Phases 5 to 14: ink, pages, tables, search, audio, math, import, intelligence, hardening, release

.gitattributes

@@ -3,3 +3,5 @@
 *.jpg binary
 *.ico binary
 *.woff2 binary
+# Files saved by Word and Excel, kept byte for byte.
+crates/interop/tests/data/legacy/* binary

.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
   # caller's event, so a release run is a push here and runs CHECKS on all files.
   workflow_call:
 
+# Every action is pinned to a full commit SHA, with the version in a comment. The release workflow runs these jobs
+# in the same run as its build and signing, so they could upload artifacts to it. workflow.test.ts checks the pins.
+#
 # Every job only reads the repository. A called workflow can narrow the caller's permissions but never widen
 # them, so the release workflow's own read-only grant for this call still works. Uploading the debug build
 # as a run artifact uses the runner's own token, not GITHUB_TOKEN, so no job needs more than this.
@@ -25,16 +28,21 @@ jobs:
     # Normally 1 to 3 minutes. A run that passes its limit is stuck, so it ends and says so.
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
       - name: Install tools
         run: npm ci
+      # The PDF tests print Japanese words and check every character reaches the PDF's text layer. Windows has a
+      # Japanese font; Ubuntu runners have none, so Chrome draws empty boxes that carry no text.
+      - name: Install a Japanese font (Ubuntu)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update -q && sudo apt-get install -y -q --no-install-recommends fonts-noto-cjk
       - name: Design tokens are up to date
         run: npm run tokens:check
       - name: Type-check, lint, and format-check
@@ -44,8 +52,8 @@ jobs:
       - name: CHECKS on changed files (pull requests)
         if: github.event_name == 'pull_request'
         run: node checks/cli.ts --base origin/${{ github.base_ref }}
-      - name: CHECKS on all files (pushes)
-        if: github.event_name == 'push'
+      - name: CHECKS on all files (pushes and release dry runs)
+        if: github.event_name != 'pull_request'
         run: node checks/cli.ts --all
 
   components:
@@ -58,10 +66,10 @@ jobs:
     # Normally under 2 minutes.
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -72,7 +80,7 @@ jobs:
       - name: Keep the failure screenshots
         # Vitest saves a screenshot of the page for each failed test.
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: component-failures-${{ matrix.os }}
           path: app/.vitest/attachments
@@ -85,10 +93,10 @@ jobs:
     # Normally about 5 minutes.
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -119,7 +127,7 @@ jobs:
         run: npx playwright test --config tests/ui/playwright.config.ts
       - name: Keep the Playwright report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: playwright-report
           path: |
@@ -134,10 +142,10 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -147,29 +155,57 @@ jobs:
         run: npm run perf:typing
       - name: Keep the numbers
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: perf-typing
           path: tests/perf/typing/results
           retention-days: 30
 
