Merge tested main for Flatpak update patch release

chore: bump version to 0.19.1 for the Flatpak update fix (#3809 )
sonar: stop counting the locale table as duplicated code (#3805 )
2026-11-12 00:43:16 -06:00 · 2026-11-11 15:25:59 -05:00 · 2026-11-11 14:55:53 -05:00 · 2026-11-11 14:33:16 -05:00 · 2026-11-11 14:27:27 -05:00 · 2026-11-11 14:24:13 -05:00
10 changed files with 81 additions and 31 deletions
@@ -27,6 +27,10 @@ jobs:
    name: Windows installation policy (no app build)
    runs-on: windows-latest
    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
@@ -910,12 +910,12 @@ dependencies = [
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"

 [[package]]
 name = "craft-i18n"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
 "fixed_decimal",
 "icu_decimal",
@@ -938,7 +938,7 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
 "craft-winprint-gdi",
 "log",
@@ -952,7 +952,7 @@ dependencies = [
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
 "craft-fonts-build",
 "craft-i18n",
@@ -972,7 +972,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
 "chrono",
 "dunce",
@@ -982,6 +982,7 @@ dependencies = [
 "image",
 "log",
 "plist",
+ "rustix 1.1.5",
 "semver",
 "serde",
 "serde_json",
@@ -1018,7 +1019,7 @@ dependencies = [
 [[package]]
 name = "craft-window"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
 "egui",
 "objc2 0.6.5",
@@ -2022,7 +2023,7 @@ dependencies = [

 [[package]]
 name = "gridcraft"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "arboard",
 "chrono",
@@ -2050,7 +2051,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-calc"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-core",
 "gridcraft-formula",
@@ -2062,7 +2063,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-chart"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-calc",
 "gridcraft-core",
@@ -2073,7 +2074,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-cli"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-engine",
 "gridcraft-mcp",
@@ -2086,7 +2087,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-core"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "chrono",
 "js-sys",
@@ -2097,7 +2098,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-engine"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-calc",
 "gridcraft-chart",
@@ -2120,7 +2121,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-formula"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-core",
 "serde",
@@ -2129,7 +2130,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-functions"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-core",
 "regex",
@@ -2137,7 +2138,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-math"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "ratex-font",
 "ratex-layout",
@@ -2147,7 +2148,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-mcp"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-engine",
 "log",
@@ -2156,7 +2157,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-model"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-core",
 "gridcraft-formula",
@@ -2169,18 +2170,18 @@ dependencies = [

 [[package]]
 name = "gridcraft-numfmt"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-core",
 ]

 [[package]]
 name = "gridcraft-pdf"
-version = "0.19.0"
+version = "0.19.1"

 [[package]]
 name = "gridcraft-sandbox"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "landlock",
 "libc",
@@ -2191,7 +2192,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-ui-egui"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "craft-ui",
 "craft-update",
@@ -2218,7 +2219,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-web"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "craft-web-api",
 "craft-web-host",
@@ -2237,7 +2238,7 @@ dependencies = [

 [[package]]
 name = "gridcraft-xlsx"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "aes",
 "gridcraft-core",
@@ -6519,7 +6520,7 @@ dependencies = [
 [[package]]
 name = "winprint"
 version = "0.2.1"
-source = "git+https://github.com/storytold/winprint.rs?rev=51934db382f225454cf152a8657eb03789be63c4#51934db382f225454cf152a8657eb03789be63c4"
+source = "git+https://github.com/storytold/winprint.rs?rev=bc06a7c48b768eb27a828c7986f6d2868b245ee0#bc06a7c48b768eb27a828c7986f6d2868b245ee0"
 dependencies = [
 "flate2",
 "fmt-derive",
@@ -6534,6 +6535,7 @@ dependencies = [
 "windows",
 "windows-core",
 "windows-implement",
+ "windows-numerics",
 "xml",
 ]

@@ -6708,7 +6710,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"

 [[package]]
 name = "xtask"
-version = "0.19.0"
+version = "0.19.1"
 dependencies = [
 "gridcraft-engine",
 "serde_json",
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/gridcraft", "apps/gridcraft-cli", "xtask"]

