Skip to content

✨ feat: F-Droid publishing readiness#4

Merged
vitofico merged 11 commits into
mainfrom
feat/fdroid-publishing
May 8, 2026
Merged

✨ feat: F-Droid publishing readiness#4
vitofico merged 11 commits into
mainfrom
feat/fdroid-publishing

Conversation

@vitofico
Copy link
Copy Markdown
Owner

@vitofico vitofico commented May 8, 2026

Summary

  • Tag-driven version derivation (buildSrc/Version.kt) replacing CI env vars — F-Droid can now reproduce a build from a tag.
  • CI workflow drops BUILD_DATE / GITHUB_RUN_NUMBER injection; reads git describe instead. Both checkout steps now use fetch-depth: 0 so tags propagate.
  • featureGraphic.png (1024×500) for the F-Droid listing.
  • Changelog filename aligned with the actual versionCode of v2026.05.08.30 (26050830.txt).
  • CONTRIBUTING.md now documents :wrench: chore: and :construction: (already used in history).
  • docs/release.md documents the local reproducibility check (fdroid build --server + content-diff).

Out of scope (deferred)

  • Tablet screenshots — listing accepts phone-only.
  • R8 / minify — separate follow-up issue planned.
  • fdroiddata MR — submitted off-repo after this merges and a fresh tag is cut.

Test plan

  • scripts/dgradle :buildSrc:test — 8 tests pass
  • scripts/dgradle :app:assembleDebug — APK builds; manifest reports the tag-derived versionCode/versionName
  • scripts/dgradle test — full suite passes
  • CI green on the PR
  • Visual: confirm featureGraphic.png renders correctly

🤖 Generated with Claude Code

vitofico and others added 11 commits May 8, 2026 11:56
Covers version-derivation rewrite (git describe-driven), fdroiddata
recipe + local verification, and the polish items needed for a clean
F-Droid listing (changelog, featureGraphic, tablet screenshots,
CONTRIBUTING tweak, repro-build doc, R8 follow-up issue).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Twelve tasks covering: buildSrc Version parser (TDD), wiring into
app/build.gradle.kts, CI workflow update, changelog rename, CONTRIBUTING
gitmoji update, tablet screenshots, featureGraphic, release.md repro
section, PR creation, and the off-repo fdroiddata MR + R8 follow-up issue.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1024x500 PNG, paper-tone background (#F2EBDD), icon left-thirds,
"Quire" wordmark and tagline in Helvetica. Generated with ImageMagick.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
actions/checkout@v4 with fetch-depth: 0 alone does not pull tags;
needs fetch-tags: true. The previous shell-step `git fetch --tags`
was apparently failing silently, so the build's gitDescribe() got
just a SHA and Version.fromGitDescribe rejected it.

Also fail-fast in the Compute version step if no v* tag is reachable,
instead of letting Gradle hit the same error 30s later.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@vitofico vitofico merged commit 1be0321 into main May 8, 2026
5 checks passed
@vitofico vitofico deleted the feat/fdroid-publishing branch May 8, 2026 11:42
vitofico added a commit that referenced this pull request May 8, 2026
…adle

PR #4 broke the release workflow: Gradle's tag-driven version derivation
expects an exact-match tag at HEAD, but on main there isn't one until
the release job creates it. Result: git describe returned the post-tag
dev format (e.g. v2026.05.08.30-1-g1be0321) and the release action used
that string verbatim as the new tag and Release name.

Fix: split the Compute version step. On refs/heads/main, compute a fresh
CalVer from date + GITHUB_RUN_NUMBER and `git tag` HEAD locally so
Gradle's git-describe finds an exact match. The release job then pushes
this tag when creating the GitHub Release. PR / feature-branch builds
keep using `git describe` for artifact-naming purposes.

The bad tag/release v2026.05.08.30-1-g1be0321 has been deleted.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
vitofico added a commit that referenced this pull request May 8, 2026
- Tag-driven version derivation in buildSrc/Version.kt (8 unit tests, TDD)
  replaces env-var-injected CalVer; F-Droid can now reproduce a build
  from a tag.
- CI workflow drops BUILD_DATE / GITHUB_RUN_NUMBER injection; uses
  fetch-tags: true on actions/checkout so git describe works.
- featureGraphic.png (1024x500) for the F-Droid listing.
- Changelog renamed to 26050830.txt to match v2026.05.08.30 versionCode.
- CONTRIBUTING.md documents 🔧 chore: and 🚧.
- docs/release.md documents the local fdroid build --server repro check.

