Report the real port status, and fix the desktop-port defects it was hiding

.github/workflows/linux-build-run.yml

@@ -149,7 +149,7 @@ jobs:
             cmake ninja-build pkg-config unzip xvfb fonts-dejavu-core \
             libgtk-3-dev libcairo2-dev libpango1.0-dev libgdk-pixbuf-2.0-dev libglib2.0-dev \
             libfontconfig1-dev libfreetype-dev \
-            libcurl4-openssl-dev \
+            libcurl4-openssl-dev libssl-dev \
             libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev gstreamer1.0-plugins-base gstreamer1.0-plugins-good \
             libwebkit2gtk-4.1-dev libsecret-1-dev libnotify-dev libgeoclue-2-dev \
             libepoxy-dev libegl1-mesa-dev libgles2-mesa-dev libgl1-mesa-dri
@@ -219,6 +219,18 @@ jobs:
           # Full app stdout/stderr -- the only evidence when the suite wedges
           # mid-run (uploaded with the screenshot artifact below).
           CN1_APP_LOG_TEE: ${{ github.workspace }}/artifacts/linux-port/raw/app-output.log
+          # Wait for the suite's own completion marker instead of stopping when
+          # screenshots go quiet. The stabilization exit fired while DesktopMode,
+          # the VideoIO grid, the VR scene and the 360 panorama were still queued
+          # behind the slow non-rendering API tail, so the suite was force-killed
+          # and every trailing test was published as "never run".
+          #
+          # This is read with Boolean.parseBoolean, which answers false for '1',
+          # so the gate it describes has never actually been armed -- the suite
+          # could be force-killed with trailing tests unrun and nothing failed.
+          # The Windows pipeline passes a real boolean, which is why its gate
+          # works. 'true' arms it here.
+          CN1_REQUIRE_SUITE: 'true'
           # Build the native ELF (and the demo) against an old glibc for portability.
           CN1_CC: /usr/local/bin/cn1-zig-cc
           # After the suite runs, the capture test relinks the same objects into a
@@ -238,6 +250,12 @@ jobs:
           # Enable core dumps and post-mortem them into the artifact.
           ulimit -c unlimited
           echo '/tmp/cn1-cores/core.%e.%p' | sudo tee /proc/sys/kernel/core_pattern >/dev/null
+          # Let the harness attach gdb to the still-running suite when it gives up
+          # waiting. Ubuntu ships yama ptrace_scope=1, which restricts attaching to
+          # descendants, and the harness is a sibling of the app -- so without this
+          # the hang dump comes back "Could not attach to process" and a hang (as
+          # opposed to a crash, which leaves a core) yields no evidence at all.
+          echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope >/dev/null 2>&1 || true
           mkdir -p /tmp/cn1-cores
           rc=0
           mvn -B clean package -pl JavaAPI -am -DskipTests
@@ -320,12 +338,13 @@ jobs:
             -v "$GITHUB_WORKSPACE":/cn1 -w /cn1 \
             -e CN1_SHOT_OUTPUT_DIR=/cn1/artifacts/linux-port/raw-musl \
             -e CN1_APP_LOG_TEE=/cn1/artifacts/linux-port/raw-musl/app-output.log \
+            -e CN1_REQUIRE_SUITE=true \
             -e LIBGL_ALWAYS_SOFTWARE=1 \
             docker.io/library/alpine:3.20 sh -ec '
               sed -i "s|^#\(.*/community\)|\1|" /etc/apk/repositories
               apk add --no-cache build-base cmake samurai pkgconf bash git openjdk8 openjdk17 maven \
                 gtk+3.0-dev cairo-dev pango-dev gdk-pixbuf-dev glib-dev fontconfig-dev freetype-dev \
-                curl-dev libepoxy-dev mesa-dev mesa-gles mesa-egl mesa-gbm mesa-dri-gallium \
+                curl-dev openssl-dev libepoxy-dev mesa-dev mesa-gles mesa-egl mesa-gbm mesa-dri-gallium \
