update ci

.build/prod/.env.example

@@ -0,0 +1,4 @@
+GITEA_SERVER_URL=
+GITEA_REPOSITORY=
+GITEA_TOKEN=
+GITEA_REF_NAME=

.build/prod/.gitignore

@@ -0,0 +1,2 @@
+out/
+.env

.build/prod/Dockerfile

@@ -0,0 +1,21 @@
+# Builder image for the self-hosted HTTP Toolkit single-file binary (Linux x64).
+# Provides Node, Bun, and the toolchain needed to build the server's native modules.
+FROM node:22-bookworm
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential \
+        python3 \
+        cmake \
+        pkg-config \
+        git \
+        curl \
+        unzip \
+        ca-certificates \
+        jq \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Bun (used for the single-file `--compile` step)
+RUN curl -fsSL https://bun.sh/install | bash
+ENV PATH="/root/.bun/bin:${PATH}"
+
+WORKDIR /source

.build/prod/build.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+#
+# Runs INSIDE the .build/prod container. Builds the Linux single-file binary and
+# drops it into .build/prod/out/ (mounted back to the host for the release step).
+#
+set -euo pipefail
+cd /source
+
+# The repo is bind-mounted from the host (owned by a different uid), so git
+# refuses to operate on it until we mark it safe:
+git config --global --add safe.directory '*'
+
+OUT_DIR="/source/.build/prod/out"
+mkdir -p "$OUT_DIR"
+
+# Reuse the platform-agnostic build (apply patches → build UI → embed → bun compile):
+OUT_NAME=httptoolkit bash scripts/build.sh
+
+# Smoke-test the Linux binary before we consider it releasable:
+bash scripts/smoke.sh dist/httptoolkit
+
+cp -v dist/httptoolkit "$OUT_DIR/httptoolkit-linux-x64"
+echo "==> Artifacts:"
+ls -lh "$OUT_DIR"

.build/prod/compose.yml

@@ -0,0 +1,22 @@
+services:
+  prod:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: htk-prod-builder:local
+    network_mode: host
+    working_dir: /source
+    environment:
+      - PUPPETEER_SKIP_DOWNLOAD=true
+      - PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
+    volumes:
+      # The whole repo (with submodules already checked out by the CI step):
+      - ../../:/source
+      # Persist package caches between runs to speed up rebuilds:
+      - htk-npm-cache:/root/.npm
+      - htk-bun-cache:/root/.bun/install/cache
+    command: bash .build/prod/build.sh
+
+volumes:
+  htk-npm-cache:
+  htk-bun-cache:

.build/prod/release.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+#
+# Create a Gitea release for a tag and upload everything in out/.
+# Mirrors the repo's existing Gitea-API release convention.
+#
+# Config via env (or a local .env next to this script):
+#   GITEA_SERVER_URL, GITEA_REPOSITORY, GITEA_TOKEN
+# Tag: passed as $1 (in CI: gitea.ref_name), else derived from the current commit.
+#
+set -euo pipefail
+cd "$(dirname "$0")"
+
+# Optional: load credentials from a local .env for manual runs.
+[ -f .env ] && source ./.env
+
+: "${GITEA_SERVER_URL:?}"
+: "${GITEA_REPOSITORY:?}"
+: "${GITEA_TOKEN:?}"
+
+TAG="${1:-$(git tag --points-at HEAD | head -n1)}"
+[ -n "$TAG" ] || { echo "No tag (pass as arg, or run on a tagged commit)"; exit 1; }
+
+OUT_DIR="$(pwd)/out"
+API="${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases"
+
+echo "==> Creating release $TAG"
+RESP=$(curl -s -X POST "$API" \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Content-Type: application/json" \
+    -d "{\"tag_name\": \"${TAG}\", \"name\": \"HTTP Toolkit ${TAG}\", \"body\": \"Self-hosted single-file build.\"}")
+
+RID=$(echo "$RESP" | jq -r '.id')
+if [ "$RID" = "null" ] || [ -z "$RID" ]; then
+    echo "!! Failed to create release:"; echo "$RESP"; exit 1
+fi
+echo "==> Release id $RID"
+
+shopt -s nullglob
+for f in "$OUT_DIR"/*; do
+    [ -f "$f" ] || continue
+    name=$(basename "$f")
+    echo "==> Uploading $name"
+    curl -s -X POST "${API}/${RID}/assets?name=${name}" \
+        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Content-Type: application/octet-stream" \
+        --data-binary "@${f}" > /dev/null
+done
+echo "==> Release complete."