Merge origin/main into codex/buzz-269-draft-prep

Resolve conflicts: - Justfile: keep the route-inventory guard and main's buzz-audio-client lane. - api/bridge.rs: pass main's token_owner alongside this branch's signed_created_at to enforce_relay_membership. - audio/handler.rs: take main's side (comment-only difference). Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Luke Tornquist <tornquist@squareup.com>
2026-10-29 05:21:31 +00:00 · 2026-10-26 14:11:53 -04:00
parent dda7ef8815 a3a47e6294
commit 60df78770f
1033 changed files with 198893 additions and 25163 deletions
--- a/.github/workflows/_ci-clients.yml
+++ b/.github/workflows/_ci-clients.yml
@@ -57,11 +57,30 @@ jobs:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: pnpm-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}

+  # Mobile lanes run in parallel; the required check reads the combined
+  # matrix result. Test shards split files, so each compiles only its own.
  mobile:
-    name: Mobile
+    name: Mobile (${{ matrix.name }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    if: inputs.lane == 'required' && (github.event_name == 'push' || inputs.mobile)
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Checks
+            lane: checks
+          - name: Tests 1/3
+            lane: test
+            shard: 0
+          - name: Tests 2/3
+            lane: test
+            shard: 1
+          - name: Tests 3/3
+            lane: test
+            shard: 2
+          - name: Android
+            lane: android
    permissions:
      contents: read
    steps:
@@ -107,47 +126,127 @@ jobs:
          path: ~/.pub-cache
          key: pub-${{ runner.os }}-${{ hashFiles('mobile/pubspec.lock') }}
      - name: Format check
+        if: matrix.lane == 'checks'
        run: cd mobile && dart format --output=none --set-exit-if-changed .
      - name: Analyze
+        if: matrix.lane == 'checks'
        run: cd mobile && flutter analyze
      - name: Test
-        run: cd mobile && flutter test --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
+        if: matrix.lane == 'test'
+        run: /bin/bash scripts/mobile-test-shard.sh ${{ matrix.shard }} 3 --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
+      - name: Test configured authentication domains
+        if: matrix.lane == 'checks'
+        run: >-
+          cd mobile && flutter test
+          --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
+          --dart-define=BUZZ_AUTH_DOMAINS=buzz.xyz,builderlab.xyz,builderlabstaging.xyz
+          test/shared/auth/community_entry_requirements_test.dart
+          test/features/invites/invite_join_provider_test.dart
+          test/features/onboarding/onboarding_entry_routes_test.dart
+          test/shared/hosted/hosted_environment_test.dart
+          test/shared/hosted/self_hosted_entry_test.dart
+          test/features/onboarding/hosted_app_gate_environment_test.dart
+          test/features/onboarding/hosted_journeys_test.dart
+          test/features/onboarding/hosted_communities_test.dart
+          test/features/pairing/pairing_hosted_handoff_test.dart
      - name: Test mobile without push configuration
+        if: matrix.lane == 'checks'
        run: cd mobile && flutter test test/shared/push/push_unconfigured_build_test.dart
      - name: Test mobile recipe argument forwarding
+        if: matrix.lane == 'checks'
        run: /bin/bash scripts/test-mobile-gateway-recipes.sh
+      - name: Restore Gradle cache
+        if: matrix.lane == 'android'
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('mobile/android/**/*.gradle*', 'mobile/android/gradle/wrapper/gradle-wrapper.properties', 'mobile/pubspec.lock') }}
+          restore-keys: gradle-${{ runner.os }}-
+      # SDK component and plugin downloads intermittently fail on hosted
+      # runners; retry once only for those, so real build failures still fail.
      - name: Build Android debug APK
-        run: just mobile-build-android
+        if: matrix.lane == 'android'
+        run: |
+          set -o pipefail
+          log="$RUNNER_TEMP/android-build.log"
+          if ! just mobile-build-android 2>&1 | tee "$log"; then
+            grep -qE 'InstallFailedException|Could not (resolve|GET|download)' "$log"
+            just mobile-build-android
+          fi
+      - name: Test Android JVM units
+        if: matrix.lane == 'android'
+        run: cd mobile/android && ./gradlew :app:testDebugUnitTest --console=plain
+      - name: Save Gradle cache
+        if: matrix.lane == 'android' && github.event_name == 'push'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
+        continue-on-error: true
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('mobile/android/**/*.gradle*', 'mobile/android/gradle/wrapper/gradle-wrapper.properties', 'mobile/pubspec.lock') }}

