Removed 0.0.0.0 bind patch

Adds CI pipelines to build and push the project to the Gitea Docker repository.

Co-authored-by: Julien Valverdé <julien.valverde@mailo.com>
Reviewed-on: https://git.jvalver.de/Thilawyn/protonmail-bridge-docker/pulls/1

.drone.yml

@@ -0,0 +1,57 @@
+kind: pipeline
+type: docker
+name: docker-build
+
+steps:
+- name: build
+  image: plugins/docker
+  settings:
+    registry: git.jvalver.de
+    username:
+      from_secret: username
+    password:
+      from_secret: password
+    repo: git.jvalver.de/thilawyn/protonmail-bridge-docker
+    dockerfile: build/Dockerfile
+    dry_run: true
+    context: build
+    autotag: true
+    compress: true
+    platform: linux/amd64
+
+trigger:
+  event:
+    exclude:
+    - tag
+  branch:
+    exclude:
+    - master
+
+
+---
+kind: pipeline
+type: docker
+name: docker-build-and-publish
+
+steps:
+- name: build-and-publish
+  image: plugins/docker
+  settings:
+    registry: git.jvalver.de
+    username:
+      from_secret: username
+    password:
+      from_secret: password
+    repo: git.jvalver.de/thilawyn/protonmail-bridge-docker
+    dockerfile: build/Dockerfile
+    context: build
+    autotag: true
+    compress: true
+    platform: linux/amd64
+
+trigger:
+  event:
+    exclude:
+    - pull_request
+  branch:
+  - master

.github/workflows/build.yaml

@@ -2,231 +2,91 @@ name: build from source
 
 on:
   push:
+    branches:
+      - master
+      - dev
     paths:
       - .github/workflows/build.yaml
       - build/*
-      - VERSION
   pull_request:
     paths:
       - .github/workflows/build.yaml
       - build/*
-  workflow_dispatch:
 
 env:
-  GHCR_REPO: shenxn/protonmail-bridge-docker
+  DOCKER_REPO: shenxn/protonmail-bridge
-  DOCKERHUB_REPO: shenxn/protonmail-bridge
+  DOCKER_REPO_DEV: ghcr.io/shenxn/protonmail-bridge-dev
-  DOCKER_REPO_DEV: ghcr.io/shenxn/protonmail-bridge
   PLATFORMS: linux/amd64,linux/arm64/v8,linux/arm/v7,linux/riscv64
 
