chore: use hermit to install node, rust and protoc (#2766)

.github/workflows/build-cli.yml

@@ -20,6 +20,10 @@ on:
         type: string
         required: false
         default: '["x86_64","aarch64"]'
+      ref:
+        type: string
+        required: false
+        default: 'refs/heads/main'
 
 name: "Reusable workflow to build CLI"
 
@@ -41,6 +45,9 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 0
 
       - name: Update version in Cargo.toml
         if: ${{ inputs.version != '' }}
@@ -48,14 +55,8 @@ jobs:
           sed -i.bak 's/^version = ".*"/version = "'${{ inputs.version }}'"/' Cargo.toml
           rm -f Cargo.toml.bak
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@38b70195107dddab2c7bbd522bcf763bac00963b # pin@stable
-        with:
-          toolchain: stable
-          target: ${{ matrix.architecture }}-${{ matrix.target-suffix }}
-
       - name: Install cross
-        run: cargo install cross --git https://github.com/cross-rs/cross
+        run: source ./bin/activate-hermit && cargo install cross --git https://github.com/cross-rs/cross
 
       - name: Build CLI
         env:
@@ -64,12 +65,7 @@ jobs:
           RUST_BACKTRACE: 1
           CROSS_VERBOSE: 1
         run: |
-          # Install protoc if on macOS
-          if [ "${{ matrix.os }}" = "macos-latest" ]; then
-            brew install protobuf
-            export PROTOC=$(which protoc)
-          fi
-
+          source ./bin/activate-hermit
           export TARGET="${{ matrix.architecture }}-${{ matrix.target-suffix }}"
           rustup target add "${TARGET}"
           echo "Building for target: ${TARGET}"

.github/workflows/bundle-desktop-intel.yml

@@ -85,20 +85,16 @@ jobs:
           # Update version in Cargo.toml
           sed -i.bak 's/^version = ".*"/version = "'${{ inputs.version }}'"/' Cargo.toml
           rm -f Cargo.toml.bak
-          
-          # Update version in package.json 
+
+          # Update version in package.json
+          source ./bin/activate-hermit
           cd ui/desktop
           npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@38b70195107dddab2c7bbd522bcf763bac00963b # pin@stable
-        with:
-          toolchain: stable
-          targets: x86_64-apple-darwin
-
       # Pre-build cleanup to ensure enough disk space
       - name: Pre-build cleanup
         run: |
+          source ./bin/activate-hermit
           echo "Performing pre-build cleanup..."
           # Clean npm cache
           npm cache clean --force || true
@@ -137,7 +133,7 @@ jobs:
 
       # Build specifically for Intel architecture
       - name: Build goosed for Intel
-        run: cargo build --release -p goose-server --target x86_64-apple-darwin
+        run: source ./bin/activate-hermit && cargo build --release -p goose-server --target x86_64-apple-darwin
 
       # Post-build cleanup to free space
       - name: Post-build cleanup
@@ -164,13 +160,8 @@ jobs:
           CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
           CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
 
-      - name: Set up Node.js
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # pin@v2
-        with:
-          node-version: 'lts/*'
-
       - name: Install dependencies
-        run: npm ci
+        run: source ../../bin/activate-hermit && npm ci
         working-directory: ui/desktop
 
       # Configure Electron builder for Intel architecture
@@ -187,6 +178,7 @@ jobs:
       - name: Make Unsigned App
         if: ${{ !inputs.signing }}
         run: |
+          source ../../bin/activate-hermit
           attempt=0
           max_attempts=2
           until [ $attempt -ge $max_attempts ]; do
@@ -204,6 +196,7 @@ jobs:
       - name: Make Signed App
         if: ${{ inputs.signing }}
         run: |
+          source ../../bin/activate-hermit
           attempt=0
           max_attempts=2
           until [ $attempt -ge $max_attempts ]; do

.github/workflows/bundle-desktop.yml

@@ -135,6 +135,7 @@ jobs:
           sed -i.bak "s/^version = \".*\"/version = \"${VERSION}\"/" Cargo.toml
           rm -f Cargo.toml.bak
           
+          source ./bin/activate-hermit
           # Update version in package.json 
           cd ui/desktop
           npm version "${VERSION}" --no-git-tag-version --allow-same-version
@@ -142,6 +143,7 @@ jobs:
       # Pre-build cleanup to ensure enough disk space
       - name: Pre-build cleanup
         run: |
+          source ./bin/activate-hermit
           echo "Performing pre-build cleanup..."
           # Clean npm cache
           npm cache clean --force || true
@@ -154,16 +156,6 @@ jobs:
           # Check disk space after cleanup
           df -h
 
