Merge branch 'main' into fix/second-library-steam-installs

.github/workflows/build-gamescope.yml

@@ -42,4 +42,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          gh release create "${{ inputs.tag }}" --title "${{ inputs.tag }}" --notes "gamescope 3.16.29 with tools/gamescope/patches; staged by the apk over /usr/local/bin/gamescope. sha256 $(cut -d' ' -f1 gamescope.tzst.sha256)" gamescope.tzst gamescope.tzst.sha256 || gh release upload "${{ inputs.tag }}" gamescope.tzst gamescope.tzst.sha256 --clobber
+          gh release create "${{ inputs.tag }}" --latest=false --prerelease=false --title "${{ inputs.tag }}" --notes "gamescope 3.16.29 with tools/gamescope/patches; staged by the apk over /usr/local/bin/gamescope. sha256 $(cut -d' ' -f1 gamescope.tzst.sha256)" gamescope.tzst gamescope.tzst.sha256 || gh release upload "${{ inputs.tag }}" gamescope.tzst gamescope.tzst.sha256 --clobber
+          # A component the apk fetches by tag, never something users install: it must not
+          # become the repo's Latest release or appear as a pre-release, also when re-uploaded.
+          gh release edit "${{ inputs.tag }}" --latest=false --prerelease=false

.github/workflows/build-wlroots.yml

@@ -43,4 +43,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          gh release create "${{ inputs.tag }}" --title "${{ inputs.tag }}" --notes "wlroots 0.20.2 with tools/wlroots/patches (Vulkan DMA-BUF allocator for non-DRM GPU nodes); staged by the apk at /usr/local/lib/droiddeck-wlroots for the desktop's GPU renderers. sha256 $(cut -d' ' -f1 wlroots.tzst.sha256)" wlroots.tzst wlroots.tzst.sha256 || gh release upload "${{ inputs.tag }}" wlroots.tzst wlroots.tzst.sha256 --clobber
+          gh release create "${{ inputs.tag }}" --latest=false --prerelease=false --title "${{ inputs.tag }}" --notes "wlroots 0.20.2 with tools/wlroots/patches (Vulkan DMA-BUF allocator for non-DRM GPU nodes); staged by the apk at /usr/local/lib/droiddeck-wlroots for the desktop's GPU renderers. sha256 $(cut -d' ' -f1 wlroots.tzst.sha256)" wlroots.tzst wlroots.tzst.sha256 || gh release upload "${{ inputs.tag }}" wlroots.tzst wlroots.tzst.sha256 --clobber
+          # A component the apk fetches by tag, never something users install: it must not
+          # become the repo's Latest release or appear as a pre-release, also when re-uploaded.
+          gh release edit "${{ inputs.tag }}" --latest=false --prerelease=false

.github/workflows/pr-release-publish.yml

@@ -88,7 +88,8 @@ jobs:
             esac
           fi
           pr=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER")
-          jq -e '.state == "open" and .draft == false and .base.ref == "main"' <<<"$pr" >/dev/null
+          jq -e '.state == "open" and .draft == false and .base.ref == "main"' <<<"$pr" >/dev/null ||
+            { echo "::error::PR #$PR_NUMBER must be open, ready for review, and target main"; exit 1; }
           head=$(jq -r '.head.sha' <<<"$pr")
           base=$(jq -r '.base.sha' <<<"$pr")
 
@@ -114,36 +115,39 @@ jobs:
             sleep 30
           done
           [[ -n "$run_id" ]] || { echo '::error::The PR build did not finish within 30 minutes'; exit 1; }
+          # GitHub leaves a run's pull_requests empty when its head is in a fork, so the build is
+          # tied to this PR by its head repository, branch and commit instead.
           run=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$run_id")
-          jq -e --arg head "$head" --arg base "$base" --argjson number "$PR_NUMBER" '
+          jq -e --arg head "$head" --arg repo "$(jq -r .head.repo.full_name <<<"$pr")" --arg ref "$(jq -r .head.ref <<<"$pr")" '
             .event == "pull_request" and .head_sha == $head and .conclusion == "success" and
-            any(.pull_requests[]?; .number == $number and .head.sha == $head and .base.sha == $base)
-          ' <<<"$run" >/dev/null
+            .head_repository.full_name == $repo and .head_branch == $ref
+          ' <<<"$run" >/dev/null ||
+            { echo "::error::Build run $run_id is not a green build of PR #$PR_NUMBER at ${head:0:7}"; exit 1; }
 
