Eight apps paste the same 25-line job into ci.yml, nix.yml or release.yml (ten
copies): Cargo.lock exists and is up to date, no .cargo/config(.toml)
replaces, patches or overrides a source, and every git dependency comes from
github.com/storytold. Apps' workflows are meant to only call workflows here.
actions/check-git-sources holds the check as a tested script, and
git-sources.yml runs it on a credential-less checkout, so an app swaps its
job for one `uses:` line and keeps `needs: git-sources`. It reports every
problem rather than the first, as GitHub error annotations, and treats
unreadable TOML as a failure. On all 18 apps' current Cargo.lock and Cargo
config it agrees with the inline copy.
Co-authored-by: Kristian Myram <kmy@oresundsbron.com>
The release job ran each app's packaging/linux/flatpak-oci.sh --push. Most
apps still carry the copy from before scripts/scaffold-flatpak-oci.sh learnt
to guard the stable tag, and it moves stable-<arch> on every push, so a
prerelease or a test run dispatched from any branch became what stable-<arch>
clients install. 15 of the 17 apps carry that copy.
Call the script without --push, which only builds the layout in every copy,
and push from the workflow: <version>-<arch> on every non-PR run, and
stable-<arch> only for a stable version built from the release branch, the
rule the scaffold template already uses. No app needs to change.
Co-authored-by: Kristian Myram <kmy@oresundsbron.com>
* Add the setup-windows-signing action: the shared Authenticode signing script
Every app carries its own packaging/windows/sign.ps1 and the copies have drifted: four lack the
Trusted Signing client SHA-256 pin. The action exports the maintained script, parameterized by
product name and URL, for package.ps1 to call; it rejects line breaks that could inject
environment variables, and refuses an unset product name. The script reads file names literally.
Tests run it against a stand-in signtool.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013fTnVxnXTv2MBW6uj2PPyU
* Test that an unset product name gets the clear message, not a null-method error
PowerShell echoes the failing source line, so the message alone passed on the old code too.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013fTnVxnXTv2MBW6uj2PPyU
* Refuse a non-x64 signtool for Azure Trusted Signing
The Azure branch loads the x64 Azure.CodeSigning.Dlib.dll, but SIGNTOOL or
PATH can name an x86 or ARM64 signtool.exe, which cannot load it. Read the
PE machine type of the chosen signtool and fail with a clear message before
downloading the client. A file that is not a PE image is left alone.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Kristian Myram <kmy@oresundsbron.com>
* Add shared macOS certificate import and Windows signing script actions
Every app carries its own packaging/macos/import-cert.sh and packaging/windows/sign.ps1, and the
copies have drifted: four apps lack the Trusted Signing client SHA-256 pin and eight still write the
signing certificate to a predictable temporary path.
- import-macos-certificate: the hardened import (private mktemp -d directory, keychain removed on
failure), self-contained, with identity/keychain outputs.
- setup-windows-signing: exports the shared sign.ps1, parameterized by product name and URL, for
package.ps1 to call; rejects line breaks that could inject environment variables.
- Tests run both scripts against stand-ins for security, openssl and signtool.
Existing callers are unchanged; apps adopt the actions one at a time.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Signing scripts: read file names literally, refuse an unset product name clearly
sign.ps1 resolved its file arguments with Resolve-Path, which treats [ and ] as wildcards, so a
file such as 'App [x64].msi' failed. setup-windows-signing called .Trim() on an unset product
name, a null-valued method call, instead of its own message. Tests for both.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013fTnVxnXTv2MBW6uj2PPyU
* Split the signing PR: keep only the macOS certificate import here
The Windows signing action moves to its own branch and PR. The tests, README text and bullet for
each action now live with that action, with separate README headings so the two PRs merge
independently.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013fTnVxnXTv2MBW6uj2PPyU
---------
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
* Add changed-paths.yml: run a job only when its paths change or a label asks
* changed-paths: read paths NUL-separated, keep the reason on one line; README: what the checkout holds
Anyone can commit under an agent email, so a free-form Git name such as
"Private Person <noreply@anthropic.com>" became a published model title,
which the apps would ship in their About windows. Each provider now lists
the words a model title may use. A name with any other word credits the
agent's default model and repeats none of it; versions are bounded too.
