cleanup (#764)

.github/workflows/build-aaudio-sink.yml

@@ -1,7 +1,5 @@
 name: Build AAudio sink module
 
-# A quick check of tools/aaudio-sink on its own; the APK build compiles the same module into the
-# audio bundle. Runs on pushes that touch the module.
 on:
   push:
     paths:

.github/workflows/build-desktop-kde.yml

@@ -1,13 +1,5 @@
 name: Build desktop package (KDE Plasma)
 
-# The desktop the app installs into its Linux runtime on first use: KDE Plasma as SteamOS's desktop
-# mode has it, the closure of tools/desktop-kde/seeds.txt over Arch Linux ARM minus what the runtime
-# already carries, plus tools/desktop-kde/overlay (tools/desktop-kde/build.sh), every package
-# signature-checked. Published as a release in Droid-Deck/DroidDeck-Components with DroidDeck's
-# other components; the apk pins it in tools/desktop-kde/release.env (tag, sha256, size). A
-# published tag is never rebuilt: the packages are Arch Linux ARM's current ones, so a rebuild
-# would not match the pinned sha256. A changed package gets a new tag (desktop-kde-r2, ...) and a
-# release.env update.
 on:
   push:
     paths:
@@ -72,7 +64,6 @@ jobs:
           KDE_KWIN_OVERRIDE="$PWD/out/kwin" tools/desktop-kde/build.sh out
           cp out/kwin/desktop-kde.kwin.txt out/
           echo "size $(stat -c %s out/desktop-kde.tar.zst) sha256 $(cat out/desktop-kde.sha256)"
-      # The package itself too, briefly: enough to try a build on a device before publishing it.
       - uses: actions/upload-artifact@v4
         with:
           name: desktop-kde

.github/workflows/build-gamescope.yml

@@ -1,9 +1,5 @@
 name: Build gamescope (patched)
 
-# The runtime's own gamescope (Arch Linux ARM's 3.16.29 package) rebuilt with the patches under
-# tools/gamescope/patches, in an Arch Linux ARM container on an arm64 runner, then published as a
-# release asset the apk build fetches (tools/gamescope/release.env names the tag and sha). The
-# hosted runtime image is never changed: the apk stages the binary over /usr/local/bin.
 on:
   push:
     paths:
@@ -43,6 +39,4 @@ jobs:
         run: |
           set -euo pipefail
           gh release create "${{ inputs.tag }}" --latest=false --prerelease=false --title "${{ inputs.tag }}" --notes "gamescope 3.16.29 with tools/gamescope/patches; staged by the apk over /usr/local/bin/gamescope. sha256 $(cut -d' ' -f1 gamescope.tzst.sha256)" gamescope.tzst gamescope.tzst.sha256 || gh release upload "${{ inputs.tag }}" gamescope.tzst gamescope.tzst.sha256 --clobber
-          # A component the apk fetches by tag, never something users install: it must not
-          # become the repo's Latest release or appear as a pre-release, also when re-uploaded.
           gh release edit "${{ inputs.tag }}" --latest=false --prerelease=false

