* Release: scripts/cut_release.py cuts a release from green main without a bump pull request
On 11 Nov 2026 the release of 14 apps took most of the day. A large part went to version-bump pull
requests that changed only version strings yet waited on the full CI of a pull request (1-2 h of
FreeBSD, sharded SonarCloud coverage), and to rerunning it. The script commits the bump on the
newest main commit whose CI passed, merges it into release (which starts release.yml), opens the
same bump for main as its own pull request, and with --publish publishes the draft once the run
passed and has assets. Tests cover the bump: workspace and path-dependency versions, only the
workspace's own Cargo.lock entries, CRLF files, the repository hook.
* cut_release: review fixes
- A trailing comment after the workspace version stays; the value alone is replaced.
- Cargo.lock: only the workspace members' entries (cargo metadata --no-deps) change, not a local
path dependency outside the workspace that shares the version.
- Cargo.lock is checked with a resolving cargo metadata --locked, on the bump, on release after
the merge and on the sync branch; --no-deps never compared it with path dependency versions.
- --publish refuses a draft with fewer assets than the last release (a skipped build job leaves
the run green), unless --allow-fewer-assets.
- The sync PR never moves main backwards: versions compare as numbers, and a main at or past the
release gets none.
- A failed auto-merge says so, with the PR to merge by hand.
- Arguments that reach git or gh are checked first (owner/name, version, commit hash, workflow,
title), so none can be read as an option. git, gh and cargo are required up front.
* Release: scripts/release_train.py releases many apps at once with cut_release.py
Every app in parallel, a log per app, and one summary line each (published, pushed, or stopped
and why); one app stopping doesn't stop the rest. Tested on figcraft and soundcraft with
--dry-run (both done in under a minute).
* tests: release_train options before -- in the test
* release_train: only owner/name repos and known cut_release.py options reach the subprocess
* release.yml: a dry-run input builds and checks without releasing
For a nightly run on main that finds release-only breakage before release day. On 11 Nov 2026
gridcraft's riscv64 build, materialcraft's private-repo FreeBSD jobs, wordcraft's Print job and
the riscv64 apt mirrors each surfaced only during the release, one fix PR and release run at a
time. With dry-run: no job enters the release environment (no signing secrets; the environment
admits only the release branch), the macOS job and the draft are skipped, and the Flatpak OCI
layouts are not pushed to GHCR or Docker Hub.
* tests: the Flatpak OCI push and the release environment also stay out of a dry run
* ci: use StepSecurity's maintained actions
Each third-party action that StepSecurity publishes a secure drop-in
replacement for now uses that replacement, pinned to a commit with its
version as a comment. Versions follow what we used: the newest
StepSecurity release in the same major, or the closest major they
publish. dtolnay/rust-toolchain refs that named a toolchain (stable,
nightly, 1.76) become the replacement's `toolchain` input.
* tests: find the FreeBSD VM, SonarCloud scan and install-action steps by their StepSecurity names
* sonarcloud: honour each repository's own sonar.cpd.exclusions
* sonarcloud: read sonar.cpd.exclusions with properties syntax and allow the ? wildcard
During the ubuntu.com outage, cloud-init's apt_configure module (once per
instance, at boot) spent two 10-second DNS timeouts looking for a mirror
and then wrote ubuntu.sources from its template, after the job had
started. On those VMs configure-apt-mirrors had already pointed the
sources at its list: apt-get update fetched every index for that list,
cloud-init put the image's mirror list back, and apt-get install found
no indexes for it, so no Ubuntu package had a candidate (materialcraft's
Flatpak x86_64 job, the FreeBSD tests job on 26.04). A repro on 12
runners failed on 8, every round, and a file watcher caught cloud-init's
write landing mid-update.
wait-for-cloud-init.sh runs `cloud-init status --wait` (at most 300 s,
never failing the job) before configure-apt-mirrors and
install-riscv64-cross's select-mirrors.sh touch anything.
Block-mode Harden-Runner still flagged apt's lookups under these zones
(_https._tcp.mirrors.edge.kernel.org, _https._tcp.mirrors.dotsrc.org),
and apt failures are breaking CI across the org. Allow the whole zones on
443 next to the existing mirror hosts.
