* ci: preserve every main-branch Sonar scan
* ci: never cancel a running main Sonar scan, as the app repos do
Per-run concurrency groups let main scans run side by side, so an older
commit's analysis can reach SonarCloud after a newer one. Keep one group
per ref and only stop cancelling on main, matching every app repo's
sonarcloud.yml.
Tests that run a workspace binary through env!("CARGO_BIN_EXE_<name>")
hold the build job's absolute target path. nextest extracts the archive
to a temporary directory, so in every coverage shard those tests failed
with "No such file or directory" while the gate passed them. Since #222
made shard test failures fail the scan, that turned SonarCloud red on
designcraft, cadcraft, pdfcraft and wordcraft main.
The build job now records cargo's target directory next to the archive.
Each shard extracts the archive to a known directory and links the
recorded path to it before running its partition.
* release.yml: a publish input publishes a complete draft at the end of the run
Part E of the faster-release plan: no one waits by the run to publish. Only on the release
branch, not in a dry run, only when no build job failed (the job already requires that) or was
cancelled, and only when the draft has at least as many assets as the last published release, so
a skipped build job can't publish an incomplete release. Off by default; apps opt in.
* publish: compare with the most recently published release, and say why in the summary
gh release list orders by creation, so the newest-created release was the baseline; an older
draft published later would have been missed. Every refusal now also writes its reason to the
job summary, not only an error annotation.
* tests: publish doesn't change the FreeBSD build, so it stays out of the cache key
* fix(ci): provide pinned translations to coverage tests
* fix(ci): keep translation checkout out of scan
---------
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
The release FreeBSD jobs keyed their Cargo cache on toJSON(inputs), and
contributors-artifact is contributor-snapshot-<run id>-<attempt>, so every run
wrote an entry no other run could restore: on 11 Nov every release built FreeBSD
cold. The key now holds only the inputs that change the FreeBSD build (app name,
architecture, craft-fonts ref, FreeBSD release); dry-run is left out too, so a dry
run warms the cache a release restores. A test makes every new input pick a side.
The aarch64 job cross-compiles, and Cargo writes that output to
target/aarch64-unknown-freebsd/release, which the cache action never saved: only
the host build scripts in target/release were kept. The action takes the triple as
a new target input and saves and restores that directory too.
Ubuntu's MOTD news and Ubuntu Pro (ESM) hooks reach motd.ubuntu.com and
esm.ubuntu.com; TLS revocation checks for Amazon-issued certificates go
to *.amazontrust.com over plain HTTP. Every Harden-Runner allow list now
names them.
Each coverage shard now merges its own raw profiles into one sparse
.profdata with the archive toolchain's llvm-profdata and uploads only
that. The scan job merges the shard profiles instead of downloading
every raw profile beside the test archive, which on 11 Nov 2026 filled
the runner for vectorcraft (four ~7 GB zipped profraw artifacts).
A raw profile llvm-profdata cannot read, such as one cut short by a
test process that crashed while writing it (lightcraft, 11 Nov 2026),
now fails its shard with an error naming the file, instead of being
uploaded and failing the scan's merge.
Single-shard callers keep the cargo llvm-cov path unchanged.
* release.yml: a dry-run input builds and checks without releasing
For a nightly run on main that finds release-only breakage before release day. On 11 Nov 2026
gridcraft's riscv64 build, materialcraft's private-repo FreeBSD jobs, wordcraft's Print job and
the riscv64 apt mirrors each surfaced only during the release, one fix PR and release run at a
time. With dry-run: no job enters the release environment (no signing secrets; the environment
admits only the release branch), the macOS job and the draft are skipped, and the Flatpak OCI
layouts are not pushed to GHCR or Docker Hub.
* tests: the Flatpak OCI push and the release environment also stay out of a dry run
* ci: use StepSecurity's maintained actions
Each third-party action that StepSecurity publishes a secure drop-in
replacement for now uses that replacement, pinned to a commit with its
version as a comment. Versions follow what we used: the newest
StepSecurity release in the same major, or the closest major they
publish. dtolnay/rust-toolchain refs that named a toolchain (stable,
nightly, 1.76) become the replacement's `toolchain` input.
* tests: find the FreeBSD VM, SonarCloud scan and install-action steps by their StepSecurity names
* sonarcloud: honour each repository's own sonar.cpd.exclusions
* sonarcloud: read sonar.cpd.exclusions with properties syntax and allow the ? wildcard
Block-mode Harden-Runner still flagged apt's lookups under these zones
(_https._tcp.mirrors.edge.kernel.org, _https._tcp.mirrors.dotsrc.org),
and apt failures are breaking CI across the org. Allow the whole zones on
443 next to the existing mirror hosts.
The release builds' Linux riscv64 job read amd64 from archive and
security.ubuntu.com and riscv64 from ports.ubuntu.com only. With no
ubuntu.com name resolving on the runners, apt spent 3m20s on failed
lookups and then found no libc6-dev:riscv64, so every app's release
failed there.
select-mirrors.sh now chooses one pair of mirrors for both architectures:
Ubuntu's own, then dotsrc (it carries both trees), then kernel.org with
TU Chemnitz's ports. It takes the first pair whose amd64 and riscv64
InRelease files answer for every suite with the same Date (Ubuntu signs
one Release for archive and ports), so Multi-Arch: same packages still
match. The image's own Ubuntu sources are disabled in that job: they
only added a second, lagging snapshot and, during the outage, the stall.