.github/workflows/build.yml

@@ -22,8 +22,6 @@ permissions:
   pull-requests: write
 
 concurrency:
-  # Replace older builds only for the same PR. Each push/dispatch gets its own group so one main
-  # build cannot cancel another before it signs and publishes.
   group: build-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
@@ -211,14 +209,12 @@ jobs:
           aarch64-linux-gnu-gcc -shared -fPIC -O2 -Wall -nostdlib -ffreestanding -fno-stack-protector \
             -fno-tree-loop-distribute-patterns -Wl,-z,defs -o "$D/libblaudit.so" tools/proot/fastpath/audit.c
           aarch64-linux-gnu-strip --strip-unneeded "$D/libblaudit.so"
-          # Force-SSBS adapter, preloaded into a game's Wine only when the game asks for it.
           aarch64-linux-gnu-gcc -shared -fPIC -O2 -Wall -pthread \
             -o "$D/libssbs.so" tools/linuxfs/ssbs/ssbs_adapter.c -ldl
           aarch64-linux-gnu-strip --strip-unneeded "$D/libssbs.so"
           mkdir -p "$D/usr/local/bin"
           aarch64-linux-gnu-gcc -O2 -Wall -Wextra -o "$D/usr/local/bin/droiddeck-clipboard" tools/linuxfs/clipboard/clipboard.c -ldl
           aarch64-linux-gnu-strip --strip-unneeded "$D/usr/local/bin/droiddeck-clipboard"
-          # Cardboard mode's SteamVR driver and Vulkan layer (tools/vr), Vulkan headers from the runner's NDK.
           VK_INCLUDE=$(ls -d "${ANDROID_NDK_LATEST_HOME:-${ANDROID_NDK_HOME:-$ANDROID_NDK_ROOT}}"/toolchains/llvm/prebuilt/*/sysroot/usr/include | head -1) \
             tools/vr/build.sh --native "$D/usr/local/lib/droiddeck-vr"
           for script in tools/linuxfs/overlay/usr/local/bin/droiddeck-* tools/linuxfs/overlay/usr/local/bin/steam-compatibility; do
@@ -254,14 +250,12 @@ jobs:
           for so in libfmt.so.10 libspdlog.so.1.13 libglfw.so.3 libtraceevent.so.1; do
             cp -L "mango-pkgs/usr/lib/$so" "$M/$so"
           done
-          # Ours, not the package's: GPU memory without tracefs (tools/mangoapp/libtracefs-shim.c).
           aarch64-linux-gnu-gcc -shared -fPIC -O2 -Wall -Wl,-soname,libtracefs.so.1 \
             -o "$M/libtracefs.so.1" tools/mangoapp/libtracefs-shim.c
           aarch64-linux-gnu-strip --strip-unneeded "$M/libtracefs.so.1"
           install -Dm644 tools/mangoapp/mangoapp "$D/usr/local/bin/mangoapp"
           rm -rf mango-pkgs
           ls -l "$M"
-          # The Windows components installer's tools (tools/msitools/packages.txt).
           T="$D/usr/local/lib/droiddeck-msitools"
           mkdir -p "$T" msi-pkgs
           grep -v '^#' tools/msitools/packages.txt | while read -r sum url; do
@@ -273,7 +267,6 @@ jobs:
           done
           install -m644 msi-pkgs/usr/bin/msiinfo "$T/msiinfo"
           install -m644 msi-pkgs/usr/bin/cabextract "$T/cabextract"
-          # 7-Zip (the full build with its format plugin) opens installer .exe wrappers.
           install -m644 msi-pkgs/usr/lib/7zip/7z "$T/7z"
           install -m644 msi-pkgs/usr/lib/7zip/7z.so "$T/7z.so"
           for so in libmsi-1.0.so.0 libgsf-1.so.114 libgcab-1.0.so.0; do
@@ -291,10 +284,6 @@ jobs:
           install -Dm644 tools/linuxfs/desktop/firefox-droiddeck.js "$D/usr/lib/firefox/defaults/pref/droiddeck.js"
           ls -lR "$D"
 
-      # The Debian 11 image the preloads are compiled in comes from a release on this repo
-      # (published once by ci-debian-image.yml, pinned in tools/linuxfs/debian-image.env): the
-      # public registry mirrors rate-limit the shared runner addresses and failed builds on a
-      # busy evening. Only if that download fails is the image pulled, with retries.
       - name: Fetch the Debian image the preloads build in
         if: steps.preloads.outputs.cache-hit != 'true'
         env:
@@ -370,9 +359,6 @@ jobs:
           set -euo pipefail
           curl -fsSL -o pa.tar.gz https://github.com/pulseaudio/pulseaudio/archive/refs/tags/v13.0.tar.gz
           mkdir -p pa13 && tar -xzf pa.tar.gz -C pa13 --strip-components=1 && rm pa.tar.gz
-      # DirectAudio - the game driver (one set per Wine audio interface), the Android-side helper and
-      # the Steam client's sinks - comes from a pinned release of The412Banner/directaudio, checksummed,
-      # exactly like gamescope; nothing compiled for audio is kept in this repo.
       - name: Fetch DirectAudio (tools/directaudio/release.env)
         run: tools/directaudio/fetch.sh "$PWD" "$PWD/sink-out"
       - name: Build the AAudio sink into the audio bundle
@@ -410,12 +396,6 @@ jobs:
           set -euo pipefail
           bash tools/linuxfs/check-preloads.sh app/src/main/assets/linuxfs
 