The release builds' Linux riscv64 job read amd64 from archive and
security.ubuntu.com and riscv64 from ports.ubuntu.com only. With no
ubuntu.com name resolving on the runners, apt spent 3m20s on failed
lookups and then found no libc6-dev:riscv64, so every app's release
failed there.
select-mirrors.sh now chooses one pair of mirrors for both architectures:
Ubuntu's own, then dotsrc (it carries both trees), then kernel.org with
TU Chemnitz's ports. It takes the first pair whose amd64 and riscv64
InRelease files answer for every suite with the same Date (Ubuntu signs
one Release for archive and ports), so Multi-Arch: same packages still
match. The image's own Ubuntu sources are disabled in that job: they
only added a second, lagging snapshot and, during the outage, the stall.
The riscv64 job runs Harden-Runner in audit mode, so release.yml needs
no allowlist change.
One run on 11 Nov 2026 found no candidate for tcsh or debsigs right after
an update that fetched every index from kernel.org; the runs before and
after it, under the same ubuntu.com outage, passed. Print apt-cache policy,
the architecture settings, the universe index files and whether the CPU
supports x86-64-v3, so the next failure shows the cause.
Harden-Runner blocked apt's SRV lookups (_https._tcp.mirrors.edge.kernel.org,
_https._tcp.mirrors.dotsrc.org): the allow lists name the hosts, not their
SRV records. configure-apt-mirrors now sets Acquire::EnableSrvRecords false;
apt connects to the hosts directly either way.
The FreeBSD workflow's VM action apt-installs QEMU on the host, which failed
during the ubuntu.com outage (sudo exit 100) and reached packages.microsoft.com.
Run configure-apt-mirrors first and drop the image's Microsoft source, which
the job never installs from.
On 11 Nov 2026 no ubuntu.com name resolved on the runners for about
half an hour. The images' mirror list (azure.archive, archive and
security.ubuntu.com) sits entirely in that zone, so every retry spent
its five minutes on 20-second lookups of the same dead names and the
SonarCloud archive builds failed with "downloading the packages failed
3 times".
configure-apt-mirrors points the image's Ubuntu sources at
/etc/apt/craft-apt-mirrors.txt: the image's mirrors in the image's
order, then mirrors.edge.kernel.org and mirrors.dotsrc.org (arm:
mirrors.dotsrc.org and ftp.tu-chemnitz.de). Each mirror is checked
first, in parallel; those that do not serve this release's InRelease
move to the end. install-apt-packages runs it before every network
attempt, and the plain apt-get steps (Flatpak, release, packaging lint,
RPM signing, Linux deps, FreeBSD test) run it before apt-get update.
Block-mode Harden-Runner lists allow the new hosts.
Clears both open SonarCloud issues.
- `actions/draft-release/sign-linux.sh`: `[[ ]]` in place of `[ ]` for bash tests (SonarCloud shell:S7688). Every script has a bash shebang; no test uses `-a`/`-o`, escaped parentheses or an unquoted pattern on the right of `=`.
- `actions/refresh-contributors/refresh_contributors.py` `model()`: `([^<>]*)<([^<>]+)>` on the stripped trailer, with the name stripped after, in place of `\s*(.*?)\s*<([^<>]+)>\s*` (python:S8786, backtracking). Same result for every Git identity: a name can't hold `<` or `>`.
* ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown
- Add persist-credentials: false across all actions/checkout invocations
- Eliminate template injection by mapping matrix and input variables to env: in freebsd.yml, release.yml, and sonarcloud.yml
- Add 7-day cooldown to dependabot.yml to protect against supply-chain compromise of recently published releases
- Update test suite to validate hardened environment mappings
* ci: allow static.crates.io and registry endpoints in gate and windows-arm64 runners
* fix(freebsd): give the VM a swap file and cap the ZFS ARC
photocraft's FreeBSD job was SIGKILLed compiling photocraft-ui-egui's lib tests late in the run (release run 42609972735, dispatch 42805955303). Add an 8 GB swap file when the guest has none, cap the ARC at 2 GB when the image uses ZFS, and print disk, swap and memory so the next OOM is diagnosable.