                 webkit2gtk-4.1-dev gstreamer-dev gst-plugins-base-dev \
                 libsecret-dev libnotify-dev geoclue-dev xvfb ttf-dejavu
               # JDK 8 runs the translator/maven; JDK 17 is needed to compile the
@@ -362,7 +381,16 @@ jobs:
   compare-comment:
     name: screenshot-comment
     needs: build-run
-    if: github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    # !cancelled() rather than a plain event check: without it GitHub skips this
+    # job whenever a build-run leg fails, and skipping it is precisely the wrong
+    # response to a failing suite. Normalization is what publishes the fail /
+    # not-run counts, so being skipped leaves the public table showing the last
+    # green report -- a failure masked as a pass. The workflow still goes red
+    # because build-run itself failed; this only keeps the reporting honest.
+    if: >-
+      !cancelled() &&
+      (github.event_name == 'pull_request' || github.event_name == 'push' ||
+      github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -415,6 +443,13 @@ jobs:
           # Gate the Linux port (both arches): fail on any mismatch/error or a new
           # screenshot that has no committed golden (missing_expected).
           export CN1SS_FAIL_ON_MISMATCH=1
+          # A test that fails an assertion, or never runs at all, has to fail
+          # this workflow the way it already does on iOS, JavaScript and Mac.
+          # Without it a suite that stopped early published its trailing tests
+          # as "never run" and the job stayed green -- a result that reads as
+          # success while hiding both the tests that failed and the fact that
+          # they stopped running.
+          export CN1SS_FAIL_ON_TEST_PROBLEMS=1
           export CN1SS_ALLOWED_MISSING=0
           if [ "${{ github.event_name }}" != "pull_request" ]; then export CN1SS_SKIP_COMMENT=1; fi
           for arch in x64 arm64; do
@@ -425,7 +460,20 @@ jobs:
               [ -f "$f" ] || continue
               entries+=("$(basename "$f" .png)=$f")
             done
-            [ ${#entries[@]} -eq 0 ] && continue
+            if [ ${#entries[@]} -eq 0 ]; then
+              # A leg that crashed or timed out before its first PNG still uploads
+              # app-output.log, and that log is precisely what normalization reads to
+              # produce the fail / not-run counts. Skipping the arch outright meant the
+              # run that most needed reporting produced none, so the table went on
+              # serving the previous -- green -- report. Carry on with an empty entry
+              # list when there is a log to read; only a leg that produced nothing at
+              # all has nothing to say.
+              if [ ! -f "$raw/app-output.log" ]; then
+                echo "[linux-gtk-$arch] no screenshots and no app log; nothing to normalize"
+                continue
+              fi
+              echo "[linux-gtk-$arch] no screenshots captured; normalizing from the app log so the failure reaches the table"
+            fi
             if [ "$arch" = "arm64" ]; then REF="scripts/linux/screenshots-arm"; else REF="scripts/linux/screenshots"; fi
             echo "Posting ${#entries[@]} screenshot(s) for $arch (baseline $REF)"
             mkdir -p "$ART/previews-$arch"
@@ -441,7 +489,7 @@ jobs:
               "Native Linux port ($arch)" \
               "$ART/compare-$arch.json" "$ART/summary-$arch.txt" "$ART/comment-$arch.md" \
               "$(pwd)/$REF" "$ART/previews-$arch" "$ART" \
-              "${entries[@]}"
+              ${entries[@]+"${entries[@]}"}
             gate_rc=$?
             set -e
             if [ "$gate_rc" -ne 0 ]; then

