Migrate GitHub automation to GitLab CI

.github/workflows/desktop-release.yml

@@ -1,116 +0,0 @@
-name: Overlord Desktop Windows Release
-
-on:
-  push:
-    branches: ["main"]
-    paths:
-      - "Overlord-Desktop/**"
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: windows-latest
-    permissions:
-      contents: write
-
-    defaults:
-      run:
-        working-directory: Overlord-Desktop
-
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          fetch-depth: 0
-
-      - name: Get Version
-        id: version
-        run: |
-          $version = (Get-Content package.json | ConvertFrom-Json).version
-          if ($version -notmatch '^\d+\.\d+\.\d+$') {
-            throw "package.json version must be strict X.Y.Z SemVer for release tags; got '$version'"
-          }
-          "version=$version" >> $env:GITHUB_OUTPUT
-        shell: pwsh
-
-      - name: Ensure Release Tag Does Not Exist
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          set -euo pipefail
-          tag="Overlord-Desktop-v${VERSION}"
-          if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
-            echo "Release tag already exists: ${tag}" >&2
-            exit 1
-          fi
-          if gh release view "${tag}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
-            echo "Release already exists: ${tag}" >&2
-            exit 1
-          fi
-        shell: bash
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.14
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-
-      - name: Cache Rust build
-        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
-        with:
-          workspaces: Overlord-Desktop/src-tauri -> target
-
-      - name: Install Dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Vendor frontend assets
-        run: bun run vendor
-
-      - name: Build Windows Installer (Tauri NSIS)
-        run: bun run build:win
-
-      - name: Locate NSIS Installer
-        id: locate
-        shell: pwsh
-        run: |
-          $nsis = Get-ChildItem -Path src-tauri\target\release\bundle\nsis\*.exe -ErrorAction Stop | Select-Object -First 1
-          echo "INSTALLER=$($nsis.FullName)" >> $env:GITHUB_ENV
-          echo "INSTALLER_NAME=$($nsis.Name)" >> $env:GITHUB_ENV
-
-      - name: Upload Build Artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: overlord-desktop-${{ steps.version.outputs.version }}
-          path: ${{ env.INSTALLER }}
-
-      - name: Create and Push Tag
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          set -euo pipefail
-          tag="Overlord-Desktop-v${VERSION}"
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag "${tag}"
-          git push origin "${tag}"
-        shell: bash
-
-      - name: Create Release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          set -euo pipefail
-          tag="Overlord-Desktop-v${VERSION}"
-          gh release create "${tag}" "${INSTALLER}" "PLEASE_READ.txt" \
-            --verify-tag \
-            -t "Overlord Desktop v${VERSION}" \
-            -n "Automated build release for Overlord Desktop v${VERSION}" \
-            --draft=false \
-            --prerelease=false
-        shell: bash