* fix(freebsd): only touch swap and the ARC inside a FreeBSD guest
The workflow tests run the prepare script on Linux under sh -eu, where swapctl doesn't exist. Run the ARC cap, swap file and diagnostics only when uname is FreeBSD, and don't let the diagnostics fail the step.
* fix(freebsd): add the swap file only with room to spare, and remove a partial one
Per review: a dd that runs out of space must not leave a partial /var/swap0 that then starves the build. Require 16 GB free on /var first and delete the file if any step fails.
* fix(freebsd): keep only the ZFS ARC cap; drop the swap-file fallback
Per review: swap on a ZFS-backed file can hang FreeBSD under memory pressure, and today's image already has a swap partition, so the fallback never ran. The verified run passed on the ARC cap alone.
- Add allowed-endpoints to ast-grep.yml matching test-ast-grep.yml
- Add pypi.org and files.pythonhosted.org to sonarcloud.yml for Python coverage
- Add packages.microsoft.com:443 and https mirrors to apt allowed-endpoints
- Set unvalidated reusable workflows (release, docker-build, gate, etc.) to audit mode
Adds step-security/harden-runner (v2.22.4, SHA-pinned) as the first step of
every job in the reusable and repo workflows, in egress-policy: audit mode.
Audit mode only records network, file and process activity; it blocks nothing.
Unsupported environments (containers, FreeBSD VM guests, ubuntu-slim) are
skipped by the action itself. Dependabot's github-actions group keeps the pin
current.
Bound archive and checksum download retries, including refused connections, while retaining HTTPS and SHA-256 validation. Report missing checksum entries using an exact archive filename lookup. Add nine real-curl regression tests for recovery, permanent failures, retry bounds and checksum validation.
buildx pushes a by-digest output to one repository per invocation, so with two
imagerepositories only the last one received the manifest and the merge job failed
with "not found". Loop over the image list and assert the digests agree.
Builds every platform in `platforms` by digest into each repository in `images`,
then joins those digests into one multi-arch manifest per repository, logging in
to DOCR, GHCR or dhi.io only when an image needs it. It carries the inputs both
craft web images need: a custom Dockerfile and stage, build args, a GHA layer
cache, preinstalled-SDK pruning, and a hook for preparing large build contexts
such as the font sources.
Add allow-published (default false) to draft-release. When true, draft-release
permits uploading assets to an existing published release without failing or
attempting to convert it to a draft with --draft.
* release.yml: export each app's build variables from its env.sh, not a list
Eight release jobs set <APP>_VERSION, <APP>_BUILD_DATE and <APP>_BUILD_SHA for
every app by name (298 lines), and the FreeBSD VM step listed them all again,
so every new app meant editing this workflow. materialcraft and texturecraft
were never added: their packaging reads MATERIALCRAFT_* and TEXTURECRAFT_*,
so their release builds got no release version, date or commit, and a
dispatched run with a version override packaged them under Cargo.toml's.
actions/export-app-build-env reads the prefix the app's packaging/env.sh (or
packaging/common.sh) already declares in VERSION="${<PREFIX>_VERSION:-...}",
falling back to app-name in capitals, and writes the three variables to
GITHUB_ENV; its names output feeds the FreeBSD VM's envs. Each job runs it
right after checkout. On all 17 apps' env.sh it finds the prefix the old
list used.
Tests run the script on sample env.sh files and check release.yml sets no
app's variable by name, so the list can't come back.
* Export the build variables after the contributor snapshot, which must follow the checkout
test_contributor_refresh requires each build job to load the contributor snapshot directly after checkout, so the export step goes after it when a job has one. Also fix the line-break test passing a variable twice.
---------
Co-authored-by: nnaannoo <n4nosaur@gmail.com>
The path is resolved and has to stay inside the named directory. The existing file's text is written back as text, so the path-traversal finding on that write is suppressed.
Co-authored-by: Cursor <cursoragent@cursor.com>
A checkout path and a recorded commit have to match a fixed pattern, and the standards path has to be one of the two known files. The per-block check is its own function.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dylan M. Taylor
FredApps
dependabot[bot]
nnaannooandnnaannoo
