v1.1.8

Install

Pick your platform on the website,
or take a file below. Every download is listed in SHA256SUMS.txt.

Already running it? It updates itself: open the window and choose Update now,
or run gcloud-dot upgrade.

What changed

winget manifests for 1.1.7

Stop gcloud-dot history panicking on a nonsense sample

It sorted the measured session lengths with partial_cmp().unwrap() to show
their range. partial_cmp is None for NaN, so one NaN anywhere in the list
took the whole command down.

Clock arithmetic should never produce one, but "should never" was doing all the
work in that sentence, and the samples live in a file on disk where anything
can reach them. total_cmp orders every float there is and cannot fail.

This was the only .unwrap() left in the workspace outside tests. There are
now none.

Put checking for updates in the menu, and make the worker obey it

check_for_updates was honoured by the app and reachable by nobody. It is the
one setting here that touches the network, so somebody who would rather this
app did not call GitHub once a day should be able to say so without being told
that a state file exists.

Adding the switch exposed a worse problem behind it. The checker was started at
launch when the setting was on, which meant turning it off left the running
thread checking and reporting, and turning it on and off again left a thread
behind each time. There is now one thread for the life of the process, reading
a flag the menu writes. Switched off it holds the next check due, so switching
back on asks straight away rather than serving out the rest of a day nobody was
counting.

Turning it off also clears any update already found, since continuing to offer
one is not what was asked for.

Document the settings that have no control in the app

Quiet hours, the warning thresholds, and the service account key age are all
read and acted on, and until now appeared in no menu and no document. The only
way to discover them was to read the source.

They are in the README with their defaults, alongside a note that the file has
to be edited while the app is stopped, since it writes its own copy back on the
next change.

A test keeps that table honest by reading the README and comparing it against
Settings::default(). Written after getting warn_at_minutes wrong in the
first draft of the very table it now checks.

Also adds gcloud-dot check, which the command table had never listed.

Write release notes from the commit messages

Every release so far published one line: a link to the compare view. GitHub
builds its generated notes from merged pull requests, and this repository is
pushed to directly, so there was nothing for it to find.

That matters more here than it would elsewhere, because the update banner in
the app offers "See what changed" and sends people to exactly that page. An
empty page is a promise the app makes and the release breaks.

The commit messages already say what changed and why, so they are the notes.
Nothing is written by hand twice. Every existing release has been backfilled.

Audit the dependency tree on every push

cargo audit now runs in CI and fails on a vulnerability. There are none. The
thirteen warnings it does report were being checked whenever somebody thought
to look, which is not a schedule.

SECURITY.md described the one unsound crate and none of the rest. It now
accounts for all thirteen and says where they come from: twelve are GTK 3
bindings reaching the tree through both tao and tray-icon, which each pin
gtk 0.18, so neither can be worked around by dropping the other. The
thirteenth is ttf-parser, by way of ab_glyph, which draws the countdown
into the tray icon and only ever parses fonts compiled into the binary.

Also takes wry 0.56.1.

1.1.8: no panics, a switch for update checks, and notes worth reading

Full changelog: v1.1.7...v1.1.8