.github/workflows/docker-publish.yml

@@ -1,204 +0,0 @@
-name: overlord-ci
-
-on:
-  workflow_dispatch:
-    inputs:
-      release_version:
-        description: 'Release version to publish, for example 1.2.3'
-        required: true
-        type: string
-
-env:
-  REGISTRY: ghcr.io
-  RELEASE_VERSION: ${{ inputs.release_version }}
-
-permissions:
-  contents: read
-
-jobs:
-  approve-release:
-    runs-on: ubuntu-latest
-    environment: overlord-ci
-    steps:
-      - name: Confirm release approval
-        run: echo "Approved release ${RELEASE_VERSION}"
-
-  build-and-push:
-    needs: approve-release
-    name: Build and push (${{ matrix.platform }})
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-            artifact: amd64
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-            artifact: arm64
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - name: Read Source Version
-        id: srcver
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          client_version=$(grep -oP 'var\s+AgentVersion\s*=\s*"\K[0-9]+\.[0-9]+\.[0-9]+' Overlord-Client/cmd/agent/config/config.go)
-          server_version=$(grep -oP 'export\s+const\s+SERVER_VERSION\s*=\s*"\K[0-9]+\.[0-9]+\.[0-9]+' Overlord-Server/src/version.ts)
-          package_version=$(node -p "require('./Overlord-Server/package.json').version")
-
-          if [[ -z "$client_version" || -z "$server_version" || -z "$package_version" ]]; then
-            echo "Failed to parse one or more version values from source files" >&2
-            exit 1
-          fi
-
-          if ! { [[ "$client_version" == "$server_version" ]] && [[ "$client_version" == "$package_version" ]]; }; then
-            echo "Version mismatch detected:" >&2
-            echo "  client(config.go): $client_version" >&2
-            echo "  server(version.ts): $server_version" >&2
-            echo "  package(package.json): $package_version" >&2
-            exit 1
-          fi
-
-          major="${client_version%%.*}"
-          rest="${client_version#*.}"
-          minor="${rest%%.*}"
-
-          {
-            echo "version=$client_version"
-            echo "major=$major"
-            echo "minor=$minor"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Validate Release Version Matches Source Version
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ ! "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Release version must be strict semver like 1.2.3; got ${RELEASE_VERSION}" >&2
-            exit 1
-          fi
-          src_version="${{ steps.srcver.outputs.version }}"
-          if [[ "$RELEASE_VERSION" != "$src_version" ]]; then
-            echo "Release version ($RELEASE_VERSION) does not match source version ($src_version)" >&2
-            exit 1
-          fi
-
-      - name: Normalize image name
-        run: printf 'IMAGE_NAME=%s\n' "${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=raw,value=${{ steps.srcver.outputs.version }}
-            type=raw,value=${{ steps.srcver.outputs.major }}.${{ steps.srcver.outputs.minor }}
-            type=raw,value=${{ steps.srcver.outputs.major }}
-            type=raw,value=latest
-
-      - name: Build and push server image
-        id: build
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,scope=server-${{ matrix.artifact }}
-          cache-to: type=gha,mode=max,scope=server-${{ matrix.artifact }}
-          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
-
-      - name: Export image digest
-        shell: bash
-        run: |
-          set -euo pipefail
-          mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          test -n "$digest"
-          touch "/tmp/digests/${digest#sha256:}"
-
-      - name: Upload image digest
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: image-digest-${{ matrix.artifact }}
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-  merge-and-publish:
-    name: Merge and publish multi-architecture image
-    needs: build-and-push
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Normalize image name
-        run: printf 'IMAGE_NAME=%s\n' "${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
-
-      - name: Download image digests
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          pattern: image-digest-*
-          path: /tmp/digests
-          merge-multiple: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract release tags
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=semver,pattern={{version}},value=${{ env.RELEASE_VERSION }}
-            type=semver,pattern={{major}}.{{minor}},value=${{ env.RELEASE_VERSION }}
-            type=semver,pattern={{major}},value=${{ env.RELEASE_VERSION }}
-            type=raw,value=latest
-
-      - name: Create and push multi-architecture manifest
-        working-directory: /tmp/digests
-        shell: bash
-        run: |
-          set -euo pipefail
-          test "$(find . -maxdepth 1 -type f | wc -l)" -eq 2
-          mapfile -t tag_args < <(jq -r '.tags[] | "-t", .' <<< "$DOCKER_METADATA_OUTPUT_JSON")
-          digest_args=()
-          for digest_file in *; do
-            digest_args+=("${REGISTRY}/${IMAGE_NAME}@sha256:${digest_file}")
-          done
-          docker buildx imagetools create "${tag_args[@]}" "${digest_args[@]}"
-
-      - name: Verify published manifest
-        run: docker buildx imagetools inspect "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${RELEASE_VERSION}"