-      - name: Install protobuf
-        run: |
-          brew install protobuf
-          echo "PROTOC=$(which protoc)" >> $GITHUB_ENV
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@38b70195107dddab2c7bbd522bcf763bac00963b # pin@stable
-        with:
-          toolchain: stable
-
       - name: Cache Cargo registry
         uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
         with:
@@ -190,7 +182,7 @@ jobs:
 
       # Build the project
       - name: Build goosed
-        run: cargo build --release -p goose-server
+        run: source ./bin/activate-hermit && cargo build --release -p goose-server
 
       # Post-build cleanup to free space
       - name: Post-build cleanup
@@ -216,13 +208,8 @@ jobs:
           CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
           CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
 
-      - name: Set up Node.js
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # pin@v2
-        with:
-          node-version: 'lts/*'
-
       - name: Install dependencies
-        run: npm ci
+        run: source ../../bin/activate-hermit && npm ci
         working-directory: ui/desktop
 
       # Check disk space before bundling
@@ -232,6 +219,7 @@ jobs:
       - name: Make Unsigned App
         if: ${{ !inputs.signing }}
         run: |
+          source ../../bin/activate-hermit
           attempt=0
           max_attempts=2
           until [ $attempt -ge $max_attempts ]; do
@@ -253,6 +241,7 @@ jobs:
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: |
+
           attempt=0
           max_attempts=2
           until [ $attempt -ge $max_attempts ]; do

.github/workflows/ci.yml

@@ -17,13 +17,8 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@38b70195107dddab2c7bbd522bcf763bac00963b # pin@stable
-        with:
-          toolchain: stable
-
       - name: Run cargo fmt
-        run: cargo fmt --check
+        run: source ./bin/activate-hermit && cargo fmt --check
 
   rust-build-and-test:
     name: Build and Test Rust Project
@@ -57,12 +52,7 @@ jobs:
       - name: Install Dependencies
         run: |
           sudo apt update -y
-          sudo apt install -y libdbus-1-dev gnome-keyring libxcb1-dev protobuf-compiler
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@38b70195107dddab2c7bbd522bcf763bac00963b # pin@stable
-        with:
-          toolchain: stable
+          sudo apt install -y libdbus-1-dev gnome-keyring libxcb1-dev
 
       - name: Cache Cargo Registry
         uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
@@ -91,7 +81,7 @@ jobs:
       - name: Build and Test
         run: |
           gnome-keyring-daemon --components=secrets --daemonize --unlock <<< 'foobar'
-          cargo test
+          source ../bin/activate-hermit && cargo test
         working-directory: crates
 
       # Add disk space cleanup before linting
@@ -120,7 +110,7 @@ jobs:
         run: df -h
 
       - name: Lint
-        run: cargo clippy -- -D warnings
+        run: source ./bin/activate-hermit && cargo clippy -- -D warnings
 
   desktop-lint:
     name: Lint Electron Desktop App
@@ -129,17 +119,12 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
 
-      - name: Set up Node.js
-        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # pin@v2
-        with:
-          node-version: "lts/*"
-
       - name: Install Dependencies
-        run: npm ci
+        run: source ../../bin/activate-hermit && npm ci
         working-directory: ui/desktop
 
       - name: Run Lint
-        run: npm run lint:check
+        run: source ../../bin/activate-hermit && npm run lint:check
         working-directory: ui/desktop
 
   # Faster Desktop App build for PRs only

.github/workflows/pr-comment-build-cli.yml

@@ -27,6 +27,7 @@ jobs:
     outputs:
       continue: ${{ steps.command.outputs.continue || github.event_name == 'workflow_dispatch' }}
       pr_number: ${{ steps.command.outputs.issue_number || github.event.inputs.pr_number }}
+      head_sha: ${{ steps.set_head_sha.outputs.head_sha || github.sha }}
     steps:
       - if: ${{ github.event_name == 'issue_comment' }}
         uses: github/command@v1.3.0
@@ -36,11 +37,23 @@ jobs:
           skip_reviews: true
           reaction: "eyes"
           allowed_contexts: pull_request
+      - name: Get PR head SHA with gh
+        id: set_head_sha
+        run: |
+          echo "Get PR head SHA with gh"
+          HEAD_SHA=$(gh pr view "$ISSUE_NUMBER" --json headRefOid -q .headRefOid)
+          echo "head_sha=$HEAD_SHA" >> $GITHUB_OUTPUT
+          echo "head_sha=$HEAD_SHA"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ steps.command.outputs.issue_number }}
 
   build-cli:
     needs: [trigger-on-command]
     if: ${{ needs.trigger-on-command.outputs.continue == 'true' }}
     uses: ./.github/workflows/build-cli.yml
+    with:
+      ref: ${{ needs.trigger-on-command.outputs.head_sha }}
 
   pr-comment-cli:
     name: PR Comment with CLI builds