test: keep Flatpak permission parsing within strict Clippy rules

.github/workflows/actions.lock

@@ -1,57 +0,0 @@
-# This file is machine-generated by `gh actions-lock`.
-# Do not edit by hand; run `gh actions-lock` to update.
-# Docs: https://gh.io/actions-lockfile
-version: 'v0.0.3'
-workflows:
-    '.github/workflows/ci.yml': []
-    '.github/workflows/freebsd.yml': []
-    '.github/workflows/house-rules.yml': []
-    '.github/workflows/lockfile.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/nix.yml': []
-    '.github/workflows/packaging-lint.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/printing.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/dtolnay-rust-toolchain@v1.0.0'
-        - 'step-security/harden-runner@v2.22.4'
-        - 'step-security/rust-cache@v2.9.2'
-        - 'storytold/craft-common-actions@main'
-    '.github/workflows/release.yml': []
-    '.github/workflows/sonarcloud.yml': []
-    '.github/workflows/windows-arm64.yml': []
-dependencies:
-    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'actions/checkout@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'step-security/dtolnay-rust-toolchain@v1.0.0':
-        ref: 'v1.0.0'
-        commit: 'sha1-8dd607977d06adf4ed49b190381e74c17a9dd25f'
-        owner_id: 88700172
-        repo_id: 1249865941
-    'step-security/harden-runner@v2.22.4':
-        ref: 'v2.22.4'
-        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
-        owner_id: 88700172
-        repo_id: 422287306
-    'step-security/rust-cache@v2.9.2':
-        ref: 'v2.9.2'
-        commit: 'sha1-8871c8ba063416da7c32246932ea6ae08700453e'
-        owner_id: 88700172
-        repo_id: 822636713
-    'storytold/craft-common-actions@main':
-        ref: 'main'
-        commit: 'sha1-293de72429d3ed5d9fa92aded5e500544c0fa28f'
-        owner_id: 76897702
-        repo_id: 1414429108
-        uses:
-            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'

.github/workflows/lockfile.yml

@@ -1,34 +0,0 @@
-name: Lockfile
-
-# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
-# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
-# Docs: https://gh.io/actions-lockfile
-on:
-  pull_request:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  GH_TOKEN: ${{ github.token }}
-
-jobs:
-  lockfile:
-    name: Lockfile is in sync
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install gh-actions-lock
-        run: gh extension install github/gh-actions-lock --pin v0.4.1
-      - name: Verify the lockfile
-        run: gh actions-lock --verify

.github/workflows/packaging-lint.yml

@@ -28,10 +28,10 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install the pinned packaging toolchain

.github/workflows/printing.yml

@@ -43,10 +43,10 @@ jobs:
       CARGO_INCREMENTAL: '0'
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -81,13 +81,12 @@ jobs:
             pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \
             libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers
 
-      - uses: step-security/dtolnay-rust-toolchain@v1.0.0
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
-          toolchain: stable
           components: rustfmt, clippy
           targets: wasm32-unknown-unknown
 
-      - uses: step-security/rust-cache@v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 

.github/workflows/release.yml

@@ -1,10 +1,6 @@
 name: Release
 
 on:
-  # A nightly dry run on main: every release build except macOS, nothing signed or released
-  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
-  schedule:
-    - cron: "0 3 * * *"
   push:
     branches: [release]
   workflow_dispatch:
@@ -37,7 +33,6 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
-      dry-run: ${{ github.event_name == 'schedule' }}
       app-name: wordcraft
       app-title: WordCraft
       craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83

Cargo.lock

@@ -6807,7 +6807,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "arboard",
  "chrono",
@@ -6847,7 +6847,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-cli"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "image",
  "serde_json",
@@ -6863,11 +6863,11 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-control-key"
-version = "0.18.1"
+version = "0.18.0"
 
 [[package]]
 name = "wordcraft-doc"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "base64 0.23.1",
  "log",
@@ -6881,7 +6881,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-docbin"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "cfb",
  "chrono",
@@ -6898,7 +6898,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-docx"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "aes",
  "base64 0.23.1",
@@ -6923,7 +6923,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-engine"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "cfb",
  "chrono",
@@ -6957,7 +6957,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-fonts"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "brotli-decompressor",
  "harfrust 0.13.3",
@@ -6971,7 +6971,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-formats"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "aes",
  "base64 0.23.1",
@@ -6998,7 +6998,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-geom"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "image",
  "serde",
@@ -7006,7 +7006,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-layout"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "craft-proof",
  "image",
@@ -7026,7 +7026,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-mcp"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "log",
  "serde_json",
@@ -7038,7 +7038,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-metafile"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "kurbo",
  "thiserror 2.0.21",
@@ -7046,7 +7046,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-pdf"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "chrono",
  "craft-pdf",
@@ -7067,7 +7067,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-render"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "image",
  "log",
@@ -7081,7 +7081,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "accesskit_consumer",
  "cfb",
@@ -7114,7 +7114,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-web"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "craft-web-api",
  "craft-web-host",
@@ -7135,7 +7135,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-zotero"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "log",
  "proptest",
@@ -7298,7 +7298,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "serde_json",
 ]

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.18.1"
+version = "0.18.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"

sonar-project.properties

@@ -4,14 +4,6 @@ sonar.organization=storytold
 # S4790 (weak hash): SHA-1 is a start-key and "SHA1/1K" checksum algorithm that ODF package
 # encryption (ODF 1.3 Part 2 §4.16) names, and older office suites wrote it. It is needed to open
 # those files, not chosen for new security: WordCraft writes a SHA-256 start key and checksum.
-sonar.issue.ignore.multicriteria=odt_sha1,gha-lockfile
+sonar.issue.ignore.multicriteria=odt_sha1
 sonar.issue.ignore.multicriteria.odt_sha1.ruleKey=rust:S4790
 sonar.issue.ignore.multicriteria.odt_sha1.resourceKey=crates/formats/src/odt/crypt.rs
-
-# githubactions:S7637 asks for every action to be pinned to a commit SHA. A workflow covered by
-# .github/workflows/actions.lock runs the commit the lockfile records, so its tag refs are pinned
-# and the lockfile covers the actions those actions use too. Sonar does not read lockfiles yet, so
-# the rule flags the tag refs anyway:
-# https://community.sonarsource.com/t/githubactions-s7637-false-positives-for-actions-pinned-through-native-actions-lock/190814
-sonar.issue.ignore.multicriteria.gha-lockfile.ruleKey=githubactions:S7637
-sonar.issue.ignore.multicriteria.gha-lockfile.resourceKey=.github/workflows/**