Tha.Les
ff66e15e6c
* fix: address open issues #169, #170, #173 #170 — Stored XSS via library folder names: folder.name was interpolated raw into innerHTML in the folder render path. Escape it with the existing esc() helper (catalog.js), matching the track render paths. #173 — SoundCloud SSRF surface: drop the on.soundcloud.com share shortener from the host allowlist (it redirects to arbitrary targets) and add a yt-dlp extractor allowlist (allowed_extractors=[youtube, soundcloud]) so a URL that slips past host validation can't invoke the generic extractor. #169 — Version stuck at 0.6.0-alpha.2 for source/Docker/self-hosted: make the version git-tag-derived via hatch-vcs (pyproject dynamic version, app/_version.py build artifact). app_version() now reads package metadata -> _version.py -> dev placeholder; static/version.json is removed (now a build artifact, gitignored). Install sites pin SETUPTOOLS_SCM_PRETEND_VERSION from the release version so shallow CI clones / Docker (no .git) don't break (Dockerfile, make-runtime-pack.sh, make-portable.ps1). make-app.sh defaults VERSION to `git describe`. Desktop version literals (Cargo.toml, package.json, tauri.conf.json) are now 0.0.0 placeholders stamped from the tag at build. The update-check no longer nags dev/source builds. Tests: 81 passed; ruff clean; app_version derives correctly. * build: exclude generated app/_version.py from ruff The hatch-vcs build hook writes app/_version.py during uv sync, and CI's `ruff format --check app/` tripped on it (it's gitignored but present on disk during lint). Add it to ruff's exclude list. * ci: make git-derived version resilient to CI's shallow clone (#169) CI runs uv sync in every step, which builds the editable package and triggers hatch-vcs/setuptools_scm. On Woodpecker's shallow, tagless clone setuptools_scm raises ("unable to detect version"), failing the lint step before ruff runs (and skipping the rest). - Set SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0 in the uv-based CI steps so the build never invokes git for the version (CI only lints/tests, never ships). - Add hatch-vcs fallback-version as a second safety net for shallow source installs outside CI. Verified: uv sync --frozen --all-extras succeeds with the env set. * feat: validate library folder names (reject symbols/markup) Folder names now accept only letters (any language), digits, spaces, and a small safe punctuation set (- _ ' & ( ) . ,). Names with markup or symbols (e.g. the XSS probe, or ±!@£$%^&*()_+{:"|?><) are rejected on Save with an inline message instead of being created. Complements the render-time escaping from #170 by blocking such names at the source. * feat: raise folder name limit to 100 chars + enforce in validator Bump the editor input maxlength from 48 to 100 and reject over-length names on Save with an inline message (defensive, in case the cap is bypassed).
75 lines
2.5 KiB
Bash
Executable File
75 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ARCH="${ARCH:-arm64}"
|
|
REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
|
|
# Default the version to the current git tag so local builds match the tag with
|
|
# no VERSION passed; falls back to a dev label outside a tagged checkout. (#169)
|
|
VERSION="${VERSION:-$(git -C "$REPO_ROOT" describe --tags --always 2>/dev/null || echo 0.0.0-dev)}"
|
|
VERSION="${VERSION#v}"
|
|
BUILD_DIR="${REPO_ROOT}/.build"
|
|
|
|
if [[ "$(uname)" != "Darwin" ]]; then
|
|
echo "ERROR: make-app.sh must run on macOS" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$ARCH" != "arm64" && "$ARCH" != "x64" ]]; then
|
|
echo "ERROR: ARCH must be arm64 or x64, got '${ARCH}'" >&2
|
|
exit 1
|
|
fi
|
|
|
|
for cmd in node npm cargo; do
|
|
if ! command -v "$cmd" >/dev/null 2>&1; then
|
|
echo "ERROR: required command not found on PATH: $cmd" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
mkdir -p "$BUILD_DIR"
|
|
|
|
echo "==> Stamping version ${VERSION}"
|
|
sed -i '' "s/^version = \".*\"/version = \"${VERSION}\"/" "$REPO_ROOT/desktop/src-tauri/Cargo.toml"
|
|
sed -i '' "s/\"version\": \".*\"/\"version\": \"${VERSION}\"/" "$REPO_ROOT/desktop/src-tauri/tauri.conf.json"
|
|
sed -i '' "s/\"version\": \".*\"/\"version\": \"${VERSION}\"/" "$REPO_ROOT/desktop/package.json"
|
|
|
|
cd "$REPO_ROOT/desktop"
|
|
|
|
# Tauri CLI reads CI env var as a boolean flag; Woodpecker sets CI=woodpecker
|
|
# which fails the boolean parser. Force a valid value.
|
|
export CI=true
|
|
|
|
npm ci
|
|
if [[ "$ARCH" == "arm64" ]]; then
|
|
npx tauri build --bundles app --target aarch64-apple-darwin
|
|
TARGET_DIR="$REPO_ROOT/desktop/src-tauri/target/aarch64-apple-darwin/release"
|
|
else
|
|
npx tauri build --bundles app --target x86_64-apple-darwin
|
|
TARGET_DIR="$REPO_ROOT/desktop/src-tauri/target/x86_64-apple-darwin/release"
|
|
fi
|
|
|
|
APP_DIR="${TARGET_DIR}/bundle/macos/StemDeck.app"
|
|
if [[ ! -d "$APP_DIR" ]]; then
|
|
APP_DIR="$(find "$REPO_ROOT/desktop/src-tauri/target" -path '*/bundle/macos/StemDeck.app' -type d | head -1)"
|
|
fi
|
|
if [[ -z "$APP_DIR" || ! -d "$APP_DIR" ]]; then
|
|
echo "ERROR: could not find built StemDeck.app" >&2
|
|
exit 1
|
|
fi
|
|
|
|
RESOURCES="${APP_DIR}/Contents/Resources"
|
|
mkdir -p "$RESOURCES"
|
|
|
|
if [[ -f "$BUILD_DIR/runtime-manifest-${ARCH}.json" ]]; then
|
|
cp "$BUILD_DIR/runtime-manifest-${ARCH}.json" "$RESOURCES/runtime-manifest.json"
|
|
else
|
|
cp "$REPO_ROOT/desktop/ui/runtime-manifest.json" "$RESOURCES/runtime-manifest.json"
|
|
fi
|
|
|
|
if [[ -f "$REPO_ROOT/packaging/macos/THIRD_PARTY_NOTICES.txt" ]]; then
|
|
cp "$REPO_ROOT/packaging/macos/THIRD_PARTY_NOTICES.txt" "$RESOURCES/THIRD_PARTY_NOTICES.txt"
|
|
fi
|
|
|
|
echo "$APP_DIR" > "$BUILD_DIR/app-path-${ARCH}.txt"
|
|
echo "==> App ready: $APP_DIR"
|