test: keep Flatpak permission parsing within strict Clippy rules

fix(flatpak): allow release checks and self-update helpers
Merge pull request #3795 from storytold/chore/craft-update-6e03f65
2026-11-13 01:14:54 -06:00 · 2026-11-11 14:08:10 -05:00 · 2026-11-11 13:58:49 -05:00 · 2026-11-11 12:44:31 -05:00 · 2026-11-11 12:11:59 -05:00
4 changed files with 35 additions and 0 deletions
@@ -27,6 +27,10 @@ jobs:
    name: Windows installation policy (no app build)
    runs-on: windows-latest
    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
@@ -0,0 +1,27 @@
+//! Release and source Flatpaks must allow release checks and host update helpers.
+fn finish_args(manifest: &str) -> Vec<&str> {
+    manifest
+        .split("finish-args:")
+        .nth(1)
+        .unwrap_or_default()
+        .lines()
+        .take_while(|line| line.is_empty() || line.starts_with(' ') || line.starts_with('#'))
+        .filter_map(|line| line.trim().strip_prefix("- "))
+        .map(|arg| arg.trim_matches(['\'', '"']))
+        .collect()
+}
+
+#[test]
+fn flatpak_update_permissions() {
+    let manifests = [
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml"),
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.gridcraft.yml"),
+    ];
+    let args = manifests.map(finish_args);
+    assert_eq!(args[0], args[1], "source and release permissions must agree");
+    for permissions in args {
+        for required in ["--share=network", "--talk-name=org.freedesktop.Flatpak"] {
+            assert!(permissions.contains(&required), "missing update permission: {required}");
+        }
+    }
+}
@@ -17,6 +17,8 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: gridcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
  - --filesystem=xdg-data/ArtCraft/versions:ro
  # Display: Wayland first; X11 only when no Wayland compositor is running.
  - --socket=wayland
@@ -18,6 +18,8 @@ sdk-extensions:
  - org.freedesktop.Sdk.Extension.rust-stable
 command: gridcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
  - --filesystem=xdg-data/ArtCraft/versions:ro
  # Display: Wayland first; X11 only when no Wayland compositor is running.
  - --socket=wayland
Author	SHA1	Message	Date
Dylan M. Taylor	046e863d85	test: keep Flatpak permission parsing within strict Clippy rules	2026-11-11 14:08:10 -05:00
Dylan M. Taylor	c475750d63	fix(flatpak): allow release checks and self-update helpers	2026-11-11 13:58:49 -05:00
Dylan M. Taylor	6dbfbc4058	Merge pull request #3795 from storytold/chore/craft-update-6e03f65 Updates: take craft-update from craft-libs main at 6e03f65bf	2026-11-11 12:44:31 -05:00
Dylan M. Taylor	763816d27c	ci: run Harden-Runner on every job (#3786 ) Adds step-security/harden-runner (audit, pinned to v2.22.4 like craft-common-actions) as the first step of each job that did not have it, so every workflow in the org's public repos reports its egress to StepSecurity. Audit, not block: block-mode allow lists come from each job's observed traffic.	2026-11-11 12:11:59 -05:00