Sync main with v1.0.0-beta.20

.github/workflows/ci.yml

@@ -21,8 +21,13 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
+    # Builds and tests run dependency code; only windows-build needs write access.
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install Linux HID and GUI dependencies
         if: runner.os == 'Linux'
         run: sudo apt-get update && sudo apt-get install -y libudev-dev libgtk-3-dev libayatana-appindicator3-dev libxcb-render0-dev libxcb-shape0-dev libxcb-xfixes0-dev libxkbcommon-dev libssl-dev libgl1-mesa-dev pkg-config
@@ -33,15 +38,21 @@ jobs:
       - name: Check formatting
         if: runner.os == 'Linux'
         run: cargo fmt --check
+      - name: Test
+        run: cargo test --locked
+      - name: Clippy
+        run: cargo clippy --locked --all-targets -- -D warnings
       - name: Test installer script
         if: runner.os == 'Linux'
         run: |
           bash -n install-linux.sh
+          bash tests/linux_startup.sh "${{ runner.temp }}"
           bash install-linux.sh --help
           bash -c 'export HOME=/root OPENMOUSE_INSTALL_SOURCED=1; source ./install-linux.sh; D=$(mktemp -d); write_udev_rule "$D/rule"; bodies=$(grep -c "SUBSYSTEM" "$D/rule"); vids=$(printf "%s" "$VENDOR_IDS" | wc -w); [ "$bodies" = "$vids" ] || exit 1; write_autostart "$D/a.desktop" "/opt/x/b"; grep -q "Exec=\"/opt/x/b\"" "$D/a.desktop"; write_launcher "$D/l.desktop" "/opt/x/b" "/opt/x/i.png"; grep -q "^Name=OpenMouse Bridge$" "$D/l.desktop"; grep -q "^Terminal=false$" "$D/l.desktop"; for pm in apt dnf pacman zypper apk; do pm_packages "$pm" | grep -q curl || exit 1; done; rm -rf "$D"'
 
   windows-build:
     name: Windows release artifact
+    needs: check
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
@@ -71,7 +82,8 @@ jobs:
       - name: Package
         shell: pwsh
         run: |
-          Compress-Archive -Path target/release/openmouse-bridge.exe,README.md,native-hid -DestinationPath openmouse-bridge-windows-x64.zip
+          Copy-Item assets/fonts/DM-Sans-OFL.txt DM-Sans-OFL.txt
+          Compress-Archive -Path target/release/openmouse-bridge.exe,README.md,DM-Sans-OFL.txt,native-hid -DestinationPath openmouse-bridge-windows-x64.zip
           (Get-FileHash openmouse-bridge-windows-x64.zip -Algorithm SHA256).Hash.ToLower() + "  openmouse-bridge-windows-x64.zip" | Set-Content openmouse-bridge-windows-x64.zip.sha256
       - uses: actions/upload-artifact@v4
         with:

.github/workflows/release.yml

@@ -23,13 +23,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
       - uses: Swatinem/rust-cache@v2
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: npm
           cache-dependency-path: native-hid/package-lock.json
+      - run: cargo fmt --check
       - run: cargo test --locked
+      - run: cargo clippy --locked --all-targets -- -D warnings
       - run: cargo build --release --locked
       - name: Sign executable
         if: env.WINDOWS_CERTIFICATE_BASE64 != ''
@@ -55,7 +59,8 @@ jobs:
       - name: Package
         shell: pwsh
         run: |
-          Compress-Archive -Path target/release/openmouse-bridge.exe,README.md,native-hid -DestinationPath openmouse-bridge-windows-x64.zip
+          Copy-Item assets/fonts/DM-Sans-OFL.txt DM-Sans-OFL.txt
+          Compress-Archive -Path target/release/openmouse-bridge.exe,README.md,DM-Sans-OFL.txt,native-hid -DestinationPath openmouse-bridge-windows-x64.zip
           (Get-FileHash openmouse-bridge-windows-x64.zip -Algorithm SHA256).Hash.ToLower() + "  openmouse-bridge-windows-x64.zip" | Set-Content openmouse-bridge-windows-x64.zip.sha256
       - uses: actions/upload-artifact@v4
         with:
@@ -67,18 +72,30 @@ jobs:
   macos:
     name: macOS universal
     runs-on: macos-14
+    # Signing and notarization are automatic when these secrets exist;
+    # without them the app is ad-hoc signed.
+    env:
+      MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
+      MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+      MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
         with:
+          components: clippy, rustfmt
           targets: aarch64-apple-darwin,x86_64-apple-darwin
       - uses: Swatinem/rust-cache@v2
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: npm
           cache-dependency-path: native-hid/package-lock.json
+      - run: cargo fmt --check
       - run: cargo test --locked
+      - run: cargo clippy --locked --all-targets -- -D warnings
       - run: cargo build --release --locked --target aarch64-apple-darwin
       - run: cargo build --release --locked --target x86_64-apple-darwin
       - name: Prepare native-hid (deps + bundled Node.js runtime)
@@ -97,21 +114,72 @@ jobs:
             "node-$NATIVE_HID_NODE_VERSION-darwin-x64/bin/node" \
             -output native-hid/node/bin/node
           chmod +x native-hid/node/bin/node
-      - name: Package universal binary
+      - name: Package universal binary (existing bare-binary installs)
         run: |
           lipo -create \
             target/aarch64-apple-darwin/release/openmouse-bridge \
             target/x86_64-apple-darwin/release/openmouse-bridge \
             -output openmouse-bridge
           chmod +x openmouse-bridge
-          zip -r openmouse-bridge-macos-universal.zip openmouse-bridge README.md native-hid
+          cp assets/fonts/DM-Sans-OFL.txt ./DM-Sans-OFL.txt
+          zip -r openmouse-bridge-macos-universal.zip openmouse-bridge README.md DM-Sans-OFL.txt native-hid
           shasum -a 256 openmouse-bridge-macos-universal.zip > openmouse-bridge-macos-universal.zip.sha256
+      - name: Import signing certificate
+        if: env.MACOS_CERTIFICATE_BASE64 != ''
+        run: |
+          set -euo pipefail
+          keychain="$RUNNER_TEMP/openmouse-signing.keychain-db"
+          keychain_password="$(uuidgen)"
+          echo "$MACOS_CERTIFICATE_BASE64" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
+          security create-keychain -p "$keychain_password" "$keychain"
+          security set-keychain-settings -lut 21600 "$keychain"
+          security unlock-keychain -p "$keychain_password" "$keychain"
+          security import "$RUNNER_TEMP/certificate.p12" -P "$MACOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain"
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain"
+          security list-keychains -d user -s "$keychain" login.keychain-db
+          echo "MACOS_SIGN_IDENTITY=$MACOS_SIGN_IDENTITY" >> "$GITHUB_ENV"
+      - name: Build OpenMouse Bridge.app
+        run: |
+          version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)"
+          mkdir -p dist
+          packaging/macos/build-app.sh openmouse-bridge native-hid "$version" dist
+      - name: Notarize app
+        if: env.MACOS_CERTIFICATE_BASE64 != '' && env.APPLE_ID != ''
+        run: |
+          set -euo pipefail
+          ditto -c -k --keepParent "dist/OpenMouse Bridge.app" notarize-app.zip
+          xcrun notarytool submit notarize-app.zip --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_PASSWORD" --wait
+          xcrun stapler staple "dist/OpenMouse Bridge.app"
+      - name: Package DMG and app update archive
+        run: |
+          set -euo pipefail
+          python3 -m pip install --quiet dmgbuild
+          packaging/macos/build-dmg.sh "dist/OpenMouse Bridge.app" OpenMouse-Bridge-macos-universal.dmg
+          # Plain Info-ZIP (not ditto): the updater's strict extractor expects ordinary zip entries.
+          (cd dist && zip -r -X -q "../openmouse-bridge-macos-app.zip" "OpenMouse Bridge.app")
+          shasum -a 256 openmouse-bridge-macos-app.zip > openmouse-bridge-macos-app.zip.sha256
+      - name: Notarize DMG
+        if: env.MACOS_CERTIFICATE_BASE64 != '' && env.APPLE_ID != ''
+        run: |
+          set -euo pipefail
+          xcrun notarytool submit OpenMouse-Bridge-macos-universal.dmg --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_PASSWORD" --wait
+          xcrun stapler staple OpenMouse-Bridge-macos-universal.dmg
+      - name: Verify DMG
+        run: |
+          set -euo pipefail
+          hdiutil attach OpenMouse-Bridge-macos-universal.dmg -nobrowse -readonly -mountpoint "$RUNNER_TEMP/dmg"
+          test -d "$RUNNER_TEMP/dmg/OpenMouse Bridge.app"
+          codesign --verify --deep --strict "$RUNNER_TEMP/dmg/OpenMouse Bridge.app"
+          hdiutil detach "$RUNNER_TEMP/dmg"
       - uses: actions/upload-artifact@v4
         with:
           name: bridge-macos
           path: |
             openmouse-bridge-macos-universal.zip
             openmouse-bridge-macos-universal.zip.sha256
+            openmouse-bridge-macos-app.zip
+            openmouse-bridge-macos-app.zip.sha256
+            OpenMouse-Bridge-macos-universal.dmg
   linux:
     name: Linux x64
     runs-on: ubuntu-24.04
@@ -120,13 +188,17 @@ jobs:
       - name: Install Linux HID and GUI dependencies
         run: sudo apt-get update && sudo apt-get install -y libudev-dev libgtk-3-dev libayatana-appindicator3-dev libxcb-render0-dev libxcb-shape0-dev libxcb-xfixes0-dev libxkbcommon-dev libssl-dev libgl1-mesa-dev pkg-config
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
       - uses: Swatinem/rust-cache@v2
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: npm
           cache-dependency-path: native-hid/package-lock.json
+      - run: cargo fmt --check
       - run: cargo test --locked
+      - run: cargo clippy --locked --all-targets -- -D warnings
       - run: cargo build --release --locked
       - name: Prepare native-hid (deps + bundled Node.js runtime)
         run: |
@@ -145,7 +217,8 @@ jobs:
           cp target/release/openmouse-bridge ./openmouse-bridge
           chmod +x openmouse-bridge
           cp assets/openmouse-app-icon.png ./openmouse-app-icon.png
-          zip -r openmouse-bridge-linux-x64.zip openmouse-bridge openmouse-app-icon.png README.md native-hid
+          cp assets/fonts/DM-Sans-OFL.txt ./DM-Sans-OFL.txt
+          zip -r openmouse-bridge-linux-x64.zip openmouse-bridge openmouse-app-icon.png README.md DM-Sans-OFL.txt native-hid
           rm openmouse-bridge openmouse-app-icon.png
           sha256sum openmouse-bridge-linux-x64.zip > openmouse-bridge-linux-x64.zip.sha256
       - uses: actions/upload-artifact@v4

.gitignore

@@ -1,3 +1,4 @@
 /target
 native-hid/node_modules
 .DS_Store
+__pycache__/