feat(linux): beta channels, a signed Flatpak repository and packages on every GitHub release

.claude/rules/ci.md

@@ -32,7 +32,7 @@ paths:
 - The base is a PR's base SHA, or on a main push the head SHA of the last green CI push run on main. No such run, or a dispatch, runs everything. A dispatch never counts as main's last green run or for a tag.
 - Concurrency in `ci.yml`: a PR keeps its newest run, main pushes run one at a time and a newer pending run replaces the older, and each `release/**` commit and each dispatch has its own group. `linux-packages.yml` keeps a PR's newest run too; its other runs, a release's call included, each have their own group.
 - macOS Tests runs the Unit and UI plans in full, with no shard, parallel, iteration or retry flag.
-- A `v*` tag runs only `release.yml`, a `linux-v*` tag only `release-linux.yml`, a `windows-v*` tag only `release-windows.yml`, which also runs by dispatch and publishes nothing then (`windows/RELEASING.md`).
+- A `v*` tag runs only `release.yml`, a `linux-v*` tag only `release-linux.yml`, a `windows-v*` tag only `release-windows.yml`. The last two also run by dispatch: `release-windows.yml` then publishes nothing (`windows/RELEASING.md`), and `release-linux.yml` publishes nothing with `dry-run` and otherwise uploads a packaging fix (`linux/docs/releasing.md`).
 - `windows-grid-gate.yml` runs only by dispatch: the Windows data grid's timing and behavior gate on `windows-2025` and `windows-11-arm`, whose numbers vary too much between hosted runners to gate a merge (`windows/docs/decisions/0003-data-grid-control.md`, Gate). `windows.yml` runs the grid's tests on every change.
 
 ## Change detector

.github/workflows/linux-packages.yml

@@ -9,6 +9,14 @@ name: Linux packages
 # go into a fresh chroot, then the build runs there with no network, then
 # rpmlint. Each package is then installed in another fresh container of its
 # release with only its runtime dependencies and started.
+# release-matrix.json names the series and releases.
+# The Flatpak is built offline from the same tarballs with the release
+# manifest, with every Meson suite, on the nightly and when asked for. It is
+# signed with a throwaway key into repositories laid out as
+# flatpak.tablepro.app serves them, validated, then installed from a
+# .flatpakref and from a bundle, updated, and switched between the release
+# and beta branches, in fresh Ubuntu 22.04, 24.04 and 26.04 containers that
+# have only their own Flatpak.
 # release-linux.yml calls this workflow and uploads the source packages.
 # A run by hand can add arm64, which the nightly and pull requests leave out.
 # Given a release tag, it packages that release's tarballs instead, with
@@ -42,6 +50,10 @@ on:
         description: Also build, test and install the arm64 .deb and .rpm
         type: boolean
         default: false
+      flatpak:
+        description: Also build the Flatpak, and install and update it from a repository
+        type: boolean
+        default: false
   workflow_call:
     inputs:
       deb-runners:
@@ -60,6 +72,14 @@ on:
         description: The PPA upload number, the N in X.Y.Z-0ppaN.
         type: string
         default: "1"
+      flatpak:
+        description: Also build the Flatpak once per rpm-runners architecture, and install and update it from a repository.
+        type: boolean
+        default: false
+      flatpak-branch:
+        description: The Flatpak branch, stable or beta.
+        type: string
+        default: stable
 
 # A pull request keeps only its newest run; every other run, a release's call included, has its own group.
 concurrency:
@@ -70,6 +90,30 @@ permissions:
   contents: read
 
 jobs:
+  # The Ubuntu series and Fedora releases come from release-matrix.json, which
+  # release_assets.py checks a release's assets against.
+  matrix:
+    name: Release matrix
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      ubuntu-series: ${{ steps.read.outputs.ubuntu-series }}
+      fedora: ${{ steps.read.outputs.fedora }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Read release-matrix.json
+        id: read
+        run: |
+          python3 - >> "$GITHUB_OUTPUT" <<'EOF'
+          import json
+          with open("linux/build-aux/packaging/release-matrix.json", encoding="utf-8") as file:
+              matrix = json.load(file)
+          print("ubuntu-series=" + " ".join(ubuntu["series"] for ubuntu in matrix["ubuntu"]))
+          print("fedora=" + json.dumps(matrix["fedora"]))
+          EOF
+
   sources:
     name: Source tarballs
     runs-on: ubuntu-24.04
@@ -102,14 +146,14 @@ jobs:
 
   source-package:
     name: Debian source packages
-    needs: sources
+    needs: [matrix, sources]
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     container:
       image: ubuntu:26.04
     env:
       # Every Ubuntu series the PPA builds for.
-      UBUNTU_SERIES: resolute stonking
+      UBUNTU_SERIES: ${{ needs.matrix.outputs.ubuntu-series }}
     outputs:
       series: ${{ steps.build.outputs.series }}
     steps:
@@ -201,14 +245,14 @@ jobs:
 