 jobs:
-  test:
-    runs-on: ubuntu-latest
-    if: github.ref != 'refs/heads/master'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@master
-
-      - name: Set version
-        id: version
-        run: echo "version=`cat VERSION`" >> $GITHUB_ENV
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ env.DOCKER_REPO_DEV }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: network=host
-
-      - name: Build and push by digest
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          labels: ${{ steps.meta.outputs.labels }}
-          outputs: type=image,"name=${{ env.DOCKER_REPO_DEV }}",push-by-digest=false,name-canonical=true,push=true
-          context: ./build
-          file: ./build/Dockerfile
-          tags: "${{ env.DOCKER_REPO_DEV }}:dev-${{ github.ref_name }}"
-          build-args: |
-            version=${{ env.version }}
-
-      - name: Run Trivy vulnerability scan
-        uses: aquasecurity/trivy-action@0.30.0
-        with:
-          image-ref: "${{ env.DOCKER_REPO_DEV }}:dev-${{ github.ref_name }}"
-          format: 'sarif'
-          exit-code: 0
-          severity: 'CRITICAL,HIGH'
-          output: 'trivy-results.sarif'
-
-      - name: Upload Trivy scan SARIF report
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: 'trivy-results.sarif'
-
   build:
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    services:
-    strategy:
+      registry:
-      fail-fast: false
+        image: registry:2
-      matrix:
+        ports:
-        platform:
+          - 5000:5000
-          - linux/amd64
-          - linux/arm64/v8
-          - linux/arm/v7
-          - linux/riscv64
     steps:
       - name: Checkout
         uses: actions/checkout@master
-
-      - name: Prepare
-        run: |
-          platform=${{ matrix.platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-
       - name: Set version
         id: version
-        run: echo "version=`cat VERSION`" >> $GITHUB_ENV
+        run: echo "::set-output name=version::`cat build/VERSION`"
-
+      - name: Set repo
+        id: repo
+        run: if [[ $GITHUB_REF == "refs/heads/master" ]]; then echo "::set-output name=repo::${DOCKER_REPO}"; else echo "::set-output name=repo::${DOCKER_REPO_DEV}"; fi
       - name: Docker meta
-        id: meta
+        id: docker_meta
-        uses: docker/metadata-action@v5
+        uses: crazy-max/ghaction-docker-meta@v1
         with:
-          images: |
+          images: ${{ steps.repo.outputs.repo }}
-            ${{ env.DOCKERHUB_REPO }}
-            ${{ env.GHCR_REPO }}
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v1
-
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v1
-
-      - name: Build and push by digest
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.meta.outputs.labels }}
-          outputs: type=image,"name=name=${{ env.DOCKERHUB_REPO }},${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=false
-          context: ./build
-          file: ./build/Dockerfile
-          tags: |
-            "${{ env.DOCKERHUB_REPO }}:build"
-            "${{ env.DOCKERHUB_REPO }}:${{ env.version }}-build"
-            "${{ env.GHCR_REPO }}:build"
-            "${{ env.GHCR_REPO }}:${{ env.version }}-build"
-          provenance: false
-          sbom: false
-          build-args: |
-            version=${{ env.version }}
-
-      - name: Export digest
-        run: |
-          mkdir -p ${{ runner.temp }}/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "${{ runner.temp }}/digests/${digest#sha256:}"
-
-      - name: Upload digest
-        uses: actions/upload-artifact@v4
-        with:
-          name: digests-${{ env.PLATFORM_PAIR }}
-          path: ${{ runner.temp }}/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-
-  merge:
-    runs-on: ubuntu-latest
-    needs:
-      - build
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ runner.temp }}/digests
-          pattern: digests-*
-          merge-multiple: true
-
-      - name: Set version
-        id: version
-        run: echo "version=`cat VERSION`" >> $GITHUB_ENV
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host
-
+      - name: Build image without push to registry
-      - name: Docker meta
+        uses: docker/build-push-action@v2
-        id: meta
-        uses: docker/metadata-action@v5
         with:
-          images: |
+          context: ./build
-            ${{ env.DOCKERHUB_REPO }}
+          file: ./build/Dockerfile
-            ${{ env.GHCR_REPO }}
+          platforms: ${{ env.PLATFORMS }}
+          push: true
+          tags: localhost:5000/protonmail-bridge:latest
+      - name: Scan image
+        id: scan
+        uses: anchore/scan-action@v2
+        with:
+          image: localhost:5000/protonmail-bridge:latest
+          fail-build: true
+          severity-cutoff: critical
+          acs-report-enable: true
+      - name: Upload Anchore scan SARIF report
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/master' }}
+        with:
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/dev' }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.CR_PAT }}
+      - name: Push image
+        uses: docker/build-push-action@v2
+        with:
+          context: ./build
+          file: ./build/Dockerfile
+          platforms: ${{ env.PLATFORMS }}
           tags: |
-            type=raw,enable=true,value=${{ env.version }}-build
+            ${{ steps.repo.outputs.repo }}:build
-            type=raw,enable=true,suffix=,value=build
+            ${{ steps.repo.outputs.repo }}:${{ steps.version.outputs.version }}-build
-
+          labels: ${{ steps.docker_meta.outputs.labels }}
-      - name: Create manifest list and push
+          push: ${{ github.event_name != 'pull_request' }}
-        working-directory: ${{ runner.temp }}/digests
-        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.DOCKERHUB_REPO }}@sha256:%s ' *)
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
-
-      - name: Run Trivy vulnerability scan
-        uses: aquasecurity/trivy-action@0.30.0
-        with:
-          image-ref: "${{ env.DOCKERHUB_REPO }}:${{ env.version }}-build"
-          format: 'sarif'
-          exit-code: 0
-          severity: 'CRITICAL,HIGH'
-          output: 'trivy-results.sarif'
-      - name: Upload Trivy scan SARIF report
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: 'trivy-results.sarif'
-
-      - name: Inspect image
-        run: |
-          docker buildx imagetools inspect ${{ env.DOCKERHUB_REPO }}:${{ steps.meta.outputs.version }}
-          docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ steps.meta.outputs.version }}

