buildx pushes a by-digest output to one repository per invocation, so with two
imagerepositories only the last one received the manifest and the merge job failed
with "not found". Loop over the image list and assert the digests agree.
Builds every platform in `platforms` by digest into each repository in `images`,
then joins those digests into one multi-arch manifest per repository, logging in
to DOCR, GHCR or dhi.io only when an image needs it. It carries the inputs both
craft web images need: a custom Dockerfile and stage, build args, a GHA layer
cache, preinstalled-SDK pruning, and a hook for preparing large build contexts
such as the font sources.
* release.yml: export each app's build variables from its env.sh, not a list
Eight release jobs set <APP>_VERSION, <APP>_BUILD_DATE and <APP>_BUILD_SHA for
every app by name (298 lines), and the FreeBSD VM step listed them all again,
so every new app meant editing this workflow. materialcraft and texturecraft
were never added: their packaging reads MATERIALCRAFT_* and TEXTURECRAFT_*,
so their release builds got no release version, date or commit, and a
dispatched run with a version override packaged them under Cargo.toml's.
actions/export-app-build-env reads the prefix the app's packaging/env.sh (or
packaging/common.sh) already declares in VERSION="${<PREFIX>_VERSION:-...}",
falling back to app-name in capitals, and writes the three variables to
GITHUB_ENV; its names output feeds the FreeBSD VM's envs. Each job runs it
right after checkout. On all 17 apps' env.sh it finds the prefix the old
list used.
Tests run the script on sample env.sh files and check release.yml sets no
app's variable by name, so the list can't come back.
* Export the build variables after the contributor snapshot, which must follow the checkout
test_contributor_refresh requires each build job to load the contributor snapshot directly after checkout, so the export step goes after it when a job has one. Also fix the line-break test passing a variable twice.
---------
Co-authored-by: nnaannoo <n4nosaur@gmail.com>
The writer and the checker share one normalization. A rewritten digest does not make an edit pass, an intact older copy warns only when main has moved on, and a source that cannot be read is reported as could not check.
Co-authored-by: Cursor <cursoragent@cursor.com>
Eight apps paste the same 25-line job into ci.yml, nix.yml or release.yml (ten
copies): Cargo.lock exists and is up to date, no .cargo/config(.toml)
replaces, patches or overrides a source, and every git dependency comes from
github.com/storytold. Apps' workflows are meant to only call workflows here.
actions/check-git-sources holds the check as a tested script, and
git-sources.yml runs it on a credential-less checkout, so an app swaps its
job for one `uses:` line and keeps `needs: git-sources`. It reports every
problem rather than the first, as GitHub error annotations, and treats
unreadable TOML as a failure. On all 18 apps' current Cargo.lock and Cargo
config it agrees with the inline copy.
Co-authored-by: Kristian Myram <kmy@oresundsbron.com>
The release job ran each app's packaging/linux/flatpak-oci.sh --push. Most
apps still carry the copy from before scripts/scaffold-flatpak-oci.sh learnt
to guard the stable tag, and it moves stable-<arch> on every push, so a
prerelease or a test run dispatched from any branch became what stable-<arch>
clients install. 15 of the 17 apps carry that copy.
Call the script without --push, which only builds the layout in every copy,
and push from the workflow: <version>-<arch> on every non-PR run, and
stable-<arch> only for a stable version built from the release branch, the
rule the scaffold template already uses. No app needs to change.
Co-authored-by: Kristian Myram <kmy@oresundsbron.com>
* Add changed-paths.yml: run a job only when its paths change or a label asks
* changed-paths: read paths NUL-separated, keep the reason on one line; README: what the checkout holds
A new optional LINUX_SIGNING_KEY secret (an unprotected OpenPGP signing subkey, from the
release environment) signs each Linux format the way its tools check it:
- rpm: embedded signature (rpmsign), for `rpm -K` and dnf/zypper gpgcheck
- deb: embedded _gpgorigin member (debsigs) and a detached .asc
- Arch: <file>.sig, which pacman looks for
- AppImage, tar.gz, zsync: detached .asc
- Flatpak bundle: signed commit and embedded public key (flatpak-bundle.sh, via the
scaffold's new step 4), so `flatpak install` verifies it, plus a detached .asc
- Flatpak OCI image: a containers/image signature for ghcr.io/<repo>@<digest>, which Flatpak
checks from its signature lookaside; the flatpak job records the pushed manifest for it
- SHA256SUMS.txt.asc over every release asset, and release-signing-key.asc
The draft-release action signs before computing checksums (embedded signatures change the rpm
and deb files) and verifies every signature against the exported public key. The new
import-signing-key action is shared by the flatpak and release jobs and refuses a key that
needs a passphrase. Without the secret, releases are published unsigned with a warning.
v2.87.29 knows nextest only up to 0.9.148, so every gate and coverage run that installs the
pinned cargo-nextest@0.9.150 fell back to cargo-binstall@latest: an unpinned download, then a
binstall of nextest. v2.87.33 is the oldest release whose manifest has 0.9.150; the releases
since v2.87.29 change only tool manifests.
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Calls with nothing to install from apt (a Windows-only check, a wasm build) had to pass a package
list the gate would ignore or install for nothing. packages now defaults to empty, and the apt step
runs only on Linux legs that name packages. The README describes such second gate calls, with
their own command and cache-version, instead of keeping web builds in the app's own workflow:
the apps' CI rules now allow only calls to shared workflows (#118).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pull requests that touch Windows packaging saved their own windows-arm64-package cache (about
0.7 GB), visible only to that pull request. Every app repository is at the 10 GB cache limit,
so each one evicted a cache main's gate restores. The nightly run on main still saves it.
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
flatpak-builder only Recommends elfutils, which --no-install-recommends skips. Apps whose
manifests now build cups-client from source (gridcraft, designcraft, wordcraft, pdfcraft) fail
in the Flatpak job with: Failed to execute child process "eu-strip".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
App repos' .github/workflows/ should only call craft-common-actions at @main, so CI
is the same across the Craft apps. gate.yml and the README said app-only jobs
(fuzzing, corpora, web builds, Windows installer probes) stay in the caller; they
now belong here as shared workflows or inputs, and move without being dropped.
* ci(release): build FreeBSD aarch64 archives by default
app packaging/freebsd/package.sh scripts now honor CARGO_BUILD_TARGET, so
aarch64 is no longer opt-in: freebsd-architectures defaults to
'["x86_64","aarch64"]'. Callers can still narrow it to x86_64 only.
* docs(readme): FreeBSD aarch64 is in the default freebsd-architectures
The aarch64 job uses FreeBSD's quarterly packages, which since 2026-10-28 have no `cmake` meta-package, only `cmake-core`. `pkg install cmake` failed and stopped every app's release build. `cmake-core` is in both the quarterly and latest sets.
Dylan M. Taylor
FredApps
dependabot[bot]
nnaannooandnnaannoo
Kristian Myram
g1obalworlds
Brandon ThomasandClaude Opus 5.5
aiongg