           sdk=${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}
           tools=$(find "$sdk/build-tools" -mindepth 1 -maxdepth 1 -type d | sort -V | tail -1)
-          stable_tag=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)
-          mkdir -p "$RUNNER_TEMP/stable" "$RUNNER_TEMP/pr"
-          gh release download "$stable_tag" -R "$GITHUB_REPOSITORY" \
-            -p "DroidDeck-$stable_tag.apk" -D "$RUNNER_TEMP/stable"
+          # A PR build is made from the PR merged onto main, so it must install over main's own
+          # build. main is what this job checked out; no release has to exist or be marked latest.
+          main_code=$(sed -n 's/^[[:space:]]*versionCode[[:space:]][[:space:]]*\([0-9][0-9]*\)[[:space:]]*$/\1/p' app/build.gradle)
+          [[ "$main_code" =~ ^[0-9]+$ ]] || { echo "::error::No numeric versionCode in main's app/build.gradle"; exit 1; }
+          mkdir -p "$RUNNER_TEMP/pr"
           gh run download "$run_id" -R "$GITHUB_REPOSITORY" -n droiddeck-apk -D "$RUNNER_TEMP/pr"
           mapfile -t apks < <(find "$RUNNER_TEMP/pr" -type f -name '*.apk')
           [[ ${#apks[@]} == 1 ]] || { echo '::error::Expected one PR APK'; exit 1; }
           package_line() {
             "$tools/aapt" dump badging "$1" | sed -n "s/^package: name='\\([^']*\\)' versionCode='\\([^']*\\)'.*/\\1 \\2/p"
           }
-          stable=$(package_line "$RUNNER_TEMP/stable/DroidDeck-$stable_tag.apk")
           candidate=$(package_line "${apks[0]}")
-          [[ "$stable" =~ ^com\.droiddeck\.launcher\ [0-9]+$ && "$candidate" =~ ^com\.droiddeck\.launcher\ [0-9]+$ &&
-             ${candidate##* } -ge ${stable##* } ]] || {
-            echo "::error::PR package/versionCode '$candidate' cannot install over stable '$stable'"; exit 1;
+          [[ "$candidate" =~ ^com\.droiddeck\.launcher\ [0-9]+$ && ${candidate##* } -ge $main_code ]] || {
+            echo "::error::PR package/versionCode '$candidate' cannot install over main (versionCode $main_code)"; exit 1;
           }
 
           current=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER")
           jq -e --arg head "$head" --arg base "$base" '
             .state == "open" and .draft == false and .base.ref == "main" and
             .head.sha == $head and .base.sha == $base
-          ' <<<"$current" >/dev/null
+          ' <<<"$current" >/dev/null ||
+            { echo "::error::PR #$PR_NUMBER moved on while its build was checked; publish again"; exit 1; }
           {
             echo "pr_number=$PR_NUMBER"
             echo "run_id=$run_id"

tools/release/update_catalog.py

@@ -243,13 +243,19 @@ def main_commit(release: dict) -> str | None:
     return match.group(1) if match else None
 
 
+def stable_app_release(releases: list[dict]) -> dict | None:
+    """The newest published app release. The repo also publishes gamescope and wlroots
+    releases that GitHub may mark latest, so an app release is one shipping DroidDeck-<tag>.apk."""
+    apps = [
+        r for r in releases
+        if not r.get("draft") and not r.get("prerelease")
+        and any(a.get("name") == f"DroidDeck-{r.get('tag_name')}.apk" for a in r.get("assets") or [])
+    ]
+    return max(apps, key=lambda r: r.get("published_at") or r.get("created_at") or "", default=None)
+
+
 def build_catalog(source: GitHub, ci: GitHub, source_repo: str, ci_repo: str) -> dict:
-    try:
-        stable_release = source.get(f"/repos/{source_repo}/releases/latest")
-    except ApiError as e:
-        if e.status != 404:
-            raise
-        stable_release = None
+    stable_release = stable_app_release(source.get(f"/repos/{source_repo}/releases?per_page=100"))
 
     stable = None
     if stable_release:

tools/tests/test_update_catalog.py

@@ -7,6 +7,7 @@ from tools.release.update_catalog import (
     parse_variants,
     published_millis,
     release_body_value,
+    stable_app_release,
 )
 
 
@@ -86,6 +87,19 @@ pubg com.tencent.ig -pubg
             published_millis(release, prefer_updated=True),
         )
 
+    def test_stable_is_the_newest_app_release_not_github_latest(self):
+        def release(tag, at, *assets, **flags):
+            return {"tag_name": tag, "published_at": at, "assets": [{"name": a} for a in assets], **flags}
+        releases = [
+            release("gamescope-3.16.29-p5", "2026-10-01T18:53:08Z", "gamescope.tzst"),
+            release("0.3.0", "2026-09-30T00:00:00Z", "DroidDeck-0.3.0.apk", prerelease=True),
+            release("0.2.1", "2026-09-29T00:00:00Z", "DroidDeck-0.2.1.apk", draft=True),
+            release("0.2.0", "2026-09-28T03:20:01Z", "DroidDeck-0.2.0-pubg.apk", "DroidDeck-0.2.0.apk"),
+            release("0.1.6", "2026-09-01T00:00:00Z", "DroidDeck-0.1.6.apk"),
+        ]
+        self.assertEqual("0.2.0", stable_app_release(releases)["tag_name"])
+        self.assertIsNone(stable_app_release(releases[:1]))
+
 
 if __name__ == "__main__":
     unittest.main()