Dylan M. Taylor
0c11395467
Clears the open SonarCloud issues outside the TypeScript frontend, except the Rust ones, which moved to #2823 so each PR stays small. Compile and tests are left to CI. **Security** - `frontend/api_docs.html` (Web:S5725): `integrity` (sha384 of the pinned `swagger-ui-dist@5.32.0` files) and `crossorigin="anonymous"` on the three unpkg assets, over `https:`. - S6505: `--ignore-scripts` on `npm install` / `npm ci` in the dev and build scripts and in the macOS and Windows publish workflows. `artcraft-linux-publish.yml` already builds with `npm ci --ignore-scripts`, and the frontend has no install scripts of its own. - S7637: `dtolnay/rust-toolchain@stable` and `tauri-apps/tauri-action@v0` pinned by commit SHA. For tauri-action that's the commit `v0` points to (`84b9d35…`). The Linux workflow had pinned the tag object instead, and is fixed the same way. - S6505 / S8543: the macOS build runs `./node_modules/.bin/nx` instead of `npx nx`, as the Linux workflow does. **Reliability** - shell:S7688: `[[ ]]` in place of `[` / `test` in `frontend_preflight.sh` and the Linux packaging scripts. **Analysis scope** (`sonar-project.properties`), each with its reason in the file: - Not analysed: `crates/vendor/**` (third-party), the upstream Python reference implementations beside the Grok and Sora clients (nothing runs them), and the hand-run developer tools `frontend/scripts/unix-dev.mjs` and `frontend/tools/performance/**`. These held the S8564, S1244, S2245, S4036, S5443 and S8707 findings. - rust:S4347 not raised on `DeterministicRng`, the fixed-seed generator for tests. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Improvements** * File downloads and database maintenance now use asynchronous operations, helping the app remain responsive during these tasks. * API documentation assets load over HTTPS with integrity checks. * **Build and Reliability** * Build and publishing workflows use pinned tool versions and skip package lifecycle scripts during dependency installation. * Linux packaging checks use consistent shell conditionals. * Frontend builds use the locally installed Nx command where applicable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> - typescript:S2187 not raised on the ApiManager tests, which build their cases with shared helpers that call `it` (`BetaKeysApi.test.ts`). typescript:S2819 not raised on `*.worker.ts`: a dedicated worker's messages come only from the page that started it.
ArtCraft Studio Linux releases
The Linux workflow builds every package before the release job signs and uploads them to the
existing artcraft-v<version> draft, retaining Windows and macOS assets. The version comes from
crates/desktop/artcraft/tauri.conf.json.
| Architecture | Outputs | Builder |
|---|---|---|
| x86_64 | AppImage, DEB, RPM, tar.gz, Arch pkg.tar.zst, Flatpak bundle, OCI | Ubuntu 22.04 native |
| aarch64 | AppImage, DEB, RPM, tar.gz, Arch pkg.tar.zst, Flatpak bundle, OCI | Ubuntu 22.04 ARM native |
| riscv64 | DEB, RPM, tar.gz | Ubuntu 24.04 cross compiler |
Native AppImages also include zsync delta-update metadata.
Flatpak uses native Ubuntu 24.04 runners and GNOME 51 for GTK3/WebKitGTK 4.1. Its build checks
for missing ELF dependencies inside the sandbox, grants --persist=Artcraft so settings and task
data survive restarts, and provides a launcher wrapper keeping WebKitGTK's accelerated rendering
path enabled. RISC-V packages require Ubuntu 24.04-era libraries; x86_64 and ARM64 use Ubuntu 22.04
as their build baseline. The suite does not publish RISC-V AppImages, Arch packages or Flatpaks.
package.sh <architecture> <rust-target> normalizes Tauri's DEB/RPM/AppImage filenames and
extracts the DEB's /usr tree into the suite's bin/ and share/ tarball layout. Shared Craft
Arch packaging consumes that tarball, with WebKitGTK, GTK3 and OpenSSL dependencies added.
flatpak.sh consumes the same tarball, builds the bundle, and exports the OCI layout.
Release runs import LINUX_SIGNING_KEY for Flatpak commit signatures and OCI publishing. The final shared
draft-release action signs RPMs, DEBs, Arch packages, AppImages, tarballs, OCI manifests and
checksums. Only a stable version on release or artcraft-release moves the OCI stable architecture tags.
Like the macOS and Windows release workflows, Linux release packaging runs on release branches
(release, artcraft-release, artcraft-linux) and workflow dispatch rather than on pull requests.
APT, RPM and pacman repositories are generated by artcraft-services from the release assets
and checksums. Its release catalog must be updated only after the signed release is published.
Installing a DEB manually is separate from publishing that DEB in the website's APT repository.
A successful build proves artifact production and metadata/dependency checks. It does not replace installation and interactive testing on physical RISC-V, ARM64 and x86_64 desktops.