.github/workflows/deb.yaml

@@ -2,15 +2,16 @@ name: pack from deb
 
 on:
   push:
+    branches:
+      - master
+      - dev
     paths:
       - .github/workflows/deb.yaml
       - deb/*
-      - VERSION
   pull_request:
     paths:
       - .github/workflows/deb.yaml
       - deb/*
-  workflow_dispatch:
 
 env:
   DOCKER_REPO: shenxn/protonmail-bridge
@@ -24,7 +25,7 @@ jobs:
         uses: actions/checkout@master
       - name: Set version
         id: version
-        run: echo "version=`cat VERSION`" >> $GITHUB_ENV
+        run: echo "::set-output name=version::`cat deb/VERSION`"
       - name: Set repo
         id: repo
         run: if [[ $GITHUB_REF == "refs/heads/master" ]]; then echo "::set-output name=repo::${DOCKER_REPO}"; else echo "::set-output name=repo::${DOCKER_REPO_DEV}"; fi
@@ -51,18 +52,18 @@ jobs:
           severity-cutoff: critical
           acs-report-enable: true
       - name: Upload Anchore scan SARIF report
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v1
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}
       - name: Login to DockerHub
         uses: docker/login-action@v1
-        if: ${{ github.event_name != 'pull_request' }}
+        if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/master' }}
         with:
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v1
-        if: ${{ github.event_name != 'pull_request' }}
+        if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/dev' }}
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -74,6 +75,6 @@ jobs:
           file: ./deb/Dockerfile
           tags: |
             ${{ steps.repo.outputs.repo }}:latest
-            ${{ steps.repo.outputs.repo }}:${{ env.version }}
+            ${{ steps.repo.outputs.repo }}:${{ steps.version.outputs.version }}
           labels: ${{ steps.docker_meta.outputs.labels }}
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/update-check.yaml

@@ -2,6 +2,9 @@ name: update check
 
 on:
   push:
+    branches:
+      - master
+      - dev
     paths:
       - .github/workflows/update-check.yaml
       - update-check.py

README.md

@@ -37,13 +37,7 @@ To initialize and add account to the bridge, run the following command.
 docker run --rm -it -v protonmail:/root shenxn/protonmail-bridge init
 ```
 
-If you want to use Docker Compose instead, you can create a copy of the provided example [docker-compose.yml](docker-compose.yml) file, modify it to suit your needs, and then run the following command:
+Wait for the bridge to startup, use `login` command and follow the instructions to add your account into the bridge. Then use `info` to see the configuration information (username and password). After that, use `exit` to exit the bridge. You may need `CTRL+C` to exit the docker entirely.
-
-```
-docker compose run protonmail-bridge init
-```
-
-Wait for the bridge to startup, then you will see a prompt appear for [Proton Mail Bridge interactive shell](https://proton.me/support/bridge-cli-guide). Use the `login` command and follow the instructions to add your account into the bridge. Then use `info` to see the configuration information (username and password). After that, use `exit` to exit the bridge. You may need `CTRL+C` to exit the docker entirely.
 
 ## Run
 
@@ -53,12 +47,6 @@ To run the container, use the following command.
 docker run -d --name=protonmail-bridge -v protonmail:/root -p 1025:25/tcp -p 1143:143/tcp --restart=unless-stopped shenxn/protonmail-bridge
 ```
 
-Or, if using Docker Compose, use the following command.
-
-```
-docker compose up -d
-```
-
 ## Kubernetes
 
 If you want to run this image in a Kubernetes environment. You can use the [Helm](https://helm.sh/) chart (https://github.com/k8s-at-home/charts/tree/master/charts/stable/protonmail-bridge) created by [@Eagleman7](https://github.com/Eagleman7). More details can be found in [#23](https://github.com/shenxn/protonmail-bridge-docker/issues/23).

VERSION

@@ -1 +0,0 @@
-v3.21.2

build/.dockerignore

@@ -0,0 +1,8 @@
+*
+
+!.dockerignore
+!VERSION
+!entrypoint.sh
+!gpgparams
+!Dockerfile
+!build.sh

build/Dockerfile

@@ -1,18 +1,15 @@
-# The build image could be golang, but it currently does not support riscv64. Only debian:sid does, at the time of writing.
+FROM golang:1.20-bookworm AS build
-FROM debian:sid-slim AS build
-
-ARG version
 
 # Install dependencies
-RUN apt-get update && apt-get install -y golang build-essential libsecret-1-dev
+RUN apt-get update && apt-get install -y git build-essential libsecret-1-dev
 
 # Build
-ADD https://github.com/ProtonMail/proton-bridge.git#${version} /build/
 WORKDIR /build/
-RUN make build-nogui vault-editor
+COPY build.sh VERSION /build/
+RUN bash build.sh
 