.github/workflows/port-status-nightly.yml

@@ -11,6 +11,24 @@ permissions:
   contents: write
 
 jobs:
+  # port-status-publish.yml only publishes a report when a workflow_run event
+  # reaches it, and those events never arrive for some producers -- the Linux
+  # and Windows suites had not landed a single report, so the public table
+  # served their checked-in fallback until it aged out and the columns rendered
+  # as unknown. This sweep publishes from the newest master run of every
+  # producing workflow and fails when a port has no report inside the
+  # contract's staleness window.
+  publish-latest-port-reports:
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v6
+      - name: Publish the newest master report for every port
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: scripts/hellocodenameone/conformance/backfill_port_status.sh
+
   build-javascript-app:
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -81,29 +99,47 @@ jobs:
           if-no-files-found: error
 
   publish-browser-evidence:
-    if: always() && needs.build-javascript-app.result == 'success'
-    needs: [build-javascript-app, browser-lifecycle]
+    # Ordered after the report sweep (and tolerant of it failing) so the site
+    # rebuild at the end of this job picks up everything published tonight.
+    # Runs whatever happened upstream. The browser-evidence steps still need the
+    # JavaScript build, and stay gated on it -- but the site rebuild at the end is
+    # the only thing in this workflow that dispatches website-docs.yml, and gating
+    # the whole job meant a failed JS build left every report the sweep had just
+    # published sitting on the data branch, absent from the public table until
+    # some later deployment. The two concerns are now separated.
+    if: always()
+    needs: [build-javascript-app, browser-lifecycle, publish-latest-port-reports]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
       - uses: actions/download-artifact@v4
+        if: needs.build-javascript-app.result == 'success'
         with:
           pattern: browser-evidence-*
           path: artifacts/browser-evidence
       - name: Assemble static browser evidence
+        if: needs.build-javascript-app.result == 'success'
         run: node scripts/website/collect_browser_evidence.mjs artifacts/browser-evidence artifacts/port-status-environment.json
       - uses: actions/upload-artifact@v4
+        if: needs.build-javascript-app.result == 'success'
         with:
           name: port-status-environment
           path: artifacts/port-status-environment.json
           retention-days: 30
       - name: Publish master evidence to the data branch
-        if: github.ref == 'refs/heads/master'
+        if: needs.build-javascript-app.result == 'success' && github.ref == 'refs/heads/master'
         env:
           GH_TOKEN: ${{ github.token }}
         run: scripts/hellocodenameone/conformance/publish_port_status_environment.sh artifacts/port-status-environment.json
       - name: Rebuild the static website snapshot
-        if: github.ref == 'refs/heads/master'
+        # Deliberately not gated on the JavaScript build, nor on the evidence
+        # steps above it: the reports published tonight reach the public table
+        # only through this dispatch. Without always() the step inherits the
+        # implicit success() requirement, so a failure while downloading,
+        # assembling, uploading or publishing the browser evidence left the
+        # sweep's freshly published reports off the public snapshot until some
+        # later deployment happened to rebuild it.
+        if: always() && github.ref == 'refs/heads/master'
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh workflow run website-docs.yml --ref master -f deploy_production=true

.github/workflows/port-status-publish.yml

@@ -18,8 +18,18 @@ permissions:
 
 jobs:
   publish:
+    # A FAILED producer's report is the one that matters most: the strict gate
+    # fails the workflow precisely when a test failed or never ran, so demanding
+    # conclusion == 'success' here published only the good news. The Linux
+    # producer can run for 90 minutes from 01:45 while the nightly sweep
+    # snapshots completed runs at 02:35, so a failure finishing after that
+    # snapshot left the previous GREEN report public for a further day. Publish
+    # whatever normalized artifacts a completed run uploaded and let the
+    # acceptance gate judge them; cancelled runs are excluded because a
+    # superseded run's evidence is not current.
     if: >-
-      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.conclusion != 'cancelled' &&
+      github.event.workflow_run.conclusion != 'skipped' &&
       (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule') &&
       github.event.workflow_run.head_branch == 'master'
     runs-on: ubuntu-latest
@@ -41,6 +51,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           PORT_STATUS_PUBLISH: '1'
+          WORKFLOW_CONCLUSION: ${{ github.event.workflow_run.conclusion }}
         run: |
           set -euo pipefail
           found=0
@@ -49,8 +60,16 @@ jobs:
             ./scripts/hellocodenameone/conformance/publish_port_status.sh "$report"
           done < <(find reports -type f -name 'port-status-*.json' | sort)
           if [ "$found" -eq 0 ]; then
-            echo "No normalized port reports were found in workflow artifacts." >&2
-            exit 1
+            # A producer that died before normalization uploads nothing. That is
+            # a real defect for a successful run, but an expected outcome for a
+            # failed one -- the job may have crashed before the normalize step --
+            # and failing here would turn every such run into a second red X
+            # that says nothing the producer's own failure did not already say.
+            if [ "${WORKFLOW_CONCLUSION}" = "success" ]; then
+              echo "No normalized port reports were found in workflow artifacts." >&2
+              exit 1
+            fi
+            echo "No normalized reports from a ${WORKFLOW_CONCLUSION} run; nothing to publish."
           fi
 
       - name: Rebuild the static Port Status snapshot

.github/workflows/pr.yml

@@ -598,14 +598,14 @@ jobs:
         if: matrix.java-version == 8
         run: zip -j result.zip CodenameOne/javadocs.zip CodenameOne/dist/CodenameOne.jar CodenameOne/updatedLibs.zip Ports/JavaSE/dist/JavaSE.jar build/CodenameOneDist/CodenameOne/demos/CodenameOne_SRC.zip
 
-      - name: Copying Files to Server
+      # Handed to a separate job rather than deployed here. See deploy-dist.
+      - name: Upload the distribution bundle
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && matrix.java-version == 8 }}
-        uses: marcodallasanta/ssh-scp-deploy@v1.0.5
+        uses: actions/upload-artifact@v7
         with:
-          host: ${{ secrets.WP_HOST }}
-          user: ${{ secrets.WP_USER }}
-          password: ${{ secrets.WP_PASSWORD }}
-          local: result.zip
+          name: result.zip
+          path: result.zip
+          retention-days: 1
 