.github/workflows/tests.yml

@@ -1,135 +0,0 @@
-name: tests
-
-on:
-  pull_request:
-  push:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  changes:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-    outputs:
-      server: ${{ steps.filter.outputs.server }}
-      client: ${{ steps.filter.outputs.client }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - name: Detect changed paths
-        uses: dorny/paths-filter@6852f92c20ea7fd3b0c25de3b5112db3a98da050 # v3
-        id: filter
-        with:
-          filters: |
-            server:
-              - 'Overlord-Server/**'
-              - 'Overlord-Client/cmd/agent/wire/wire_contract_generated.go'
-              - 'protocol/**'
-              - 'scripts/generate-wire-protocol.ts'
-              - '.github/workflows/tests.yml'
-            client:
-              - 'Overlord-Client/**'
-              - 'protocol/**'
-              - 'scripts/generate-wire-protocol.ts'
-              - 'go.work'
-              - 'go.work.sum'
-
-  server-tests:
-    needs: changes
-    if: needs.changes.outputs.server == 'true' || github.event_name == 'workflow_dispatch'
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    defaults:
-      run:
-        working-directory: Overlord-Server
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.14
-
-      - name: Install server dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Typecheck server
-        run: bun run typecheck
-
-      - name: Verify generated wire protocol
-        run: bun run protocol:check
-
-      - name: Run server tests
-        run: bun run test
-
-  server-e2e-tests:
-    needs: changes
-    if: needs.changes.outputs.server == 'true' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: Overlord-Server
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.14
-
-      - name: Install server dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Install Chromium and system dependencies
-        run: bunx playwright install --with-deps chromium
-
-      - name: Run browser tests
-        run: bun run test:e2e
-
-  client-tests:
-    needs: changes
-    if: needs.changes.outputs.client == 'true' || github.event_name == 'workflow_dispatch'
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    defaults:
-      run:
-        working-directory: Overlord-Client
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
-        with:
-          go-version-file: Overlord-Client/go.mod
-          cache: true
-          cache-dependency-path: |
-            Overlord-Client/go.sum
-            go.work.sum
-
-      - name: Download Go modules
-        run: go mod download
-
-      - name: Vendor third-party headers (Windows)
-        if: runner.os == 'Windows'
-        shell: bash
-        working-directory: ${{ github.workspace }}
-        run: |
-          bash scripts/vendor-onevpl-headers.sh
-          bash scripts/vendor-amf-headers.sh
-
-      - name: Run client tests
-        run: go test ./...

.gitlab-ci.yml

@@ -0,0 +1,21 @@
+stages:
+  - test
+  - package
+  - release
+
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS && $CI_PIPELINE_SOURCE == "push"'
+      when: never
+    - if: "$CI_COMMIT_BRANCH || $CI_COMMIT_TAG"
+
+variables:
+  RELEASE_VERSION:
+    value: ""
+    description: "Server image version to publish (strict SemVer, for example 3.1.0). Leave blank for a test-only pipeline."
+
+include:
+  - local: /.gitlab/ci/tests.yml
+  - local: /.gitlab/ci/container-release.yml
+  - local: /.gitlab/ci/desktop-release.yml