-FROM debian:sid-slim
+FROM ubuntu:jammy
-LABEL maintainer="Simon Felding <sife@adm.ku.dk>"
+LABEL maintainer="Xiaonan Shen <s@sxn.dev>"
 
 EXPOSE 25/tcp
 EXPOSE 143/tcp
@@ -26,8 +23,7 @@ RUN apt-get update \
 COPY gpgparams entrypoint.sh /protonmail/
 
 # Copy protonmail
-COPY --from=build /build/bridge /protonmail/
+COPY --from=build /build/proton-bridge/bridge /protonmail/
-COPY --from=build /build/proton-bridge /protonmail/
+COPY --from=build /build/proton-bridge/proton-bridge /protonmail/
-COPY --from=build /build/vault-editor /protonmail/
 
 ENTRYPOINT ["bash", "/protonmail/entrypoint.sh"]

build/VERSION

@@ -0,0 +1 @@
+3.4.0

build/build.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -ex
+
+VERSION=`cat VERSION`
+
+# Clone new code
+git clone https://github.com/ProtonMail/proton-bridge.git
+cd proton-bridge
+git checkout v$VERSION
+
+ARCH=$(uname -m)
+if [[ $ARCH == "armv7l" ]] ; then
+	# This is expected to fail, and we use the following patch to fix
+	make build-nogui || true
+	# For 32bit architectures, there was a overflow error on the parser
+	# This is a workaround for this problem found at:
+	#   https://github.com/antlr/antlr4/issues/2433#issuecomment-774514106
+	find $(go env GOPATH)/pkg/mod/github.com/\!proton\!mail/go-rfc5322*/ -type f -exec sed -i.bak 's/(1<</(int64(1)<</g' {} +
+fi
+
+# Build
+make build-nogui

deb/.dockerignore

@@ -0,0 +1,8 @@
+*
+
+!.dockerignore
+!VERSION
+!entrypoint.sh
+!install.sh
+!gpgparams
+!Dockerfile

deb/Dockerfile

@@ -1,16 +1,5 @@
-### The Deb install is just a repack of the official ProtonMail Bridge deb package with less dependencies.
+FROM ubuntu:jammy
-### I recommend you don't use this. It's here for legacy reasons.
+LABEL maintainer="Xiaonan Shen <s@sxn.dev>"
-
-FROM debian:sid-slim AS build
-
-COPY install.sh PACKAGE /
-RUN apt-get update && apt-get install -y wget binutils
-
-# Repack deb (removes unnecessary dependencies and produces /protonmail.deb)
-RUN bash /install.sh
-
-FROM debian:sid-slim
-LABEL maintainer="Simon Felding <sife@adm.ku.dk>"
 
 EXPOSE 25/tcp
 EXPOSE 143/tcp
@@ -18,11 +7,9 @@ EXPOSE 143/tcp
 WORKDIR /protonmail
 
 # Copy bash scripts
-COPY gpgparams entrypoint.sh PACKAGE /protonmail/
+COPY gpgparams install.sh entrypoint.sh VERSION /protonmail/
-COPY --from=build /protonmail.deb /tmp/protonmail.deb
 
-RUN apt-get update \
+# Install dependencies and protonmail bridge
-    && apt-get install -y --no-install-recommends /tmp/protonmail.deb socat pass libsecret-1-0 ca-certificates procps \
+RUN bash install.sh
-    && rm -rf /var/lib/apt/lists/*
 
-CMD ["bash", "/protonmail/entrypoint.sh"]
+ENTRYPOINT ["bash", "/protonmail/entrypoint.sh"]

deb/PACKAGE

@@ -1 +0,0 @@
-https://github.com/ProtonMail/proton-bridge/releases/download/v3.21.2/protonmail-bridge_3.21.2-1_amd64.deb

deb/VERSION

@@ -0,0 +1 @@
+3.3.2-1

deb/install.sh

@@ -1,16 +1,36 @@
 #!/bin/bash
+
 set -ex
 
+VERSION=`cat VERSION`
+DEB_FILE=protonmail-bridge_${VERSION}_amd64.deb
+
+# Install dependents
+apt-get update
+apt-get install -y --no-install-recommends socat pass ca-certificates
+
+# Build time dependencies
+apt-get install -y wget binutils xz-utils
+
 # Repack deb (remove unnecessary dependencies)
 mkdir deb
-wget -i /PACKAGE -O /deb/protonmail.deb
 cd deb
-ar x -v protonmail.deb
+wget -q https://protonmail.com/download/bridge/${DEB_FILE}
+ar x -v ${DEB_FILE}
 mkdir control
 tar zxvf control.tar.gz -C control
 sed -i "s/^Depends: .*$/Depends: libgl1, libc6, libsecret-1-0, libstdc++6, libgcc1/" control/control
 cd control
 tar zcvf ../control.tar.gz .
 cd ../
+ar rcs -v ${DEB_FILE} debian-binary control.tar.gz data.tar.gz
+cd ../
 
