From c2a6e3d113d36373a82bf7afe6c75150cc414363 Mon Sep 17 00:00:00 2001 From: NimBold Date: Wed, 26 Aug 2026 21:39:29 +0330 Subject: [PATCH] chore(deps): refresh packages and bundled engines - update Lucide and compatible transitive Rust locks - refresh Windows/Linux FFmpeg payloads with verified source hashes - verify macOS release checks against the mounted DMG artifact --- .github/workflows/release.yml | 14 ++++++++++++-- RELEASE.md | 18 ++++++++++++++++-- engine-sources.lock.json | 12 ++++++------ package-lock.json | 8 ++++---- package.json | 2 +- scripts/release-workflow.node-test.js | 8 ++++++++ src-tauri/Cargo.lock | 8 ++++---- 7 files changed, 51 insertions(+), 19 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3c4a722..8816efc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -140,11 +140,21 @@ jobs: - name: Verify macOS packaged engines and launch if: runner.os == 'macOS' run: | - APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app" + set -euo pipefail DMG="$(find src-tauri/target/${{ matrix.target }}/release/bundle/dmg -name '*.dmg' -print -quit)" test -n "$DMG" + npm run verify:macos-signing -- --dmg "$DMG" + MOUNT_POINT="$(mktemp -d "$RUNNER_TEMP/firelink-dmg-mount.XXXXXX")" + cleanup() { + hdiutil detach "$MOUNT_POINT" -quiet || hdiutil detach "$MOUNT_POINT" -force -quiet || true + rmdir "$MOUNT_POINT" 2>/dev/null || true + } + trap cleanup EXIT + hdiutil attach -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$DMG" >/dev/null + APP_COUNT="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' | wc -l | tr -d ' ')" + test "$APP_COUNT" -eq 1 + APP="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' -print -quit)" FIRELINK_MACOS_APP="$APP" node scripts/app-associations.node-test.js - npm run verify:macos-signing -- --app "$APP" --dmg "$DMG" node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }} ARIA2="$(find "$APP" -type f -name 'aria2c-${{ matrix.target }}' -print -quit)" test -n "$ARIA2" diff --git a/RELEASE.md b/RELEASE.md index bfc0055..422df74 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -50,10 +50,24 @@ cd .. npm run tauri build -- --target aarch64-apple-darwin --bundles dmg ``` -Verify packaged resources, then launch outside repository working directory: +Verify the DMG and the app it contains, then launch outside the repository +working directory. The DMG bundler removes the intermediate app directory, so +the post-build checks must use the mounted release artifact: ```bash -APP="src-tauri/target/aarch64-apple-darwin/release/bundle/macos/Firelink.app" +DMG="$(find src-tauri/target/aarch64-apple-darwin/release/bundle/dmg -name '*.dmg' -print -quit)" +test -n "$DMG" +npm run verify:macos-signing -- --dmg "$DMG" +MOUNT_POINT="$(mktemp -d -t firelink-dmg)" +cleanup() { + hdiutil detach "$MOUNT_POINT" -quiet || hdiutil detach "$MOUNT_POINT" -force -quiet || true + rmdir "$MOUNT_POINT" 2>/dev/null || true +} +trap cleanup EXIT +hdiutil attach -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$DMG" >/dev/null +APP_COUNT="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' | wc -l | tr -d ' ')" +test "$APP_COUNT" -eq 1 +APP="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' -print -quit)" node scripts/verify-binaries.js --search-root "$APP" --target aarch64-apple-darwin node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink" ``` diff --git a/engine-sources.lock.json b/engine-sources.lock.json index 9781a9a..a8ebee4 100644 --- a/engine-sources.lock.json +++ b/engine-sources.lock.json @@ -13,9 +13,9 @@ "sha256": "171efab55ac6b9881fd53ee4c20f8bf3bb1340ffc618483746909014db12216a" }, "ffmpeg": { - "version": "8.1.2-44-g7c533d0f86", - "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-23-13-03/ffmpeg-n8.1.2-44-g7c533d0f86-win64-gpl-8.1.zip", - "sha256": "40d98aef3e8d48665c4dbbdd0093d6e50c61d71a3a48067e9d3edd9fb3a1f3ca" + "version": "8.1.2-46-g139afe709a", + "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-26-13-06/ffmpeg-n8.1.2-46-g139afe709a-win64-gpl-8.1.zip", + "sha256": "f966bc2e843bcd680dedd6d1a2c0c895bab859a402c6dd107cbe72a796dfebcf" }, "aria2c": { "version": "1.37.0", @@ -35,9 +35,9 @@ "sha256": "8b010a3b1a4a0188a67cdb8a7a27348b2a501af78aec7fc74f2ace167368d530" }, "ffmpeg": { - "version": "8.1.2-44-g7c533d0f86", - "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-23-13-03/ffmpeg-n8.1.2-44-g7c533d0f86-linux64-gpl-8.1.tar.xz", - "sha256": "fb1f9326d203d038f249d5399efb34f4597836f54ad0bcffcc7040af25576493" + "version": "8.1.2-46-g139afe709a", + "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-26-13-06/ffmpeg-n8.1.2-46-g139afe709a-linux64-gpl-8.1.tar.xz", + "sha256": "0814f4491c2673ea505be8fb65a76c2bfabaa5aad8f33d49b1c5b87a2262e8c5" }, "aria2c": { "version": "1.37.0", diff --git a/package-lock.json b/package-lock.json index 963ee41..f66d16d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -25,7 +25,7 @@ "@tauri-apps/plugin-notification": "^2.3.3", "@tauri-apps/plugin-opener": "^2", "i18next": "^26.4.0", - "lucide-react": "^1.33.0", + "lucide-react": "^1.34.0", "react": "^19.2.8", "react-dom": "^19.2.8", "react-i18next": "^17.0.12", @@ -2122,9 +2122,9 @@ } }, "node_modules/lucide-react": { - "version": "1.33.0", - "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.33.0.tgz", - "integrity": "sha512-MTRwMy0ZlL8Ur/vOAiJ9XGHE+kFPC7brq6MxAm0GiGXEBj0qy0jA/pG4N675oSzciO/UCdX8T+5yUQdmDeTLxg==", + "version": "1.34.0", + "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.34.0.tgz", + "integrity": "sha512-vnjGJNI7Htk5+oWW8gXGuaLgwgAb0T6/iZbBrp9JCfRFwdNWZ0YTm3eyxjOLgwN6r8iyAf3UA70zNmBRBNv7yg==", "license": "ISC", "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" diff --git a/package.json b/package.json index 413f9b1..c80d591 100644 --- a/package.json +++ b/package.json @@ -60,7 +60,7 @@ "@tauri-apps/plugin-notification": "^2.3.3", "@tauri-apps/plugin-opener": "^2", "i18next": "^26.4.0", - "lucide-react": "^1.33.0", + "lucide-react": "^1.34.0", "react": "^19.2.8", "react-dom": "^19.2.8", "react-i18next": "^17.0.12", diff --git a/scripts/release-workflow.node-test.js b/scripts/release-workflow.node-test.js index ed02ef2..708fd78 100644 --- a/scripts/release-workflow.node-test.js +++ b/scripts/release-workflow.node-test.js @@ -15,3 +15,11 @@ test('release Linux dependency installation is mirror-normalized and bounded', ( assert.equal((releaseWorkflow.match(/timeout --foreground --signal=TERM --kill-after=30s 10m apt-get/g) || []).length, 2); assert.doesNotMatch(releaseWorkflow, /^\s*sudo apt-get (update|install)/m); }); + +test('macOS release verification uses the app mounted from the final DMG', () => { + assert.match(releaseWorkflow, /npm run verify:macos-signing -- --dmg "\$DMG"/); + assert.match(releaseWorkflow, /hdiutil attach -nobrowse -readonly -mountpoint "\$MOUNT_POINT" "\$DMG"/); + assert.match(releaseWorkflow, /find "\$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink\.app'/); + assert.match(releaseWorkflow, /node scripts\/verify-binaries\.js --search-root "\$APP"/); + assert.doesNotMatch(releaseWorkflow, /verify:macos-signing -- --app "\$APP" --dmg/); +}); diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 1cd5799..ecd0753 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -659,9 +659,9 @@ checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a" [[package]] name = "combine" -version = "4.6.7" +version = "4.6.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd" +checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e" dependencies = [ "bytes", "memchr", @@ -3278,9 +3278,9 @@ checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" [[package]] name = "open" -version = "5.4.1" +version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f9cfef937e9c486488c7e3d949ae31c0f1d06bdacd75b99c086cb35356e30408" +checksum = "ade3be4664bc1ef537ce133015f04c176b737815c2ba9fd60edf212d6e90dd55" dependencies = [ "dunce", "is-wsl",