Feature/automated installers by Rossi-Luciano · Pull Request #34 · scieloorg/markapi

Rossi-Luciano · 2025-10-20T13:54:59Z

No description provided.

- Windows installer with Inno Setup - Linux DEB and AppImage packages - Universal tarball distribution - Automated GitHub Actions workflow

Copilot

Pull Request Overview

This PR implements automated installer support for MarkAPI across multiple platforms, providing universal deployment capabilities and cross-platform compatibility for the SciELO XML processor.

Creates a universal bash script CLI that handles Docker setup and service management
Implements automated installer builds for Windows, Linux, and universal platforms
Adds GitHub Actions workflow for continuous integration of installer packages

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
distribution/universal/markapi	Universal CLI script for cross-platform MarkAPI management
distribution/universal/docker-compose.yml	Simplified Docker Compose configuration for universal deployment
distribution/universal/.env.example	Environment configuration template
distribution/linux/build-deb.sh	Debian package build script for Linux distribution
.github/workflows/build-installers.yml	GitHub Actions workflow for automated installer builds

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-20T14:09:25Z

+        # Fallback simples
+        date +%s | sha256sum | head -c 32


The fallback password generation method uses predictable timestamp and is not cryptographically secure. Consider using /dev/urandom or requiring openssl/python3 for secure password generation.

Suggested change

# Fallback simples

date +%s | sha256sum | head -c 32

# Fallback seguro usando /dev/urandom

head -c 16 /dev/urandom | xxd -p

Copilot · 2025-10-20T14:09:25Z

+                # Atualizar .env com senhas geradas
+                sed -i.bak "s/DB_PASSWORD=.*/DB_PASSWORD=$db_password/" .env
+                sed -i.bak "s/SECRET_KEY=.*/SECRET_KEY=$secret_key/" .env


The sed commands could fail if the generated passwords contain special regex characters (/, &, etc.). Use a more robust method to replace these values or escape the variables properly.

Suggested change

# Atualizar .env com senhas geradas

sed -i.bak "s/DB_PASSWORD=.*/DB_PASSWORD=$db_password/" .env

sed -i.bak "s/SECRET_KEY=.*/SECRET_KEY=$secret_key/" .env

# Função para escapar caracteres especiais para sed replacement

escape_sed_replacement() {

printf '%s' "$1" | sed 's/[\/&\\]/\\&/g'

}

# Atualizar .env com senhas geradas (usando | como delimitador)

db_password_escaped=$(escape_sed_replacement "$db_password")

secret_key_escaped=$(escape_sed_replacement "$secret_key")

sed -i.bak "s|DB_PASSWORD=.*|DB_PASSWORD=$db_password_escaped|" .env

sed -i.bak "s|SECRET_KEY=.*|SECRET_KEY=$secret_key_escaped|" .env

Copilot · 2025-10-20T14:09:26Z

+        # Remove docker volumes (optional)
+        docker volume prune -f 2>/dev/null || true


Running 'docker volume prune -f' in the package removal script could delete unrelated Docker volumes from other applications. This should be more specific to MarkAPI volumes only.

Suggested change

# Remove docker volumes (optional)

docker volume prune -f 2>/dev/null || true

# Remove MarkAPI docker volumes only (optional)

for v in $(docker volume ls -q --filter name=markapi); do

docker volume rm "$v" 2>/dev/null || true

done

Copilot · 2025-10-20T14:09:26Z

+          $url = "https://files.jrsoftware.org/is/6/innosetup-6.2.2.exe"
+          Invoke-WebRequest -Uri $url -OutFile "innosetup.exe"


Downloading and executing software from external URLs without checksum verification poses a security risk. Consider verifying the installer's hash or using a GitHub Actions marketplace action for Inno Setup.

Suggested change

$url = "https://files.jrsoftware.org/is/6/innosetup-6.2.2.exe"

Invoke-WebRequest -Uri $url -OutFile "innosetup.exe"

$url = "https://files.jrsoftware.org/is/6/innosetup-6.2.2.exe"

$expectedHash = "b7e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2" # Replace with actual SHA256 from vendor

Invoke-WebRequest -Uri $url -OutFile "innosetup.exe"

$actualHash = (Get-FileHash "innosetup.exe" -Algorithm SHA256).Hash.ToLower()

if ($actualHash -ne $expectedHash) {

Write-Error "Installer hash mismatch! Aborting."

exit 1

}

Copilot · 2025-10-20T14:09:26Z

+        docker run --rm -v $(pwd):/backup -v markapi_markapi_media:/media \
+            alpine tar czf /backup/$backup_dir/media.tar.gz /media 2>/dev/null


The hardcoded volume name 'markapi_markapi_media' may not match the actual volume name used by the Docker Compose setup. Consider dynamically detecting the volume name or making it configurable.

robertatakenaka · 2025-10-20T20:54:08Z

+        default: '1.0.0'
+
+env:
+  APP_VERSION: ${{ github.event.inputs.version || '1.0.0' }}


