Anyone can commit under an agent email, so a free-form Git name such as
"Private Person <noreply@anthropic.com>" became a published model title,
which the apps would ship in their About windows. Each provider now lists
the words a model title may use. A name with any other word credits the
agent's default model and repeats none of it; versions are bounded too.
Across the co-author trailers in the 13 apps' history, 18,099 keep their
model row and 7 unusual names now fall back to the default. Also pin that
the PR lookup reads the merge commit rather than the PR head.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
effectcraft's 4,000-commit history made 50-commit association queries time
out on GitHub, so batches are smaller and a failed batch is retried once.
GraphQL names bot openers without the [bot] suffix, which turned dependabot
into a person; only User accounts now count as PR openers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GitHub links agent trailers such as noreply@anthropic.com to the claude and
codex accounts, so they appeared as the top human contributors. Agents are now
recognized by exact Git email or GitHub account, never by name, and credited
only in the snapshot's models (About > Models), including commits an agent
authored itself. Bots are no longer listed as people. Model and version are
read from the agent's Git name, covering every provider the apps' history
uses.
Commits merged with a merge commit or rebase never equal a PR's merge commit,
so self-added names lost verification and unlinked commits lost their author.
GitHub's commit-to-PR association now supplies the opener of the one merged PR
containing the commit. An integration PR opened by a writer that carries the
person's own linked commit also verifies their entry.
Against the shipped snapshots of effectcraft, pdfcraft, photocraft and
lightcraft at their recorded heads, no person loses a row, a name or a commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The paths input is checked to stay inside the checkout, but its original
spelling was then passed to ast-grep where option parsing still applied, so
a checked file named like an option (--update-all, --follow) changed how the
scan ran. Pass "--" before the path list in both scan invocations.
The metainfo path comes from the release archive. A symlink to an endless
stream such as /dev/zero, or a FIFO, made sed read without bound. Refuse a
metainfo entry that is not a regular file resolving inside staging, read at
most 1 MiB of it once, and parse the summary and homepage from that prefix.
A new optional LINUX_SIGNING_KEY secret (an unprotected OpenPGP signing subkey, from the
release environment) signs each Linux format the way its tools check it:
- rpm: embedded signature (rpmsign), for `rpm -K` and dnf/zypper gpgcheck
- deb: embedded _gpgorigin member (debsigs) and a detached .asc
- Arch: <file>.sig, which pacman looks for
- AppImage, tar.gz, zsync: detached .asc
- Flatpak bundle: signed commit and embedded public key (flatpak-bundle.sh, via the
scaffold's new step 4), so `flatpak install` verifies it, plus a detached .asc
- Flatpak OCI image: a containers/image signature for ghcr.io/<repo>@<digest>, which Flatpak
checks from its signature lookaside; the flatpak job records the pushed manifest for it
- SHA256SUMS.txt.asc over every release asset, and release-signing-key.asc
The draft-release action signs before computing checksums (embedded signatures change the rpm
and deb files) and verifies every signature against the exported public key. The new
import-signing-key action is shared by the flatpak and release jobs and refuses a key that
needs a passphrase. Without the secret, releases are published unsigned with a warning.
- A prerelease bundle (a version with `-`, as resolve-version marks it) gets no --repo-url: the
OCI index serves only the latest stable release, so Flatpak would replace the prerelease
with that older build. The generated script clears OCI_REPO for such a version and passes
${OCI_REPO:+--repo-url="$OCI_REPO"}.
- --verify passes only with the exact URL, the prerelease guard and the option on the active
build-bundle command; a commented-out command never matches, nor is it edited.
- A script that already sets OCI_REPO or its own --repo-url fails the scaffold instead of being
reported ready or overwritten.
- The OCI export assertion matches the whole line (CodeRabbit).
scaffold-flatpak-oci.sh now also adds --repo-url=oci+https://getartcraft.com to each app's
.flatpak build-bundle command, and --verify reports it. A bundle installed with that URL gets an
origin remote that updates from the OCI index, which points Flatpak at GHCR. Installing such a
bundle over an existing bundle install rewrites the existing origin's URL in place, so existing
users switch over on their next bundle update without a reinstall.
v2.87.29 knows nextest only up to 0.9.148, so every gate and coverage run that installs the
pinned cargo-nextest@0.9.150 fell back to cargo-binstall@latest: an unpinned download, then a
binstall of nextest. v2.87.33 is the oldest release whose manifest has 0.9.150; the releases
since v2.87.29 change only tool manifests.
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Calls with nothing to install from apt (a Windows-only check, a wasm build) had to pass a package
list the gate would ignore or install for nothing. packages now defaults to empty, and the apt step
runs only on Linux legs that name packages. The README describes such second gate calls, with
their own command and cache-version, instead of keeping web builds in the app's own workflow:
the apps' CI rules now allow only calls to shared workflows (#118).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(install-apt-packages): time-limit and retry mirror downloads
A SonarCloud job in vectorcraft (run 41253493430) sat in this step for 58 minutes: the Azure
Ubuntu mirror timed out, apt fell back to archive.ubuntu.com, then a connection went silent and
apt printed nothing until the run was cancelled. Acquire::http::Timeout doesn't end a connection
that stays open, so the job's 90-minute timeout was the only bound.
apt-get update and a new --download-only pass now each run under timeout(1), 300 s per attempt,
up to 3 attempts. The install itself then works from downloaded files only, so dpkg is never
killed mid-configure. Acquire::https::Timeout is set alongside the http one for the HTTPS fallback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(install-apt-packages): retry an update that fetched only some indexes
apt-get update warns and exits 0 when an index fails to download, so the retry never ran for
it. APT::Update::Error-Mode=any makes that a failure, which is retried. If indexes are still
missing after the last attempt the step continues with a warning, as it did before: they often
belong to a repository the packages don't need, and a package that needs one fails the download.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Pull requests that touch Windows packaging saved their own windows-arm64-package cache (about
0.7 GB), visible only to that pull request. Every app repository is at the 10 GB cache limit,
so each one evicted a cache main's gate restores. The nightly run on main still saves it.
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
flatpak-builder only Recommends elfutils, which --no-install-recommends skips. Apps whose
manifests now build cups-client from source (gridcraft, designcraft, wordcraft, pdfcraft) fail
in the Flatpak job with: Failed to execute child process "eu-strip".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dylan M. Taylor
FredApps
Kristian Myram
dependabot[bot]
g1obalworlds
Brandon ThomasandClaude Opus 5.5