v2.87.29 knows nextest only up to 0.9.148, so every gate and coverage run that installs the
pinned cargo-nextest@0.9.150 fell back to cargo-binstall@latest: an unpinned download, then a
binstall of nextest. v2.87.33 is the oldest release whose manifest has 0.9.150; the releases
since v2.87.29 change only tool manifests.
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Calls with nothing to install from apt (a Windows-only check, a wasm build) had to pass a package
list the gate would ignore or install for nothing. packages now defaults to empty, and the apt step
runs only on Linux legs that name packages. The README describes such second gate calls, with
their own command and cache-version, instead of keeping web builds in the app's own workflow:
the apps' CI rules now allow only calls to shared workflows (#118).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(install-apt-packages): time-limit and retry mirror downloads
A SonarCloud job in vectorcraft (run 41253493430) sat in this step for 58 minutes: the Azure
Ubuntu mirror timed out, apt fell back to archive.ubuntu.com, then a connection went silent and
apt printed nothing until the run was cancelled. Acquire::http::Timeout doesn't end a connection
that stays open, so the job's 90-minute timeout was the only bound.
apt-get update and a new --download-only pass now each run under timeout(1), 300 s per attempt,
up to 3 attempts. The install itself then works from downloaded files only, so dpkg is never
killed mid-configure. Acquire::https::Timeout is set alongside the http one for the HTTPS fallback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(install-apt-packages): retry an update that fetched only some indexes
apt-get update warns and exits 0 when an index fails to download, so the retry never ran for
it. APT::Update::Error-Mode=any makes that a failure, which is retried. If indexes are still
missing after the last attempt the step continues with a warning, as it did before: they often
belong to a repository the packages don't need, and a package that needs one fails the download.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Pull requests that touch Windows packaging saved their own windows-arm64-package cache (about
0.7 GB), visible only to that pull request. Every app repository is at the 10 GB cache limit,
so each one evicted a cache main's gate restores. The nightly run on main still saves it.
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
flatpak-builder only Recommends elfutils, which --no-install-recommends skips. Apps whose
manifests now build cups-client from source (gridcraft, designcraft, wordcraft, pdfcraft) fail
in the Flatpak job with: Failed to execute child process "eu-strip".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
App repos' .github/workflows/ should only call craft-common-actions at @main, so CI
is the same across the Craft apps. gate.yml and the README said app-only jobs
(fuzzing, corpora, web builds, Windows installer probes) stay in the caller; they
now belong here as shared workflows or inputs, and move without being dropped.
* ci(release): build FreeBSD aarch64 archives by default
app packaging/freebsd/package.sh scripts now honor CARGO_BUILD_TARGET, so
aarch64 is no longer opt-in: freebsd-architectures defaults to
'["x86_64","aarch64"]'. Callers can still narrow it to x86_64 only.
* docs(readme): FreeBSD aarch64 is in the default freebsd-architectures
The aarch64 job uses FreeBSD's quarterly packages, which since 2026-10-28 have no `cmake` meta-package, only `cmake-core`. `pkg install cmake` failed and stopped every app's release build. `cmake-core` is in both the quarterly and latest sets.
The test's explanation was a comment; it's the method's docstring now, as CodeRabbit's
docstring-coverage check asks. No change to what it checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The apps build winit's X11 backend, and the Craft apps' winit (storytold/winit a517b38)
loads libxkbcommon-x11 when it sets up the keyboard on X11 or XWayland: without it the app
panics at start ("Library libxkbcommon-x11.so could not be loaded"). Arch ships it as its own
package, apart from libxkbcommon, and the package only depended on libxkbcommon, so on a
system without it (a fresh install, a minimal or Wayland-first desktop) every Craft app's
Arch package started and couldn't open its window. PhotoCraft hit the same panic on its deb
(photocraft#201) and fixed its own nfpm.yaml; the shared Arch package never got it.
libxkbcommon-x11 is now in depends. A test checks the generated PKGBUILD.
Checked on a clean archlinux container with a Craft app's release tarball, under Xvfb: the
package built by main installs without libxkbcommon-x11 and the window fails with that error;
the one built with this change pulls in libxkbcommon-x11 1.13.2 and the window runs. The
unit tests pass on Ubuntu 24.04 as in test-freebsd.yml (155, 28 skipped), and test_arch
passes on Arch with makepkg, end-to-end build included; shellcheck is clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cargo llvm-cov adds its own exclusions to --ignore-filename-regex: tests/,
examples/ and benches/ directories and tests.rs / *_tests.rs files. The
sharded merge (the default since #87) calls llvm-cov export directly with
only (vendor|xtask)/, so integration tests and src/**/tests.rs reached
lcov.info as almost fully covered source, and coverage moved when a caller
switched between shards: 1 and the default. Put those exclusions in the
shared regex; the unsharded run already applies them.
The attest job has no checkout, so `gh release upload` had no git remote to
find the repository from and failed with "not a git repository" after the
attestations were already published. Pass GH_REPO, as draft-release does.
* Provision coverage fonts for archive builds and test runners
* Keep coverage fonts optional unless a pin is requested
* Pin nested actions used by coverage jobs
* Export the font path only after a requested checkout
* Measure optional Python tooling coverage in Sonar
* ci: restore craft-common-actions tracking main
* ci: share Python coverage configuration with XML reporting
* sonarcloud: optionally shard Rust coverage across parallel nextest partitions
* sonarcloud: default coverage to four shards
* sonarcloud: build the instrumented archive once and shard tests from it
* sonarcloud: skip sharded scan steps when the plan job produces no shards
* sonarcloud: validate shard count, pin the archive's toolchain, merge only test binaries
- Preserve full SPDX expression as a single shell-quoted array element in PKGBUILD license
- Use cp --remove-destination to replace any destination symlink when copying license files
- Update test_pkgbuild_and_makepkg_conf_safe_serialization test assertion to expect preserved expression
- Restrict SonarCloud project-key grammar to start with an alphanumeric/underscore, reject leading hyphens/flags, and enforce 400 character length limit (F-006)
- Verify Nix extra-args argument parsing without eval (F-005)
- Verify Windows ARM64 PowerShell environment variable passing and path component sanitization (F-007)
- Add unit test verifying FreeBSD workflow architecture pre-validation rejects invalid architectures and injection payloads prior to VM execution (F-009)
- Verify FreeBSD custom-test-command environment data passing (F-010)
- Disallow carriage returns and newlines upfront in resolve-version to prevent GitHub output-file protocol forgery
- Strictly validate generated build date against YYYY-MM-DD format
- Sanitize APP_TITLE against carriage returns and newlines in step summary
- Validate package tokens in install-apt-packages, rejecting options, path traversals, and injection payloads
- Terminate options with -- when invoking apt-get install
- Add unit tests for install-apt-packages validation and new test suite for resolve-version
Dylan M. Taylor