Skip to content

build(flatpak): add CI build job, update metainfo, fix JVM heap for runners #653

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nitheeshdr wants to merge 3 commits into
base: main
Choose a base branch
from
Open

build(flatpak): add CI build job, update metainfo, fix JVM heap for runners #653

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7abfda4
build(flatpak): add CI job, update metainfo releases, reduce JVM heap
nitheeshdr May 20, 2026
68f2dc6
fix(flatpak): key builder cache on dependency content, not commit SHA
nitheeshdr May 20, 2026
7845c54
fix(flatpak): add permissions block and disable credential persistence
nitheeshdr May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 39 additions & 2 deletions .github/workflows/build-desktop-platforms.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -506,9 +506,38 @@ jobs:
retention-days: 30
compression-level: 0

build-flatpak:
runs-on: ubuntu-latest
permissions:
contents: read

steps:
- name: Checkout code
uses: actions/checkout@v4
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚖️ Poor tradeoff

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch commit SHAs for action version tags

echo "=== actions/checkout@v4 ==="
gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha'

echo "=== flatpak/flatpak-github-actions/flatpak-builder@v6 ==="
gh api repos/flatpak/flatpak-github-actions/git/refs/tags/flatpak-builder/v6 --jq '.object.sha' 2>/dev/null || \
  echo "Note: flatpak-builder may use a different ref structure; check manually"

echo "=== actions/upload-artifact@v4 ==="
gh api repos/actions/upload-artifact/git/refs/tags/v4 --jq '.object.sha'

Repository: OpenHub-Store/GitHub-Store

Length of output: 506

🏁 Script executed:

# Examine the workflow file around the mentioned lines
cat -n .github/workflows/build-desktop-platforms.yml | sed -n '125,135p'
cat -n .github/workflows/build-desktop-platforms.yml | sed -n '510,530p'

Repository: OpenHub-Store/GitHub-Store

Length of output: 1638

Pin action references to commit SHAs for supply chain security.

Actions at lines 514, 517, and 526 are referenced by mutable tags (@v4, @v6) instead of immutable commit SHAs. A compromised or force-pushed tag could inject malicious code. Pin to specific commit hashes as demonstrated by the SignPath action at line 131.

Update:

  • Line 514: actions/checkout@v4 → pin to specific commit SHA
  • Line 517: flatpak/flatpak-github-actions/flatpak-builder@v6 → pin to specific commit SHA
  • Line 526: actions/upload-artifact@v4 → pin to specific commit SHA
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 513-514: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 514-514: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-desktop-platforms.yml at line 514, Replace the
mutable action tags with immutable commit SHAs: locate the three uses entries
referencing actions/checkout@v4,
flatpak/flatpak-github-actions/flatpak-builder@v6, and
actions/upload-artifact@v4 and update each to the corresponding commit SHA (the
full 40-char commit hash) instead of the tag; follow the same pattern used for
the SignPath action (which is pinned to a commit SHA) to ensure supply-chain
security and reproducibility.

with:
persist-credentials: false

- name: Build Flatpak bundle
uses: flatpak/flatpak-github-actions/flatpak-builder@v6
with:
bundle: GitHub-Store-x86_64.flatpak
manifest-path: packaging/flatpak/zed.rainxch.githubstore.yml
run-tests: false
upload-artifact: false
cache-key: flatpak-builder-${{ hashFiles('packaging/flatpak/flatpak-sources.json', 'packaging/flatpak/zed.rainxch.githubstore.yml') }}

- name: Upload Flatpak bundle
uses: actions/upload-artifact@v4
with:
name: linux-flatpak
path: GitHub-Store-x86_64.flatpak
if-no-files-found: error
retention-days: 30
compression-level: 0
Comment thread
coderabbitai[bot] marked this conversation as resolved.

release:
name: Draft release with all installers
needs: [sign-windows, build-macos, build-linux]
needs: [sign-windows, build-macos, build-linux, build-flatpak]
runs-on: ubuntu-latest
permissions:
contents: write
Expand Down Expand Up @@ -572,6 +601,7 @@ jobs:
linux_debian12_count=0
linux_appimage_count=0
linux_arch_count=0
linux_flatpak_count=0

