ci: install xdg-utils for Linux AppImage bundling

The ubuntu-22.04-arm runner image does not ship /usr/bin/xdg-open, so tauri-action failed while bundling the aarch64 AppImage and uploaded no Linux artifacts. Install xdg-utils explicitly in the Linux build job.
Merge tested main for artcraft-v0.42.1
2026-11-12 08:56:47 -05:00 · 2026-11-11 22:23:07 -05:00 · 2026-11-11 21:57:11 -05:00 · 2026-11-06 21:36:51 -05:00 · 2026-11-06 21:01:05 -05:00
7 changed files with 38 additions and 167 deletions
@@ -1,93 +0,0 @@
-# This file is machine-generated by `gh actions-lock`.
-# Do not edit by hand; run `gh actions-lock` to update.
-# Docs: https://gh.io/actions-lockfile
-version: 'v0.0.3'
-workflows:
-    '.github/workflows/artcraft-linux-publish.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/download-artifact@v8.0.2'
-        - 'actions/setup-node@v7.1.0'
-        - 'actions/upload-artifact@v7.0.2'
-        - 'step-security/dtolnay-rust-toolchain@v1.0.0'
-        - 'step-security/harden-runner@v2.22.4'
-        - 'step-security/rust-cache@v2.9.2'
-        - 'step-security/tauri-action@v1.0.0'
-        - 'storytold/craft-common-actions@main'
-    '.github/workflows/artcraft-macos-publish.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/setup-node@v7.1.0'
-        - 'step-security/dtolnay-rust-toolchain@v1.0.0'
-        - 'step-security/harden-runner@v2.22.4'
-        - 'step-security/tauri-action@v1.0.0'
-    '.github/workflows/artcraft-windows-publish.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/setup-node@v7.1.0'
-        - 'step-security/dtolnay-rust-toolchain@v1.0.0'
-        - 'step-security/harden-runner@v2.22.4'
-        - 'step-security/tauri-action@v1.0.0'
-    '.github/workflows/freebsd.yml': []
-    '.github/workflows/house-rules.yml': []
-    '.github/workflows/lockfile.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/packaging-lint.yml': []
-    '.github/workflows/sonarcloud.yml': []
-dependencies:
-    'actions/cache@caa296126883cff596d87d8935842f9db880ef25':
-        ref: 'v5.1.0'
-        commit: 'sha1-caa296126883cff596d87d8935842f9db880ef25'
-        owner_id: 44036562
-        repo_id: 215566462
-    'actions/checkout@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333':
-        ref: 'v8.0.2'
-        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
-        owner_id: 44036562
-        repo_id: 192626254
-    'actions/download-artifact@v8.0.2':
-        ref: 'v8.0.2'
-        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
-        owner_id: 44036562
-        repo_id: 192626254
-    'actions/setup-node@v7.1.0':
-        ref: 'v7.1.0'
-        commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1'
-        owner_id: 44036562
-        repo_id: 189476904
-    'actions/upload-artifact@v7.0.2':
-        ref: 'v7.0.2'
-        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
-        owner_id: 44036562
-        repo_id: 192625955
-    'step-security/dtolnay-rust-toolchain@v1.0.0':
-        ref: 'v1.0.0'
-        commit: 'sha1-8dd607977d06adf4ed49b190381e74c17a9dd25f'
-        owner_id: 88700172
-        repo_id: 1249865941
-    'step-security/harden-runner@v2.22.4':
-        ref: 'v2.22.4'
-        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
-        owner_id: 88700172
-        repo_id: 422287306
-    'step-security/rust-cache@v2.9.2':
-        ref: 'v2.9.2'
-        commit: 'sha1-8871c8ba063416da7c32246932ea6ae08700453e'
-        owner_id: 88700172
-        repo_id: 822636713
-    'step-security/tauri-action@v1.0.0':
-        ref: 'v1.0.0'
-        commit: 'sha1-dc662d498edbd35ec8ed564b45d44e955444d1bc'
-        owner_id: 88700172
-        repo_id: 1283860856
-    'storytold/craft-common-actions@main':
-        ref: 'main'
-        commit: 'sha1-293de72429d3ed5d9fa92aded5e500544c0fa28f'
-        owner_id: 76897702
-        repo_id: 1414429108
-        uses:
-            - 'actions/cache@caa296126883cff596d87d8935842f9db880ef25'
-            - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333'
@@ -14,10 +14,10 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@v7
      - uses: storytold/craft-common-actions/actions/install-apt-packages@main
        with:
          packages: rpm jq binutils zsync
@@ -39,13 +39,13 @@ jobs:
      TAURI_APP_PATH: ${{ github.workspace }}/crates/desktop/artcraft
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@v7
      - uses: storytold/craft-common-actions/actions/install-apt-packages@main
        with:
