Merge tested main for v0.18.1

CI: nightly release dry run (#6367 )
release.yml also runs nightly on main with craft-common-actions' dry-run: every release build except macOS, with nothing signed, pushed or drafted. Breakage that only the release build hits (riscv64, Flatpak, FreeBSD, packaging) then shows up the next morning instead of on release day, as it did on 11 Nov 2026.
2026-11-12 08:53:27 -06:00 · 2026-11-11 18:38:09 -05:00 · 2026-11-11 23:04:54 +01:00 · 2026-11-11 14:59:04 -05:00 · 2026-11-11 14:56:11 -05:00 · 2026-11-11 19:36:24 +01:00
4 changed files with 28 additions and 22 deletions
@@ -81,12 +81,13 @@ jobs:
            pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \
            libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers

-      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
        with:
+          toolchain: stable
          components: rustfmt, clippy
          targets: wasm32-unknown-unknown

-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}

@@ -1,6 +1,10 @@
 name: Release

 on:
+  # A nightly dry run on main: every release build except macOS, nothing signed or released
+  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
+  schedule:
+    - cron: "0 3 * * *"
  push:
    branches: [release]
  workflow_dispatch:
@@ -33,6 +37,7 @@ jobs:
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
    with:
+      dry-run: ${{ github.event_name == 'schedule' }}
      app-name: wordcraft
      app-title: WordCraft
      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
@@ -6807,7 +6807,7 @@ dependencies = [

 [[package]]
 name = "wordcraft"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "arboard",
 "chrono",
@@ -6847,7 +6847,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-cli"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "image",
 "serde_json",
@@ -6863,11 +6863,11 @@ dependencies = [

 [[package]]
 name = "wordcraft-control-key"
-version = "0.18.0"
+version = "0.18.1"

 [[package]]
 name = "wordcraft-doc"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "base64 0.23.1",
 "log",
@@ -6881,7 +6881,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docbin"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "cfb",
 "chrono",
@@ -6898,7 +6898,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docx"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6923,7 +6923,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-engine"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "cfb",
 "chrono",
@@ -6957,7 +6957,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-fonts"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "brotli-decompressor",
 "harfrust 0.13.3",
@@ -6971,7 +6971,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-formats"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6998,7 +6998,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-geom"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "image",
 "serde",
@@ -7006,7 +7006,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-layout"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "craft-proof",
 "image",
@@ -7026,7 +7026,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-mcp"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "log",
 "serde_json",
@@ -7038,7 +7038,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-metafile"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "kurbo",
 "thiserror 2.0.21",
@@ -7046,7 +7046,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-pdf"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "chrono",
 "craft-pdf",
@@ -7067,7 +7067,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-render"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "image",
 "log",
@@ -7081,7 +7081,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "accesskit_consumer",
 "cfb",
@@ -7114,7 +7114,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-web"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "craft-web-api",
 "craft-web-host",
@@ -7135,7 +7135,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-zotero"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "log",
 "proptest",
@@ -7298,7 +7298,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "serde_json",
 ]
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]

 [workspace.package]
-version = "0.18.0"
+version = "0.18.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
Author	SHA1	Message	Date
Dylan M. Taylor	079f478bd8	Merge tested main for v0.18.1	2026-11-11 18:38:09 -05:00
FredApps	07f977372d	CI: nightly release dry run (#6367 ) release.yml also runs nightly on main with craft-common-actions' dry-run: every release build except macOS, with nothing signed, pushed or drafted. Breakage that only the release build hits (riscv64, Flatpak, FreeBSD, packaging) then shows up the next morning instead of on release day, as it did on 11 Nov 2026.	2026-11-11 23:04:54 +01:00
Dylan M. Taylor	06c2ae6f9d	ci: use StepSecurity's maintained actions (#6343 ) Each third-party action that StepSecurity publishes a secure drop-in replacement for now uses that replacement, pinned to a commit with its version as a comment. Versions follow what we used: the newest StepSecurity release in the same major, or the closest major they publish. dtolnay/rust-toolchain refs that named a toolchain (stable, nightly, 1.76) become the replacement's `toolchain` input.	2026-11-11 14:59:04 -05:00
Dylan M. Taylor	a58b41a716	chore: bump version to 0.18.1 for the Flatpak update fix (#6344 )	2026-11-11 14:56:11 -05:00
FredApps	7296cf64de	Merge main into release for WordCraft v0.18.0	2026-11-11 19:36:24 +01:00
Dylan M. Taylor	5574b32600	Release 0.17.0	2026-11-09 06:34:22 -05:00