Open Config File works and every item is audited; Adwaita settings; shadow fix; onboarding extensions; arm64; cargo-deny; pinned actions

.github/actions/vm-host/action.yml

@@ -84,7 +84,7 @@ runs:
         # "stability is not yet established".
         sudo df -h /var/lib/containers/storage | tail -1
 
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version: '1.26'
 

.github/dependabot.yml

@@ -0,0 +1,20 @@
+# Keeps the SHA-pinned actions current. Every third-party `uses:` is pinned to a
+# commit with its version in a trailing comment; Dependabot moves both together.
+#
+# Cargo is deliberately not here: every Cargo.lock change has to regenerate
+# packaging/flatpak/cargo-sources.json (flatpak.yaml checks it), which
+# Dependabot cannot do. tuna-os/.github stays on @main by design, and
+# Dependabot leaves branch refs alone.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/*
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: ci

.github/workflows/api-release.yml

@@ -27,12 +27,12 @@ jobs:
       run:
         working-directory: ./src/typescript/api
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ inputs.tag }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org

.github/workflows/cachix.yaml

@@ -42,14 +42,14 @@ jobs:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
     steps:
-    - uses: actions/checkout@v4
-    - uses: cachix/install-nix-action@v31
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
     - name: Cache Nix Evaluation
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ~/.cache/nix
         key: nix-eval-${{ hashFiles('flake.lock') }}
-    - uses: cachix/cachix-action@v14
+    - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
       with:
         name: vicinae
         authToken: ${{ github.ref == 'refs/heads/main' && secrets.CACHIX_AUTH_TOKEN || '' }}

.github/workflows/cargo-deny.yaml

@@ -0,0 +1,49 @@
+# cargo-deny against deny.toml: RustSec advisories, licences, duplicate
+# versions and where crates may come from.
+#
+# Advisories are a separate leg because they change without any change here:
+# a crate published years ago can gain an advisory tonight. On a pull request
+# that leg reports without blocking, so an unrelated change is not held up by
+# news about a dependency it did not touch; on main and on the daily schedule it
+# fails, which is where somebody has to act on it. The other checks only change
+# when Cargo.lock or deny.toml does, so they always gate.
+name: cargo-deny
+
+on:
+  push:
+    branches: [main]
+    paths: &paths
+      - Cargo.lock
+      - "**/Cargo.toml"
+      - deny.toml
+      - .github/workflows/cargo-deny.yaml
+  pull_request:
+    paths: *paths
+  schedule:
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  deny:
+    name: cargo-deny (${{ matrix.checks }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        checks:
+          - advisories
+          - bans licenses sources
+    continue-on-error: ${{ matrix.checks == 'advisories' && github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with:
+          command: check ${{ matrix.checks }}

.github/workflows/corpus-harvest.yaml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Ordered cheap-first, deliberately. The unknown here is whether the
       # repoquery below names packages at all; if the syntax is wrong this step
@@ -125,7 +125,7 @@ jobs:
           echo "harvested $(find harvested -name "*.desktop" | wc -l) entries"
 
       - name: Publish for review
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: desktop-corpus
           path: harvested

.github/workflows/flatpak.yaml

@@ -26,6 +26,14 @@ on:
   # The VM tier calls this workflow so that "how the Flatpak is built" has one
   # definition. The bundle it uploads is what gets layered into the test image.
   workflow_call:
+    inputs:
+      archs:
+        description: >-
+          JSON array of the architectures to build. The callers (VM tier,
+          Suite 1, tier 2) test on x86_64 runners only, so they need only that
+          bundle and do not wait for an aarch64 build.
+        type: string
+        default: '["x86_64"]'
 
 # The literal prefix matters. `github.workflow` in a *called* workflow is the
 # CALLER's name, so without it this group would be identical to the VM tier's
@@ -54,7 +62,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Regenerate and compare
         run: |
@@ -66,13 +74,30 @@ jobs:
           fi
           echo "cargo-sources.json matches Cargo.lock"
 