.gitlab/ci/container-release.yml

@@ -0,0 +1,106 @@
+approve-container-release:
+  stage: package
+  image: alpine:3.22
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "web" && $RELEASE_VERSION =~ /^\d+\.\d+\.\d+$/'
+      when: manual
+  environment:
+    name: overlord-container-release
+  script:
+    - echo "Approved container release ${RELEASE_VERSION}"
+
+container-build:
+  stage: package
+  image: docker:27.5.1-cli
+  services:
+    - name: docker:27.5.1-dind
+      command: ["--mtu=1400"]
+  needs:
+    - approve-container-release
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "web" && $RELEASE_VERSION =~ /^\d+\.\d+\.\d+$/'
+  parallel:
+    matrix:
+      - PLATFORM: linux/amd64
+        ARCH: amd64
+        RUNNER_TAG: saas-linux-small-amd64
+      - PLATFORM: linux/arm64
+        ARCH: arm64
+        RUNNER_TAG: saas-linux-small-arm64
+  tags:
+    - $RUNNER_TAG
+  variables:
+    DOCKER_TLS_CERTDIR: /certs
+  before_script:
+    - echo "$CI_REGISTRY_PASSWORD" | docker login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
+    - docker buildx create --driver docker-container --use
+    - docker buildx inspect --bootstrap
+  script:
+    - |
+      set -eu
+      client_version=$(sed -nE 's/.*AgentVersion[[:space:]]*=[[:space:]]*"([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' Overlord-Client/cmd/agent/config/config.go | head -n1)
+      server_version=$(sed -nE 's/.*SERVER_VERSION[[:space:]]*=[[:space:]]*"([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' Overlord-Server/src/version.ts | head -n1)
+      package_version=$(sed -nE 's/[[:space:]]*"version":[[:space:]]*"([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' Overlord-Server/package.json | head -n1)
+      test -n "$client_version"
+      test "$client_version" = "$server_version"
+      test "$client_version" = "$package_version"
+      test "$RELEASE_VERSION" = "$client_version"
+    - |
+      set -eu
+      metadata_file=$(mktemp)
+      docker buildx build \
+        --file Dockerfile \
+        --platform "$PLATFORM" \
+        --label "org.opencontainers.image.source=$CI_PROJECT_URL" \
+        --label "org.opencontainers.image.revision=$CI_COMMIT_SHA" \
+        --cache-from "type=registry,ref=$CI_REGISTRY_IMAGE:buildcache-$ARCH" \
+        --cache-to "type=registry,ref=$CI_REGISTRY_IMAGE:buildcache-$ARCH,mode=max" \
+        --output "type=image,name=$CI_REGISTRY_IMAGE,push-by-digest=true,name-canonical=true,push=true" \
+        --metadata-file "$metadata_file" \
+        .
+      digest=$(sed -nE 's/.*"containerimage.digest"[[:space:]]*:[[:space:]]*"sha256:([a-f0-9]+)".*/\1/p' "$metadata_file" | head -n1)
+      test -n "$digest"
+      mkdir -p digests
+      touch "digests/$digest"
+  artifacts:
+    expire_in: 1 day
+    paths:
+      - digests/
+
+container-publish:
+  stage: release
+  image: docker:27.5.1-cli
+  services:
+    - name: docker:27.5.1-dind
+      command: ["--mtu=1400"]
+  tags:
+    - saas-linux-small-amd64
+  needs:
+    - job: container-build
+      artifacts: true
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "web" && $RELEASE_VERSION =~ /^\d+\.\d+\.\d+$/'
+  variables:
+    DOCKER_TLS_CERTDIR: /certs
+  before_script:
+    - echo "$CI_REGISTRY_PASSWORD" | docker login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
+    - docker buildx create --driver docker-container --use
+    - docker buildx inspect --bootstrap
+  script:
+    - |
+      set -eu
+      major=${RELEASE_VERSION%%.*}
+      remainder=${RELEASE_VERSION#*.}
+      minor=${remainder%%.*}
+      set --
+      for digest_file in digests/*; do
+        set -- "$@" "$CI_REGISTRY_IMAGE@sha256:$(basename "$digest_file")"
+      done
+      test "$#" -eq 2
+      docker buildx imagetools create \
+        --tag "$CI_REGISTRY_IMAGE:$RELEASE_VERSION" \
+        --tag "$CI_REGISTRY_IMAGE:$major.$minor" \
+        --tag "$CI_REGISTRY_IMAGE:$major" \
+        --tag "$CI_REGISTRY_IMAGE:latest" \
+        "$@"
+      docker buildx imagetools inspect "$CI_REGISTRY_IMAGE:$RELEASE_VERSION"

