mirror of
https://github.com/storytold/artcraft.git
synced 2026-11-11 16:31:04 +00:00
Dylan M. Taylor
0c11395467
Clears the open SonarCloud issues outside the TypeScript frontend, except the Rust ones, which moved to #2823 so each PR stays small. Compile and tests are left to CI. **Security** - `frontend/api_docs.html` (Web:S5725): `integrity` (sha384 of the pinned `swagger-ui-dist@5.32.0` files) and `crossorigin="anonymous"` on the three unpkg assets, over `https:`. - S6505: `--ignore-scripts` on `npm install` / `npm ci` in the dev and build scripts and in the macOS and Windows publish workflows. `artcraft-linux-publish.yml` already builds with `npm ci --ignore-scripts`, and the frontend has no install scripts of its own. - S7637: `dtolnay/rust-toolchain@stable` and `tauri-apps/tauri-action@v0` pinned by commit SHA. For tauri-action that's the commit `v0` points to (`84b9d35…`). The Linux workflow had pinned the tag object instead, and is fixed the same way. - S6505 / S8543: the macOS build runs `./node_modules/.bin/nx` instead of `npx nx`, as the Linux workflow does. **Reliability** - shell:S7688: `[[ ]]` in place of `[` / `test` in `frontend_preflight.sh` and the Linux packaging scripts. **Analysis scope** (`sonar-project.properties`), each with its reason in the file: - Not analysed: `crates/vendor/**` (third-party), the upstream Python reference implementations beside the Grok and Sora clients (nothing runs them), and the hand-run developer tools `frontend/scripts/unix-dev.mjs` and `frontend/tools/performance/**`. These held the S8564, S1244, S2245, S4036, S5443 and S8707 findings. - rust:S4347 not raised on `DeterministicRng`, the fixed-seed generator for tests. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Improvements** * File downloads and database maintenance now use asynchronous operations, helping the app remain responsive during these tasks. * API documentation assets load over HTTPS with integrity checks. * **Build and Reliability** * Build and publishing workflows use pinned tool versions and skip package lifecycle scripts during dependency installation. * Linux packaging checks use consistent shell conditionals. * Frontend builds use the locally installed Nx command where applicable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> - typescript:S2187 not raised on the ApiManager tests, which build their cases with shared helpers that call `it` (`BetaKeysApi.test.ts`). typescript:S2819 not raised on `*.worker.ts`: a dedicated worker's messages come only from the page that started it.
55 lines
2.6 KiB
Bash
Executable File
55 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Normalize Tauri packages and derive the suite's bin/share tarball from its Debian package.
|
|
set -euo pipefail
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
arch="${1:?architecture required}"
|
|
target="${2:?Rust target required}"
|
|
version="$(jq -r .version crates/desktop/artcraft/tauri.conf.json)"
|
|
case "$arch" in x86_64|aarch64|riscv64) ;; *) exit 2 ;; esac
|
|
base="artcraft-$version-linux-$arch"
|
|
bundle="target/$target/release/bundle"
|
|
mkdir -p dist/release
|
|
for format in deb rpm AppImage; do
|
|
mapfile -t files < <(find "$bundle" -type f -name "*.$format")
|
|
if [[ "$arch" == riscv64 && "$format" == AppImage ]]; then continue; fi
|
|
[[ ${#files[@]} == 1 ]] || { echo "Expected one $format in $bundle, found ${#files[@]}" >&2; exit 1; }
|
|
cp "${files[0]}" "dist/release/$base.$format"
|
|
done
|
|
if [[ "$arch" != riscv64 ]]; then
|
|
zsyncmake -u "https://github.com/storytold/artcraft/releases/download/artcraft-v$version/$base.AppImage" \
|
|
-o "dist/release/$base.AppImage.zsync" "dist/release/$base.AppImage"
|
|
fi
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "$work"' EXIT
|
|
dpkg-deb -x "dist/release/$base.deb" "$work/deb"
|
|
mkdir -p "$work/$base"
|
|
cp -a "$work/deb/usr/." "$work/$base/"
|
|
mapfile -t desktops < <(find "$work/$base/share/applications" -name '*.desktop')
|
|
[[ ${#desktops[@]} == 1 ]] || { echo 'Expected one desktop entry' >&2; exit 1; }
|
|
if [[ "${desktops[0]}" != "$work/$base/share/applications/ai.artcraft.app.desktop" ]]; then
|
|
mv "${desktops[0]}" "$work/$base/share/applications/ai.artcraft.app.desktop"
|
|
fi
|
|
install -Dm644 "$script_dir/ai.artcraft.app.metainfo.xml" "$work/$base/share/metainfo/ai.artcraft.app.metainfo.xml"
|
|
sed -i 's/^Name=.*/Name=ArtCraft Studio/' "$work/$base/share/applications/ai.artcraft.app.desktop"
|
|
[[ -x "$work/$base/bin/artcraft" ]]
|
|
case "$arch" in
|
|
x86_64) machine='Advanced Micro Devices X86-64' ;;
|
|
aarch64) machine='AArch64' ;;
|
|
riscv64) machine='RISC-V' ;;
|
|
esac
|
|
readelf -h "$work/$base/bin/artcraft" | grep -F "$machine"
|
|
if [[ "$arch" == "$(uname -m)" ]]; then
|
|
dependencies="$(ldd "$work/$base/bin/artcraft")"
|
|
if grep -q 'not found' <<< "$dependencies"; then
|
|
printf '%s\n' "$dependencies" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
# The tarball layout is consumed by the launcher, Arch packaging and Flatpak.
|
|
tar -czf "dist/release/$base.tar.gz" -C "$work" "$base"
|
|
case "$arch" in x86_64) deb_arch=amd64 ;; aarch64) deb_arch=arm64 ;; riscv64) deb_arch=riscv64 ;; esac
|
|
[[ "$(dpkg-deb -f "dist/release/$base.deb" Architecture)" == "$deb_arch" ]]
|
|
[[ "$(rpm -qp --qf '%{ARCH}' "dist/release/$base.rpm")" == "$arch" ]]
|
|
dpkg-deb --info "dist/release/$base.deb"
|
|
rpm -qp --requires "dist/release/$base.rpm"
|