Closes #5 (R8 follow-up tracked separately).
vitofico added a commit that referenced this pull request May 8, 2026
…adle

PR #4 broke the release workflow: Gradle's tag-driven version derivation
expects an exact-match tag at HEAD, but on main there isn't one until
the release job creates it. Result: git describe returned the post-tag
dev format (e.g. v2026.05.08.30-1-g1be0321) and the release action used
that string verbatim as the new tag and Release name.

Fix: split the Compute version step. On refs/heads/main, compute a fresh
CalVer from date + GITHUB_RUN_NUMBER and `git tag` HEAD locally so
Gradle's git-describe finds an exact match. The release job then pushes
this tag when creating the GitHub Release. PR / feature-branch builds
keep using `git describe` for artifact-naming purposes.

The bad tag/release v2026.05.08.30-1-g1be0321 has been deleted.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
vitofico added a commit that referenced this pull request May 8, 2026
- Tag-driven version derivation in buildSrc/Version.kt (8 unit tests, TDD)
  replaces env-var-injected CalVer; F-Droid can now reproduce a build
  from a tag.
- CI workflow drops BUILD_DATE / GITHUB_RUN_NUMBER injection; uses
  fetch-tags: true on actions/checkout so git describe works.
- featureGraphic.png (1024x500) for the F-Droid listing.
- Changelog renamed to 26050830.txt to match v2026.05.08.30 versionCode.
- CONTRIBUTING.md documents 🔧 chore: and 🚧.
- docs/release.md documents the local fdroid build --server repro check.

Closes #5 (R8 follow-up tracked separately).
vitofico added a commit that referenced this pull request May 8, 2026
…adle

PR #4 broke the release workflow: Gradle's tag-driven version derivation
expects an exact-match tag at HEAD, but on main there isn't one until
the release job creates it. Result: git describe returned the post-tag
dev format (e.g. v2026.05.08.30-1-g1be0321) and the release action used
that string verbatim as the new tag and Release name.

Fix: split the Compute version step. On refs/heads/main, compute a fresh
CalVer from date + GITHUB_RUN_NUMBER and `git tag` HEAD locally so
Gradle's git-describe finds an exact match. The release job then pushes
this tag when creating the GitHub Release. PR / feature-branch builds
keep using `git describe` for artifact-naming purposes.

The bad tag/release v2026.05.08.30-1-g1be0321 has been deleted.
vitofico added a commit that referenced this pull request May 8, 2026
Post-PR #4 follow-up that consolidates several CI / build fixes into one
squashed commit:

- **JDK 17 → 21** across all module build files, both CI workflows, and
  the Docker base image. Matches F-Droid's buildserver and removes the
  Kotlin/Java JVM-target mismatch we hit on first submission.
- **Main-branch CalVer tagging in CI** — the build job now computes a
  fresh \`vYYYY.MM.DD.<run>\` tag locally before Gradle runs so its
  git-describe finds an exact match. Previously the release action
  tagged with the literal git-describe output (\`v2026.05.08.30-1-g1be0321\`).
- **Release job version pass-through** — release runner gets a fresh
  checkout with no local tag, so feed the build job's computed version
  in via \`QUIRE_VERSION_FALLBACK\`.
- **CodeQL fallback** — same fallback for the analyze workflow, plus
  \`fetch-tags: true\` on its checkout.
- **Disable AGP 8.3+ VCS-info embedding** in the release buildType so
  F-Droid's reproducible-build verification has a chance.
vitofico added a commit that referenced this pull request May 20, 2026
* ✨ feat(server): add env-prefix back-compat helper

Centralize QUIRE_SERVER_* / OPDS_SYNC_* precedence logic per coordinator
§3.9. New prefix wins; legacy prefix triggers a one-shot WARNING per
process per key. Per Lock #21, only os.environ is consulted (dotenv
source not routed through the helper).

Helper lives under the still-current opds_sync package; subsequent commit
renames the package to quire_server and the helper moves with it.

* ✨ feat(server): wire Settings to dual-prefix env source

Replace the default env source with LegacyEnvSettingsSource so each field
is resolved from QUIRE_SERVER_* with one-cycle fallback to OPDS_SYNC_*.
The dotenv source still uses env_prefix="QUIRE_SERVER_" (Lock #21).

Switch test_settings primary cases to the new prefix and keep one
back-compat test; add test_settings_env_compat covering precedence,
WARNING emission, and complex-field (ai_token_secrets) round-trip under
both prefixes.