-          packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libclang-dev libasound2-dev libxdo-dev libdbus-1-dev build-essential clang file jq perl cmake nasm rpm zsync gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-libav
+          packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libclang-dev libasound2-dev libxdo-dev libdbus-1-dev build-essential clang file jq perl cmake nasm rpm zsync gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-libav xdg-utils
      - uses: storytold/craft-common-actions/actions/install-riscv64-cross@main
        if: matrix.arch == 'riscv64'
      - name: Remove conflicting host Pango development files
@@ -71,16 +71,16 @@ jobs:
          PKG_CONFIG_LIBDIR_riscv64gc_unknown_linux_gnu=/usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
          ENV
          echo "CMAKE_TOOLCHAIN_FILE_riscv64gc_unknown_linux_gnu=$GITHUB_WORKSPACE/packaging/linux/riscv64.cmake" >> "$GITHUB_ENV"
-      - uses: actions/setup-node@v7.1.0
+      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: frontend/package-lock.json
-      - uses: step-security/dtolnay-rust-toolchain@v1.0.0
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
        with:
          toolchain: stable
          targets: ${{ matrix.target }}
-      - uses: step-security/rust-cache@v2.9.2
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
        with:
          key: tauri-linux-${{ matrix.arch }}
          cache-on-failure: true
@@ -88,7 +88,7 @@ jobs:
        working-directory: frontend
      - run: ./node_modules/.bin/nx run artcraft:build
        working-directory: frontend
-      - uses: step-security/tauri-action@v1.0.0
+      - uses: step-security/tauri-action@dc662d498edbd35ec8ed564b45d44e955444d1bc # v1.0.0
        with:
          projectPath: crates/desktop/artcraft
          args: --target ${{ matrix.target }} --bundles ${{ matrix.bundles }} --config ${{ github.workspace }}/packaging/linux/tauri.conf.json
@@ -97,7 +97,7 @@ jobs:
          ARCH: ${{ matrix.arch }}
          TARGET: ${{ matrix.target }}
        run: packaging/linux/package.sh "$ARCH" "$TARGET"
-      - uses: actions/upload-artifact@v7.0.2
+      - uses: actions/upload-artifact@v7
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist/release/*
@@ -111,11 +111,11 @@ jobs:
        arch: [x86_64, aarch64]
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
-      - uses: actions/download-artifact@v8.0.2
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist/linux
@@ -128,7 +128,7 @@ jobs:
          files=(dist/linux/artcraft-*-linux-"$ARCH".tar.gz)
          test "${#files[@]}" -eq 1
          echo "path=${files[0]}" >> "$GITHUB_OUTPUT"
-      - uses: storytold/craft-common-actions/actions/arch-package@main # extra-depends support (#161)
+      - uses: storytold/craft-common-actions/actions/arch-package@9d6790582b4997aa2120f4413cdb55c0b6f77fae # extra-depends support (#161)
        with:
          tarball: ${{ steps.tarball.outputs.path }}
          arch: ${{ matrix.arch }}
@@ -138,7 +138,7 @@ jobs:
          for package in dist/release/*.pkg.tar.zst; do
            tar --zstd -xOf "$package" .PKGINFO | grep -Fx 'depend = webkit2gtk-4.1'
          done
-      - uses: actions/upload-artifact@v7.0.2
+      - uses: actions/upload-artifact@v7
        with:
          name: release-arch-${{ matrix.arch }}
          path: dist/release/*.pkg.tar.zst
@@ -158,11 +158,11 @@ jobs:
          - {arch: aarch64, runner: ubuntu-24.04-arm}
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
-      - uses: actions/download-artifact@v8.0.2
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist/linux
@@ -180,7 +180,7 @@ jobs:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: packaging/linux/flatpak.sh
-      - uses: actions/upload-artifact@v7.0.2
+      - uses: actions/upload-artifact@v7
        with:
          name: release-flatpak-${{ matrix.arch }}
          path: |
@@ -194,10 +194,10 @@ jobs:
      contents: write
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@v7
      - name: Read version
        id: version
        run: echo "value=$(jq -r .version crates/desktop/artcraft/tauri.conf.json)" >> "$GITHUB_OUTPUT"
@@ -211,5 +211,6 @@ jobs:
          app-title: ArtCraft
          tag-prefix: artcraft-v
          retain: "true"
+          allow-published: "true"
          github-token: ${{ secrets.GITHUB_TOKEN }}
          signing-key: ${{ secrets.LINUX_SIGNING_KEY }}
@@ -39,18 +39,18 @@ jobs:
    timeout-minutes: 60
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@v7