The riscv64 job runs Harden-Runner in audit mode, so release.yml needs
no allowlist change.
One run on 11 Nov 2026 found no candidate for tcsh or debsigs right after
an update that fetched every index from kernel.org; the runs before and
after it, under the same ubuntu.com outage, passed. Print apt-cache policy,
the architecture settings, the universe index files and whether the CPU
supports x86-64-v3, so the next failure shows the cause.
Harden-Runner blocked apt's SRV lookups (_https._tcp.mirrors.edge.kernel.org,
_https._tcp.mirrors.dotsrc.org): the allow lists name the hosts, not their
SRV records. configure-apt-mirrors now sets Acquire::EnableSrvRecords false;
apt connects to the hosts directly either way.
The FreeBSD workflow's VM action apt-installs QEMU on the host, which failed
during the ubuntu.com outage (sudo exit 100) and reached packages.microsoft.com.
Run configure-apt-mirrors first and drop the image's Microsoft source, which
the job never installs from.
On 11 Nov 2026 no ubuntu.com name resolved on the runners for about
half an hour. The images' mirror list (azure.archive, archive and
security.ubuntu.com) sits entirely in that zone, so every retry spent
its five minutes on 20-second lookups of the same dead names and the
SonarCloud archive builds failed with "downloading the packages failed
3 times".
configure-apt-mirrors points the image's Ubuntu sources at
/etc/apt/craft-apt-mirrors.txt: the image's mirrors in the image's
order, then mirrors.edge.kernel.org and mirrors.dotsrc.org (arm:
mirrors.dotsrc.org and ftp.tu-chemnitz.de). Each mirror is checked
first, in parallel; those that do not serve this release's InRelease
move to the end. install-apt-packages runs it before every network
attempt, and the plain apt-get steps (Flatpak, release, packaging lint,
RPM signing, Linux deps, FreeBSD test) run it before apt-get update.
Block-mode Harden-Runner lists allow the new hosts.
clippy records clippy.toml in its dep-info, so sccache already sees it.
The one setting sccache leaves out is --check-cfg, declared in Cargo.toml
lints and build scripts. Correct the comment and README.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sccache v0.18.0 leaves --check-cfg out of its key on purpose, and a
cached clippy-driver run doesn't see clippy.toml, so a cached compile
replays the warnings it had. The cache's version (SCCACHE_GHA_VERSION)
now comes from cache-version and a hash of every Cargo.toml, build.rs
and clippy.toml, unless the caller sets it.
The README also says what sccache can't see: files a procedural macro
reads without rustc tracking them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
As gate.yml does: the build starts at once and the space is free before
it needs it. The scan job's cleanup is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rust-cache keeps dependencies but not the workspace's crates, so every
gate run compiles all of them again. With `sccache: true` the gate wraps
rustc in sccache over the GitHub Actions cache. It writes where the
dependency cache saves (the default branch, opted-in dispatches) and
only reads elsewhere; SCCACHE_GHA_RW_MODE in `env` overrides that.
Off by default, so no caller changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown
- Add persist-credentials: false across all actions/checkout invocations
- Eliminate template injection by mapping matrix and input variables to env: in freebsd.yml, release.yml, and sonarcloud.yml
- Add 7-day cooldown to dependabot.yml to protect against supply-chain compromise of recently published releases
- Update test suite to validate hardened environment mappings
* ci: allow static.crates.io and registry endpoints in gate and windows-arm64 runners
* fix(freebsd): give the VM a swap file and cap the ZFS ARC
photocraft's FreeBSD job was SIGKILLed compiling photocraft-ui-egui's lib tests late in the run (release run 42609972735, dispatch 42805955303). Add an 8 GB swap file when the guest has none, cap the ARC at 2 GB when the image uses ZFS, and print disk, swap and memory so the next OOM is diagnosable.
* fix(freebsd): only touch swap and the ARC inside a FreeBSD guest
The workflow tests run the prepare script on Linux under sh -eu, where swapctl doesn't exist. Run the ARC cap, swap file and diagnostics only when uname is FreeBSD, and don't let the diagnostics fail the step.
* fix(freebsd): add the swap file only with room to spare, and remove a partial one
Per review: a dd that runs out of space must not leave a partial /var/swap0 that then starves the build. Require 16 GB free on /var first and delete the file if any step fails.
* fix(freebsd): keep only the ZFS ARC cap; drop the swap-file fallback
Per review: swap on a ZFS-backed file can hang FreeBSD under memory pressure, and today's image already has a swap partition, so the fallback never ran. The verified run passed on the ARC cap alone.
- Add allowed-endpoints to ast-grep.yml matching test-ast-grep.yml
- Add pypi.org and files.pythonhosted.org to sonarcloud.yml for Python coverage
- Add packages.microsoft.com:443 and https mirrors to apt allowed-endpoints
- Set unvalidated reusable workflows (release, docker-build, gate, etc.) to audit mode
Adds step-security/harden-runner (v2.22.4, SHA-pinned) as the first step of
every job in the reusable and repo workflows, in egress-policy: audit mode.
Audit mode only records network, file and process activity; it blocks nothing.
Unsupported environments (containers, FreeBSD VM guests, ubuntu-slim) are
skipped by the action itself. Dependabot's github-actions group keeps the pin
current.
Dylan M. Taylor
FredApps
FredApps