-      # The store download engines (app/src/main/rust/stores) are Rust, built by Gradle's
-      # buildRustStores task through cargo-ndk. rustup and cargo are on the runner image; the Android
-      # target and cargo-ndk are added here. Cache = cargo registry + cargo-ndk + the crate's target
-      # tree, keyed on the rustc version and Cargo.lock, so a source-only change rebuilds this crate
-      # on top of the cached dependency objects, and a lockfile change still starts from the
-      # previous objects (restore-keys).
       - name: Rust toolchain for the store engines (aarch64-linux-android)
         id: rust
         run: |
@@ -474,9 +454,6 @@ jobs:
           python3 tools/release/runtime_inputs.py apk app/build/outputs/apk/release/app-release.apk
 
       - name: Check the store engines' library
-        # The exports Kotlin binds must be in the apk's libdroiddeckstores.so, or the stores fail on
-        # the device with an UnsatisfiedLinkError instead of here. The lockfile check is the
-        # reproducibility guard: cargo must not have had to re-resolve anything.
         run: |
           set -euo pipefail
           NDK="${ANDROID_NDK_LATEST_HOME:-${ANDROID_NDK_HOME:-$ANDROID_NDK_ROOT}}"
@@ -487,11 +464,6 @@ jobs:
             || { echo "::error::Cargo.lock changed during the build; commit the regenerated lockfile (uploaded as stores-cargo-lock)"; exit 1; }
 
       - name: Store engines host unit tests
-        # The crate's #[test] functions are pure host-side logic (manifest parsing, chunk plans,
-        # assembly from a cache, hashes), so a plain `cargo test` on the runner's own architecture
-        # runs them; the Android build above compiles none of them. Informational on this first
-        # run - the point is to learn whether they pass - and bounded so a hang can never hold
-        # the apk. Make it blocking once it is known green.
         timeout-minutes: 10
         continue-on-error: true
         run: |
@@ -626,13 +598,6 @@ jobs:
       variants: ${{ needs.build.outputs.variants }}
     secrets: inherit
 
-  # Each signed main build as a prerelease of the public Droid-Deck/DroidDeck-CI (main-<sha>, the
-  # last KEEP kept), where anyone can download it without a GitHub account, then a post in the
-  # Discord's #preview-builds channel linking to it. The release is made with a token of the org's
-  # "DroidDeck CI Publisher" app (installed on DroidDeck-CI only, Contents: write): its ID in the
-  # DROIDDECK_CI_APP_ID variable, its private key in the DROIDDECK_CI_APP_KEY secret.
-  # DISCORD_BUILDS_WEBHOOK is the channel's webhook URL. Keep this secret name when renaming
-  # the channel: Discord routes the existing webhook by channel ID, not its display name.
   announce:
     needs: [build, sign]
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
@@ -659,8 +624,6 @@ jobs:
           owner: Droid-Deck
           repositories: DroidDeck-CI
 
-      # What this build is, for the top of the release notes: the merged PR's title and the first
-      # paragraph of its description, or the commit's subject for a push made without a PR.
       - name: Describe the change
         env:
           GH_TOKEN: ${{ github.token }}
@@ -710,15 +673,12 @@ jobs:
           gh release delete "$tag" -R "$CI_REPO" --yes --cleanup-tag 2>/dev/null || true
           gh release create "$tag" -R "$CI_REPO" --target main --prerelease \
             --title "main ${GITHUB_SHA::7}" --notes "$notes" signed/*
-          # Keep the newest main builds by publication time. GitHub App releases can share createdAt.
           gh release list -R "$CI_REPO" -L 200 --json tagName,publishedAt \
             --jq '[.[] | select(.tagName | startswith("main-"))] | sort_by(.publishedAt) | reverse | .['"$KEEP"':][] | .tagName' |
             while IFS= read -r old; do
-              # Never remove this run's release, even if the API returns an unexpected ordering.
               if [ "$old" = "$tag" ]; then
                 continue
               fi
-              # Another main publish may have removed the same old release concurrently.
               if ! gh release delete "$old" -R "$CI_REPO" --yes --cleanup-tag 2>/dev/null; then
                 if gh release view "$old" -R "$CI_REPO" >/dev/null 2>&1; then
                   echo "::error::Could not delete old release $old"
@@ -748,8 +708,6 @@ jobs:
           fi
           commit=$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA")
           subject=$(jq -r '.commit.message | split("\n")[0]' <<<"$commit")
-          # A merge commit's subject is "Merge pull request #N from ..."; its body's first line is
-          # the PR's title, which says more.
           title=$(jq -r '.commit.message | split("\n") | map(select(length > 0)) | .[1] // ""' <<<"$commit")
           pr=$(sed -n 's/^Merge pull request #\([0-9]*\).*/\1/p' <<<"$subject")
           if [ -n "$pr" ]; then

