ShadowCode 0.33.1: reliable workflows and authenticated Linux releases

.github/workflows/ci.yml

@@ -37,12 +37,18 @@ jobs:
         with:
           node-version: '22'
       - name: No credentials in tracked files
-        run: node scripts/check-secrets.mjs
+        run: |
+          node scripts/check-secrets.mjs
+          node --test scripts/test-check-secrets.mjs
+      - name: Verify publisher authentication and private release snapshots
+        run: node --test scripts/test-native-release-auth.mjs
       - name: Managed llama.cpp packaging (pins, notices, relative links, deb repack)
-        run: node --test scripts/test-llama-runtime.mjs
+        run: node --test scripts/test-llama-runtime.mjs scripts/test-llama-build-inputs.mjs
       - name: Packaging PATH ignores host node hijacks
         run: node --test scripts/test-native-packaging-env.mjs
       - name: Pinned-source failures and mirror recovery
         run: node --test scripts/test-native-source-fetch.mjs
       - name: Installer replacement, runtime swap and checksum refusal
-        run: bash scripts/test-install-appimage.sh
+        run: |
+          node --test --test-reporter=tap scripts/test-install-auth.mjs
+          bash scripts/test-install-appimage.sh

.github/workflows/native.yml

@@ -3,7 +3,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    paths: ['native/**', 'src-tauri/**', 'ui/**', 'licenses/native/**', 'packaging/native-runtime/**', 'packaging/native-app-run.sh', 'packaging/llama.cpp/**', 'packaging/shadow-agent.desktop', 'tools/llama.cpp.pin', 'tools/glslc-flatpak.sh', 'scripts/build-llama.cpp.sh', 'scripts/*llama*.mjs', 'scripts/install-appimage.sh', 'scripts/test-install-appimage.sh', 'scripts/*native*.mjs', 'scripts/native-packaging-env.sh', 'scripts/native-mcp-peer/**', 'Cargo.toml', 'Cargo.lock', '.github/workflows/native.yml', '.github/workflows/release.yml']
+    paths: ['native/**', 'vendor/**', 'scripts/fixtures/native-glib-variant.rs', 'scripts/fixtures/native-runtime-write-errors.c', 'src-tauri/**', 'ui/**', 'licenses/native/**', 'packaging/native-runtime/**', 'packaging/native-app-run.sh', 'packaging/llama.cpp/**', 'packaging/shadow-agent.desktop', 'tools/llama.cpp.pin', 'tools/glslc-flatpak.sh', 'scripts/build-llama.cpp.sh', 'scripts/*llama*.mjs', 'scripts/install-appimage.sh', 'scripts/install-release-state.sh', 'scripts/installer-auth-fixtures.mjs', 'scripts/test-install-auth.mjs', 'release/**', 'scripts/test-install-appimage.sh', 'scripts/test-clean-host-*.mjs', 'scripts/clean-host-*.mjs', 'scripts/clean-host-mcp-smoke.sh', 'scripts/fixtures/native-*.mjs', 'scripts/clean-host-runtime.Dockerfile', 'scripts/clean-host-gui-smoke.sh', 'scripts/*native*.mjs', 'scripts/publisher-fixtures.mjs', 'scripts/test-publisher-auth.mjs', 'scripts/native-packaging-env.sh', 'scripts/native-release-auth-lib.sh', 'scripts/verify-native-release.sh', 'scripts/check-secrets.mjs', 'scripts/test-check-secrets.mjs', 'scripts/native-mcp-peer/**', 'Cargo.toml', 'Cargo.lock', '.github/workflows/native.yml', '.github/workflows/release.yml']
 permissions:
   contents: read
 jobs:
@@ -20,19 +20,36 @@ jobs:
           node-version: '22'
           cache: npm
           cache-dependency-path: ui/package-lock.json
+      - name: Native window dependencies
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev libayatana-appindicator3-dev libasound2-dev patchelf webkit2gtk-driver xvfb appstream dbus-daemon dbus-bin
+      - name: Test release staging and immutable retry behavior
+        run: node --test scripts/test-native-release.mjs scripts/test-native-release-verification.mjs scripts/test-publisher-auth.mjs scripts/test-native-release-signing.mjs scripts/test-native-test-session.mjs scripts/test-clean-host-mcp-receipt.mjs scripts/test-clean-host-container.mjs scripts/test-native-app-run.mjs scripts/test-llama-build-inputs.mjs && node scripts/test-native-process-ownership.mjs
+      - name: Verify publisher authentication and private release snapshots
+        run: node --test scripts/test-native-release-auth.mjs scripts/test-check-secrets.mjs
       - name: Package version
         run: echo "VERSION=$(node -p "require('./src-tauri/tauri.conf.json').version")" >> "$GITHUB_ENV"
-      - name: Native window dependencies
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev libayatana-appindicator3-dev libasound2-dev patchelf webkit2gtk-driver xvfb
       - name: Managed llama.cpp build dependencies
         run: sudo apt-get install -y cmake ninja-build libssl-dev libvulkan-dev glslc spirv-headers
       - run: npm --prefix ui ci && npm --prefix ui run build && npm --prefix ui test
       - name: Install pinned Rust toolchain
         run: rustup toolchain install 1.95.0 --profile minimal --component rustfmt --component clippy
+      - name: Verify the exact GLib backport and optimized iterator behavior
+        run: |
+          rustfmt +1.95.0 --check --edition 2021 scripts/fixtures/native-glib-variant.rs
+          node --test --test-reporter=tap scripts/test-native-glib-backport.mjs
+          node scripts/test-native-glib-variant.mjs
       - run: cargo +1.95.0 fmt --all --check
       - run: cargo +1.95.0 clippy --workspace --all-targets --locked -- -D warnings
