CI: run the Print job through the shared gate

printing.yml's native job ran its own apt-get, its own checkouts of craft-i18n and craft-fonts, and its own Rust setup. It now calls craft-common-actions gate.yml on the same three runners with the same commands, so Ubuntu packages come through install-apt-packages (cached, with the mirror fallback) and suite-wide CI fixes reach it.
ci: use StepSecurity's maintained actions (#6343 )
2026-11-11 16:31:54 -06:00 · 2026-11-11 23:01:35 +01:00 · 2026-11-11 14:59:04 -05:00 · 2026-11-11 14:56:11 -05:00 · 2026-11-11 14:24:25 -05:00
6 changed files with 76 additions and 89 deletions
@@ -30,75 +30,31 @@ concurrency:
  cancel-in-progress: true

 jobs:
+  # The print host and UI tests on Linux, Windows and macOS, through the suite's shared gate: it
+  # checks out craft-i18n (craft-i18n.rev) and craft-fonts, and installs the Ubuntu packages through
+  # install-apt-packages, which falls back to mirrors outside ubuntu.com (as on 11 Nov 2026).
  native:
-    name: Print (${{ matrix.os }})
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-24.04, windows-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 90
-    env:
-      CARGO_TERM_COLOR: always
-      CARGO_INCREMENTAL: '0'
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      # The interface catalogs and craft-proof's Language data come from craft-i18n at the commit in
-      # craft-i18n.rev, so these tests build with the same data as the gate (ci.yml).
-      - name: Check out craft-i18n
-        uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
-
+    name: Print
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      os: '["ubuntu-24.04","windows-latest","macos-latest"]'
+      timeout-minutes: 90
      # The catalogs include CJK interface languages, so the UI tests need the suite's fonts, as in
      # the gate (same commit as ci.yml and release.yml).
-      - name: Check out craft-fonts
-        uses: storytold/craft-common-actions/actions/checkout-craft-fonts@main
-        with:
-          ref: b076417b5880bd4154bd22f00695b1d28c6bea83
-
-      - name: Build with craft-fonts
-        shell: bash
-        run: |
-          echo "CRAFT_FONTS_DIR=$GITHUB_WORKSPACE/craft-fonts" >> "$GITHUB_ENV"
-          echo "CRAFT_FONTS_REQUIRED=1" >> "$GITHUB_ENV"
-
-      # apt falls back to mirrors outside ubuntu.com when it doesn't resolve (as on 11 Nov 2026).
-      - name: Configure apt mirrors
-        if: runner.os == 'Linux'
-        uses: storytold/craft-common-actions/actions/configure-apt-mirrors@main
-
-      - name: Install Linux build and software-rendering dependencies
-        if: runner.os == 'Linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \
-            libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers
-
-      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
-        with:
-          components: rustfmt, clippy
-          targets: wasm32-unknown-unknown
-
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
-        with:
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: Formatting
-        run: cargo fmt --all -- --check
-
-      - name: Native app and UI Clippy
-        run: cargo clippy -p wordcraft -p wordcraft-ui-egui --all-targets --locked -- -D warnings
-
-      - name: Native app and UI tests
-        run: cargo test -p wordcraft -p wordcraft-ui-egui --locked
-
-      - name: Browser compatibility
-        if: runner.os == 'Linux'
-        run: cargo check -p wordcraft-web --target wasm32-unknown-unknown --locked
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+      packages: >-
+        pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev
+        libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers
+      # No nextest: the tests run with cargo test, as before.
+      tools: ""
+      # Its own cache, apart from ci.yml's gate, which builds the whole workspace.
+      cache-version: v1-printing
+      command: |
+        cargo fmt --all -- --check
+        cargo clippy -p wordcraft -p wordcraft-ui-egui --all-targets --locked -- -D warnings
+        cargo test -p wordcraft -p wordcraft-ui-egui --locked
+        # Browser compatibility, once.
+        if [ "$RUNNER_OS" = Linux ]; then
+          cargo check -p wordcraft-web --target wasm32-unknown-unknown --locked
+        fi
@@ -6807,7 +6807,7 @@ dependencies = [

 [[package]]
 name = "wordcraft"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "arboard",
 "chrono",
@@ -6847,7 +6847,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-cli"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "image",
 "serde_json",
@@ -6863,11 +6863,11 @@ dependencies = [

