chore: improve packaging reliability and code quality

.github/workflows/ci.yml

@@ -28,3 +28,35 @@ jobs:
           bun run test:app-flow
       - name: Build
         run: bun run build
+
+  rust:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Linux build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libgtk-3-dev \
+            librsvg2-dev \
+            libssl-dev \
+            libappindicator3-dev \
+            patchelf
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          workspaces: ./src-tauri -> target
+
+      - name: cargo check
+        working-directory: src-tauri
+        run: cargo check --all-targets
+
+      - name: cargo clippy
+        working-directory: src-tauri
+        run: cargo clippy --all-targets -- -D warnings

.github/workflows/release.yml

@@ -1,19 +1,30 @@
-name: Release Tauri App
+name: Release
 
 on:
   push:
     tags:
       - "v*"
+    branches:
+      - "build/**"
+  workflow_dispatch:
+    inputs:
+      prerelease:
+        description: "Publish as a prerelease"
+        type: boolean
+        default: true
 
 permissions:
   contents: write
 
 jobs:
   extract-notes:
-    runs-on: macos-latest
+    runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.notes.outputs.version }}
       payloadJson: ${{ steps.notes.outputs.payloadJson }}
+      isPrerelease: ${{ steps.meta.outputs.isPrerelease }}
+      releaseTag: ${{ steps.meta.outputs.releaseTag }}
+      releaseName: ${{ steps.meta.outputs.releaseName }}
     steps:
       - uses: actions/checkout@v4
 
@@ -23,48 +34,86 @@ jobs:
 
       - run: bun install --frozen-lockfile
 
+      - name: Resolve release version
+        id: version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            echo "version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+          else
+            VER=$(node -p "require('./package.json').version")
+            echo "version=v${VER}" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Extract release notes
         id: notes
         env:
-          RELEASE_VERSION: ${{ github.ref_name }}
+          RELEASE_VERSION: ${{ steps.version.outputs.version }}
         run: bun scripts/extract-release-note.mjs
 
+      - name: Release metadata
+        id: meta
+        shell: bash
+        env:
+          INPUT_PRERELEASE: ${{ github.event.inputs.prerelease }}
+          VERSION: ${{ steps.notes.outputs.version }}
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            echo "isPrerelease=false" >> "$GITHUB_OUTPUT"
+            echo "releaseTag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+            echo "releaseName=OpenSlides ${VERSION}" >> "$GITHUB_OUTPUT"
+          else
+            # Branch / manual builds never create a v* tag.
+            if [[ "${INPUT_PRERELEASE}" == "false" ]]; then
+              echo "isPrerelease=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "isPrerelease=true" >> "$GITHUB_OUTPUT"
+            fi
+            echo "releaseTag=build-${VERSION}-${GITHUB_RUN_NUMBER}" >> "$GITHUB_OUTPUT"
+            echo "releaseName=OpenSlides ${VERSION} (build ${GITHUB_RUN_NUMBER})" >> "$GITHUB_OUTPUT"
+          fi
+
   build-tauri:
     needs: extract-notes
     strategy:
       fail-fast: false
       matrix:
         include:
-          # ── macOS (universal binary) ──
-          - runner: macos-latest
-            args: --target universal-apple-darwin
-            rust_targets: aarch64-apple-darwin,x86_64-apple-darwin
-
-          # ── Windows ──
-          - runner: windows-latest
+          # ── macOS Apple Silicon ──
+          - platform: macos-latest
+            args: --target aarch64-apple-darwin
+            rust_targets: aarch64-apple-darwin
+
+          # ── macOS Intel ──
+          - platform: macos-latest
+            args: --target x86_64-apple-darwin
+            rust_targets: x86_64-apple-darwin
+
+          # ── Windows x64 ──
+          - platform: windows-latest
             args: ""
             rust_targets: ""
 
-          - runner: windows-latest
+          # ── Windows ARM64 ──
+          - platform: windows-latest
             args: --target aarch64-pc-windows-msvc
             rust_targets: aarch64-pc-windows-msvc
 
-          # ── Linux (x86_64) ──
-          - runner: ubuntu-22.04
+          # ── Linux x86_64 (deb, rpm, AppImage) ──
+          - platform: ubuntu-22.04
             args: ""
             rust_targets: ""
 
-    runs-on: ${{ matrix.runner }}
+    runs-on: ${{ matrix.platform }}
     steps:
       - uses: actions/checkout@v4
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
 
-      # ── Linux system dependencies ──
       - name: Install Linux dependencies
-        if: matrix.runner == 'ubuntu-22.04'
+        if: matrix.platform == 'ubuntu-22.04'
         run: |
           sudo apt-get update
           sudo apt-get install -y \
@@ -80,28 +129,84 @@ jobs:
             librsvg2-dev \
             patchelf
 
-      - uses: dtolnay/rust-toolchain@stable
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.rust_targets }}
 
-      - run: bun install --frozen-lockfile
+      - uses: swatinem/rust-cache@v2
+        with:
+          workspaces: ./src-tauri -> target
+          key: ${{ matrix.platform }}-${{ matrix.rust_targets }}-${{ matrix.args }}
+
+      - name: Install frontend dependencies
+        run: bun install --frozen-lockfile
 
       - name: Build, bundle, and attach release artifacts
         uses: tauri-apps/tauri-action@v0.6.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          tagName: ${{ github.ref_name }}
-          releaseName: OpenSlides ${{ needs.extract-notes.outputs.version }}
+          tagName: ${{ needs.extract-notes.outputs.releaseTag }}
+          releaseName: ${{ needs.extract-notes.outputs.releaseName }}
           releaseBody: ${{ fromJSON(needs.extract-notes.outputs.payloadJson).fullNotes }}
           releaseDraft: false
-          prerelease: false
+          prerelease: ${{ needs.extract-notes.outputs.isPrerelease }}
           args: ${{ matrix.args }}
           tauriScript: bun run tauri
 
