From a7703b0974068d9f1ab7eed9a7ee5f88fadeab8e Mon Sep 17 00:00:00 2001 From: Talha Date: Thu, 30 Jul 2026 19:42:42 +0500 Subject: [PATCH 1/2] fix(ci): repair release workflow security --- .github/workflows/desktop.yml | 6 +- .github/workflows/release-to-pypi.yml | 3 + .github/workflows/release-to-test-pypi.yml | 3 + changes/+release-workflow.security.md | 1 + desktop/rust-toolchain.toml | 3 + desktop/src-tauri/Cargo.lock | 115 ++++++++++----------- desktop/src-tauri/Cargo.toml | 6 +- 7 files changed, 70 insertions(+), 67 deletions(-) create mode 100644 changes/+release-workflow.security.md create mode 100644 desktop/rust-toolchain.toml diff --git a/.github/workflows/desktop.yml b/.github/workflows/desktop.yml index 94c0b6f..1383e44 100644 --- a/.github/workflows/desktop.yml +++ b/.github/workflows/desktop.yml @@ -68,7 +68,7 @@ jobs: version: "0.12.0" enable-cache: false - - uses: dtolnay/rust-toolchain@1.85.0 + - uses: dtolnay/rust-toolchain@stable - name: Restore Rust build cache uses: actions/cache@v5 @@ -77,9 +77,9 @@ jobs: ~/.cargo/registry ~/.cargo/git desktop/src-tauri/target - key: desktop-rust-${{ runner.os }}-${{ runner.arch }}-1.85.0-${{ hashFiles('desktop/src-tauri/Cargo.lock') }} + key: desktop-rust-${{ runner.os }}-${{ runner.arch }}-stable-${{ hashFiles('desktop/src-tauri/Cargo.lock') }} restore-keys: | - desktop-rust-${{ runner.os }}-${{ runner.arch }}-1.85.0- + desktop-rust-${{ runner.os }}-${{ runner.arch }}-stable- - name: Install locked desktop tooling run: npm ci diff --git a/.github/workflows/release-to-pypi.yml b/.github/workflows/release-to-pypi.yml index ff53181..7c39646 100644 --- a/.github/workflows/release-to-pypi.yml +++ b/.github/workflows/release-to-pypi.yml @@ -74,6 +74,9 @@ jobs: validate-release: if: needs.release.outputs.released == 'true' needs: release + permissions: + contents: read + pull-requests: read uses: ./.github/workflows/ci.yml with: checkout_ref: ${{ needs.release.outputs.commit_sha }} diff --git a/.github/workflows/release-to-test-pypi.yml b/.github/workflows/release-to-test-pypi.yml index 803d784..d96fd25 100644 --- a/.github/workflows/release-to-test-pypi.yml +++ b/.github/workflows/release-to-test-pypi.yml @@ -27,6 +27,9 @@ concurrency: jobs: validate: + permissions: + contents: read + pull-requests: read uses: ./.github/workflows/ci.yml with: checkout_ref: ${{ github.sha }} diff --git a/changes/+release-workflow.security.md b/changes/+release-workflow.security.md new file mode 100644 index 0000000..d673b9c --- /dev/null +++ b/changes/+release-workflow.security.md @@ -0,0 +1 @@ +Restore prerelease and stable-release validation, and update the desktop Rust baseline so patched `time` and `serde_with` releases are used. diff --git a/desktop/rust-toolchain.toml b/desktop/rust-toolchain.toml new file mode 100644 index 0000000..2fc3eef --- /dev/null +++ b/desktop/rust-toolchain.toml @@ -0,0 +1,3 @@ +[toolchain] +channel = "stable" +profile = "minimal" diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 306e984..fc57db1 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -343,6 +343,15 @@ dependencies = [ "alloc-stdlib", ] +[[package]] +name = "bs58" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4" +dependencies = [ + "tinyvec", +] + [[package]] name = "bumpalo" version = "3.20.3" @@ -675,9 +684,9 @@ checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1" [[package]] name = "darling" -version = "0.21.3" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0" +checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d" dependencies = [ "darling_core", "darling_macro", @@ -685,11 +694,10 @@ dependencies = [ [[package]] name = "darling_core" -version = "0.21.3" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4" +checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0" dependencies = [ - "fnv", "ident_case", "proc-macro2", "quote", @@ -699,9 +707,9 @@ dependencies = [ [[package]] name = "darling_macro" -version = "0.21.3" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81" +checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d" dependencies = [ "darling_core", "quote", @@ -1639,7 +1647,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.62.2", + "windows-core", ] [[package]] @@ -2146,9 +2154,9 @@ dependencies = [ [[package]] name = "num-conv" -version = "0.1.0" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9" +checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441" [[package]] name = "num-traits" @@ -3128,11 +3136,12 @@ dependencies = [ [[package]] name = "serde_with" -version = "3.17.0" +version = "3.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "381b283ce7bc6b476d903296fb59d0d36633652b633b27f64db4fb46dcbfc3b9" +checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c" dependencies = [ "base64 0.22.1", + "bs58", "chrono", "hex", "indexmap 1.9.3", @@ -3147,9 +3156,9 @@ dependencies = [ [[package]] name = "serde_with_macros" -version = "3.17.0" +version = "3.