      - name: setup node
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7
        with:
          node-version: lts/*

      - name: install Rust stable
-        uses: step-security/dtolnay-rust-toolchain@v1.0.0
+        uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
        with:
          toolchain: stable
          targets: ${{ matrix.platform == 'macos-latest-xlarge' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
@@ -230,7 +230,7 @@ jobs:


      - name: build and publish
-        uses: step-security/tauri-action@v1.0.0
+        uses: step-security/tauri-action@dc662d498edbd35ec8ed564b45d44e955444d1bc # v1.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
@@ -34,13 +34,13 @@ jobs:
    timeout-minutes: 90
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@v7

      - name: install Rust stable
-        uses: step-security/dtolnay-rust-toolchain@v1.0.0
+        uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
        with:
          toolchain: stable

@@ -54,7 +54,7 @@ jobs:
        shell: cmd

      - name: setup node
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7
        with:
          node-version: lts/*

@@ -107,7 +107,7 @@ jobs:
          $config | ConvertTo-Json -Depth 10 | Set-Content tauri.conf.json

      - name: build and publish
-        uses: step-security/tauri-action@v1.0.0
+        uses: step-security/tauri-action@dc662d498edbd35ec8ed564b45d44e955444d1bc # v1.0.0
        env:
          # NB(bt): This is needed by wreq. Hopefully it doesn't kill Tauri
          RUSTFLAGS: "-C target-feature=+crt-static"
@@ -21,4 +21,9 @@ jobs:
  freebsd:
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
+    with:
+      architectures: '["x86_64"]'
+      craft-fonts-ref: ""
+      cargo-build-extra-args: "--exclude artcraft --exclude artcraft_native --exclude tauri-plugin-http"
+      cargo-test-extra-args: "--exclude artcraft --exclude artcraft_native --exclude tauri-plugin-http"

@@ -1,34 +0,0 @@
-name: Lockfile
-
-# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
-# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
-# Docs: https://gh.io/actions-lockfile
-on:
-  pull_request:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  GH_TOKEN: ${{ github.token }}
-
-jobs:
-  lockfile:
-    name: Lockfile is in sync
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install gh-actions-lock
-        run: gh extension install github/gh-actions-lock --pin v0.4.1
-      - name: Verify the lockfile
-        run: gh actions-lock --verify
@@ -22,18 +22,10 @@ sonar.exclusions=crates/vendor/**,crates/api_clients/grok_consumer_client/src/cr
 # test/app/Classes/ApiManager/utils/, which call `it` themselves.
 # S2819 (message origin): a dedicated worker's `message` events come only from the page that
 # started it; they carry no origin to check.
-sonar.issue.ignore.multicriteria=deterministic_rng,api_test_helpers,worker_messages,gha-lockfile
+sonar.issue.ignore.multicriteria=deterministic_rng,api_test_helpers,worker_messages
 sonar.issue.ignore.multicriteria.deterministic_rng.ruleKey=rust:S4347
 sonar.issue.ignore.multicriteria.deterministic_rng.resourceKey=crates/schema/public/tokens/src/deterministic_rng.rs
 sonar.issue.ignore.multicriteria.api_test_helpers.ruleKey=typescript:S2187
 sonar.issue.ignore.multicriteria.api_test_helpers.resourceKey=frontend/apps/artcraft/test/app/Classes/ApiManager/**
 sonar.issue.ignore.multicriteria.worker_messages.ruleKey=typescript:S2819
 sonar.issue.ignore.multicriteria.worker_messages.resourceKey=**/*.worker.ts
-
-# githubactions:S7637 asks for every action to be pinned to a commit SHA. A workflow covered by
-# .github/workflows/actions.lock runs the commit the lockfile records, so its tag refs are pinned
-# and the lockfile covers the actions those actions use too. Sonar does not read lockfiles yet, so
-# the rule flags the tag refs anyway:
-# https://community.sonarsource.com/t/githubactions-s7637-false-positives-for-actions-pinned-through-native-actions-lock/190814
-sonar.issue.ignore.multicriteria.gha-lockfile.ruleKey=githubactions:S7637
-sonar.issue.ignore.multicriteria.gha-lockfile.resourceKey=.github/workflows/**
Author	SHA1	Message	Date
Dylan M. Taylor	df3417834f	ci: install xdg-utils for Linux AppImage bundling The ubuntu-22.04-arm runner image does not ship /usr/bin/xdg-open, so tauri-action failed while bundling the aarch64 AppImage and uploaded no Linux artifacts. Install xdg-utils explicitly in the Linux build job.	2026-11-11 22:23:07 -05:00
Dylan M. Taylor	8a65a34040	Merge tested main for artcraft-v0.42.1 # Conflicts: # crates/desktop/artcraft/src/version.rs # crates/desktop/artcraft/tauri-mac.conf.json # crates/desktop/artcraft/tauri.conf.json	2026-11-11 21:57:11 -05:00
Dylan M. Taylor	07ebde1454	fix(ci): exclude desktop GUI crates and pin architecture for FreeBSD CI	2026-11-06 21:36:51 -05:00
Dylan M. Taylor	b4ae5275eb	chore: prepare v0.41.1 multi-platform release	2026-11-06 21:01:05 -05:00