-ar rcs -v /protonmail.deb debian-binary control.tar.gz data.tar.gz
+# Install protonmail bridge
+apt-get install -y --no-install-recommends ./deb/${DEB_FILE}
+
+# Cleanup
+apt-get purge -y wget binutils xz-utils
+apt-get autoremove -y
+rm -rf /var/lib/apt/lists/*
+rm -rf deb

docker-compose.yml

@@ -3,12 +3,16 @@ version: '2.1'
 services:
   protonmail-bridge:
     image: shenxn/protonmail-bridge
+    # build:
+    #  context: ./build
+    #  dockerfile: Dockerfile
+    container_name: pm_bridge
     ports:
       - 1025:25/tcp
       - 1143:143/tcp
     restart: unless-stopped
-    volumes:
+    stdin_open: true 
-      - protonmail:/root
+    tty: true
 volumes:
   protonmail:
     name: protonmail

update-check.py

@@ -1,37 +1,64 @@
-import requests, os, sys
+import sys
+import os
+import requests
+import json
+import re
 
-def git(command):
-  return os.system(f"git {command}")
-
-
-release = requests.get("https://api.github.com/repos/protonmail/proton-bridge/releases/latest").json()
-version = release['tag_name']
-deb = [asset for asset in release ['assets'] if asset['name'].endswith('.deb')][0]['browser_download_url']
-
-print(f"Latest release is: {version}")
-
-with open("VERSION", 'w') as f:
-  f.write(version)
-
-with open("deb/PACKAGE", 'w') as f:
-  f.write(deb)
-
-git("config --local user.name 'GitHub Actions'")
-git("config --local user.email 'actions@github.com'")
-
-git("add -A")
-
-if git("diff --cached --quiet") == 0: # Returns 0 if there are no changes
-  print("Version didn't change")
-  exit(0)
-
-git(f"commit -m 'Bump version to {version}'")
 is_pull_request = sys.argv[1] == "true"
+print(f"is_pull_request={is_pull_request}")
 
-if is_pull_request:
-  print("This is a pull request, skipping push step.")
-  exit(0)
 
-if git("push") != 0:
+def check_version(directory, new_version):
-  print("Git push failed!")
+    print(f"Checking version for {directory}")
+
+    if not new_version:
+        print("Failed to get new version. Exiting.")
         exit(1)
+
+    with open(f"{directory}/VERSION", "r") as f:
+        old_version = f.read().rstrip()
+    
+    print(f"Up-to-date version {new_version}")
+    print(f"Current version: {old_version}")
+
+    if old_version != new_version:
+        print(f"New release found: {new_version}")
+
+        # bump up to new release
+        with open(f"{directory}/VERSION", "w") as f:
+            f.write(new_version)
+        # commit
+        result = os.system(f"git config --local user.email 'actions@github.com' \
+            && git config --local user.name 'GitHub Actions' \
+            && git add {directory}/VERSION \
+            && git commit -m 'Bump {directory} version to {new_version}'")
+        if result != 0:
+            print("Failed to commit the bump. Exiting")
+            exit(1)
+        if is_pull_request:
+            print("Action triggered by pull request. Do not push.")
+        else:
+            result = os.system("git push")
+            if result != 0:
+                print("Failed to push. Exiting")
+                exit(1)
+    else:
+        print(f"Already newest version {old_version}")
+
+
+# check deb version
+response = requests.get("https://protonmail.com/download/current_version_linux.json")
+content = json.loads(response.content)
+version = re.match(".*_([0-9.-]+)_amd64\.deb", content["DebFile"]).group(1)
+check_version("deb", version)
+
+
+# check build version
+response = requests.get(
+    "https://api.github.com/repos/ProtonMail/proton-bridge/tags",
+    headers={"Accept": "application/vnd.github.v3+json"},
+    )
+tags = json.loads(response.content)
+version_re = re.compile("v\d+\.\d+\.\d+")
+releases = [tag["name"][1:] for tag in tags if version_re.match(tag["name"])]
+check_version("build", releases[0])