refactor(linux): finish remediation steps 56 to 66

.github/workflows/linux-packages.yml

@@ -0,0 +1,181 @@
+name: Linux packages
+
+# Builds the .deb and the .rpm from the release source tarballs, each in a
+# fresh container that installs only the build dependencies the package
+# declares, then installs each package in another fresh container with only
+# its runtime dependencies and starts it. release-linux.yml calls this
+# workflow and publishes what it builds.
+
+on:
+  pull_request:
+    paths:
+      - "linux/build-aux/debian/**"
+      - "linux/build-aux/rpm/**"
+      - "linux/build-aux/packaging/**"
+      - "linux/meson.build"
+      - "linux/meson_options.txt"
+      - "linux/crates/app/meson.build"
+      - "linux/data/meson.build"
+      - "linux/po/meson.build"
+      - "linux/rust-toolchain.toml"
+      - ".github/workflows/linux-packages.yml"
+  push:
+    branches: [linux]
+    paths:
+      - "linux/build-aux/debian/**"
+      - "linux/build-aux/rpm/**"
+      - "linux/build-aux/packaging/**"
+      - "linux/meson.build"
+      - "linux/meson_options.txt"
+      - "linux/crates/app/meson.build"
+      - "linux/data/meson.build"
+      - "linux/po/meson.build"
+      - "linux/rust-toolchain.toml"
+      - ".github/workflows/linux-packages.yml"
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      deb-runners:
+        description: JSON list of runners; one .deb is built per runner architecture.
+        type: string
+        default: '["ubuntu-24.04"]'
+
+permissions:
+  contents: read
+
+jobs:
+  sources:
+    name: Source tarballs
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    container:
+      image: ubuntu:26.04
+    steps:
+      # Before the checkout: without git, actions/checkout downloads a
+      # tarball, which leaves no .git for meson dist to archive.
+      - name: Install git
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends ca-certificates git
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Make the source and vendor tarballs
+        run: linux/build-aux/packaging/make-sources.sh --install-deps _packages/sources
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-sources
+          path: _packages/sources
+          if-no-files-found: error
+
+  deb:
+    name: Debian package (${{ matrix.runner }})
+    needs: sources
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: ${{ fromJSON(inputs.deb-runners || '["ubuntu-24.04"]') }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 300
+    container:
+      image: ubuntu:26.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: linux-sources
+          path: _packages/sources
+      - name: Build, test and lint the package
+        run: |
+          dist="$(find _packages/sources -name 'tablepro-*.tar.xz' ! -name '*-vendor.tar.xz')"
+          vendor="$(find _packages/sources -name 'tablepro-*-vendor.tar.xz')"
+          linux/build-aux/packaging/build-deb.sh "$dist" "$vendor" _packages/deb
+      - name: Keep the Meson test log
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-deb-testlog-${{ runner.arch }}
+          path: _packages/deb/testlog.txt
+          if-no-files-found: ignore
+          retention-days: 7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-deb-${{ runner.arch }}
+          path: _packages/deb
+          if-no-files-found: error
+
+  deb-install:
+    name: Install the Debian package (${{ matrix.runner }})
+    needs: deb
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: ${{ fromJSON(inputs.deb-runners || '["ubuntu-24.04"]') }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    container:
+      image: ubuntu:26.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: linux-deb-${{ runner.arch }}
+          path: _packages/deb
+      - name: Install, start and validate
+        run: linux/build-aux/packaging/smoke-test.sh "$(find _packages/deb -name 'tablepro_*.deb')"
+
+  rpm:
+    name: RPM package
+    needs: sources
+    runs-on: ubuntu-24.04
+    timeout-minutes: 300
+    container:
+      image: fedora:44
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: linux-sources
+          path: _packages/sources
+      - name: Build, test and lint the package
+        run: |
+          dist="$(find _packages/sources -name 'tablepro-*.tar.xz' ! -name '*-vendor.tar.xz')"
+          vendor="$(find _packages/sources -name 'tablepro-*-vendor.tar.xz')"
+          linux/build-aux/packaging/build-rpm.sh "$dist" "$vendor" _packages/rpm
+      - name: Keep the Meson test log
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-rpm-testlog
+          path: _packages/rpm/testlog.txt
+          if-no-files-found: ignore
+          retention-days: 7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-rpm
+          path: _packages/rpm
+          if-no-files-found: error
+
+  rpm-install:
+    name: Install the RPM package
+    needs: rpm
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    container:
+      image: fedora:44
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: linux-rpm
+          path: _packages/rpm
+      - name: Install, start and validate
+        run: linux/build-aux/packaging/smoke-test.sh "$(find _packages/rpm -name 'tablepro-[0-9]*.rpm' ! -name '*.src.rpm')"