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a6d4e30573c8cb306ed6ab1dca8423eec9a463ea0e155f45399455e0368b27e0" +checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660" dependencies = [ "darling", "proc-macro2", @@ -3487,7 +3496,7 @@ dependencies = [ "unicode-segmentation", "url", "windows", - "windows-core 0.61.2", + "windows-core", "windows-version", "x11-dl", ] @@ -3924,9 +3933,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.45" +version = "0.3.47" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f9e442fc33d7fdb45aa9bfeb312c095964abdf596f7567261062b2a7107aaabd" +checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c" dependencies = [ "deranged", "itoa", @@ -3941,15 +3950,15 @@ dependencies = [ [[package]] name = "time-core" -version = "0.1.7" +version = "0.1.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b36ee98fd31ec7426d599183e8fe26932a8dc1fb76ddb6214d05493377d34ca" +checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca" [[package]] name = "time-macros" -version = "0.2.25" +version = "0.2.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "71e552d1249bf61ac2a52db88179fd0673def1e1ad8243a00d9ec9ed71fee3dd" +checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215" dependencies = [ "num-conv", "time-core", @@ -3965,6 +3974,21 @@ dependencies = [ "zerovec", ] +[[package]] +name = "tinyvec" +version = "1.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f" +dependencies = [ + "tinyvec_macros", +] + +[[package]] +name = "tinyvec_macros" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" + [[package]] name = "tokio" version = "1.53.1" @@ -4573,7 +4597,7 @@ dependencies = [ "webview2-com-macros", "webview2-com-sys", "windows", - "windows-core 0.61.2", + "windows-core", "windows-implement", "windows-interface", ] @@ -4597,7 +4621,7 @@ checksum = "381336cfffd772377d291702245447a5251a2ffa5bad679c99e61bc48bacbf9c" dependencies = [ "thiserror 2.0.19", "windows", - "windows-core 0.61.2", + "windows-core", ] [[package]] @@ -4653,7 +4677,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893" dependencies = [ "windows-collections", - "windows-core 0.61.2", + "windows-core", "windows-future", "windows-link 0.1.3", "windows-numerics", @@ -4665,7 +4689,7 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8" dependencies = [ - "windows-core 0.61.2", + "windows-core", ] [[package]] @@ -4677,21 +4701,8 @@ dependencies = [ "windows-implement", "windows-interface", "windows-link 0.1.3", - "windows-result 0.3.4", - "windows-strings 0.4.2", -] - -[[package]] -name = "windows-core" -version = "0.62.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb" -dependencies = [ - "windows-implement", - "windows-interface", - "windows-link 0.2.1", - "windows-result 0.4.1", - "windows-strings 0.5.1", + "windows-result", + "windows-strings", ] [[package]] @@ -4700,7 +4711,7 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e" dependencies = [ - "windows-core 0.61.2", + "windows-core", "windows-link 0.1.3", "windows-threading", ] @@ -4745,7 +4756,7 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1" dependencies = [ - "windows-core 0.61.2", + "windows-core", "windows-link 0.1.3", ] @@ -4758,15 +4769,6 @@ dependencies = [ "windows-link 0.1.3", ] -[[package]] -name = "windows-result" -version = "0.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5" -dependencies = [ - "windows-link 0.2.1", -] - [[package]] name = "windows-strings" version = "0.4.2" @@ -4776,15 +4778,6 @@ dependencies = [ "windows-link 0.1.3", ] -[[package]] -name = "windows-strings" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091" -dependencies = [ - "windows-link 0.2.1", -] - [[package]] name = "windows-sys" version = "0.45.0" @@ -5113,7 +5106,7 @@ dependencies = [ "webkit2gtk-sys", "webview2-com", "windows", - "windows-core 0.61.2", + "windows-core", "windows-version", "x11-dl", ] diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index 12c9696..043fe36 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -3,7 +3,7 @@ name = "vidxp-desktop" version = "0.2.1-b.1" description = "The VidXP desktop launcher and local runtime supervisor" edition = "2024" -rust-version = "1.85" +rust-version = "1.88" license = "MIT" [lib] @@ -23,8 +23,8 @@ serde_json = "1.0.151" sha2 = "0.11.0" tauri = { version = "2.11.5", features = ["tray-icon"] } tauri-plugin-log = "2.9.0" -tauri-plugin-dialog = "2.6.0" -tauri-plugin-opener = "2.5.0" +tauri-plugin-dialog = "2.7.2" +tauri-plugin-opener = "2.5.4" tauri-plugin-shell = "2.3.5" tauri-plugin-single-instance = "2.4.3" wait-timeout = "0.2.1" From 6d2f5903bb995e591d9a2ebd75a78d9de622a558 Mon Sep 17 00:00:00 2001 From: Talha Date: Thu, 30 Jul 2026 19:48:43 +0500 Subject: [PATCH 2/2] docs: add desktop download call to action --- README.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 02116d8..8554d27 100644 --- a/README.md +++ b/README.md @@ -18,10 +18,20 @@ Dialogue search · Scene search · Actor grouping

+

+ + Download VidXP desktop app + +

+ +

+ Windows · Apple Silicon macOS · Linux +

+

PyPI version GHCR container - CI status + Main prerelease status MIT license Discord