+      # Strip the bundled libwayland-* libs from the AppImage so it loads the
+      # host copies at runtime. Ubuntu 22.04 ships older libwayland than recent
+      # Mesa needs; AppImage puts bundled libs first on the search path, so the
+      # stale copy wins and EGL can fail. Removing them redirects resolution to
+      # the host copy present on every GTK-capable system.
+      - name: Fix AppImage wayland libs
+        if: matrix.platform == 'ubuntu-22.04'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ needs.extract-notes.outputs.releaseTag }}
+        run: |
+          set -euo pipefail
+
+          APPIMAGE=$(ls src-tauri/target/release/bundle/appimage/*.AppImage | head -n1)
+          BASENAME=$(basename "$APPIMAGE")
+          echo "Patching: $APPIMAGE"
+
+          WORK=$(mktemp -d)
+          cp "$APPIMAGE" "$WORK/"
+          pushd "$WORK" >/dev/null
+          chmod +x "./$BASENAME"
+          "./$BASENAME" --appimage-extract >/dev/null
+
+          for lib in libwayland-client.so.0 libwayland-egl.so.1 libwayland-cursor.so.0; do
+            if [ -e "squashfs-root/usr/lib/$lib" ]; then
+              rm -f "squashfs-root/usr/lib/$lib"
+            fi
+          done
+          rm -f squashfs-root/usr/lib/libwayland-server.so.0 || true
+
+          curl -fsSL -o appimagetool.AppImage \
+            https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-x86_64.AppImage
+          chmod +x appimagetool.AppImage
+          ARCH=x86_64 ./appimagetool.AppImage --appimage-extract-and-run squashfs-root "$BASENAME"
+
+          rm -rf squashfs-root
+          chmod +x "./$BASENAME"
+          "./$BASENAME" --appimage-extract >/dev/null
+          test -x squashfs-root/usr/bin/openslides \
+            || test -x squashfs-root/usr/bin/OpenSlides \
+            || { echo "openslides binary missing from repacked AppImage"; ls -la squashfs-root/usr/bin/ || true; exit 1; }
+          popd >/dev/null
+
+          cp "$WORK/$BASENAME" "$APPIMAGE"
+
+          gh release upload "$RELEASE_TAG" "$APPIMAGE" \
+            --clobber --repo "$GITHUB_REPOSITORY"
+
   update-marketing-site:
     needs: [extract-notes, build-tauri]
-    runs-on: macos-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
     steps:
       - name: Send release notes to the marketing site
         uses: actions/github-script@v7

.github/workflows/update-nix-sources.yml

@@ -0,0 +1,87 @@
+name: Update Nix sources
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v1.2.2)"
+        required: true
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      # On a `release` event the default checkout lands on the tag (detached
+      # HEAD); create-pull-request needs a branch base, so check out main.
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+
+      - name: Normalize tag
+        id: tag
+        env:
+          RAW_TAG: ${{ github.event.release.tag_name || github.event.inputs.tag }}
+        run: |
+          case "$RAW_TAG" in
+            v*) TAG="$RAW_TAG" ;;
+            *) TAG="v$RAW_TAG" ;;
+          esac
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Download release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.tag.outputs.tag }}
+          VERSION: ${{ steps.tag.outputs.version }}
+        run: |
+          gh release download "$TAG" \
+            --repo codewiththiha/OpenSlides \
+            --pattern "OpenSlides_${VERSION}_amd64.deb" \
+            --pattern "OpenSlides_x64.app.tar.gz" \
+            --pattern "OpenSlides_aarch64.app.tar.gz"
+
+      - name: Compute SRI hashes
+        id: hashes
+        env:
+          VERSION: ${{ steps.tag.outputs.version }}
+        run: |
+          hash_sri() {
+            openssl dgst -sha256 -binary "$1" | base64 | tr -d '\n'
+          }
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "linux=sha256-$(hash_sri "OpenSlides_${VERSION}_amd64.deb")" >> "$GITHUB_OUTPUT"
+          echo "x64-darwin=sha256-$(hash_sri "OpenSlides_x64.app.tar.gz")" >> "$GITHUB_OUTPUT"
+          echo "aarch64-darwin=sha256-$(hash_sri "OpenSlides_aarch64.app.tar.gz")" >> "$GITHUB_OUTPUT"
+
+      - name: Update nix/sources.json
+        run: |
+          cat > nix/sources.json <<- EOF
+          {
+            "version": "${{ steps.hashes.outputs.version }}",
+            "hashes": {
+              "x86_64-linux": "${{ steps.hashes.outputs.linux }}",
+              "x86_64-darwin": "${{ steps.hashes.outputs.x64-darwin }}",
+              "aarch64-darwin": "${{ steps.hashes.outputs.aarch64-darwin }}"
+            }
+          }
+          EOF
+
+      - name: Create PR
+        uses: peter-evans/create-pull-request@v7
+        with:
+          commit-message: "chore: update nix sources to ${{ steps.hashes.outputs.version }}"
+          title: "nix: update sources to ${{ steps.hashes.outputs.version }}"
+          body: "Automated update of `nix/sources.json` for release ${{ steps.tag.outputs.tag }}."
+          base: main
+          # Only commit the manifest; the downloaded release assets sit in the
+          # work tree and must not be committed.
+          add-paths: nix/sources.json
+          branch: update-nix-sources/${{ steps.hashes.outputs.version }}
+          delete-branch: true