 [[package]]
 name = "wordcraft-control-key"
-version = "0.18.0"
+version = "0.18.1"

 [[package]]
 name = "wordcraft-doc"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "base64 0.23.1",
 "log",
@@ -6881,7 +6881,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docbin"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "cfb",
 "chrono",
@@ -6898,7 +6898,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docx"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6923,7 +6923,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-engine"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "cfb",
 "chrono",
@@ -6957,7 +6957,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-fonts"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "brotli-decompressor",
 "harfrust 0.13.3",
@@ -6971,7 +6971,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-formats"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6998,7 +6998,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-geom"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "image",
 "serde",
@@ -7006,7 +7006,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-layout"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "craft-proof",
 "image",
@@ -7026,7 +7026,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-mcp"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "log",
 "serde_json",
@@ -7038,7 +7038,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-metafile"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "kurbo",
 "thiserror 2.0.21",
@@ -7046,7 +7046,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-pdf"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "chrono",
 "craft-pdf",
@@ -7067,7 +7067,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-render"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "image",
 "log",
@@ -7081,7 +7081,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "accesskit_consumer",
 "cfb",
@@ -7114,7 +7114,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-web"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "craft-web-api",
 "craft-web-host",
@@ -7135,7 +7135,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-zotero"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "log",
 "proptest",
@@ -7298,7 +7298,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
 "serde_json",
 ]
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]

 [workspace.package]
-version = "0.18.0"
+version = "0.18.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -0,0 +1,27 @@
+//! Release and source Flatpaks must allow release checks and host update helpers.
+fn finish_args(manifest: &str) -> Vec<&str> {
+    manifest
+        .split("finish-args:")
+        .nth(1)
+        .unwrap_or_default()
+        .lines()
+        .take_while(|line| line.is_empty() || line.starts_with(' ') || line.starts_with('#'))
+        .filter_map(|line| line.trim().strip_prefix("- "))
+        .map(|arg| arg.trim_matches(['\'', '"']))
+        .collect()
+}
+
+#[test]
+fn flatpak_update_permissions() {
+    let manifests = [
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml"),
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.wordcraft.yml"),
+    ];
+    let args = manifests.map(finish_args);
+    assert_eq!(args[0], args[1], "source and release permissions must agree");
+    for permissions in args {
+        for required in ["--share=network", "--talk-name=org.freedesktop.Flatpak"] {
+            assert!(permissions.contains(&required), "missing update permission: {required}");
+        }
+    }
+}
@@ -17,6 +17,8 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: wordcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
  - --filesystem=xdg-data/ArtCraft/versions:ro
  # Display: Wayland first; X11 only when no Wayland compositor is running.
  - --socket=wayland
@@ -18,6 +18,8 @@ sdk-extensions:
  - org.freedesktop.Sdk.Extension.rust-stable
 command: wordcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
  - --filesystem=xdg-data/ArtCraft/versions:ro
  # Display: Wayland first; X11 only when no Wayland compositor is running.
  - --socket=wayland
Author	SHA1	Message	Date
FredApps	ad866134dc	CI: run the Print job through the shared gate printing.yml's native job ran its own apt-get, its own checkouts of craft-i18n and craft-fonts, and its own Rust setup. It now calls craft-common-actions gate.yml on the same three runners with the same commands, so Ubuntu packages come through install-apt-packages (cached, with the mirror fallback) and suite-wide CI fixes reach it.	2026-11-11 23:01:35 +01:00
Dylan M. Taylor	06c2ae6f9d	ci: use StepSecurity's maintained actions (#6343 ) Each third-party action that StepSecurity publishes a secure drop-in replacement for now uses that replacement, pinned to a commit with its version as a comment. Versions follow what we used: the newest StepSecurity release in the same major, or the closest major they publish. dtolnay/rust-toolchain refs that named a toolchain (stable, nightly, 1.76) become the replacement's `toolchain` input.	2026-11-11 14:59:04 -05:00
Dylan M. Taylor	a58b41a716	chore: bump version to 0.18.1 for the Flatpak update fix (#6344 )	2026-11-11 14:56:11 -05:00
Dylan M. Taylor	d86d2b69f8	Fix Flatpak permissions for update checks and self-updates (#6339 ) * fix(flatpak): allow release checks and self-update helpers * test: keep Flatpak permission parsing within strict Clippy rules	2026-11-11 14:24:25 -05:00