CI: nightly release dry run (#6367 )

release.yml also runs nightly on main with craft-common-actions' dry-run: every release build except macOS, with nothing signed, pushed or drafted. Breakage that only the release build hits (riscv64, Flatpak, FreeBSD, packaging) then shows up the next morning instead of on release day, as it did on 11 Nov 2026.
ci: use StepSecurity's maintained actions (#6343 )
2026-11-12 00:44:27 -06:00 · 2026-11-11 23:04:54 +01:00 · 2026-11-11 14:59:04 -05:00 · 2026-11-11 14:56:11 -05:00 · 2026-11-11 14:24:25 -05:00
4 changed files with 28 additions and 22 deletions
@@ -81,12 +81,13 @@ jobs:
            pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \
            libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers

-      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
        with:
+          toolchain: stable
          components: rustfmt, clippy
          targets: wasm32-unknown-unknown

-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}

@@ -1,6 +1,10 @@
 name: Release

 on:
+  # A nightly dry run on main: every release build except macOS, nothing signed or released
+  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
+  schedule:
+    - cron: "0 3 * * *"
  push:
    branches: [release]
  workflow_dispatch:
@@ -33,6 +37,7 @@ jobs:
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
    with:
+      dry-run: ${{ github.event_name == 'schedule' }}
      app-name: wordcraft
      app-title: WordCraft
      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
@@ -6807,7 +6807,7 @@ dependencies = [

 [[package]]
 name = "wordcraft"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "arboard",
 "chrono",
@@ -6847,7 +6847,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-cli"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "image",
 "serde_json",
@@ -6863,11 +6863,11 @@ dependencies = [

 [[package]]
 name = "wordcraft-control-key"
-version = "0.18.0"
+version = "0.18.1"

 [[package]]
 name = "wordcraft-doc"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "base64 0.23.1",
 "log",
@@ -6881,7 +6881,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docbin"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "cfb",
 "chrono",
@@ -6898,7 +6898,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docx"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6923,7 +6923,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-engine"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "cfb",
 "chrono",
@@ -6957,7 +6957,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-fonts"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "brotli-decompressor",
 "harfrust 0.13.3",
@@ -6971,7 +6971,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-formats"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6998,7 +6998,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-geom"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "image",
 "serde",
@@ -7006,7 +7006,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-layout"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "craft-proof",
 "image",
@@ -7026,7 +7026,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-mcp"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "log",
 "serde_json",
@@ -7038,7 +7038,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-metafile"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "kurbo",
 "thiserror 2.0.21",
@@ -7046,7 +7046,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-pdf"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "chrono",
 "craft-pdf",
@@ -7067,7 +7067,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-render"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "image",
 "log",
@@ -7081,7 +7081,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "accesskit_consumer",
 "cfb",
@@ -7114,7 +7114,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-web"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "craft-web-api",
 "craft-web-host",
@@ -7135,7 +7135,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-zotero"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "log",
 "proptest",
@@ -7298,7 +7298,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "serde_json",
 ]
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]

 [workspace.package]
-version = "0.18.0"
+version = "0.18.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
Author	SHA1	Message	Date
FredApps	07f977372d	CI: nightly release dry run (#6367 ) release.yml also runs nightly on main with craft-common-actions' dry-run: every release build except macOS, with nothing signed, pushed or drafted. Breakage that only the release build hits (riscv64, Flatpak, FreeBSD, packaging) then shows up the next morning instead of on release day, as it did on 11 Nov 2026.	2026-11-11 23:04:54 +01:00
Dylan M. Taylor	06c2ae6f9d	ci: use StepSecurity's maintained actions (#6343 ) Each third-party action that StepSecurity publishes a secure drop-in replacement for now uses that replacement, pinned to a commit with its version as a comment. Versions follow what we used: the newest StepSecurity release in the same major, or the closest major they publish. dtolnay/rust-toolchain refs that named a toolchain (stable, nightly, 1.76) become the replacement's `toolchain` input.	2026-11-11 14:59:04 -05:00
Dylan M. Taylor	a58b41a716	chore: bump version to 0.18.1 for the Flatpak update fix (#6344 )	2026-11-11 14:56:11 -05:00
Dylan M. Taylor	d86d2b69f8	Fix Flatpak permissions for update checks and self-updates (#6339 ) * fix(flatpak): allow release checks and self-update helpers * test: keep Flatpak permission parsing within strict Clippy rules	2026-11-11 14:24:25 -05:00