Across the co-author trailers in the 13 apps' history, 18,099 keep their
model row and 7 unusual names now fall back to the default. Also pin that
the PR lookup reads the merge commit rather than the PR head.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
effectcraft's 4,000-commit history made 50-commit association queries time
out on GitHub, so batches are smaller and a failed batch is retried once.
GraphQL names bot openers without the [bot] suffix, which turned dependabot
into a person; only User accounts now count as PR openers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GitHub links agent trailers such as noreply@anthropic.com to the claude and
codex accounts, so they appeared as the top human contributors. Agents are now
recognized by exact Git email or GitHub account, never by name, and credited
only in the snapshot's models (About > Models), including commits an agent
authored itself. Bots are no longer listed as people. Model and version are
read from the agent's Git name, covering every provider the apps' history
uses.
Commits merged with a merge commit or rebase never equal a PR's merge commit,
so self-added names lost verification and unlinked commits lost their author.
GitHub's commit-to-PR association now supplies the opener of the one merged PR
containing the commit. An integration PR opened by a writer that carries the
person's own linked commit also verifies their entry.
Against the shipped snapshots of effectcraft, pdfcraft, photocraft and
lightcraft at their recorded heads, no person loses a row, a name or a commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The paths input is checked to stay inside the checkout, but its original
spelling was then passed to ast-grep where option parsing still applied, so
a checked file named like an option (--update-all, --follow) changed how the
scan ran. Pass "--" before the path list in both scan invocations.
The metainfo path comes from the release archive. A symlink to an endless
stream such as /dev/zero, or a FIFO, made sed read without bound. Refuse a
metainfo entry that is not a regular file resolving inside staging, read at
most 1 MiB of it once, and parse the summary and homepage from that prefix.
A new optional LINUX_SIGNING_KEY secret (an unprotected OpenPGP signing subkey, from the
release environment) signs each Linux format the way its tools check it:
- rpm: embedded signature (rpmsign), for `rpm -K` and dnf/zypper gpgcheck
- deb: embedded _gpgorigin member (debsigs) and a detached .asc
- Arch: <file>.sig, which pacman looks for
- AppImage, tar.gz, zsync: detached .asc
- Flatpak bundle: signed commit and embedded public key (flatpak-bundle.sh, via the
scaffold's new step 4), so `flatpak install` verifies it, plus a detached .asc
- Flatpak OCI image: a containers/image signature for ghcr.io/<repo>@<digest>, which Flatpak
checks from its signature lookaside; the flatpak job records the pushed manifest for it
- SHA256SUMS.txt.asc over every release asset, and release-signing-key.asc
The draft-release action signs before computing checksums (embedded signatures change the rpm
and deb files) and verifies every signature against the exported public key. The new
import-signing-key action is shared by the flatpak and release jobs and refuses a key that
needs a passphrase. Without the secret, releases are published unsigned with a warning.
- A prerelease bundle (a version with `-`, as resolve-version marks it) gets no --repo-url: the
OCI index serves only the latest stable release, so Flatpak would replace the prerelease
with that older build. The generated script clears OCI_REPO for such a version and passes
${OCI_REPO:+--repo-url="$OCI_REPO"}.
- --verify passes only with the exact URL, the prerelease guard and the option on the active
build-bundle command; a commented-out command never matches, nor is it edited.
- A script that already sets OCI_REPO or its own --repo-url fails the scaffold instead of being
reported ready or overwritten.
- The OCI export assertion matches the whole line (CodeRabbit).
scaffold-flatpak-oci.sh now also adds --repo-url=oci+https://getartcraft.com to each app's
.flatpak build-bundle command, and --verify reports it. A bundle installed with that URL gets an
origin remote that updates from the OCI index, which points Flatpak at GHCR. Installing such a
bundle over an existing bundle install rewrites the existing origin's URL in place, so existing
users switch over on their next bundle update without a reinstall.
v2.87.29 knows nextest only up to 0.9.148, so every gate and coverage run that installs the
pinned cargo-nextest@0.9.150 fell back to cargo-binstall@latest: an unpinned download, then a
binstall of nextest. v2.87.33 is the oldest release whose manifest has 0.9.150; the releases
since v2.87.29 change only tool manifests.
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
dependabot[bot]
nnaannooandKristian Myram
FredApps
Dylan M. Taylor
Kristian Myram
g1obalworlds
