mirror of
https://github.com/storytold/artcraft.git
synced 2026-11-12 04:42:16 +00:00
Dylan M. Taylor
0c11395467
Clears the open SonarCloud issues outside the TypeScript frontend, except the Rust ones, which moved to #2823 so each PR stays small. Compile and tests are left to CI. **Security** - `frontend/api_docs.html` (Web:S5725): `integrity` (sha384 of the pinned `swagger-ui-dist@5.32.0` files) and `crossorigin="anonymous"` on the three unpkg assets, over `https:`. - S6505: `--ignore-scripts` on `npm install` / `npm ci` in the dev and build scripts and in the macOS and Windows publish workflows. `artcraft-linux-publish.yml` already builds with `npm ci --ignore-scripts`, and the frontend has no install scripts of its own. - S7637: `dtolnay/rust-toolchain@stable` and `tauri-apps/tauri-action@v0` pinned by commit SHA. For tauri-action that's the commit `v0` points to (`84b9d35…`). The Linux workflow had pinned the tag object instead, and is fixed the same way. - S6505 / S8543: the macOS build runs `./node_modules/.bin/nx` instead of `npx nx`, as the Linux workflow does. **Reliability** - shell:S7688: `[[ ]]` in place of `[` / `test` in `frontend_preflight.sh` and the Linux packaging scripts. **Analysis scope** (`sonar-project.properties`), each with its reason in the file: - Not analysed: `crates/vendor/**` (third-party), the upstream Python reference implementations beside the Grok and Sora clients (nothing runs them), and the hand-run developer tools `frontend/scripts/unix-dev.mjs` and `frontend/tools/performance/**`. These held the S8564, S1244, S2245, S4036, S5443 and S8707 findings. - rust:S4347 not raised on `DeterministicRng`, the fixed-seed generator for tests. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Improvements** * File downloads and database maintenance now use asynchronous operations, helping the app remain responsive during these tasks. * API documentation assets load over HTTPS with integrity checks. * **Build and Reliability** * Build and publishing workflows use pinned tool versions and skip package lifecycle scripts during dependency installation. * Linux packaging checks use consistent shell conditionals. * Frontend builds use the locally installed Nx command where applicable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> - typescript:S2187 not raised on the ApiManager tests, which build their cases with shared helpers that call `it` (`BetaKeysApi.test.ts`). typescript:S2819 not raised on `*.worker.ts`: a dedicated worker's messages come only from the page that started it.
51 lines
2.0 KiB
Bash
Executable File
51 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Integration fixture: real DEB/RPM archives, with no Rust compilation or signing key.
|
|
set -euo pipefail
|
|
script="$(realpath "$(dirname "$0")/package.sh")"
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "$work"' EXIT
|
|
cd "$work"
|
|
mkdir -p crates/desktop/artcraft target/x86_64-unknown-linux-gnu/release/bundle/{deb,rpm,appimage}
|
|
printf '{"version":"0.42.0"}\n' > crates/desktop/artcraft/tauri.conf.json
|
|
mkdir -p stage/{DEBIAN,usr/bin,usr/share/applications}
|
|
cp /bin/true stage/usr/bin/artcraft
|
|
printf '[Desktop Entry]\nType=Application\nName=ArtCraft\nExec=artcraft\n' > stage/usr/share/applications/ArtCraft.desktop
|
|
cat > stage/DEBIAN/control <<'CONTROL'
|
|
Package: artcraft
|
|
Version: 0.42.0
|
|
Architecture: amd64
|
|
Maintainer: Fixture <fixture@example.invalid>
|
|
Description: Packaging fixture
|
|
CONTROL
|
|
dpkg-deb --build stage target/x86_64-unknown-linux-gnu/release/bundle/deb/ArtCraft.deb
|
|
mkdir -p rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
|
|
cat > rpmbuild/SPECS/artcraft.spec <<'SPEC'
|
|
Name: artcraft
|
|
Version: 0.42.0
|
|
Release: 1
|
|
Summary: Packaging fixture
|
|
License: MIT
|
|
%description
|
|
Packaging fixture
|
|
%install
|
|
mkdir -p %{buildroot}/usr/bin
|
|
cp /bin/true %{buildroot}/usr/bin/artcraft
|
|
%files
|
|
/usr/bin/artcraft
|
|
SPEC
|
|
rpmbuild --define "_topdir $work/rpmbuild" -bb rpmbuild/SPECS/artcraft.spec
|
|
find rpmbuild/RPMS -name '*.rpm' -exec cp {} target/x86_64-unknown-linux-gnu/release/bundle/rpm/ \;
|
|
printf 'appimage fixture\n' > target/x86_64-unknown-linux-gnu/release/bundle/appimage/ArtCraft.AppImage
|
|
"$script" x86_64 x86_64-unknown-linux-gnu
|
|
for format in deb rpm AppImage AppImage.zsync tar.gz; do [[ -s "dist/release/artcraft-0.42.0-linux-x86_64.$format" ]]; done
|
|
mkdir unpacked
|
|
tar -xzf dist/release/artcraft-0.42.0-linux-x86_64.tar.gz -C unpacked
|
|
[[ -x unpacked/artcraft-0.42.0-linux-x86_64/bin/artcraft ]]
|
|
[[ -f unpacked/artcraft-0.42.0-linux-x86_64/share/applications/ai.artcraft.app.desktop ]]
|
|
rm target/x86_64-unknown-linux-gnu/release/bundle/rpm/*.rpm
|
|
if "$script" x86_64 x86_64-unknown-linux-gnu; then
|
|
echo 'Packaging accepted a missing RPM' >&2
|
|
exit 1
|
|
fi
|
|
echo 'Package integration checks passed'
|