# Windows — names already unique (.exe, .msi). Files come from the
# signed artifact, not the raw build output, so they carry the
Expand Down Expand Up @@ -625,11 +655,17 @@ jobs:
stage "$f" "$(basename "$f")" && linux_arch_count=$((linux_arch_count + 1)) || true
done < <(find artifacts/linux-arch -type f -name '*.pkg.tar.zst' 2>/dev/null)

# Linux Flatpak bundle (.flatpak)
while IFS= read -r f; do
[ -n "$f" ] || continue
stage "$f" "$(basename "$f")" && linux_flatpak_count=$((linux_flatpak_count + 1)) || true
done < <(find artifacts/linux-flatpak -type f -name '*.flatpak' 2>/dev/null)

echo
echo "Final staged files:"
ls -la release-files/
echo
echo "Per-group counts: windows=$windows_count macos-x64=$macos_x64_count macos-arm64=$macos_arm64_count linux-modern=$linux_modern_count linux-debian12=$linux_debian12_count linux-appimage=$linux_appimage_count linux-arch=$linux_arch_count"
echo "Per-group counts: windows=$windows_count macos-x64=$macos_x64_count macos-arm64=$macos_arm64_count linux-modern=$linux_modern_count linux-debian12=$linux_debian12_count linux-appimage=$linux_appimage_count linux-arch=$linux_arch_count linux-flatpak=$linux_flatpak_count"

# Completeness guard: refuse to ship an incomplete release. Each
# group must produce >= 1 staged file. Without this guard, a build
Expand All @@ -644,6 +680,7 @@ jobs:
[ "$linux_debian12_count" -eq 0 ] && missing+=("Linux debian12-compat (.deb/.rpm)")
[ "$linux_appimage_count" -eq 0 ] && missing+=("Linux AppImage (.AppImage/.zsync)")
[ "$linux_arch_count" -eq 0 ] && missing+=("Linux Arch (.pkg.tar.zst)")
[ "$linux_flatpak_count" -eq 0 ] && missing+=("Linux Flatpak (.flatpak)")

if [ ${#missing[@]} -gt 0 ]; then
echo
Expand Down
29 changes: 29 additions & 0 deletions packaging/flatpak/zed.rainxch.githubstore.metainfo.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,35 @@
<content_rating type="oars-1.1"/>

<releases>
<release version="1.8.2" date="2026-05-13">
<description>
<p>Multi-OS release picker: download APKs from desktop and .debs from phone;
cross-platform downloads open in your browser. Adds "Hide seen repositories"
to declutter discovery feeds, content-width preference for desktop, and
AppImage distribution for Linux.</p>
</description>
</release>
<release version="1.8.1" date="2026-05-06">
<description>
<p>APK inspection: view signatures, permissions, and metadata before installing.
Background update-check toggle to save battery. Migration tooling for
switching between installer types.</p>
</description>
</release>
<release version="1.8.0" date="2026-04-30">
<description>
<p>Switched to a dedicated backend for improved reliability and faster response
times in throttled regions. Adds external import (paste a GitHub URL to add
a repository) and mirror picker for China users.</p>
</description>
</release>
<release version="1.7.0" date="2026-03-28">
<description>
<p>Tweaks overhaul: installer attribution, font and theme customisation, and
per-app update channels. Link Apps feature: associate any installed app with
its GitHub repository for one-tap updates.</p>
</description>
</release>
<release version="1.6.2" date="2026-03-18">
<description>
<p>Security improvements: package name and signing key validation on updates,
Expand Down
2 changes: 1 addition & 1 deletion packaging/flatpak/zed.rainxch.githubstore.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ modules:
- ./gradlew :composeApp:packageUberJarForCurrentOS
--no-daemon
--no-configuration-cache
-Dorg.gradle.jvmargs="-Xmx6g -XX:MaxMetaspaceSize=2g"
-Dorg.gradle.jvmargs="-Xmx4g -XX:MaxMetaspaceSize=1g"
-Dorg.gradle.parallel=false
# Install the JAR
- install -Dm644 "$(find composeApp/build/compose/jars/ -name '*.jar' -type f | head -1)"
Expand Down