.github/workflows/ci-debian-image.yml

@@ -1,8 +1,5 @@
 name: Publish the CI Debian image
 
-# Pulls the Debian 11 image the x86 preloads build in, once, and publishes it as a release asset
-# on this repo so build.yml never depends on a registry mirror's rate limit. Run it again (with a
-# new tag) only to refresh the image; tools/linuxfs/debian-image.env names the one builds use.
 
 on:
   workflow_dispatch:
@@ -32,7 +29,6 @@ jobs:
         run: |
           set -euo pipefail
           image=public.ecr.aws/docker/library/debian:bullseye
-          # A published image is pinned by checksum in the build; never replace one by accident.
           if [ "$REPLACE" != true ] && gh release view "$TAG" -R "$GITHUB_REPOSITORY" --json assets -q '.assets[].name' 2>/dev/null | grep -qx debian-bullseye.tar.zst; then
             echo "::error::$TAG already carries debian-bullseye.tar.zst; publish to a new tag, or set replace and re-pin tools/linuxfs/debian-image.env"
             exit 1

.github/workflows/pr-release-cleanup.yml

@@ -1,9 +1,9 @@
 name: PR Release Cleanup
-run-name: remove PR #${{ github.event.pull_request.number }}'s test build
+run-name: remove PR
+
+
+
 
-# A merged or closed PR's test build leaves DroidDeck-CI, so the app's Updates page stops offering it
-# (a merged fix is in the next Preview). pull_request_target for the publisher app's secrets; nothing
-# from the PR is checked out or run.
 on:
   pull_request_target:
     types: [ closed ]
@@ -32,7 +32,6 @@ jobs:
           set -euo pipefail
           state=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" --jq .state)
           echo "closed=$([ "$state" = closed ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-      # A token of the org's "DroidDeck CI Publisher" app, as build.yml's announce job uses.
       - uses: actions/create-github-app-token@v2
         if: ${{ steps.state.outputs.closed == 'true' }}
         id: ci-token

.github/workflows/pr-release-publish.yml

@@ -11,8 +11,6 @@ on:
   pull_request_target:
     types: [labeled]
     branches: [main]
-  # A PR from a branch of this repo is signed on its own after each green build: only people who
-  # can push here can change it. A fork's PR waits for a maintainer's publish-test label.
   workflow_run:
     workflows: [Build APK]
     types: [completed]
@@ -53,7 +51,6 @@ jobs:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      # Every variant a main build ships, so a PR build can be tried under any of them.
       - name: The packages a signed build ships as
         id: variants
         run: echo "list=$(awk '!/^#/ && NF { print $1 }' tools/release/variants.txt | jq -R . | jq -sc .)" >> "$GITHUB_OUTPUT"
@@ -68,8 +65,6 @@ jobs:
         run: |
           set -euo pipefail
           [[ "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]] || { echo "::error::Invalid PR number '$PR_NUMBER'"; exit 1; }
-          # The automatic path stands down quietly, never failing: a draft, a PR labelled
-          # no-test-build, or a build that a later push has already overtaken.
           skip() { echo "::notice::Not publishing PR #$PR_NUMBER: $1"; echo "skip=true" >> "$GITHUB_OUTPUT"; exit 0; }
           if [ "$EVENT_NAME" = workflow_run ]; then
             echo "automatic=true" >> "$GITHUB_OUTPUT"
@@ -94,9 +89,6 @@ jobs:
           head=$(jq -r '.head.sha' <<<"$pr")
           base=$(jq -r '.base.sha' <<<"$pr")
 