   rpm:
     name: RPM package (Fedora ${{ matrix.fedora }}, ${{ matrix.runner }})
-    needs: sources
+    needs: [matrix, sources]
     if: inputs.release-tag == ''
     strategy:
       fail-fast: false
       matrix:
         runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
-        # Every Fedora release the COPR project builds for.
-        fedora: ["44", "45"]
+        # Every Fedora release the COPR project builds for, from release-matrix.json.
+        fedora: ${{ fromJSON(needs.matrix.outputs.fedora) }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 300
     # On the runner itself, so the build's container can go on the larger
@@ -251,12 +295,13 @@ jobs:
 
   rpm-install:
     name: Install the RPM package (Fedora ${{ matrix.fedora }}, ${{ matrix.runner }})
-    needs: rpm
+    needs: [matrix, rpm]
     strategy:
       fail-fast: false
       matrix:
         runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
-        fedora: ["44", "45"]
+        # Every Fedora release the COPR project builds for, from release-matrix.json.
+        fedora: ${{ fromJSON(needs.matrix.outputs.fedora) }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 20
     container:
@@ -273,3 +318,107 @@ jobs:
         run: |
           linux/build-aux/packaging/smoke-test.sh \
             "$(find _packages/rpm -name 'tablepro-[0-9]*.rpm' ! -name '*.src.rpm')" linux/po/LINGUAS
+
+  # From the same tarballs as the packages, offline, with every Meson suite in
+  # the sandbox (build-flatpak.sh). The unsigned repository goes to
+  # release-linux.yml, which signs it.
+  flatpak:
+    name: Flatpak (${{ matrix.runner }})
+    needs: sources
+    if: inputs.flatpak || github.event_name == 'schedule'
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 300
+    container:
+      image: ghcr.io/flathub-infra/flatpak-github-actions:gnome-51
+      options: --privileged
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: linux-sources
+          path: _packages/sources
+      - name: Build and test
+        env:
+          BRANCH: ${{ inputs.flatpak-branch || 'stable' }}
+        run: |
+          xvfb-run --auto-servernum linux/build-aux/packaging/build-flatpak.sh --branch "$BRANCH" \
+            "$(find _packages/sources -name 'tablepro-*.tar.xz' ! -name '*-vendor.tar.xz')" \
+            "$(find _packages/sources -name 'tablepro-*-vendor.tar.xz')" _packages/flatpak
+          tar -C _packages/flatpak -cf "_packages/flatpak-repo-$(uname -m).tar" repo
+      # One file, since an OSTree repository is thousands.
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: linux-flatpak-repo-${{ runner.arch }}
+          path: _packages/flatpak-repo-*.tar
+          if-no-files-found: error
+      - name: Lint the manifest
+        if: runner.arch == 'X64'
+        run: flatpak-builder-lint manifest linux/build-aux/flatpak/app.tablepro.TablePro.json
+
+  # Signed with a throwaway key, for http://127.0.0.1:8080, by the same
+  # flatpak-repo.sh release-linux.yml publishes with, on both branches
+  # whatever the build's own.
+  flatpak-test-repo:
+    name: Flatpak test repository
+    needs: flatpak
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    container:
+      image: ubuntu:26.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: linux-flatpak-repo-*
+          path: _packages/flatpak-repo
+          merge-multiple: true
+      - name: Commit twice to both repositories, bundle the first commit and validate
+        run: |
+          for tarball in _packages/flatpak-repo/*.tar; do
+            mkdir -p "${tarball%.tar}"
+            tar -C "${tarball%.tar}" -xf "$tarball"
+            set -- "$@" "${tarball%.tar}/repo"
+          done
+          linux/build-aux/packaging/flatpak-test-site.sh --install-deps _packages/site "$@"
+          tar -C _packages -cf _packages/flatpak-test-site.tar site
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: linux-flatpak-test-site
+          path: _packages/flatpak-test-site.tar
+          if-no-files-found: error
+
+  # Also on the Ubuntu releases below the GNOME 50 floor, whose users have the
+  # Flatpak and not the packages, each with its own Flatpak.
+  flatpak-install:
+    name: Install the Flatpak (Ubuntu ${{ matrix.ubuntu }}, ${{ matrix.runner }})
+    needs: flatpak-test-repo
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
+        ubuntu: ["22.04", "24.04", "26.04"]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    container:
+      image: ubuntu:${{ matrix.ubuntu }}
+      options: --privileged
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: linux-flatpak-test-site
+          path: _packages
+      - name: Install from the repositories and a bundle, start, update and switch branches
+        run: |
+          tar -C _packages -xf _packages/flatpak-test-site.tar
+          linux/build-aux/packaging/smoke-test-flatpak.sh _packages/site linux/po/LINGUAS