:${IMAGE_TAG}"
+          docker build \
+            --file deploy/remote-pwa/Dockerfile \
+            --tag "$image" \
+            .
+          docker push "$image"
+          echo "IMAGE=$image" >> "$GITHUB_ENV"
+
+      - name: Deploy to Cloud Run
+        run: |
+          set -euo pipefail
+
+          runtime_service_account="${CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT:-pane-remote-pwa-runtime@${GCP_PROJECT_ID}.iam.gserviceaccount.com}"
+
+          gcloud run deploy "$CLOUD_RUN_SERVICE" \
+            --project="$GCP_PROJECT_ID" \
+            --region="$GCP_REGION" \
+            --platform=managed \
+            --image="$IMAGE" \
+            --service-account="$runtime_service_account" \
+            --no-invoker-iam-check \
+            --min-instances=0 \
+            --max-instances=1 \
+            --cpu=1 \
+            --memory=256Mi \
+            --port=8080 \
+            --set-env-vars="PANE_REMOTE_PWA_PREVIEW_COMMIT=${GITHUB_SHA},PANE_REMOTE_PWA_PREVIEW_REF=${GITHUB_REF_NAME}" \
+            --quiet
+
+      - name: Print service URL
+        run: |
+          gcloud run services describe "$CLOUD_RUN_SERVICE" \
+            --project="$GCP_PROJECT_ID" \
+            --region="$GCP_REGION" \
+            --platform=managed \
+            --format='value(status.url)'

.github/workflows/nightly-release.yml

@@ -0,0 +1,239 @@
+name: Nightly / Canary Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: 'Release channel'
+        type: choice
+        required: true
+        default: nightly
+        options:
+          - nightly
+          - canary
+      source_ref:
+        description: 'Branch, tag, or SHA to build'
+        type: string
+        required: true
+        default: nightly
+
+permissions:
+  contents: write
+
+jobs:
+  metadata:
+    runs-on: ubuntu-latest
+    outputs:
+      channel: ${{ steps.meta.outputs.channel }}
+      source_ref: ${{ steps.meta.outputs.source_ref }}
+      source_sha: ${{ steps.meta.outputs.source_sha }}
+      short_sha: ${{ steps.meta.outputs.short_sha }}
+      version: ${{ steps.meta.outputs.version }}
+      tag: ${{ steps.meta.outputs.tag }}
+      title: ${{ steps.meta.outputs.title }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.source_ref }}
+          fetch-depth: 0
+
+      - id: meta
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          channel="${{ inputs.channel }}"
+          source_ref="${{ inputs.source_ref }}"
+          base_version="$(node -p "require('./package.json').version.replace(/-.*/, '')")"
+          source_sha="$(git rev-parse HEAD)"
+          short_sha="$(git rev-parse --short=7 HEAD)"
+          timestamp="$(date -u +%Y%m%d%H%M)"
+          version="${base_version}-${channel}.${timestamp}.${short_sha}.${{ github.run_number }}.${{ github.run_attempt }}"
+          tag="v${version}"
+          title="Pane ${channel^} ${version}"
+
+          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*$ ]]; then
+            echo "Generated version is not valid semver: $version" >&2
+            exit 1
+          fi
+
+          {
+            echo "channel=$channel"
+            echo "source_ref=$source_ref"
+            echo "source_sha=$source_sha"
+            echo "short_sha=$short_sha"
+            echo "version=$version"
+            echo "tag=$tag"
+            echo "title=$title"
+          } >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: metadata
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            command: build:mac:ci
+            artifact_name: pane-macos
+            artifact_path: |
+              dist-electron/*.dmg
+          - os: ubuntu-latest
+            command: build:linux:ci
+            artifact_name: pane-linux
+            artifact_path: |
+              dist-electron/*.deb
+              dist-electron/*.AppImage
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.metadata.outputs.source_sha }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.15.1'
+          cache: 'pnpm'
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/electron
+            ~/.cache/electron-builder
+          key: ${{ runner.os }}-electron-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: ${{ runner.os }}-electron-
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Stamp prerelease version
+        env:
+          NIGHTLY_VERSION: ${{ needs.metadata.outputs.version }}
+        run: |
+          node - <<'NODE'
+          const fs = require('fs');
+          const path = require('path');
+          const packagePath = path.resolve('package.json');
+          const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+          packageJson.version = process.env.NIGHTLY_VERSION;
+          fs.writeFileSync(packagePath, `${JSON.stringify(packageJson, null, 2)}\n`);
+          NODE
+
+      - name: Build ${{ matrix.os }} package
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+          CSC_DISABLE: 'true'
+        run: pnpm run ${{ matrix.command }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact_name }}-${{ needs.metadata.outputs.channel }}-${{ needs.metadata.outputs.tag }}
+          path: ${{ matrix.artifact_path }}
+          if-no-files-found: error
+          retention-days: 30
+
+  build-windows:
+    needs: metadata
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - x64
+          - arm64
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.metadata.outputs.source_sha }}
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.15.1'
+          cache: 'pnpm'
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/AppData/Local/electron/Cache
+            ~/AppData/Local/electron-builder/Cache
+          key: windows-${{ matrix.arch }}-electron-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: windows-${{ matrix.arch }}-electron-
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Stamp prerelease version
+        env:
+          NIGHTLY_VERSION: ${{ needs.metadata.outputs.version }}
+        shell: bash
+        run: |
+          node - <<'NODE'
+          const fs = require('fs');
+          const path = require('path');
+          const packagePath = path.resolve('package.json');
+          const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+          packageJson.version = process.env.NIGHTLY_VERSION;
+          fs.writeFileSync(packagePath, `${JSON.stringify(packageJson, null, 2)}\n`);
+          NODE
+
+      - name: Build Windows ${{ matrix.arch }} package
+        run: node scripts/build-win.js ${{ matrix.arch }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: pane-windows-${{ matrix.arch }}-${{ needs.metadata.outputs.channel }}-${{ needs.metadata.outputs.tag }}
+          path: |
+            dist-electron/*-Windows-${{ matrix.arch }}.exe
+          if-no-files-found: error
+          retention-days: 30
+
+  publish:
+    needs:
+      - metadata
+      - build
+      - build-windows
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: release-assets
+          merge-multiple: true
+
+      - name: Publish prerelease
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          CHANNEL: ${{ needs.metadata.outputs.channel }}
+          SOURCE_REF: ${{ needs.metadata.outputs.source_ref }}
+          SOURCE_SHA: ${{ needs.metadata.outputs.source_sha }}
+          SHORT_SHA: ${{ needs.metadata.outputs.short_sha }}
+          VERSION: ${{ needs.metadata.outputs.version }}
+          TAG: ${{ needs.metadata.outputs.tag }}
+          TITLE: ${{ needs.metadata.outputs.title }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          find release-assets -maxdepth 1 -type f | sort
+          cat > release-notes.md <<EOF
+          Manual ${CHANNEL} build from \`${SOURCE_REF}\` at \`${SHORT_SHA}\`.
+
+          This is a GitHub prerelease for manual testing. It is not marked as Latest and does not include update metadata assets, so stable users will not be moved onto this channel by auto-update.
+
+          Build version: \`${VERSION}\`
+          Source commit: \`${SOURCE_SHA}\`
+          EOF
+
+          gh release create "$TAG" release-assets/* \
+            --repo "$GH_REPO" \
+            --target "$SOURCE_SHA" \
+            --title "$TITLE" \
+            --notes-file release-notes.md \
+            --prerelease \
+            --latest=false