-          # The label is often added while the PR's build is still running, or just after a push
-          # before it has started: wait for the latest build of the head commit to finish (a PR
-          # build takes about 4 minutes) rather than fail and need the label added again.
           run_id=
           for attempt in $(seq 1 60); do
             latest=$(gh run list -R "$GITHUB_REPOSITORY" --workflow build.yml \
@@ -116,8 +108,6 @@ jobs:
             sleep 30
           done
           [[ -n "$run_id" ]] || { echo '::error::The PR build did not finish within 30 minutes'; exit 1; }
-          # GitHub leaves a run's pull_requests empty when its head is in a fork, so the build is
-          # tied to this PR by its head repository, branch and commit instead.
           run=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$run_id")
           jq -e --arg head "$head" --arg repo "$(jq -r .head.repo.full_name <<<"$pr")" --arg ref "$(jq -r .head.ref <<<"$pr")" '
             .event == "pull_request" and .head_sha == $head and .conclusion == "success" and
@@ -127,8 +117,6 @@ jobs:
 
           sdk=${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}
           tools=$(find "$sdk/build-tools" -mindepth 1 -maxdepth 1 -type d | sort -V | tail -1)
-          # A PR build is made from the PR merged onto main, so it must install over main's own
-          # build. main is what this job checked out; no release has to exist or be marked latest.
           main_code=$(sed -n 's/^[[:space:]]*versionCode[[:space:]][[:space:]]*\([0-9][0-9]*\)[[:space:]]*$/\1/p' app/build.gradle)
           [[ "$main_code" =~ ^[0-9]+$ ]] || { echo "::error::No numeric versionCode in main's app/build.gradle"; exit 1; }
           mkdir -p "$RUNNER_TEMP/pr"
@@ -188,8 +176,6 @@ jobs:
           pattern: droiddeck-pr-signed-*
           merge-multiple: true
           path: signed
-      # What this build is, for the top of the release notes: the PR's title and the first
-      # paragraph of its description.
       - name: Describe the change
         env:
           GH_TOKEN: ${{ github.token }}
@@ -208,7 +194,6 @@ jobs:
             fi
           } > notes-head.md
           cat notes-head.md
-      # A token of the org's "DroidDeck CI Publisher" app, as build.yml's announce job uses.
       - uses: actions/create-github-app-token@v2
         id: ci-token
         with:
@@ -250,7 +235,6 @@ jobs:
           echo "first=$first" >> "$GITHUB_OUTPUT"
           gh release upload "$tag" signed/* -R "$repo" --clobber
           gh release edit "$tag" -R "$repo" --title "PR #$PR_NUMBER" --notes "$notes" --prerelease
-          # Drop the previous build's files: anything this build did not just upload.
           keep=$(cd signed && ls | jq -R . | jq -sc .)
           gh api "repos/$repo/releases/tags/$tag" |
             jq -r --argjson keep "$keep" '.assets[] | select(.name as $n | $keep | index($n) | not) | .id' |

.github/workflows/release.yml

@@ -63,7 +63,6 @@ jobs:
       artifact: droiddeck-release
     secrets: inherit
 
-  # The release is made here, from the apks this run signed, so it traces back to its Build APK run.
   publish:
     name: publish the release
     needs: [find, sign]
@@ -94,7 +93,6 @@ jobs:
           if gh release view "$VERSION" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "::error::release $VERSION already exists"; exit 1
           fi
-          # The notes' first line is the title; media paths become raw URLs at this release's tag.
           title=$(sed -n '1s/^# *//p' "$notes")
           [ -n "$title" ] || title="DroidDeck $VERSION"
           raw="https://raw.githubusercontent.com/$GITHUB_REPOSITORY/$VERSION/docs/releases/media/"
@@ -110,7 +108,6 @@ jobs:
             --target "$GITHUB_SHA" --title "$title" --notes-file "$RUNNER_TEMP/body.md" --latest
           echo "Published [$title]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/tag/$VERSION)" >> "$GITHUB_STEP_SUMMARY"
 
-  # A release made with this run's token fires no release event, so the in-app catalog is refreshed here.
   catalog:
     needs: publish
     uses: ./.github/workflows/update-catalog.yml

.github/workflows/update-catalog.yml

@@ -20,7 +20,6 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      # Always use the current trusted generator, even when a release event points at an older tag.
       - uses: actions/checkout@v4
         with:
           ref: main