       - run: cargo +1.95.0 build -p shadowcode-desktop --locked
-      - run: cargo +1.95.0 test --workspace --locked
+      - run: cargo +1.95.0 test --workspace --locked -- --skip worktrees::cleanup::tests::actual_built_project_cleanup_is_bounded_and_completes
+      - name: Qualify cleanup over actual built UI dependencies and output
+        run: node scripts/native-release-verification.mjs run built-project-cleanup
+      - name: Preserve built-project cleanup diagnostics
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: built-project-cleanup-diagnostics
+          path: artifacts/built-project-cleanup
       - name: Exercise the native CLI without a display
         run: node scripts/test-native-cli.mjs
       - name: Stress repeated native tasks, cancellation, output and cleanup
@@ -68,12 +85,20 @@ jobs:
             artifacts/native-tui
       - run: cargo +1.95.0 install tauri-driver --version 2.0.6 --locked
       - name: Exercise the native window
-        run: xvfb-run -a -s '-screen 0 1440x1100x24' dbus-run-session -- node scripts/test-native-desktop.mjs
+        run: node scripts/run-native-x11.mjs node scripts/test-native-desktop.mjs
+      - name: Exercise the embedded Markdown worker under the native security policy
+        run: node scripts/run-native-x11.mjs node scripts/test-native-markdown.mjs
+      - name: Qualify 100 sequential tasks through the native window
+        run: node scripts/native-release-verification.mjs run native-endurance
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
           name: native-window-diagnostics
-          path: artifacts/native
+          path: |
+            artifacts/native
+            artifacts/native-markdown
+            artifacts/native-endurance
+            artifacts/native-x11
       - run: cargo +1.95.0 build --release -p shadowcode-core --examples --locked
       - name: Check pinned-source failures and mirror recovery
         run: node --test scripts/test-native-source-fetch.mjs
@@ -90,17 +115,25 @@ jobs:
       - name: Build the managed llama.cpp runtime (Vulkan + all CPU variants)
         run: bash scripts/build-llama.cpp.sh --no-user-install
       - name: Check the managed runtime packaging steps
-        run: node --test scripts/test-llama-runtime.mjs
+        run: node --test scripts/test-llama-runtime.mjs scripts/test-native-desktop-metadata.mjs
       - name: Build native development packages with dependency notices
         run: node scripts/build-native.mjs
       - name: Inspect both packages
         run: node scripts/check-native-package.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_amd64.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_amd64.deb"
+      - name: Build runtime-only clean-host qualification image
+        run: docker build -f scripts/clean-host-runtime.Dockerfile -t shadowcode-clean-runtime:ci scripts
+      - name: Install and first-launch both packages in an offline clean host
+        run: node scripts/test-clean-host-packages.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_amd64.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_amd64.deb" artifacts/native-package/SHA256SUMS
+      - name: Reject AppImage extraction writes that fail
+        run: node scripts/test-native-runtime-write-errors.mjs
       - name: Rebuild the shipped runtime sources without network access
         run: node scripts/test-native-runtime-sources.mjs
       - name: Exercise concurrent AppImage extraction and shutdown
         run: node scripts/test-native-runtime.mjs
       - name: Verify installer runtime swap and checksum refusal
-        run: bash scripts/test-install-appimage.sh
+        run: |
+          node --test --test-reporter=tap scripts/test-install-auth.mjs
+          bash scripts/test-install-appimage.sh
       - name: Exercise the packaged CLI without a display
         env:
           SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
@@ -119,7 +152,13 @@ jobs:
           SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run","ui"]'
           SHADOW_NATIVE_DEFAULT_PROFILE: '1'
           SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/window
-        run: xvfb-run -a -s '-screen 0 1440x1100x24' dbus-run-session -- node scripts/test-native-desktop.mjs
+        run: node scripts/run-native-x11.mjs node scripts/test-native-desktop.mjs
+      - name: Exercise the packaged Markdown worker under its native security policy
+        env:
+          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
+          SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run"]'
+          SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/markdown
+        run: node scripts/run-native-x11.mjs node scripts/test-native-markdown.mjs
       - name: Exercise the packaged native MCP server
         env:
           SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_amd64.AppImage
@@ -143,7 +182,9 @@ jobs:
         if: always()
         with:
           name: native-package-diagnostics
-          path: artifacts/native-package
+          path: |
+            artifacts/native-package
+            artifacts/native-x11
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: native-linux-development