.gitlab/ci/desktop-release.yml

@@ -0,0 +1,88 @@
+desktop-build-windows:
+  stage: package
+  tags:
+    - saas-windows-medium-amd64
+  rules:
+    - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+      changes:
+        - Overlord-Desktop/package.json
+        - Overlord-Desktop/bun.lock
+        - Overlord-Desktop/scripts/**/*
+        - Overlord-Desktop/src/**/*
+        - Overlord-Desktop/src-tauri/**/*
+  before_script:
+    - npm install --global --prefix "$env:CI_PROJECT_DIR\.tools" bun@1.3.14
+    - $env:PATH = "$env:CI_PROJECT_DIR\.tools;$env:USERPROFILE\.cargo\bin;$env:PATH"
+    - |
+      if (-not (Get-Command rustup -ErrorAction SilentlyContinue)) {
+        Invoke-WebRequest -UseBasicParsing https://win.rustup.rs/x86_64 -OutFile "$env:CI_PROJECT_DIR\rustup-init.exe"
+        & "$env:CI_PROJECT_DIR\rustup-init.exe" -y --profile minimal
+      }
+    - rustup toolchain install stable --profile minimal
+    - rustup default stable
+  script:
+    - Set-Location Overlord-Desktop
+    - |
+      $Version = (Get-Content package.json | ConvertFrom-Json).version
+      if ($Version -notmatch '^\d+\.\d+\.\d+$') {
+        throw "package.json version must be strict X.Y.Z SemVer; got '$Version'"
+      }
+      $Tag = "Overlord-Desktop-v$Version"
+      if (git ls-remote --exit-code --tags origin "refs/tags/$Tag") {
+        throw "Release tag already exists: $Tag"
+      }
+      $env:DESKTOP_VERSION = $Version
+      $env:DESKTOP_TAG = $Tag
+      "DESKTOP_VERSION=$Version" | Out-File -FilePath "$env:CI_PROJECT_DIR\desktop.env" -Encoding ascii
+      "DESKTOP_TAG=$Tag" | Out-File -FilePath "$env:CI_PROJECT_DIR\desktop.env" -Encoding ascii -Append
+    - bun install --frozen-lockfile
+    - bun run vendor
+    - bun run build:win
+    - |
+      $Installer = Get-ChildItem -Path src-tauri\target\release\bundle\nsis\*.exe -ErrorAction Stop | Select-Object -First 1
+      $ReleaseDirectory = New-Item -ItemType Directory -Path "$env:CI_PROJECT_DIR\release" -Force
+      $InstallerName = "Overlord-Desktop-$env:DESKTOP_VERSION-setup.exe"
+      Copy-Item -LiteralPath $Installer.FullName -Destination (Join-Path $ReleaseDirectory $InstallerName)
+      Copy-Item -LiteralPath PLEASE_READ.txt -Destination $ReleaseDirectory
+      "INSTALLER_NAME=$InstallerName" | Out-File -FilePath "$env:CI_PROJECT_DIR\desktop.env" -Encoding ascii -Append
+  artifacts:
+    expire_in: 30 days
+    paths:
+      - release/
+    reports:
+      dotenv: desktop.env
+
+desktop-release:
+  stage: release
+  image: registry.gitlab.com/gitlab-org/cli:latest
+  needs:
+    - job: desktop-build-windows
+      artifacts: true
+  rules:
+    - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+      changes:
+        - Overlord-Desktop/package.json
+        - Overlord-Desktop/bun.lock
+        - Overlord-Desktop/scripts/**/*
+        - Overlord-Desktop/src/**/*
+        - Overlord-Desktop/src-tauri/**/*
+  script:
+    - |
+      set -eu
+      package_base="$CI_API_V4_URL/projects/$CI_PROJECT_ID/packages/generic/overlord-desktop/$DESKTOP_VERSION"
+      curl --fail --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file "release/$INSTALLER_NAME" "$package_base/$INSTALLER_NAME"
+      curl --fail --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file release/PLEASE_READ.txt "$package_base/PLEASE_READ.txt"
+  release:
+    tag_name: $DESKTOP_TAG
+    tag_message: "Overlord Desktop v$DESKTOP_VERSION"
+    name: "Overlord Desktop v$DESKTOP_VERSION"
+    description: "Automated build release for Overlord Desktop v$DESKTOP_VERSION"
+    ref: $CI_COMMIT_SHA
+    assets:
+      links:
+        - name: $INSTALLER_NAME
+          url: "$CI_API_V4_URL/projects/$CI_PROJECT_ID/packages/generic/overlord-desktop/$DESKTOP_VERSION/$INSTALLER_NAME"
+          link_type: package
+        - name: PLEASE_READ.txt
+          url: "$CI_API_V4_URL/projects/$CI_PROJECT_ID/packages/generic/overlord-desktop/$DESKTOP_VERSION/PLEASE_READ.txt"
+          link_type: other