@Rossi-Luciano pesquise como usar uma versão de forma variável (consulte o repositório scms-upload (há o arquivo VERSION)

robertatakenaka · 2025-10-20T20:54:58Z

+
+      - name: Build Windows installer
+        run: |
+          $inno = "C:\Program Files (x86)\Inno Setup 6\ISCC.exe"


@Rossi-Luciano evite caminhos fixos

robertatakenaka · 2025-10-20T20:55:27Z

+        uses: actions/upload-artifact@v4
+        with:
+          name: markapi-windows-installer
+          path: distribution/windows/Output/MarkAPI-Setup-*.exe


@Rossi-Luciano tornar "variável"

Copilot

Pull Request Overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-10-28T11:36:16Z

+                sed -i.bak "s/DB_PASSWORD=.*/DB_PASSWORD=$db_password/" .env
+                sed -i.bak "s/SECRET_KEY=.*/SECRET_KEY=$secret_key/" .env
+                rm -f .env.bak


The sed -i.bak syntax is BSD/macOS specific. On Linux (GNU sed), this will fail. Use sed -i on Linux or create a cross-platform solution with explicit backup file extension: sed -i.bak for macOS and sed -i'' -e for portability.

Suggested change

sed -i.bak "s/DB_PASSWORD=.*/DB_PASSWORD=$db_password/" .env

sed -i.bak "s/SECRET_KEY=.*/SECRET_KEY=$secret_key/" .env

rm -f .env.bak

if [ "$PLATFORM" = "mac" ]; then

sed -i.bak "s/DB_PASSWORD=.*/DB_PASSWORD=$db_password/" .env

sed -i.bak "s/SECRET_KEY=.*/SECRET_KEY=$secret_key/" .env

rm -f .env.bak

else

sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$db_password/" .env

sed -i "s/SECRET_KEY=.*/SECRET_KEY=$secret_key/" .env

fi

Rossi-Luciano added 2 commits October 20, 2025 10:32

feat: Add automated installer builds

5747b60

- Windows installer with Inno Setup - Linux DEB and AppImage packages - Universal tarball distribution - Automated GitHub Actions workflow

fix: Clean YAML formatting (line length and trailing spaces)

2bc1759

robertatakenaka requested a review from Copilot October 20, 2025 14:08

Copilot AI reviewed Oct 20, 2025

View reviewed changes

fix: Add missing build-appimage.sh script

de138b7

robertatakenaka reviewed Oct 20, 2025

View reviewed changes

fix: Use chocolatey for Inno Setup and add fallbacks for missing files

d47cfab

robertatakenaka requested a review from Copilot October 28, 2025 11:35

Copilot AI reviewed Oct 28, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/automated installers#34

Feature/automated installers#34
Rossi-Luciano wants to merge 4 commits intoscieloorg:mainfrom
Rossi-Luciano:feature/automated-installers

Rossi-Luciano commented Oct 20, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 20, 2025

Uh oh!

Copilot AI Oct 20, 2025

Uh oh!

Copilot AI Oct 20, 2025

Uh oh!

Copilot AI Oct 20, 2025

Uh oh!

Copilot AI Oct 20, 2025

Uh oh!

robertatakenaka Oct 20, 2025

Uh oh!

robertatakenaka Oct 20, 2025

Uh oh!

robertatakenaka Oct 20, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-                # Atualizar .env com senhas geradas
-                sed -i.bak "s/DB_PASSWORD=.*/DB_PASSWORD=$db_password/" .env
-                sed -i.bak "s/SECRET_KEY=.*/SECRET_KEY=$secret_key/" .env
+                # Função para escapar caracteres especiais para sed replacement
+                escape_sed_replacement() {
+                    printf '%s' "$1" | sed 's/[\/&\\]/\\&/g'
+                }
+                # Atualizar .env com senhas geradas (usando | como delimitador)
+                db_password_escaped=$(escape_sed_replacement "$db_password")
+                secret_key_escaped=$(escape_sed_replacement "$secret_key")
+                sed -i.bak "s|DB_PASSWORD=.*|DB_PASSWORD=$db_password_escaped|" .env
+                sed -i.bak "s|SECRET_KEY=.*|SECRET_KEY=$secret_key_escaped|" .env

		# Remove docker volumes (optional)
		docker volume prune -f 2>/dev/null \|\| true

-        # Remove docker volumes (optional)
-        docker volume prune -f 2>/dev/null || true
+        # Remove MarkAPI docker volumes only (optional)
+        for v in $(docker volume ls -q --filter name=markapi); do
+            docker volume rm "$v" 2>/dev/null || true
+        done

		$url = "https://files.jrsoftware.org/is/6/innosetup-6.2.2.exe"
		Invoke-WebRequest -Uri $url -OutFile "innosetup.exe"

		docker run --rm -v $(pwd):/backup -v markapi_markapi_media:/media \
		alpine tar czf /backup/$backup_dir/media.tar.gz /media 2>/dev/null

Conversation

Rossi-Luciano commented Oct 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

robertatakenaka Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

robertatakenaka Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

robertatakenaka Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants