chore: sync upstream (5 Commits) #9

Merged

alf merged 5 commits from chore/sync-upstream-20261023 into main

2026-10-23 18:58:26 +00:00

alf commented

2026-10-23 18:58:26 +00:00

Owner

Upstream-Sync von upstream/main (5 Commits). Fast-Forward.

ae5a6d54 CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645)
2e36dcf9 packaging: harden shell scripts (SonarCloud S7688/S7679/S7682/S131) (#1640)
df1db164 web: let the browser zoom the page (SonarCloud Web:S7926) (#1641)
08718d71 Merge pull request #1658 from dylanmtaylor/sonar/security-reliability
bd7fb76d fix: annotate package output permissions (SonarCloud rust:S2612)

Upstream-Sync von `upstream/main` (5 Commits). Fast-Forward. - ae5a6d54 CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645) - 2e36dcf9 packaging: harden shell scripts (SonarCloud S7688/S7679/S7682/S131) (#1640) - df1db164 web: let the browser zoom the page (SonarCloud Web:S7926) (#1641) - 08718d71 Merge pull request #1658 from dylanmtaylor/sonar/security-reliability - bd7fb76d fix: annotate package output permissions (SonarCloud rust:S2612)

alf added 5 commits

2026-10-23 18:58:26 +00:00

fix: annotate package output permissions (SonarCloud rust:S2612) bd7fb76d4c

New packages are created with the ordinary 0666 request; the process umask
decides the effective mode. Annotated with that reason so the analyzer's
world-writable warning does not change the intended sharing behaviour.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

Merge pull request #1658 from dylanmtaylor/sonar/security-reliability 08718d712c

fix: keep package temp files owner-writable (SonarCloud rust:S2612)

web: let the browser zoom the page (SonarCloud Web:S7926) (#1641 ) df1db1646b

The viewport no longer sets user-scalable=no, so people who need to zoom
the page can (WCAG 1.4.4). The canvas takes touch-action: none, so pinch
and pan gestures on it still go to the app's own zoom, as eframe's touch
handlers expect, instead of zooming the page.

packaging: harden shell scripts (SonarCloud S7688/S7679/S7682/S131) (#1640 ) 2e36dcf909

- Use bash's [[ ]] instead of [ ] for conditional tests (S7688).
- Copy positional parameters into named locals in render(), has() and
  sha256() (S7679).
- End the env.sh helper functions with an explicit return, which keeps
  the last command's status (S7682).
- Give the appimagetool checksum case a default branch for architectures
  without a pinned download (S131).

No behaviour change; shellcheck -x is clean.

CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645 )

ci.yml / CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645) (push) Failing after 0s

Details

packaging-lint.yml / CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645) (push) Failing after 0s

Details

sonarcloud.yml / CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645) (push) Failing after 0s

Details

ci.yml / CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645) (pull_request) Failing after 0s

Details

freebsd.yml / CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645) (pull_request) Failing after 0s

Details

packaging-lint.yml / CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645) (pull_request) Failing after 0s

Details

sonarcloud.yml / CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release (#1645) (pull_request) Failing after 0s

Details

ae5a6d549c

ci.yml calls the shared workflow (cached apt packages, nextest, main-only cache saves, Cargo.lock check). FreeBSD and Windows ARM64 run nightly and on pushes to release instead of on pull requests. Depends on storytold/craft-common-actions#69.

alf merged commit ae5a6d549c into main

2026-10-23 18:58:26 +00:00

alf deleted branch chore/sync-upstream-20261023

2026-10-23 18:58:26 +00:00