chore: update bundled runtime pins

.github/workflows/build.yml

@@ -1,7 +1,7 @@
 name: CI Build Flatpak
 on:
   push:
-    branches: ['**']
+    branches: ['main']
   pull_request:
   workflow_dispatch:
 jobs:
@@ -18,6 +18,8 @@ jobs:
     runs-on: ${{ matrix.variant.runner }}
     steps:
       - uses: actions/checkout@v5
+      - name: Check launcher defaults
+        run: bash tests/check-launcher.sh
       - uses: flatpak/flatpak-github-actions/flatpak-builder@v6
         with:
           bundle: t3code.flatpak
@@ -27,6 +29,20 @@ jobs:
           arch: ${{ matrix.variant.arch }}
           verbose: true
 
+      - name: Create checksum
+        run: sha256sum t3code.flatpak > t3code.flatpak.sha256
+
+      - name: Upload Flatpak and checksum
+        uses: actions/upload-artifact@v7
+        with:
+          name: t3code-flatpak
+          path: |
+            t3code.flatpak
+            t3code.flatpak.sha256
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 3
+
       - name: Check installed SSH boundaries with a disposable key and agent
         shell: bash
         env:

.github/workflows/pages-flatpak-repo.yml

@@ -162,9 +162,8 @@ jobs:
       - name: Download unsigned architecture repository
         uses: actions/download-artifact@v8
         with:
-          pattern: t3code-ostree-*
-          path: inputs
-          merge-multiple: false
+          name: t3code-ostree-x86_64
+          path: inputs/t3code-ostree-x86_64
 
       - name: Restore previous final repository
         id: repo-cache
@@ -196,8 +195,8 @@ jobs:
           ref_file="$artifact_dir/t3code-ref-${arch}.txt"
           expected_ref="app/${APP_ID}/${arch}/master"
 
-          test -s "$archive"
-          test -s "$ref_file"
+          test -s "$archive" || { echo "Missing repository archive: $archive" >&2; exit 1; }
+          test -s "$ref_file" || { echo "Missing application ref: $ref_file" >&2; exit 1; }
           test "$(<"$ref_file")" = "$expected_ref"
 
           extract_dir="$RUNNER_TEMP/t3code-${arch}"
@@ -338,7 +337,10 @@ jobs:
           grep -Eq '^RuntimeRepo=https://flathub\.org/repo/flathub\.flatpakrepo$' site/t3code.flatpakref
           grep -Eq '^IsRuntime=false$' site/t3code.flatpakref
           grep -Eq '^GPGKey=[A-Za-z0-9+/=]+$' site/t3code.flatpakref
-          ! grep -Eq '@[A-Z_]+@' site/t3code.flatpakrepo site/t3code.flatpakref
+          if grep -Eq '@[A-Z_]+@' site/t3code.flatpakrepo site/t3code.flatpakref; then
+            echo "Unexpanded placeholders remain in repository descriptors." >&2
+            exit 1
+          fi
           grep -Fq 't3code.flatpakrepo' site/index.html
           grep -Fq 't3code.flatpakref' site/index.html
           grep -Fq 'flatpak install --user t3code com.t3tools.t3code' site/index.html

.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
 
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
-          commit="$(git rev-parse --verify HEAD^{commit})"
+          commit="$(git rev-parse --verify 'HEAD^{commit}')"
           source_date_epoch="$(git show -s --format=%ct "$commit")"
 
           if [[ ! "$source_date_epoch" =~ ^[0-9]+$ ]]; then
@@ -151,8 +151,8 @@ jobs:
         run: |
           set -euo pipefail
 
-          sha256sum -c *.sha256
-          sha256sum *.flatpak > SHA256SUMS
+          sha256sum -c ./*.sha256
+          sha256sum ./*.flatpak > SHA256SUMS
 
       - name: Create or update release
         env:

.github/workflows/update-bundled-runtime-pins.yml

@@ -15,6 +15,10 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  group: update-bundled-runtime-pins
+  cancel-in-progress: false
+
 jobs:
   update:
     name: Check bundled runtime pins
@@ -59,21 +63,28 @@ jobs:
 
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          # Refresh the remote-tracking ref before a leased update of an
+          # existing automation branch.
+          if git ls-remote --exit-code --heads origin "$branch" >/dev/null 2>&1; then
+            git fetch origin "refs/heads/$branch:refs/remotes/origin/$branch"
+          fi
           git switch -c "$branch"
           git add com.t3tools.t3code.yml
           git commit -m "chore: update bundled runtime pins"
           git push --force-with-lease origin "$branch"
 
           body="$(printf 'Updates bundled runtime source pins for the T3 Code Flatpak.\n\n- Node.js: %s\n- Git: %s\n- OpenSSH: %s\n\nThis workflow keeps updates separate from upstream T3 Code AppImage repinning.' "$NODE_VERSION" "$GIT_VERSION" "$OPENSSH_VERSION")"
 
