ArtCraft’s Help menu has news but no application update check, and its
Flatpak cannot invoke the host updater. Add **Help → Check for
Updates…** with background checks, current/available versions, explicit
Update and restart, progress and failure states, and Releases fallback.
Browser users are offered a reload and the desktop releases.
Use the same verified `craft-update` core as the native Craft apps,
pinned to the immutable reviewed commit in
https://github.com/storytold/craft-libs/pull/970. Keep ArtCraft’s
existing `ai.artcraft.app` identity and release naming. Honor launcher
pins, reject active generation tasks before download and again before
replacement, preserve the native window during installation, defer the
helper until accepted exit, and report helper outcomes on startup.
Registered NSIS copies use Releases; they are not overwritten as
portable folders.
Grant the host update interface and read-only launcher choices in the
existing Flatpak manifest. No frontend network-policy expansion. Add a
separate version commit changing the canonical Tauri configuration and
display version to **0.42.1**, with a regression keeping them
synchronized. Once this and the shared-library prerequisite are green
and merged, merge main into the release branch, finish all platform
drafts, verify signed checksums/assets, and publish.
Validation: native all-target cargo check inside GNOME SDK 51; all six
focused Rust updater tests; all ten Help-menu/UI tests; TypeScript
project build; production frontend build; Flatpak permission regression
red before and green after. All six native SDK tests also pass at the
final 0.42.1 version. The existing lockfile needs compatible chrono and
crc32fast updates for the shared updater; other dependency revisions are
preserved.
Clears the open SonarCloud issues outside the TypeScript frontend,
except the Rust ones, which moved to #2823 so each PR stays small.
Compile and tests are left to CI.
**Security**
- `frontend/api_docs.html` (Web:S5725): `integrity` (sha384 of the
pinned `swagger-ui-dist@5.32.0` files) and `crossorigin="anonymous"` on
the three unpkg assets, over `https:`.
- S6505: `--ignore-scripts` on `npm install` / `npm ci` in the dev and
build scripts and in the macOS and Windows publish workflows.
`artcraft-linux-publish.yml` already builds with `npm ci
--ignore-scripts`, and the frontend has no install scripts of its own.
- S7637: `dtolnay/rust-toolchain@stable` and
`tauri-apps/tauri-action@v0` pinned by commit SHA. For tauri-action
that's the commit `v0` points to (`84b9d35…`). The Linux workflow had
pinned the tag object instead, and is fixed the same way.
- S6505 / S8543: the macOS build runs `./node_modules/.bin/nx` instead
of `npx nx`, as the Linux workflow does.
**Reliability**
- shell:S7688: `[[ ]]` in place of `[` / `test` in
`frontend_preflight.sh` and the Linux packaging scripts.
**Analysis scope** (`sonar-project.properties`), each with its reason in
the file:
- Not analysed: `crates/vendor/**` (third-party), the upstream Python
reference implementations beside the Grok and Sora clients (nothing runs
them), and the hand-run developer tools `frontend/scripts/unix-dev.mjs`
and `frontend/tools/performance/**`. These held the S8564, S1244, S2245,
S4036, S5443 and S8707 findings.
- rust:S4347 not raised on `DeterministicRng`, the fixed-seed generator
for tests.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **Improvements**
* File downloads and database maintenance now use asynchronous
operations, helping the app remain responsive during these tasks.
* API documentation assets load over HTTPS with integrity checks.
* **Build and Reliability**
* Build and publishing workflows use pinned tool versions and skip
package lifecycle scripts during dependency installation.
* Linux packaging checks use consistent shell conditionals.
* Frontend builds use the locally installed Nx command where applicable.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- typescript:S2187 not raised on the ApiManager tests, which build their
cases with shared helpers that call `it` (`BetaKeysApi.test.ts`).
typescript:S2819 not raised on `*.worker.ts`: a dedicated worker's
messages come only from the page that started it.
Adds the complete signed Linux release matrix, FreeBSD CI, and packaging
lint to ArtCraft Studio, aligned with the Craft suite standards in
`craft-common-actions`.
| Architecture | Formats |
|:-------------|:------------------------------------------------------------------------|
| x86_64 | AppImage and zsync, DEB, RPM, tar.gz, Arch package, Flatpak
bundle, OCI |
| aarch64 | AppImage and zsync, DEB, RPM, tar.gz, Arch package, Flatpak
bundle, OCI |
| riscv64 | DEB, RPM, tar.gz |
### Changes
- **Linux Packaging Matrix**: Builds and packages ArtCraft Studio across
x86_64, aarch64, and riscv64 using `storytold/craft-common-actions`.
Produces DEB, RPM, AppImage, tarball, Arch package, and Flatpak
bundle/OCI artifacts. Cross-compiles riscv64 DEB and RPM via BoringSSL
CMake configuration. Signed Linux artifacts join existing
`artcraft-v<version>` release drafts while retaining macOS and Windows
assets (storytold/craft-common-actions#160 and #161).
- **Release Trigger Alignment**: Like macOS and Windows release
workflows, Linux release builds run on release branches (`release`,
`artcraft-release`, `artcraft-linux`) and `workflow_dispatch` rather
than on PRs.
- **Documentation**: Updated `README.md` to include Linux under download
options and reference `packaging/linux/README.md`. Added
`packaging/windows/README.md` placeholder.
- **Packaging Lint**: Added `.github/workflows/packaging-lint.yml`
calling `craft-common-actions/packaging-lint.yml@main`. Fixed
pre-existing actionlint and shellcheck issues in macOS and Windows
publish workflows (`shell: pwsh` defaults and variable quoting).
- **FreeBSD CI**: Added `.github/workflows/freebsd.yml` calling
`craft-common-actions/freebsd.yml@main` on scheduled nightly runs,
release branches, and manual dispatch (not on pull requests).
- **SQLx Build Fallback**: Updated
`crates/schema/database/sqlite_tasks/build.rs` to fall back to
`SQLX_OFFLINE=true` using committed `.sqlx/` query data when no live
`/tmp/tasks.sqlite` database file exists, fixing nextest coverage
archives under CI.
### Validation
- `actionlint` passes cleanly across all `.github/workflows/*.yml`
files.
- `shellcheck` passes across all scripts in `packaging/linux/*.sh`.
- `xmllint` validates `packaging/linux/ai.artcraft.app.metainfo.xml`.
- `cargo check -p sqlite_tasks`, `cargo test -p sqlite_tasks`, and
`cargo test --no-run -p sqlite_tasks` pass locally without database
environment variables.
- Packaging lint passes 100% green on CI.
- SonarCloud / nextest instrumented test archive build passes on CI.
- Linux package scripts (`package.sh`, `package-test.sh`, `flatpak.sh`)
verified locally and on CI runners.
Dylan M. Taylor