.github/workflows/release-linux.yml

@@ -0,0 +1,111 @@
+name: Release Linux
+
+# A linux-vX.Y.Z tag publishes the Linux release: the source and vendor
+# tarballs and the .deb for Ubuntu 26.04 on GitHub Releases, and the .rpm
+# for Fedora 44 through COPR. Flathub's own repository picks the new source
+# tarball up from the release.
+#
+# Secret COPR_CONFIG: the API token file copr-cli reads (~/.config/copr).
+# Variable LINUX_COPR_PROJECT: the COPR project, as owner/project.
+
+on:
+  push:
+    tags: ["linux-v*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-linux-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Tag, version and release notes
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    container:
+      image: ubuntu:26.04
+    steps:
+      - name: Install git and meson
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends ca-certificates git meson python3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: The tag, metainfo, spec and changelog name one version
+        working-directory: linux
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          version="$(meson introspect --projectinfo meson.build \
+            | python3 -c 'import json, sys; print(json.load(sys.stdin)["version"])')"
+          tag_date="$(TZ=UTC git log -1 --date=format-local:%Y-%m-%d --format=%cd)"
+          python3 build-aux/packaging/check_packaging.py --source-root . \
+            --version "$version" --tag "$TAG" --tag-date "$tag_date"
+
+  packages:
+    name: Packages
+    needs: verify
+    uses: ./.github/workflows/linux-packages.yml
+    with:
+      deb-runners: '["ubuntu-24.04", "ubuntu-24.04-arm"]'
+
+  copr:
+    name: COPR build for Fedora 44
+    needs: packages
+    runs-on: ubuntu-24.04
+    timeout-minutes: 300
+    container:
+      image: fedora:44
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: linux-rpm
+          path: rpm
+      - name: Build the source RPM in COPR
+        env:
+          COPR_CONFIG: ${{ secrets.COPR_CONFIG }}
+          COPR_PROJECT: ${{ vars.LINUX_COPR_PROJECT }}
+        run: |
+          if [ -z "$COPR_CONFIG" ] || [ -z "$COPR_PROJECT" ]; then
+            echo "::error::Set the COPR_CONFIG secret and the LINUX_COPR_PROJECT variable to publish the RPM"
+            exit 1
+          fi
+          dnf install -y --setopt=install_weak_deps=False copr-cli
+          mkdir -p "$HOME/.config"
+          printf '%s\n' "$COPR_CONFIG" > "$HOME/.config/copr"
+          copr-cli build "$COPR_PROJECT" "$(find rpm -name '*.src.rpm')" \
+            --chroot fedora-44-x86_64 --chroot fedora-44-aarch64
+
+  github-release:
+    name: GitHub release
+    needs: packages
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: linux-*
+          path: artifacts
+      - name: Publish the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          version="${TAG#linux-v}"
+          mkdir release
+          find artifacts -type f \( -name '*.tar.xz' -o -name 'tablepro_*.deb' -o -name 'tablepro-dbgsym_*.ddeb' \) \
+            -exec cp {} release/ \;
+          (cd release && sha256sum -- * > SHA256SUMS)
+          python3 linux/build-aux/packaging/check_packaging.py --source-root linux \
+            --version "$version" --tag "$TAG" --notes notes.md
+          gh release create "$TAG" release/* --repo "$GITHUB_REPOSITORY" --verify-tag \
+            --title "TablePro for Linux $version" --notes-file notes.md

linux/.gitignore

@@ -1,4 +1,5 @@
 target/
+_packages/
 *.swp
 .DS_Store
 

linux/AGENTS.md

@@ -56,8 +56,14 @@ From the repository root, through the verification wrapper, which keeps the full
 
 `.github/workflows/build-linux.yml` runs on a pull request that touches `linux/`:
 
-- **Fast checks**: format, both clippy runs, build, every Meson suite, the Secret Service tests, `meson dist`.
-- **Translations**: the POT template, with gettext 0.24.
-- **Third-party licenses**: reruns `build-aux/update-third-party-licenses.sh` and fails when `data/licenses` differs from what it writes, or when a crate has no license file cargo-about can read.
+- **Fast checks**: format, both clippy runs, build, every Meson suite, the Secret Service tests, `meson dist`, then the release-shaped Flatpak manifest rendered from the dist tarball.
+- **Supply chain**: `cargo deny check` against `deny.toml`, `cargo shear`, and `build-aux/update-third-party-licenses.sh`, failing when `data/licenses`, `build-aux/debian/copyright` or the spec's `License` tag differ from what it writes; then zizmor over the Linux workflows.
+- **Translations**: in `fedora:44` (gettext 0.26), `po/POTFILES.in` and `po/tablepro.pot` must match what the tree generates. A change to a user-facing string regenerates the template in the same commit.
+- **Documentation links**: lychee, offline, over the Markdown under `linux/`.
+- **Flatpak Devel** (x86_64 and aarch64) and **Flatpak release shape**: the Devel manifest with every Meson suite in the sandbox, and the shape Flathub builds, offline from the dist tarball, linted with `build-aux/flatpak/lint-exceptions.json`.
 - **Docker tests** (`integration`): one matrix job per package on the host runner, for the PostgreSQL, MySQL, SQL Server and ClickHouse drivers, `tablepro-ssh` and `tablepro-test-fixtures`.
 - **Docker tests (tablepro-session)** (`integration-session`) and **Docker tests (tablepro)** (`integration-app`): in the fast job's `ubuntu:26.04` image with the host's Docker socket, because the session crate links GLib 2.88 and the app GTK 4.22, which the host runner lacks. The app job runs only its named test targets, since the `startup` test needs Meson.
+
+`docs/testing.md` describes each job. Every action is pinned by commit SHA; a new one is too.
+
+`.github/workflows/linux-packages.yml` runs on a pull request that touches the packaging (`build-aux/debian`, `build-aux/rpm`, `build-aux/packaging`, the Meson files): it builds the source and vendor tarballs, the .deb in `ubuntu:26.04` and the .rpm in `fedora:44`, each with lintian or rpmlint, then installs and starts each in a fresh container. `release-linux.yml` calls it on a `linux-v*` tag and publishes the result (ADR 0017).