.gitlab/ci/tests.yml

@@ -0,0 +1,114 @@
+.server-test-rules:
+  rules:
+    - changes:
+        - Overlord-Server/**/*
+        - Overlord-Client/cmd/agent/wire/wire_contract_generated.go
+        - protocol/**/*
+        - scripts/generate-wire-protocol.ts
+        - .gitlab-ci.yml
+        - .gitlab/ci/tests.yml
+
+.client-test-rules:
+  rules:
+    - changes:
+        - Overlord-Client/**/*
+        - protocol/**/*
+        - scripts/generate-wire-protocol.ts
+        - go.work
+        - go.work.sum
+        - .gitlab-ci.yml
+        - .gitlab/ci/tests.yml
+
+server-tests-linux:
+  extends: .server-test-rules
+  stage: test
+  image: oven/bun:1.3.14
+  script:
+    - cd Overlord-Server
+    - bun install --frozen-lockfile
+    - bun run typecheck
+    - bun run protocol:check
+    - bun run test
+
+server-tests-macos:
+  extends: .server-test-rules
+  stage: test
+  tags:
+    - saas-macos-medium-m1
+  image: macos-15-xcode-16
+  before_script:
+    - npm install --global --prefix "$CI_PROJECT_DIR/.tools" bun@1.3.14
+    - export PATH="$CI_PROJECT_DIR/.tools/bin:$PATH"
+  script:
+    - cd Overlord-Server
+    - bun install --frozen-lockfile
+    - bun run typecheck
+    - bun run protocol:check
+    - bun run test
+
+server-tests-windows:
+  extends: .server-test-rules
+  stage: test
+  tags:
+    - saas-windows-medium-amd64
+  before_script:
+    - npm install --global --prefix "$env:CI_PROJECT_DIR\.tools" bun@1.3.14
+    - $env:PATH = "$env:CI_PROJECT_DIR\.tools;$env:PATH"
+  script:
+    - Set-Location Overlord-Server
+    - bun install --frozen-lockfile
+    - bun run typecheck
+    - bun run protocol:check
+    - bun run test
+
+server-e2e-tests:
+  extends: .server-test-rules
+  stage: test
+  image: oven/bun:1.3.14
+  script:
+    - cd Overlord-Server
+    - bun install --frozen-lockfile
+    - bunx playwright install --with-deps chromium
+    - bun run test:e2e
+
+client-tests-linux:
+  extends: .client-test-rules
+  stage: test
+  image: golang:1.26-bookworm
+  script:
+    - cd Overlord-Client
+    - go mod download
+    - go test ./...
+
+client-tests-macos:
+  extends: .client-test-rules
+  stage: test
+  tags:
+    - saas-macos-medium-m1
+  image: macos-15-xcode-16
+  before_script:
+    - export GO_VERSION="$(awk '/^go / { print $2; exit }' Overlord-Client/go.mod)"
+    - mkdir -p "$CI_PROJECT_DIR/.toolchains"
+    - curl --fail --silent --show-error --location "https://go.dev/dl/go${GO_VERSION}.darwin-arm64.tar.gz" | tar -xz -C "$CI_PROJECT_DIR/.toolchains"
+    - export PATH="$CI_PROJECT_DIR/.toolchains/go/bin:$PATH"
+  script:
+    - cd Overlord-Client
+    - go mod download
+    - go test ./...
+
+client-tests-windows:
+  extends: .client-test-rules
+  stage: test
+  tags:
+    - saas-windows-medium-amd64
+  before_script:
+    - $GoVersion = ((Select-String -Path Overlord-Client/go.mod -Pattern '^go ').Line -split '\s+')[1]
+    - Invoke-WebRequest -UseBasicParsing "https://go.dev/dl/go$GoVersion.windows-amd64.zip" -OutFile "$env:CI_PROJECT_DIR\go.zip"
+    - Expand-Archive -Path "$env:CI_PROJECT_DIR\go.zip" -DestinationPath "$env:CI_PROJECT_DIR\.toolchains" -Force
+    - $env:PATH = "$env:CI_PROJECT_DIR\.toolchains\go\bin;$env:PATH"
+  script:
+    - bash scripts/vendor-onevpl-headers.sh
+    - bash scripts/vendor-amf-headers.sh
+    - Set-Location Overlord-Client
+    - go mod download
+    - go test ./...