 [workspace.package]
-version = "0.19.0"
+version = "0.19.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -29,7 +29,7 @@ gridcraft-math = { path = "crates/math" }
 # Every craft-libs crate (craft-update and craft-window here, craft-ui in ui-egui, craft-print in
 # the app) comes from one craft-libs revision.
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", rev = "1b34eba41e62138fc2438d2734523b302840b45d", version = "=0.1.0", features = ["egui"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.1.0", features = ["egui"] }

 # foundation
 thiserror = "2"
@@ -72,7 +72,7 @@ skrifa = { version = "0.44", default-features = false, features = ["std"] }
 epaint_default_fonts = "0.37"
 # One native window per workbook: the window list, Window menu titles and the immediate-viewport
 # driver. Same craft-libs revision as craft-update above.
-craft-window = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "1b34eba41e62138fc2438d2734523b302840b45d", default-features = false, features = ["egui"] }
+craft-window = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", default-features = false, features = ["egui"] }

 [workspace.lints.rust]
 unsafe_code = "forbid"
@@ -35,7 +35,7 @@ winit = { version = "0.30", default-features = false, features = ["x11", "waylan
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 # Same craft-libs revision as the workspace's craft-update and craft-window (see the root
 # Cargo.toml).
-craft-print = { git = "https://github.com/storytold/craft-libs", rev = "1b34eba41e62138fc2438d2734523b302840b45d" }
+craft-print = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b" }
 craft-update = { workspace = true }
 rfd = { workspace = true }
 arboard = { workspace = true, features = ["image-data"] }
@@ -31,6 +31,12 @@ const SYS_SETXATTRAT: libc::c_long = 463;
 const SYS_REMOVEXATTRAT: libc::c_long = 466;
 const SYS_OPEN_TREE_ATTR: libc::c_long = 467;
 const SYS_FILE_SETATTR: libc::c_long = 469;
+// `libc` names no kexec_file_load on riscv64 (0.2.190). It takes 294 from the kernel's generic
+// table there, as on aarch64, where `libc` names it.
+#[cfg(target_arch = "riscv64")]
+const SYS_KEXEC_FILE_LOAD: libc::c_long = 294;
+#[cfg(not(target_arch = "riscv64"))]
+const SYS_KEXEC_FILE_LOAD: libc::c_long = libc::SYS_kexec_file_load;

 pub fn support() -> Support {
    match arch() {
@@ -223,7 +229,7 @@ fn denied_calls() -> Vec<libc::c_long> {
        libc::SYS_finit_module,
        libc::SYS_delete_module,
        libc::SYS_kexec_load,
-        libc::SYS_kexec_file_load,
+        SYS_KEXEC_FILE_LOAD,
        libc::SYS_swapon,
        libc::SYS_swapoff,
        libc::SYS_reboot,
@@ -455,6 +461,9 @@ mod tests {
        #[cfg(target_arch = "x86_64")]
        assert_eq!(SYS_FCHMODAT2, libc::SYS_fchmodat2);
        assert_eq!((SYS_SETXATTRAT, SYS_REMOVEXATTRAT, SYS_OPEN_TREE_ATTR, SYS_FILE_SETATTR), (463, 466, 467, 469));
+        // The generic table's number, which riscv64 writes here, is the one `libc` gives aarch64.
+        #[cfg(target_arch = "aarch64")]
+        assert_eq!(libc::SYS_kexec_file_load, 294);
    }

