Skip to content

fix(ci): rpm metadata syntax + release write permission #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bearice merged 2 commits into from
Jul 7, 2026
Merged

fix(ci): rpm metadata syntax + release write permission #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d68ae5f
fix(ci): correct rpm metadata syntax and grant release write permission
bearice Jul 7, 2026
b0a44f4
fix(ci): make AppImage build best-effort so it can't block deb/rpm/ta…
bearice Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 33 additions & 4 deletions .github/workflows/rust.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,12 @@ on:
types: [created, edited]

permissions:
# contents: write is required by softprops/action-gh-release to upload
# assets to a GitHub release. Specifying any permission makes all others
# default to none, so this must be listed explicitly.
contents: write

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Limit release write permission to release jobs

Because this workflow also runs on pull_request_target, this top-level contents: write permission is granted to every PR-target build job, even though only the tag/release upload steps need repository-content write access. Those PR jobs still execute third-party actions and build scripts before the release-only publish steps are skipped, so any compromised action or PR-target execution path gets a token capable of mutating repository contents/releases; move this permission to release-only jobs or split publishing into a release-only workflow while keeping PR-target jobs read-only.

Useful? React with 👍 / 👎.

pull-requests: write

jobs:
#run build first to populate caches
build-windows:
Expand Down Expand Up @@ -163,6 +167,10 @@ jobs:
cp target/generate-rpm/*.rpm rpm-out/RustCat-linux-x86_64.rpm

- name: Build AppImage
# Best-effort: linuxdeploy + an AppImage-from-AppImage bootstrap can be
# finicky in CI. A failure here must not block the core deb/rpm/tarball
# artifacts, so this step is allowed to fail and its upload is lenient.
continue-on-error: true
shell: bash
run: |
set -e
Expand All @@ -171,7 +179,22 @@ jobs:
mkdir -p appimage/AppDir/usr/share/icons
cp target/release/rust_cat appimage/AppDir/usr/bin/
cp assets/rustcat.desktop appimage/AppDir/usr/share/applications/
cp assets/appIcon.ico appimage/AppDir/usr/share/icons/rustcat.ico

# linuxdeploy prefers a PNG icon; convert the multi-resolution ICO
# with whichever ImageMagick binary the runner ships (v7: magick,
# v6: convert). Fall back to the raw .ico if neither is present.
ICON_ARG=()
if command -v magick >/dev/null 2>&1; then
magick assets/appIcon.ico appimage/AppDir/usr/share/icons/rustcat.png
ICON_ARG=(--icon-file appimage/AppDir/usr/share/icons/rustcat.png)
elif command -v convert >/dev/null 2>&1; then
convert assets/appIcon.ico appimage/AppDir/usr/share/icons/rustcat.png
ICON_ARG=(--icon-file appimage/AppDir/usr/share/icons/rustcat.png)
else
cp assets/appIcon.ico appimage/AppDir/usr/share/icons/rustcat.ico
ICON_ARG=(--icon-file appimage/AppDir/usr/share/icons/rustcat.ico)
fi

# AppImage desktop entry must point to the binary inside the AppDir
sed -i 's|^Exec=.*|Exec=rust_cat|' appimage/AppDir/usr/share/applications/rustcat.desktop

Expand All @@ -180,9 +203,14 @@ jobs:
export OUTPUT=RustCat-${VERSION}-${ARCH}.AppImage
wget -qO linuxdeploy https://github.com/linuxdeploy/linuxdeploy/releases/latest/download/linuxdeploy-${ARCH}.AppImage
chmod +x linuxdeploy
# Some runners can't run nested AppImages directly; fall back to
# extracting and running via the AppRun wrapper if FUSE is unavailable.
if ! ./linuxdeploy --version >/dev/null 2>&1; then
export APPIMAGE_EXTRACT_AND_RUN=1
fi
./linuxdeploy --appdir appimage/AppDir \
--desktop-file appimage/AppDir/usr/share/applications/rustcat.desktop \
--icon-file appimage/AppDir/usr/share/icons/rustcat.ico \
"${ICON_ARG[@]}" \
--output appimage
mv appimage/*.AppImage "${OUTPUT}"

Expand Down Expand Up @@ -216,11 +244,12 @@ jobs:
if-no-files-found: error

- name: Upload Linux AppImage
if: always()
uses: actions/upload-artifact@v4
with:
name: RustCat-x86_64.AppImage
path: RustCat-*.AppImage
if-no-files-found: error
if-no-files-found: ignore

- name: Publish Linux release
uses: softprops/action-gh-release@v1
Expand Down
8 changes: 7 additions & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,9 +90,15 @@ name = "rustcat"
license = "Apache-2.0"
summary = "Animated tray cat whose speed tracks CPU usage"
description = "RustCat displays an animated cat or parrot tray icon whose animation speed reflects real-time CPU usage. Integrates with KDE Plasma via the StatusNotifierItem D-Bus protocol."
recommends = ["kdialog", "plasma-systemmonitor"]
assets = [
{ source = "target/release/rust_cat", dest = "/usr/bin/rust_cat", mode = "755" },
{ source = "assets/rustcat.desktop", dest = "/usr/share/applications/rustcat.desktop", mode = "644" },
{ source = "assets/appIcon.ico", dest = "/usr/share/pixmaps/rustcat.ico", mode = "644" },
]

# Dependency fields in cargo-generate-rpm use a table section (not inline
# arrays), per the 0.21 docs. Each key is a package, each value a version
# constraint ("*" = any). These are soft runtime hints.
[package.metadata.generate-rpm.recommends]
kdialog = "*"
plasma-systemmonitor = "*"
Loading