* ✨ feat(server): migrate.py reads QUIRE_SERVER_* with legacy fallback

main() now resolves PROGRESS_ENABLED / AI_ENABLED through
resolve_env_prefix_value, so deployments can use either prefix during the
one-cycle back-compat window. Adds test_migrate_env_compat covering both
prefixes plus the both-set tiebreaker.

* 🔨 refactor(server): rename Python package opds_sync -> quire_server

Mechanical commit:
- git mv server/opds_sync -> server/quire_server
- Rewrite every import (server source, tests, scripts/migrate, alembic env)
- Switch test setenv calls from OPDS_SYNC_* to QUIRE_SERVER_*
  (legacy prefix still honored via _env_compat; one defensive
  back-compat case retained in test_settings)
- Add tests/unit/test_no_stale_opds_sync_imports.py for fast local
  feedback if a stale import slips through

DB role / DB name / volume name 'opds_sync' are a deliberate non-rename
per Lock #20; the alembic.ini sqlalchemy.url default and the config.py
database_url default explicitly preserve 'opds_sync' as the DB name.

* 🔨 refactor(server): rename packaging/runtime metadata to quire-server

- pyproject.toml: project name + setuptools include + marker descriptions
- Dockerfile: OCI labels + entrypoint comment refers to QUIRE_SERVER_*
- docker-compose.yml / docker-compose.full.yml: service name and image
  switch to quire-server; env vars promoted to QUIRE_SERVER_* with
  ${QUIRE_SERVER_X:-${OPDS_SYNC_X:-default}} fallbacks so the back-compat
  window also covers operators who pass values through Compose
- caddy/Caddyfile: upstream renamed to quire-server:8000
- .env.example: every key prefixed QUIRE_SERVER_*; banner explains Lock
  #21 dotenv limitation

The DB role / DB name / Postgres volume (postgres user/db 'opds_sync',
volume 'opds_sync_pg') stay unchanged per Lock #20; alembic.ini and
config.py preserve the same DB name in their defaults.

* ✨ ci(server): dual-publish image and add rename-guard step

server-ci.yaml:
- Mode matrix env vars renamed to QUIRE_SERVER_*
- Image build now produces both ghcr.io/.../quire-server and the legacy
  ghcr.io/.../opds-sync tags from the same digest, so operators have a
  one-cycle window to repin
- Trivy scan targets the new image name
- Adds a rename-guard regex (catches both opds-sync / opds_sync as
  standalone tokens and OPDS_SYNC_<X> env vars) with an explicit
  self-test fixture before it runs
- Allowlist matches Lock #20 plus three defensive entries
  (env-compat tests + tests/conftest.py + import-graph regression test)

android-ci.yaml:
- Mirrors the same self-test + rename-guard step. The server CI is
  path-filtered to server/**, so a stale legacy reference added in an
  Android-side commit would slip past server-ci entirely (Required #5).

* 📝 docs(server): rename opds-sync references and document migration

- Rename Python module / image / service references across docs/,
  README.md (active prose, with the historical sentence preserved per
  the Lock #20 allowlist note), CONTRIBUTING.md, SECURITY.md, NOTICE,
  fastlane Play Store copy, and Android KDocs that point at
  server-side files.
- server/README.md gains a 'Migration from opds-sync' section covering
  the dual-prefix env helper, the dual-published image tag, and the
  deliberate DB-name non-rename. Also adds the five previously-omitted
  env vars (CWA_PROBE_PATH / CWA_PROBE_TIMEOUT_S / AUTH_CACHE_MAX_ENTRIES
  / AUTH_CACHE_POSITIVE_TTL_S already present) and an
  AI_PROMPT_VERSION row documenting the Lock #19 sentinel.
- docs/release.md gains the 'Post-release cluster operator checklist'
  paragraph pointing at the operational ticket flow (Lock #4); the
  Quire repo does not modify any cluster manifests.
- Update the rename-guard allowlist (server-ci + android-ci) to cover
  docs/release.md, docs/development.md, server/quire_server/config.py
  (DB-name preservation) and server/migrations/env.py (same).
- Server-source docstrings, error messages, User-Agent strings, and the
  FastAPI title swap to QUIRE_SERVER_* / quire-server. Token-mode
  validation error messages now reference QUIRE_SERVER_AI_*; the unit
  tests assert on the suffix (AI_TOKEN_SECRETS / _ISSUER / _AUDIENCE)
  so they remain agnostic to the prefix change.

* 💚 ci: install ripgrep before the rename-guard step

GitHub-hosted ubuntu-latest runners do not ship with ripgrep by default,
so both the server-ci 'full' matrix cell and the android-ci 'build' job
failed with 'rg: command not found' on the self-test step. Install via
apt before the guard runs.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant