1 #708

sourcery-ai · 2026-01-25T23:17:59Z

🚨 suggestion (security): Consider pinning GitHub Actions to specific commit SHAs for supply-chain security

Floating tags like @v4 can change over time and introduce supply-chain risk. Please pin actions/checkout (and other third-party actions in this workflow) to a specific commit SHA, with an inline comment noting the version for traceability.

Suggested implementation:

# 1. Checkout repo - name: Checkout # v4.2.2 uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633

If there are other third-party actions used elsewhere in this workflow file (or in other workflow files), they should also be updated to use commit SHA pins with inline comments indicating the tagged version (e.g., # vX.Y.Z) for consistency and supply-chain security.

-Original file line number
+Diff line change
@@ -0,0 +1,66 @@
+    name: Build Flatpak Snapshot
+    on:
+      push:
+        branches:
+          - flatpak-snapshot
+      workflow_dispatch:
+    jobs:
+      build-and-deploy:
+        runs-on: ubuntu-latest
+        permissions:
+          contents: write
+        steps:
+          # 1. Checkout repo
+          - name: Checkout
+            uses: actions/checkout@v4
+          # 2. Set up Flatpak
+          - name: Install Flatpak
+            run: |
+              sudo apt update
+              sudo apt install -y flatpak flatpak-builder git wget xz-utils
+          - name: Cache Flatpak SDK
+            if: always()
+            uses: actions/cache@v3
+            with:
+              path: ~/.local/share/flatpak
+              key: flatpak-sdk-48-${{ runner.os }}
+          # 3. Install GNOME SDK runtime
+          - name: Install GNOME SDK
+            run: |
+              sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+              sudo flatpak install --noninteractive flathub org.freedesktop.Sdk//25.08 org.freedesktop.Platform//25.08
+          # 4. Determine snapshot version from Git
+          - name: Set snapshot version
+            id: vars
+            run: |
+              SHORT_HASH=$(git rev-parse --short HEAD)
+              VERSION="0.10.0~git${SHORT_HASH}"
+              echo "VERSION=${VERSION}" >> $GITHUB_ENV
+              echo "Snapshot version set to ${VERSION}"
+          # 5. Build Flatpak
+          - name: Build Flatpak
+            run: |
+              flatpak-builder --force-clean build-dir scripts/flatpak/io.github.iptux_src.iptux.snapshot.yml
+          # 6. Export repository to repo/
+          - name: Export Flatpak repo
+            run: |
+              flatpak build-export repo build-dir --collection-id=io.github.iptux
+          # 7. Commit & push to gh-pages
+          - name: Deploy to GitHub Pages
+            uses: peaceiris/actions-gh-pages@v4
+            with:
+              github_token: ${{ secrets.GITHUB_TOKEN }}
+              publish_dir: repo
+              publish_branch: gh-pages
+              user_name: "GitHub Actions"
+              user_email: "actions@github.com"
+              commit_message: "Update Flatpak snapshot: ${{ env.VERSION }}"

-Original file line number
+Diff line change
@@ -0,0 +1,37 @@
+    app-id: io.github.iptux_src.iptux
+    runtime: org.freedesktop.Platform
+    runtime-version: '25.08'
+    sdk: org.freedesktop.Sdk
+    command: iptux
+    finish-args:
+      - --share=network
+      - --share=ipc
+      - --socket=fallback-x11
+      - --socket=wayland
+      - --filesystem=home
+    modules:
+      - name: libsigc++
+        buildsystem: meson
+        sources:
+          - type: archive
+            url: https://download.gnome.org/sources/libsigc++/2.10/libsigc++-2.10.8.tar.xz
+            sha256: 235a40bec7346c7b82b6a8caae0456353dc06e71f14bc414bcc858af1838719a
+      - name: jsoncpp
+        buildsystem: meson
+        sources:
+          - type: archive
+            url: https://github.com/open-source-parsers/jsoncpp/archive/1.9.5.tar.gz
+            sha256: f409856e5920c18d0c2fb85276e24ee607d2a09b5e7d5f0a371368903c275da2
+      # - "shared-modules/libayatana-appindicator/libayatana-appindicator-gtk3.json"
+      - name: iptux
+        buildsystem: meson
+        sources:
+          - type: git
+            url: https://github.com/iptux-src/iptux.git
+            branch: flatpak-snapshot
+        config-opts:
+          - --buildtype=release

-Original file line number
+Diff line change
@@ Expand Up / @@ -12,6 +12,7 @@ @@
     #include "config.h"
     #include "LogSystem.h"
+    #include "iptux-utils/output.h"
     #include <fcntl.h>
     #include <glib/gi18n.h>
@@ Expand Down Expand Up / @@ -84,7 +85,9 @@ void LogSystem::communicateLogv(const MsgPara* msgpara, @@
       msg = g_strdup_vprintf(fmt, ap);
       log = g_strdup_printf("%s\n%s\n%s\n%s\n\n", LOG_START_HEADER, ptr, msg,
                             LOG_END_HEADER);
-      write(fdc, log, strlen(log));
+      if (write(fdc, log, strlen(log)) < 0) {
+        LOG_WARN("Write communicate log failed!");
+      }
       g_free(log);
       g_free(ptr);
       g_free(msg);
@@ Expand All / @@ -104,7 +107,9 @@ void LogSystem::systemLogv(const char* fmt, va_list ap) { @@
       g_free(ptr);
       g_free(msg);
-      write(fds, log, strlen(log));
+      if (write(fds, log, strlen(log)) < 0) {
+        LOG_WARN("Write system log failed!");
+      }
       g_free(log);
     }
@@ Expand Down @@

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

1 #708

Diff view

Diff view

There are no files selected for viewing

sourcery-ai bot Jan 25, 2026

Uh oh!

Uh oh!

1 #708

Are you sure you want to change the base?

1 #708

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

sourcery-ai bot Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!