From d86d2b69f8b6de0aefdabb28e46e1d1287991265 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 11 Nov 2026 14:24:25 -0500 Subject: [PATCH 1/4] Fix Flatpak permissions for update checks and self-updates (#6339) * fix(flatpak): allow release checks and self-update helpers * test: keep Flatpak permission parsing within strict Clippy rules --- crates/ui-egui/tests/flatpak_updates.rs | 27 +++++++++++++++++++ .../ai.storyteller.wordcraft.bundle.yml | 2 ++ .../flatpak/ai.storyteller.wordcraft.yml | 2 ++ 3 files changed, 31 insertions(+) create mode 100644 crates/ui-egui/tests/flatpak_updates.rs diff --git a/crates/ui-egui/tests/flatpak_updates.rs b/crates/ui-egui/tests/flatpak_updates.rs new file mode 100644 index 0000000000..bc0cf42d6a --- /dev/null +++ b/crates/ui-egui/tests/flatpak_updates.rs @@ -0,0 +1,27 @@ +//! Release and source Flatpaks must allow release checks and host update helpers. +fn finish_args(manifest: &str) -> Vec<&str> { + manifest + .split("finish-args:") + .nth(1) + .unwrap_or_default() + .lines() + .take_while(|line| line.is_empty() || line.starts_with(' ') || line.starts_with('#')) + .filter_map(|line| line.trim().strip_prefix("- ")) + .map(|arg| arg.trim_matches(['\'', '"'])) + .collect() +} + +#[test] +fn flatpak_update_permissions() { + let manifests = [ + include_str!("../../../packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml"), + include_str!("../../../packaging/linux/flatpak/ai.storyteller.wordcraft.yml"), + ]; + let args = manifests.map(finish_args); + assert_eq!(args[0], args[1], "source and release permissions must agree"); + for permissions in args { + for required in ["--share=network", "--talk-name=org.freedesktop.Flatpak"] { + assert!(permissions.contains(&required), "missing update permission: {required}"); + } + } +} diff --git a/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml index 694c7138ba..14d0a219a9 100644 --- a/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml +++ b/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml @@ -17,6 +17,8 @@ runtime-version: '25.08' sdk: org.freedesktop.Sdk command: wordcraft finish-args: + # The shared updater inspects and updates this installation via flatpak-spawn --host. + - --talk-name=org.freedesktop.Flatpak - --filesystem=xdg-data/ArtCraft/versions:ro # Display: Wayland first; X11 only when no Wayland compositor is running. - --socket=wayland diff --git a/packaging/linux/flatpak/ai.storyteller.wordcraft.yml b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml index 9ce3934aef..a855e0c110 100644 --- a/packaging/linux/flatpak/ai.storyteller.wordcraft.yml +++ b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml @@ -18,6 +18,8 @@ sdk-extensions: - org.freedesktop.Sdk.Extension.rust-stable command: wordcraft finish-args: + # The shared updater inspects and updates this installation via flatpak-spawn --host. + - --talk-name=org.freedesktop.Flatpak - --filesystem=xdg-data/ArtCraft/versions:ro # Display: Wayland first; X11 only when no Wayland compositor is running. - --socket=wayland From a58b41a716cf4c205edc7db295febc97c82dad4c Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 11 Nov 2026 14:56:11 -0500 Subject: [PATCH 2/4] chore: bump version to 0.18.1 for the Flatpak update fix (#6344) --- Cargo.lock | 38 +++++++++++++++++++------------------- Cargo.toml | 2 +- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index aa556b5b68..653ae11b75 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -6807,7 +6807,7 @@ dependencies = [ [[package]] name = "wordcraft" -version = "0.18.0" +version = "0.18.1" dependencies = [ "arboard", "chrono", @@ -6847,7 +6847,7 @@ dependencies = [ [[package]] name = "wordcraft-cli" -version = "0.18.0" +version = "0.18.1" dependencies = [ "image", "serde_json", @@ -6863,11 +6863,11 @@ dependencies = [ [[package]] name = "wordcraft-control-key" -version = "0.18.0" +version = "0.18.1" [[package]] name = "wordcraft-doc" -version = "0.18.0" +version = "0.18.1" dependencies = [ "base64 0.23.1", "log", @@ -6881,7 +6881,7 @@ dependencies = [ [[package]] name = "wordcraft-docbin" -version = "0.18.0" +version = "0.18.1" dependencies = [ "cfb", "chrono", @@ -6898,7 +6898,7 @@ dependencies = [ [[package]] name = "wordcraft-docx" -version = "0.18.0" +version = "0.18.1" dependencies = [ "aes", "base64 0.23.1", @@ -6923,7 +6923,7 @@ dependencies = [ [[package]] name = "wordcraft-engine" -version = "0.18.0" +version = "0.18.1" dependencies = [ "cfb", "chrono", @@ -6957,7 +6957,7 @@ dependencies = [ [[package]] name = "wordcraft-fonts" -version = "0.18.0" +version = "0.18.1" dependencies = [ "brotli-decompressor", "harfrust 0.13.3", @@ -6971,7 +6971,7 @@ dependencies = [ [[package]] name = "wordcraft-formats" -version = "0.18.0" +version = "0.18.1" dependencies = [ "aes", "base64 0.23.1", @@ -6998,7 +6998,7 @@ dependencies = [ [[package]] name = "wordcraft-geom" -version = "0.18.0" +version = "0.18.1" dependencies = [ "image", "serde", @@ -7006,7 +7006,7 @@ dependencies = [ [[package]] name = "wordcraft-layout" -version = "0.18.0" +version = "0.18.1" dependencies = [ "craft-proof", "image", @@ -7026,7 +7026,7 @@ dependencies = [ [[package]] name = "wordcraft-mcp" -version = "0.18.0" +version = "0.18.1" dependencies = [ "log", "serde_json", @@ -7038,7 +7038,7 @@ dependencies = [ [[package]] name = "wordcraft-metafile" -version = "0.18.0" +version = "0.18.1" dependencies = [ "kurbo", "thiserror 2.0.21", @@ -7046,7 +7046,7 @@ dependencies = [ [[package]] name = "wordcraft-pdf" -version = "0.18.0" +version = "0.18.1" dependencies = [ "chrono", "craft-pdf", @@ -7067,7 +7067,7 @@ dependencies = [ [[package]] name = "wordcraft-render" -version = "0.18.0" +version = "0.18.1" dependencies = [ "image", "log", @@ -7081,7 +7081,7 @@ dependencies = [ [[package]] name = "wordcraft-ui-egui" -version = "0.18.0" +version = "0.18.1" dependencies = [ "accesskit_consumer", "cfb", @@ -7114,7 +7114,7 @@ dependencies = [ [[package]] name = "wordcraft-web" -version = "0.18.0" +version = "0.18.1" dependencies = [ "craft-web-api", "craft-web-host", @@ -7135,7 +7135,7 @@ dependencies = [ [[package]] name = "wordcraft-zotero" -version = "0.18.0" +version = "0.18.1" dependencies = [ "log", "proptest", @@ -7298,7 +7298,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee" [[package]] name = "xtask" -version = "0.18.0" +version = "0.18.1" dependencies = [ "serde_json", ] diff --git a/Cargo.toml b/Cargo.toml index 209e45cf70..f6fa8c1f35 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"] default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"] [workspace.package] -version = "0.18.0" +version = "0.18.1" edition = "2024" license = "MIT OR Apache-2.0" rust-version = "1.95" From 06c2ae6f9d2bdb84ce699241a84604405d87d3a4 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 11 Nov 2026 14:59:04 -0500 Subject: [PATCH 3/4] ci: use StepSecurity's maintained actions (#6343) Each third-party action that StepSecurity publishes a secure drop-in replacement for now uses that replacement, pinned to a commit with its version as a comment. Versions follow what we used: the newest StepSecurity release in the same major, or the closest major they publish. dtolnay/rust-toolchain refs that named a toolchain (stable, nightly, 1.76) become the replacement's `toolchain` input. --- .github/workflows/printing.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/printing.yml b/.github/workflows/printing.yml index 1b0573a5a4..3bfa5cfc44 100644 --- a/.github/workflows/printing.yml +++ b/.github/workflows/printing.yml @@ -81,12 +81,13 @@ jobs: pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \ libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers - - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable + - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0 with: + toolchain: stable components: rustfmt, clippy targets: wasm32-unknown-unknown - - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3 + - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2 with: save-if: ${{ github.ref == 'refs/heads/main' }} From 07f977372d3767e4abf7f3b0cc77c351289013f2 Mon Sep 17 00:00:00 2001 From: FredApps <153173854+FredApps@users.noreply.github.com> Date: Wed, 11 Nov 2026 23:04:54 +0100 Subject: [PATCH 4/4] CI: nightly release dry run (#6367) release.yml also runs nightly on main with craft-common-actions' dry-run: every release build except macOS, with nothing signed, pushed or drafted. Breakage that only the release build hits (riscv64, Flatpak, FreeBSD, packaging) then shows up the next morning instead of on release day, as it did on 11 Nov 2026. --- .github/workflows/release.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 89d3b647b1..0ebfaae45c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,6 +1,10 @@ name: Release on: + # A nightly dry run on main: every release build except macOS, nothing signed or released + # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day. + schedule: + - cron: "0 3 * * *" push: branches: [release] workflow_dispatch: @@ -33,6 +37,7 @@ jobs: # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos. uses: storytold/craft-common-actions/.github/workflows/release.yml@main with: + dry-run: ${{ github.event_name == 'schedule' }} app-name: wordcraft app-title: WordCraft craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83