+  # One leg per architecture, each on a native runner (#246). No QEMU: the
+  # build is a full release compile, and every step after it -- doctor, Suite
+  # 5, Spike B -- runs the binary, so each architecture is tested on its own
+  # hardware with the same steps. Pushes, pull requests and manual runs build
+  # both, so publish-flatpak.yaml always finds both bundles; a caller through
+  # workflow_call gets the `archs` it asks for, x86_64 by default.
+  #
+  # x86_64 keeps the artifact names it always had (flatpak-bundle and so on),
+  # which the VM tier, Suite 1 and tier 2 download by name; other
+  # architectures add `-<arch>`.
   build:
-    runs-on: ubuntu-24.04
+    name: build (${{ matrix.arch }})
+    runs-on: ${{ matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
     # The freedesktop SDK plus the Rust extension is a large download and the build
     # is a full release compile of the workspace. Generous, but bounded.
     timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: ${{ fromJSON(inputs.archs || '["x86_64", "aarch64"]') }}
+    env:
+      ARTIFACT_SUFFIX: ${{ matrix.arch != 'x86_64' && format('-{0}', matrix.arch) || '' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install flatpak and flatpak-builder
         run: |
@@ -94,11 +119,11 @@ jobs:
       # See --reinstall and the commit assertion below, which are what make the
       # cache safe to keep.
       - name: Cache the runtime
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.local/share/flatpak
-          key: flatpak-runtime-${{ runner.os }}-${{ hashFiles('packaging/flatpak/org.tunaos.compass.yaml') }}
-          restore-keys: flatpak-runtime-${{ runner.os }}-
+          key: flatpak-runtime-${{ runner.os }}-${{ matrix.arch }}-${{ hashFiles('packaging/flatpak/org.tunaos.compass.yaml') }}
+          restore-keys: flatpak-runtime-${{ runner.os }}-${{ matrix.arch }}-
 
       - name: Install the runtime and SDK
         run: |
@@ -125,6 +150,13 @@ jobs:
           flatpak run --user --command=sh --devel org.freedesktop.Sdk//26.08 \
             -c 'PATH=/usr/lib/sdk/rust-stable/bin:$PATH rustc --version' || echo "could not query"
 
+      # The bundle is JavaScript, the same on every architecture, but npm runs
+      # on the runner, and the arm64 image need not carry the Node the x86_64
+      # one does. 22 is the major the manifest ships (node22).
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
       # The manifest installs this from the source tree, because the offline
       # build cannot run npm. Same script as the Rust workflow's
       # extension-runtime job.
@@ -227,9 +259,9 @@ jobs:
 
       - name: Upload the Spike B report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: spike-b-flatpak
+          name: spike-b-flatpak${{ env.ARTIFACT_SUFFIX }}
           path: /tmp/spike-b.*
           retention-days: 14
           if-no-files-found: warn
@@ -246,18 +278,18 @@ jobs:
 
       - name: Upload the bundle
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: flatpak-bundle
+          name: flatpak-bundle${{ env.ARTIFACT_SUFFIX }}
           path: /tmp/org.tunaos.compass.flatpak
           retention-days: 14
           if-no-files-found: error
 
       - name: Upload the repo
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: flatpak-repo
+          name: flatpak-repo${{ env.ARTIFACT_SUFFIX }}
           path: /tmp/repo
           retention-days: 7
           if-no-files-found: warn

.github/workflows/format.yaml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Check TypeScript formatting
         working-directory: src/typescript

.github/workflows/head-to-head.yaml

@@ -28,8 +28,10 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
-      - uses: taiki-e/install-action@just
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+        with:
+          tool: just
       - name: Runner prerequisites
         run: |
           sudo apt-get update -qq
@@ -44,7 +46,7 @@ jobs:
           find target/head-to-head -name summary.md -exec cat {} + >> "$GITHUB_STEP_SUMMARY"
       - name: Preserve measurements and failure logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: upstream-head-to-head-${{ github.sha }}
           retention-days: 30

.github/workflows/nix-format.yaml

@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v25
+        uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
         with:
           nix_path: nixpkgs=channel:nixos-unstable
           extra_nix_config: |

.github/workflows/nix-support.yml

@@ -19,11 +19,11 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0
           fetch-tags: true
-      - uses: cachix/install-nix-action@v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
       - name: Check nix hashes
         run: |
           nix run --no-update-lock-file .#nix-update-script --extra-experimental-features nix-command flakes --accept-flake-config