-          if gh pr view "$branch" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            gh pr edit "$branch" --repo "$GITHUB_REPOSITORY" \
-              --title "chore: update bundled runtime pins" \
-              --body "$body"
+          # Use the repository endpoint explicitly, including in contributor
+          # forks where PR discovery must not select the parent repository.
+          owner="${GITHUB_REPOSITORY%%/*}"
+          pr_number="$(gh api --method GET "repos/$GITHUB_REPOSITORY/pulls" \
+            -f state=open -f base=main -f "head=$owner:$branch" --jq '.[0].number // empty')"
+          if [ -n "$pr_number" ]; then
+            gh api --method PATCH "repos/$GITHUB_REPOSITORY/pulls/$pr_number" \
+              -f title="chore: update bundled runtime pins" -f body="$body"
           else
-            gh pr create --repo "$GITHUB_REPOSITORY" \
-              --base main \
-              --head "$branch" \
-              --title "chore: update bundled runtime pins" \
-              --body "$body"
+            gh api --method POST "repos/$GITHUB_REPOSITORY/pulls" \
+              -f base=main -f "head=$owner:$branch" \
+              -f title="chore: update bundled runtime pins" -f body="$body"
           fi

.github/workflows/update-t3code-appimage.yml

@@ -7,26 +7,22 @@ on:
 
 permissions:
   contents: write
+  actions: write
+
+concurrency:
+  group: update-t3code-appimage
+  cancel-in-progress: false
 
 jobs:
   update:
     name: Check latest upstream AppImage
     runs-on: ubuntu-24.04
     steps:
-      - name: Verify downstream workflow token
-        env:
-          DOWNSTREAM_WORKFLOW_TOKEN: ${{ secrets.GH_TOKEN }}
-        run: |
-          if [ -z "${DOWNSTREAM_WORKFLOW_TOKEN:-}" ]; then
-            echo "Set the GH_TOKEN secret so updater pushes trigger CI, release, and Pages workflows." >&2
-            exit 1
-          fi
-
       - uses: actions/checkout@v5
         with:
           ref: main
           fetch-depth: 0
-          token: ${{ secrets.GH_TOKEN }}
+          token: ${{ secrets.GH_TOKEN || github.token }}
 
       - uses: actions/setup-node@v5
         with:
@@ -39,6 +35,7 @@ jobs:
         run: node scripts/update-t3code-appimage.js
 
       - name: Commit update and tag release
+        id: publish
         env:
           VERSION: ${{ steps.update.outputs.version }}
         run: |
@@ -49,6 +46,7 @@ jobs:
             *) tag="t3code-v${VERSION}" ;;
           esac
 
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
@@ -61,6 +59,7 @@ jobs:
             echo "Manifest already points at T3 Code ${VERSION}; creating missing release tag ${tag}."
             git tag -a "$tag" -m "T3 Code ${VERSION}"
             git push origin "$tag"
+            echo "release=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
@@ -74,3 +73,24 @@ jobs:
           git tag -a "$tag" -m "T3 Code ${VERSION}"
           git push origin HEAD:main
           git push origin "$tag"
+          echo "release=true" >> "$GITHUB_OUTPUT"
+          echo "updated=true" >> "$GITHUB_OUTPUT"
+
+      - name: Dispatch downstream workflows for the default token
+        if: steps.publish.outputs.release == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CUSTOM_TOKEN: ${{ secrets.GH_TOKEN }}
+          RELEASE_TAG: ${{ steps.publish.outputs.tag }}
+          UPDATED: ${{ steps.publish.outputs.updated }}
+        run: |
+          set -euo pipefail
+          # PAT pushes trigger workflows automatically; GITHUB_TOKEN pushes do not.
+          if [ -n "$CUSTOM_TOKEN" ]; then
+            exit 0
+          fi
+          gh workflow run release.yml --repo "$GITHUB_REPOSITORY" --ref main -f tag="$RELEASE_TAG"
+          if [ "$UPDATED" = true ]; then
+            gh workflow run build.yml --repo "$GITHUB_REPOSITORY" --ref main
+            gh workflow run pages-flatpak-repo.yml --repo "$GITHUB_REPOSITORY" --ref main
+          fi