feat(flatpak): build a Flathub-ready manifest offline from source

.github/workflows/flatpak-spike.yml

@@ -86,6 +86,20 @@ jobs:
               echo "- \`$id\` → **NOT PUBLISHED**" >> "$GITHUB_STEP_SUMMARY"
             fi
           done
+          # Enumerate rather than guess. Run 31602275749 died in bindgen with
+          # "Unable to find libclang", so an LLVM extension is required and its exact
+          # name is not something to discover one 8-minute run at a time. This prints
+          # every SDK extension published for this runtime version.
+          {
+            echo
+            echo "<details><summary>All <code>org.freedesktop.Sdk.Extension.*</code> on 24.08</summary>"
+            echo
+            printf '%s\n' "$CATALOG" \
+              | awk '$1 ~ /^org\.freedesktop\.Sdk\.Extension\./ && $2 == "24.08" { print "- `" $1 "`" }' \
+              | sort
+            echo
+            echo "</details>"
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - name: "Stage B — install runtime, SDK, base and extensions"
         id: install
@@ -97,7 +111,8 @@ jobs:
             org.freedesktop.Sdk/x86_64/24.08 \
             org.electronjs.Electron2.BaseApp/x86_64/24.08 \
             org.freedesktop.Sdk.Extension.node22/x86_64/24.08 \
-            org.freedesktop.Sdk.Extension.rust-stable/x86_64/24.08
+            org.freedesktop.Sdk.Extension.rust-stable/x86_64/24.08 \
+            org.freedesktop.Sdk.Extension.llvm18/x86_64/24.08
 
       # ---------------------------------------------------------------------
       # Stage C is the single biggest unknown for any Electron app on Flathub:
@@ -126,51 +141,95 @@ jobs:
           echo "generated $COUNT sources, $BYTES bytes"
 
       # ---------------------------------------------------------------------
-      # Stage D: the same problem for Rust. Two lockfiles, and the compositor tree
-      # pulls bindgen, which wants libclang at build time as well as crates.
-      - name: "Stage D — vendor both Cargo lockfiles"
+      # Stage D: the same problem for Rust, for both lockfiles. `cargo vendor` was
+      # enough to answer "do these resolve"; the manifest needs the generator's
+      # output, which is a source list flatpak-builder can fetch offline.
+      - name: "Stage D — cargo sources for both lockfiles"
         id: vendor
         continue-on-error: true
         run: |
           set -euo pipefail
-          for dir in crates electron/native/pipewire-capture; do
-            echo "--- $dir ---"
-            ( cd "$dir" && cargo vendor --versioned-dirs /tmp/vendor-$(basename "$dir") \
-              > /tmp/vendor-$(basename "$dir").toml )
-            echo "$dir: $(find /tmp/vendor-$(basename "$dir") -maxdepth 1 -type d | wc -l) crates"
-          done
+          /tmp/fbt-venv/bin/pip install --quiet tomlkit aiohttp
+          gen() {
+            /tmp/fbt-venv/bin/python /tmp/fbt/cargo/flatpak-cargo-generator.py "$1" -o "$2"
+            echo "$2: $(python3 -c "import json,sys;print(len(json.load(open('$2'))))") sources"
+          }
+          gen crates/Cargo.lock build/flatpak/cargo-sources-crates.json
+          gen electron/native/pipewire-capture/Cargo.lock build/flatpak/cargo-sources-pipewire.json
+          # The generator hardcodes $CARGO_HOME/vendor, so these two lists overlap on
+          # every crate both trees share. Report the collision count rather than
+          # discovering it inside flatpak-builder.
+          python3 - <<'PY'
+          import json
+          a = {s.get('dest') for s in json.load(open('build/flatpak/cargo-sources-crates.json'))}
+          b = {s.get('dest') for s in json.load(open('build/flatpak/cargo-sources-pipewire.json'))}
+          shared = {d for d in a & b if d}
+          print(f"shared destinations: {len(shared)}")
+          for d in sorted(shared)[:10]:
+              print(f"  {d}")
+          PY
 
-      # ---------------------------------------------------------------------
-      # Stage E: the manifest ships a deliberately wrong ffmpeg sha256 so that a
-      # guessed digest can never reach a submission. Resolve the real one here.
-      - name: "Stage E — resolve the ffmpeg source digest"
-        id: ffmpeg
-        continue-on-error: true
-        run: |
-          set -euo pipefail
-          URL=https://ffmpeg.org/releases/ffmpeg-8.1.2.tar.xz
-          if curl -fsSL --retry 3 -o /tmp/ffmpeg.tar.xz "$URL"; then
-            SHA=$(sha256sum /tmp/ffmpeg.tar.xz | awk '{print $1}')
-            echo "sha=$SHA" >> "$GITHUB_OUTPUT"
-            echo "$URL → $SHA"
-          else
-            echo "::warning::$URL does not exist — the pinned build is BtbN's n8.1.2-34-g9b6c8969e0, which is a *snapshot*, not an upstream release. The manifest needs a real upstream version, and whichever one is chosen is not the tree the addon was tested against."
-            exit 1
-          fi
+      # Stage E is gone. It resolved the ffmpeg digest, which now lives pinned in the
+      # manifest, so all it could do was re-download 8.1.2 to confirm a constant.
+      # It also demonstrated the failure mode this workflow was already corrected
+      # for once: it reported "does not exist" for `curl: (35) Connection reset by
+      # peer`, turning a network flake into a false claim about upstream. A stage
+      # that can only be redundant or wrong is worth deleting rather than fixing.
 
       # ---------------------------------------------------------------------
-      # Stage F: the actual build. Expected to fail — the interesting output is
-      # WHERE. Run it even when earlier stages failed, so the log exists.
+      # Stage F: the actual build. Run it even when earlier stages failed, so the
+      # log exists.
       - name: "Stage F — flatpak-builder"
         id: build
         continue-on-error: true
         run: |
           set -euo pipefail
+          # --repo exports an OSTree repo alongside the build tree, which is what
+          # stage G needs: the repo lint catches things the manifest lint cannot see,
+          # like an icon or metainfo that did not actually get exported.
+          #
+          # In the workspace and NOT in /tmp. A flatpak always gets a private /tmp,
+          # whatever filesystem permissions it holds, so the sandboxed linter in stage G
+          # cannot see a host /tmp path — it read the manifest by a workspace-relative
+          # path perfectly well, which is what makes this the fix.
           flatpak-builder --user --install-deps-from=flathub --force-clean \
             --disable-rofiles-fuse \
+            --repo="$GITHUB_WORKSPACE/flatpak-repo" \
             /tmp/flatpak-build build/flatpak/com.getopenscreen.OpenScreen.yml \
             2>&1 | tee /tmp/flatpak-build.log
 
+      # ---------------------------------------------------------------------
+      # Stage G: the gate Flathub actually applies at submission time. Running it
+      # here is the difference between "it builds" and "they would accept it", and
+      # it costs one flatpak install rather than a review round-trip.
+      #
+      # org.flatpak.Builder only for the lint — the build above keeps apt's
+      # flatpak-builder, which is the one proven to work, so this stays additive.
+      - name: "Stage G — flatpak-builder-lint"
+        id: lint
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+          flatpak install -y --user --noninteractive flathub org.flatpak.Builder
+          lint() {
+            local mode="$1" target="$2"
+            echo "### flatpak-builder-lint $mode" >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+            if flatpak run --command=flatpak-builder-lint org.flatpak.Builder \
+                 "$mode" "$target" 2>&1 | tee "/tmp/lint-$mode.json"; then
+              echo "clean" >> "$GITHUB_STEP_SUMMARY"
+            else
+              cat "/tmp/lint-$mode.json" >> "$GITHUB_STEP_SUMMARY"
+            fi
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+          }
+          # Both, and neither is allowed to abort the other: they report different
+          # classes of problem and a submission has to satisfy the two.
+          rc=0
+          lint manifest build/flatpak/com.getopenscreen.OpenScreen.yml || rc=1
+          lint repo "$GITHUB_WORKSPACE/flatpak-repo" || rc=1
+          exit $rc
+
       - name: Collect artifacts
         if: always()
         uses: actions/upload-artifact@v7
@@ -179,6 +238,8 @@ jobs:
           path: |
             /tmp/flatpak-build.log
             build/flatpak/generated-sources.json
+            build/flatpak/cargo-sources-crates.json
+            build/flatpak/cargo-sources-pipewire.json
           if-no-files-found: warn
           retention-days: 7
 
@@ -189,10 +250,9 @@ jobs:
           B: ${{ steps.install.outcome }}
           C: ${{ steps.nodegen.outcome }}
           D: ${{ steps.vendor.outcome }}
-          E: ${{ steps.ffmpeg.outcome }}
           F: ${{ steps.build.outcome }}
+          G: ${{ steps.lint.outcome }}
           NPM_COUNT: ${{ steps.nodegen.outputs.count }}
-          FFMPEG_SHA: ${{ steps.ffmpeg.outputs.sha }}
         run: |
           {
             echo "## Verdict"
@@ -202,12 +262,12 @@ jobs:
             echo "| A — versions exist | $A |"
             echo "| B — runtime/SDK/base install | $B |"
             echo "| C — offline npm sources (${NPM_COUNT:-n/a} entries) | $C |"
-            echo "| D — cargo vendor, both lockfiles | $D |"
-            echo "| E — ffmpeg source digest (${FFMPEG_SHA:-unresolved}) | $E |"
+            echo "| D — cargo sources, both lockfiles | $D |"
             echo "| F — flatpak-builder | $F |"
+            echo "| G — flatpak-builder-lint | $G |"
             echo
-            echo "Stage F failing is the expected result, not the finding. The finding is"
-            echo "which of A–E failed, because those are the ones that decide whether this"
-            echo "port is a week or a quarter. Read the tail of the build log in the"
-            echo "\`flatpak-spike\` artifact before drawing any conclusion from F."
+            echo "F green means it builds offline from source. G green means Flathub would"
+            echo "not reject it on sight. **Neither means the app runs** — nothing here has"
+            echo "launched it, and a CI runner has no desktop session or ScreenCast portal to"
+            echo "launch it into. That verification needs a Linux desktop and a human."
           } >> "$GITHUB_STEP_SUMMARY"

build/flatpak/com.getopenscreen.OpenScreen.desktop

@@ -0,0 +1,15 @@
+[Desktop Entry]
+Type=Application
+Name=OpenScreen
+GenericName=Screen Recorder
+Comment=Screen recorder and video editor
+Exec=openscreen %U
+Icon=com.getopenscreen.OpenScreen
+Terminal=false
+Categories=AudioVideo;AudioVideoEditing;Recorder;
+Keywords=screen;record;recorder;capture;screencast;video;editor;
+# Electron derives the WM class from productName, which is "Openscreen" in
+# electron-builder.json5 — not the app id. Without this the window does not
+# associate with the launcher icon under Wayland or GNOME.
+StartupWMClass=Openscreen
+StartupNotify=true