    #[test]
@@ -11,7 +11,7 @@ workspace = true
 [dependencies]
 # The shared capture slot (`craft_ui::capture`) comes from the one craft-libs revision every
 # craft-libs dependency uses (see the root Cargo.toml).
-craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "1b34eba41e62138fc2438d2734523b302840b45d" }
+craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b" }
 gridcraft-engine = { workspace = true }
 gridcraft-chart = { workspace = true }
 # `monochrome_emoji_fonts` restores the Noto Emoji and emoji-icon faces that 0.37 moved behind
@@ -0,0 +1,27 @@
+//! Release and source Flatpaks must allow release checks and host update helpers.
+fn finish_args(manifest: &str) -> Vec<&str> {
+    manifest
+        .split("finish-args:")
+        .nth(1)
+        .unwrap_or_default()
+        .lines()
+        .take_while(|line| line.is_empty() || line.starts_with(' ') || line.starts_with('#'))
+        .filter_map(|line| line.trim().strip_prefix("- "))
+        .map(|arg| arg.trim_matches(['\'', '"']))
+        .collect()
+}
+
+#[test]
+fn flatpak_update_permissions() {
+    let manifests = [
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml"),
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.gridcraft.yml"),
+    ];
+    let args = manifests.map(finish_args);
+    assert_eq!(args[0], args[1], "source and release permissions must agree");
+    for permissions in args {
+        for required in ["--share=network", "--talk-name=org.freedesktop.Flatpak"] {
+            assert!(permissions.contains(&required), "missing update permission: {required}");
+        }
+    }
+}
@@ -17,6 +17,8 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: gridcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
  - --filesystem=xdg-data/ArtCraft/versions:ro
  # Display: Wayland first; X11 only when no Wayland compositor is running.
  - --socket=wayland
@@ -18,6 +18,8 @@ sdk-extensions:
  - org.freedesktop.Sdk.Extension.rust-stable
 command: gridcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
  - --filesystem=xdg-data/ArtCraft/versions:ro
  # Display: Wayland first; X11 only when no Wayland compositor is running.
  - --socket=wayland
@@ -1,2 +1,6 @@
 sonar.projectKey=storytold_gridcraft
 sonar.organization=storytold
+
+# The region table is one record per locale with the same field names and many shared values
+# (month names, formats); that repetition is data, not copy-pasted logic.
+sonar.cpd.exclusions=crates/core/src/region.rs
Author	SHA1	Message	Date
Dylan M. Taylor	476448d7d9	Merge tested main for Flatpak update patch release	2026-11-11 15:25:59 -05:00
Dylan M. Taylor	5cf52c5fbb	chore: bump version to 0.19.1 for the Flatpak update fix (#3809 )	2026-11-11 14:55:53 -05:00
Dylan M. Taylor	0c5b1e85e6	sonar: stop counting the locale table as duplicated code (#3805 )	2026-11-11 14:33:16 -05:00
Dylan M. Taylor	26f9783d11	Release 0.19.1: repair Flatpak update checks and self-updates (#3804 ) * Release 0.19.1: fix Flatpak update permissions * test: avoid unchecked option parsing in Flatpak regression	2026-11-11 14:27:27 -05:00
Dylan M. Taylor	7f6a79fd98	Fix Flatpak permissions for update checks and self-updates (#3803 ) * fix(flatpak): allow release checks and self-update helpers * test: keep Flatpak permission parsing within strict Clippy rules	2026-11-11 14:24:13 -05:00
Dylan M. Taylor	6dbfbc4058	Merge pull request #3795 from storytold/chore/craft-update-6e03f65 Updates: take craft-update from craft-libs main at 6e03f65bf	2026-11-11 12:44:31 -05:00
Dylan M. Taylor	e258db5f19	Updates: take craft-update from craft-libs main at 6e03f65bf	2026-11-11 12:44:25 -05:00
Dylan M. Taylor	763816d27c	ci: run Harden-Runner on every job (#3786 ) Adds step-security/harden-runner (audit, pinned to v2.22.4 like craft-common-actions) as the first step of each job that did not have it, so every workflow in the org's public repos reports its egress to StepSecurity. Audit, not block: block-mode allow lists come from each job's observed traffic.	2026-11-11 12:11:59 -05:00
FredApps	b7cb2c97dd	Merge main into release for GridCraft v0.19.0	2026-11-11 17:35:47 +01:00
FredApps	90180f4d87	Sandbox: build on riscv64, where libc names no kexec_file_load (#3777 ) The seccomp list named libc::SYS_kexec_file_load, which libc (0.2.190) defines for x86_64 and aarch64 but not riscv64, so the release's Linux riscv64 build stopped with E0425. riscv64 takes the number from the kernel's generic table, 294, as aarch64 does; the test checks libc's aarch64 value against it.	2026-11-11 17:35:44 +01:00
FredApps	fd10b86cc2	Merge main into release for GridCraft v0.19.0	2026-11-11 16:38:57 +01:00
Dylan M. Taylor	17cb3c83d9	Release 0.18.0	2026-11-09 06:32:01 -05:00