Overlord-Desktop/PLEASE_READ.txt

@@ -15,7 +15,7 @@ show a connection error and nothing will work. That is expected.
    The server is a separate component that you must deploy yourself.
 
 2. Full setup instructions are in the README:
-   https://github.com/vxaboveground/Overlord/blob/main/README.md
+   https://gitlab.com/vxaboveground/overlord/-/blob/main/README.md
 
 3. Once the server is running, open this desktop client and enter the
    server's IP address (or hostname) and port on the connection screen.

Overlord-Desktop/README.md

@@ -49,7 +49,7 @@ bun run build:linux    # Linux AppImage
 
 Or from the repo root: `./scripts/build-desktop.sh` (or `scripts\build-desktop.bat` on Windows) picks the right target for the current OS.
 
-Output lands in `src-tauri/target/release/bundle/`. The CI workflow in `.github/workflows/desktop-release.yml` builds the Windows NSIS installer on every push to `main` that touches `Overlord-Desktop/` and publishes it as a GitHub Release tagged `Overlord-Desktop-v<version>`.
+Output lands in `src-tauri/target/release/bundle/`. The CI workflow in `.gitlab/ci/desktop-release.yml` builds the Windows NSIS installer on every push to `main` that changes the desktop application or its build inputs, and publishes it as a GitLab Release tagged `Overlord-Desktop-v<version>`.
 
 ## Configuration
 

Overlord-Server/public/assets/onboarding.js

@@ -1,5 +1,5 @@
 const TELEGRAM_URL = "https://t.me/Onimai";
-const GITHUB_ISSUES_URL = "https://github.com/vxaboveground/Overlord/issues/new";
+const GITLAB_ISSUES_URL = "https://gitlab.com/vxaboveground/overlord/-/issues/new";
 
 let mounted = false;
 