+  native-engines:
+    # whisper.cpp, ONNX Runtime, and the language model program need CMake, a C++ compiler, and libclang, so the other
+    # jobs leave them out. This one builds and tests them on Windows, where the release builds them.
+    runs-on: windows-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
+        with:
+          toolchain: stable
+          components: clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: Clippy
+        env:
+          LIBCLANG_PATH: C:\Program Files\LLVM\bin
+        run: |
+          cargo clippy -p opennote-intel-engines --all-targets --features whisper-cpp,onnx -- -D warnings
+          cargo clippy -p opennote-llm --all-targets --features llama -- -D warnings
+      - name: Tests
+        env:
+          LIBCLANG_PATH: C:\Program Files\LLVM\bin
+        run: |
+          cargo test -p opennote-intel-engines --features whisper-cpp,onnx
+          cargo test -p opennote-llm --features llama
+
   windows-app:
     # Rust checks and a test build of the desktop app on Windows, the first target platform.
     runs-on: windows-latest
     # Normally about 11 minutes with a cold cache.
     timeout-minutes: 35
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
         with:
+          toolchain: stable
           components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Install tools
         run: npm ci
       - name: Build the interface (the Rust app embeds it)
@@ -178,8 +214,18 @@ jobs:
         run: cargo fmt --all -- --check
       - name: Clippy
         run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: Clippy ratchet (no new unwrap, expect, or panic in shipped code)
+        # Existing uses are counted per file in checks/data/clippy-ratchet.json. A count may go down, never up.
+        run: node checks/clippy-ratchet.ts
       - name: Rust tests
         run: cargo test --workspace
+      - name: The notes contract suite against the app's notes bridge and the core
+        # The suite runs the notes harness example over stdin and stdout.
+        shell: bash
+        run: |
+          cargo build -p opennote --example notes_harness
+          export OPENNOTE_NOTES_HARNESS="$PWD/target/debug/examples/notes_harness.exe"
+          npx vitest run --config app/vitest.config.ts --project unit app/src/services/notes/core
       - name: Core lints and tests with every feature
         run: |
           cargo clippy -p opennote-core --all-targets --all-features -- -D warnings
@@ -193,7 +239,7 @@ jobs:
       - name: Test build of the app (ci profile, with the test endpoints the E2E tests use)
         run: npx tauri build --no-bundle --features test-endpoints -- --profile ci
       - name: Keep the test build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: opennote-e2e-exe
           path: target/ci/opennote.exe
@@ -207,28 +253,30 @@ jobs:
     # session holds the runner for GitHub's six-hour default.
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
+        with:
+          toolchain: stable
       - name: Install tools
         run: npm ci
       - name: Cache tauri-driver
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cargo/bin/tauri-driver.exe
           key: tauri-driver-2.1.0-${{ runner.os }}-${{ runner.arch }}
       - name: Cache msedgedriver
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: tests/e2e/.drivers
           key: msedgedriver-${{ runner.os }}-${{ runner.arch }}-${{ github.run_id }}
           restore-keys: msedgedriver-${{ runner.os }}-${{ runner.arch }}-
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: opennote-e2e-exe
           path: target/e2e
@@ -252,7 +300,7 @@ jobs:
       - name: Keep the E2E logs
         # A step that times out is canceled, not failed, and its logs are the ones worth reading.
         if: failure() || cancelled()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: e2e-logs
           path: tests/e2e/logs
@@ -264,23 +312,33 @@ jobs:
     # Normally about 10 minutes with a cold cache.
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
         with:
+          toolchain: stable
           components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Clippy for the core, the kill harness, and the benchmarks
         run: >-
           cargo clippy -p opennote-core -p opennote-crashtest -p opennote-perf
           --all-targets --all-features -- -D warnings
       - name: Core tests with every feature
         run: cargo test -p opennote-core --all-features
+      - name: Print crate tests, with stand-in lp and lpstat scripts
+        run: cargo test -p opennote-print
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
+        with:
+          tool: cargo-deny
+      - name: Licenses of every crate the build uses
+        run: cargo deny check licenses
       - name: Benchmark harness tests
         run: cargo test -p opennote-perf
       - name: Fuzz targets compile
-        run: cargo check --manifest-path crates/core/fuzz/Cargo.toml
+        run: |
+          cargo check --manifest-path crates/core/fuzz/Cargo.toml
+          cargo check --manifest-path crates/interop/fuzz/Cargo.toml
       - name: No work package stubs are left (pull requests into main)
         if: github.event_name == 'pull_request' && github.base_ref == 'main'
         run: |
@@ -295,15 +353,17 @@ jobs:
     # Normally about 5 minutes with a cold cache.
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Install tools
         run: npm ci
       - name: Rust fixture tests
@@ -317,10 +377,10 @@ jobs:
     # Normally under 1 minute.
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.x'
       - name: Reference reader tests

.github/workflows/crosscheck.yml

@@ -0,0 +1,66 @@
+name: crosscheck
+
+# A second opinion on OpenNote's exports and table formulas, from independent readers. They are built from pinned
+# revisions of open-source projects (tests/crosscheck/pins.json).
+#   - wordcraft-cli reads DOCX.
+#   - gridcraft-cli reads XLSX and evaluates formulas.
+#   - deckcraft-cli reads PPTX.
+#   - pdfcraft-cli reads PDF, with its accessibility check and PDF/A preflight.
+#
+# This job never blocks a merge. Those projects are alpha software and not ground truth, so a difference means
+# "look" and shows up as a warning. Nothing from them ships with OpenNote. See docs/CHECKS.md, "Cross-checks".
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '41 3 * * 1'
+  pull_request:
+    paths:
+      - 'crates/interop/src/export/**'
+      - 'crates/interop/src/docx/**'
+      - 'app/src/features/pages/pdf/**'
+      - 'app/src/features/tables/engine/**'
+      - 'tests/crosscheck/**'
+      - '.github/workflows/crosscheck.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  crosscheck:
+    runs-on: ubuntu-latest
+    # A failure of the job itself (a tool that did not build) must not turn a pull request red.
+    continue-on-error: true
+    # The first build of the four tools takes about 25 minutes. A run that passes the limit is stuck.
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: npm
+      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: Install tools
+        run: npm ci
+      - name: Build the cross-check tools from their pinned revisions
+        run: npm run crosscheck:install
+      - name: Make the corpus of exports
+        run: node tests/crosscheck/corpus.ts
+      - name: Check the exports with the other readers
+        run: node tests/crosscheck/run.ts --json crosscheck.json
+      - name: Compare table formulas with gridcraft-cli
+        run: npm run crosscheck:formulas
+      - name: Keep the corpus and the report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: crosscheck
+          path: |
+            tests/crosscheck/.corpus
+            crosscheck.json
+          if-no-files-found: ignore
+          retention-days: 14