       - name: Upload a Build Artifact
         if: matrix.java-version == 8
@@ -614,3 +614,31 @@ jobs:
           name: JavaSE.jar
           path: Ports/JavaSE/dist/JavaSE.jar
 
+
+  deploy-dist:
+    # Gated at the JOB level, deliberately, and this is not a style preference.
+    # A Docker-based action is BUILT during job setup, before any step's `if` is
+    # evaluated -- so while this deploy step was inside build-test it made every
+    # matrix leg, including the Java 17 and 21 legs that could never satisfy its
+    # condition, pull alpine:latest from Docker Hub to build an action they were
+    # never going to run. A Docker Hub timeout then failed a pull-request job for
+    # a deploy that was not happening: exactly what killed build-test (17) with
+    # "failed to resolve source metadata for docker.io/library/alpine:latest"
+    # after three retries. A job-level condition skips setup entirely, so on a
+    # pull request the image is never fetched.
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+    needs: build-test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download the distribution bundle
+        uses: actions/download-artifact@v7
+        with:
+          name: result.zip
+
+      - name: Copying Files to Server
+        uses: marcodallasanta/ssh-scp-deploy@v1.0.5
+        with:
+          host: ${{ secrets.WP_HOST }}
+          user: ${{ secrets.WP_USER }}
+          password: ${{ secrets.WP_PASSWORD }}
+          local: result.zip

.github/workflows/scripts-ios.yml

@@ -104,6 +104,11 @@ jobs:
 
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
+      # The device runner reports logical test failures through CN1SS log
+      # markers, not through the build or the screenshot comparison. Make the
+      # normalized report authoritative so a failing or never-run compliance
+      # test cannot leave this workflow green and then be published from master.
+      CN1SS_FAIL_ON_TEST_PROBLEMS: '1'
       GH_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
       # Optional: when set, build-ios-app.sh writes it as a bundled resource so
       # the GoogleWebMap screenshot test renders a live Google map; absent (e.g.
@@ -297,6 +302,11 @@ jobs:
 
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
+      # The device runner reports logical test failures through CN1SS log
+      # markers, not through the build or the screenshot comparison. Make the
+      # normalized report authoritative so a failing or never-run compliance
+      # test cannot leave this workflow green and then be published from master.
+      CN1SS_FAIL_ON_TEST_PROBLEMS: '1'
       GH_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
       # Optional: when set, build-ios-app.sh writes it as a bundled resource so
       # the GoogleWebMap screenshot test renders a live Google map; absent (e.g.
@@ -578,6 +588,11 @@ jobs:
 
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
+      # The device runner reports logical test failures through CN1SS log
+      # markers, not through the build or the screenshot comparison. Make the
+      # normalized report authoritative so a failing or never-run compliance
+      # test cannot leave this workflow green and then be published from master.
+      CN1SS_FAIL_ON_TEST_PROBLEMS: '1'
       GH_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
       # Optional: when set, build-ios-app.sh writes it as a bundled resource so
       # the GoogleWebMap screenshot test renders a live Google map; absent (e.g.
@@ -745,6 +760,11 @@ jobs:
 
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
+      # The device runner reports logical test failures through CN1SS log
+      # markers, not through the build or the screenshot comparison. Make the
+      # normalized report authoritative so a failing or never-run compliance
+      # test cannot leave this workflow green and then be published from master.
+      CN1SS_FAIL_ON_TEST_PROBLEMS: '1'
       GH_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
 
     steps:

.github/workflows/scripts-javascript.yml

@@ -77,6 +77,11 @@ jobs:
     runs-on: ubuntu-latest
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
+      # The device runner reports logical test failures through CN1SS log
+      # markers, not through the build or the screenshot comparison. Make the
+      # normalized report authoritative so a failing or never-run compliance
+      # test cannot leave this workflow green and then be published from master.
+      CN1SS_FAIL_ON_TEST_PROBLEMS: '1'
       GH_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
       ARTIFACTS_DIR: ${{ github.workspace }}/artifacts/javascript-ui-tests
       # CN1_JS_TIMEOUT_SECONDS guards the per-suite SUITE:FINISHED wait.

.github/workflows/scripts-mac-native.yml

@@ -93,6 +93,11 @@ jobs:
 
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
+      # The device runner reports logical test failures through CN1SS log
+      # markers, not through the build or the screenshot comparison. Make the
+      # normalized report authoritative so a failing or never-run compliance
+      # test cannot leave this workflow green and then be published from master.
+      CN1SS_FAIL_ON_TEST_PROBLEMS: '1'
       GH_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
       # Optional: when set, build-mac-native-app.sh writes it as a bundled
       # resource so the GoogleWebMap screenshot test renders a live Google map;