@@ -90,11 +90,11 @@ export function showOnboardingIfNeeded(user) {
 
     stepContent.innerHTML = `
       <div class="account-onboarding__card">
-        <h2><i class="fa-brands fa-github" aria-hidden="true"></i> Found a bug? Use GitHub Issues</h2>
+        <h2><i class="fa-brands fa-gitlab" aria-hidden="true"></i> Found a bug? Use GitLab Issues</h2>
-        <p><strong>This is the official place to report bugs.</strong> Create a GitHub issue with what happened, what you expected, and any useful screenshots or logs so the problem can be tracked and fixed.</p>
+        <p><strong>This is the official place to report bugs.</strong> Create a GitLab issue with what happened, what you expected, and any useful screenshots or logs so the problem can be tracked and fixed.</p>
         <div class="account-onboarding__url-label">Full bug report link</div>
-        <a class="account-onboarding__url" href="${GITHUB_ISSUES_URL}" target="_blank" rel="noopener noreferrer">${GITHUB_ISSUES_URL}</a>
+        <a class="account-onboarding__url" href="${GITLAB_ISSUES_URL}" target="_blank" rel="noopener noreferrer">${GITLAB_ISSUES_URL}</a>
-        <a class="account-onboarding__open" href="${GITHUB_ISSUES_URL}" target="_blank" rel="noopener noreferrer"><i class="fa-brands fa-github" aria-hidden="true"></i> Create a GitHub issue</a>
+        <a class="account-onboarding__open" href="${GITLAB_ISSUES_URL}" target="_blank" rel="noopener noreferrer"><i class="fa-brands fa-gitlab" aria-hidden="true"></i> Create a GitLab issue</a>
       </div>
     `;
     progressText.textContent = "Step 2 of 2";

README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/vxaboveground/Overlord/refs/heads/main/Overlord-Server/public/assets/overlord.png" alt="Overlord" width="280" />
+  <img src="https://gitlab.com/vxaboveground/overlord/-/raw/main/Overlord-Server/public/assets/overlord.png" alt="Overlord" width="280" />
 </p>
 
 # Overlord
@@ -103,7 +103,7 @@ docker compose version
 **2. Get the project**
 
 ```powershell
-git clone https://github.com/vxaboveground/Overlord.git
+git clone https://gitlab.com/vxaboveground/overlord.git
 cd Overlord
 ```
 
@@ -190,14 +190,14 @@ Make a folder for it, drop in the file, and you're done:
 
 ```bash
 mkdir overlord && cd overlord
-wget https://raw.githubusercontent.com/vxaboveground/Overlord/refs/heads/main/docker-compose.yml
+wget https://gitlab.com/vxaboveground/overlord/-/raw/main/docker-compose.yml
 ```
 
 No `wget`? Use `curl`:
 
 ```bash
 mkdir overlord && cd overlord
-curl -O https://raw.githubusercontent.com/vxaboveground/Overlord/refs/heads/main/docker-compose.yml
+curl -O https://gitlab.com/vxaboveground/overlord/-/raw/main/docker-compose.yml
 ```
 
 **3. Start it**
@@ -206,7 +206,7 @@ curl -O https://raw.githubusercontent.com/vxaboveground/Overlord/refs/heads/main
 docker compose up -d
 ```
 
-The image is pulled automatically from `ghcr.io/vxaboveground/overlord:latest` on first run.
+The image is pulled automatically from `registry.gitlab.com/vxaboveground/overlord:latest` on first run.
 
 **4. Open the panel**
 
@@ -266,7 +266,7 @@ docker compose version
 **2. Get the project**
 
 ```bash
-git clone https://github.com/vxaboveground/Overlord.git
+git clone https://gitlab.com/vxaboveground/overlord.git
 cd Overlord
 ```
 

docker-compose.quickstart.yml

@@ -1,6 +1,6 @@
 services:
   overlord-server:
-    image: ghcr.io/vxaboveground/overlord:latest
+    image: registry.gitlab.com/vxaboveground/overlord:latest
     build:
       context: .
       dockerfile: Dockerfile

docker-compose.windows.yml

@@ -1,6 +1,6 @@
 services:
   overlord-server:
-    image: ${DOCKER_IMAGE:-ghcr.io/vxaboveground/overlord:latest}
+    image: ${DOCKER_IMAGE:-registry.gitlab.com/vxaboveground/overlord:latest}
     build:
       context: .
       dockerfile: Dockerfile

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   overlord-server:
-    image: ${DOCKER_IMAGE:-ghcr.io/vxaboveground/overlord:latest}
+    image: ${DOCKER_IMAGE:-registry.gitlab.com/vxaboveground/overlord:latest}
     build:
       context: .
       dockerfile: Dockerfile