+  # The unsigned release build needs nothing from the native lane, so it runs
+  # beside it instead of after the simulator tests.
  mobile-swift:
-    name: Mobile Swift
+    name: Mobile Swift (${{ matrix.name }})
    runs-on: macos-latest
-    timeout-minutes: 30
+    timeout-minutes: 45
    if: inputs.lane == 'mobile-swift' && inputs.mobile
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Native
+            lane: native
+          - name: Release
+            lane: release
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
      - name: Install Flutter dependencies
        run: cd mobile && flutter pub get
-      - name: Build
-        run: swift build --package-path mobile/ios/BuzzPushKit
-      - name: Build release
-        run: swift build -c release --package-path mobile/ios/BuzzPushKit
+      # `swift test` builds BuzzPushKit; the Release lane covers its release build.
      - name: Test
+        if: matrix.lane == 'native'
        run: swift test --package-path mobile/ios/BuzzPushKit
      - name: Test native pagination geometry
+        if: matrix.lane == 'native'
        run: /bin/bash scripts/test-mobile-pagination.sh
-      - name: Build complete iOS simulator app
-        run: cd mobile && flutter build ios --simulator --debug --no-pub
-      - name: Test native pagination accessibility
+      - name: Generate iOS build configuration
+        if: matrix.lane == 'native'
+        run: cd mobile && flutter build ios --simulator --debug --no-pub --config-only
+      # Build the complete simulator app and RunnerTests once, in the
+      # background, while the simulator boots and runs the native-control
+      # scripts. The build also guards Apple Silicon simulator linking (#7646).
+      - name: Test native controls and Runner unit tests
+        if: matrix.lane == 'native'
        run: |
-          device=$(xcrun simctl create "Pagination accessibility" "iPhone 16")
+          device=$(xcrun simctl create "Native tests" "iPhone 16")
          trap 'xcrun simctl shutdown "$device"; xcrun simctl delete "$device"' EXIT
+          xcode=(xcodebuild -workspace mobile/ios/Runner.xcworkspace -scheme Runner
+            -configuration Debug -destination "platform=iOS Simulator,id=$device"
+            CODE_SIGNING_ALLOWED=NO)
+          build_log="$RUNNER_TEMP/runner-build.log"
+          "${xcode[@]}" build-for-testing > "$build_log" 2>&1 &
+          build=$!
          xcrun simctl boot "$device"
          xcrun simctl bootstatus "$device" -b
          /bin/bash scripts/test-mobile-pagination-accessibility.sh "$device"
+          /bin/bash scripts/test-mobile-carousel.sh "$device"
          /bin/bash scripts/test-mobile-member-picker.sh "$device"
+          /bin/bash scripts/test-mobile-me-agent-accessibility.sh "$device"
+          if ! wait "$build"; then
+            cat "$build_log"
+            exit 1
+          fi
+          tail -n 5 "$build_log"
+          "${xcode[@]}" -parallel-testing-enabled NO -only-testing:RunnerTests \
+            test-without-building
      - name: Build complete unsigned iOS release
+        if: matrix.lane == 'release'
        run: |
          /bin/bash scripts/test-mobile-gateway-recipes.sh
          cd mobile && flutter build ios --release --no-codesign --no-pub
--- a/.github/workflows/_ci-relay.yml
+++ b/.github/workflows/_ci-relay.yml
@@ -110,6 +110,8 @@ jobs:
            -p buzz-test-client \
            --lib \
            --test e2e_event_reminder \
+            --test e2e_author_only_deletion \
+            --test e2e_existence_oracle \
            --archive-file target/ci/backend-integration-tests.tar.zst
      - name: Build PostgreSQL test archive
        if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' && matrix.artifact == 'postgres-tests'
@@ -584,10 +586,12 @@ jobs:
        run: |
          cargo nextest run \
            --archive-file target/ci/backend-integration-tests.tar.zst \
-            -E 'binary(e2e_event_reminder)' \
+            -E 'binary(e2e_event_reminder) | binary(e2e_author_only_deletion) | binary(e2e_existence_oracle)' \
            --run-ignored ignored-only
        env:
          RELAY_URL: ws://localhost:3000
+          # schema/schema.sql (applied above) indexes kind:5 content.
+          BUZZ_TEST_SEARCH_INDEXES_DELETIONS: "1"
      - name: Upload relay log
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -631,6 +635,13 @@ jobs:
          cargo test -p buzz-test-client --test e2e_relay invite -- --ignored --nocapture
          cargo test -p buzz-test-client --test e2e_relay nip43_membership_snapshots_are_rejected -- --ignored --nocapture
          cargo test -p buzz-test-client --test e2e_relay nip29_departure_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_batch_put_user_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_announce_channel_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_unlisted_channel_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_solo_share_and_convert_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_member_raises_guest_agent -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_guest_is_read_only_in_normal_channel -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_relay_rejects_role_change_by_unprivileged_actor -- --ignored --nocapture
        env:
          RELAY_URL: ws://localhost:3000
          RELAY_HTTP_URL: http://localhost:3000
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,9 @@ jobs:
  changes:
    name: Detect Changed Paths
    runs-on: ubuntu-latest
-    timeout-minutes: 2
+    # The steps take about 75 seconds, but GitHub can finish the job minutes
+    # after the last step. A 2-minute limit cancelled finished runs.
+    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
@@ -51,6 +53,8 @@ jobs:
              - '.config/nextest.toml'
              - 'scripts/postgres-test-*.sh'
              - 'scripts/reconcile-schema-after-pgschema.sql'
+              - 'scripts/repair-events-pkey.sql'
+              - 'scripts/start-relay-for-tests.sh'
              - 'bin/pgschema'
              - 'bin/.pgschema-*.pkg'
              - 'scripts/check-postgres-test-discovery.py'
@@ -86,7 +90,10 @@ jobs:
              - 'pnpm-lock.yaml'
            mobile:
              - 'mobile/**'
+              - 'Justfile'
+              - 'scripts/test-mobile-gateway-recipes.sh'
              - 'scripts/mobile-release.sh'
+              - 'scripts/mobile-release-source.sh'
              - 'scripts/mobile-worktree-overrides.sh'
              - 'scripts/mobile-worktree-clean.sh'
              - 'scripts/publish-mobile-release-candidate.sh'
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -16,8 +16,8 @@ name: Docker image
 # the relay image version tracks crates/buzz-relay/Cargo.toml, never desktop.
 #
 # Triggers:
-#   - push to main           → :main + :sha-<7>
-#                              + :debug-main + :debug-sha-<7>
+#   - push to main           → :main + :sha-<7> + :main-<commit UTC>-<7>
+#                              + the matching :debug-* tags
 #   - push tags relay-v*.*.* → :{version} + :{major}.{minor} + :{major}
 #                              + matching :debug-* tags
 #                              (+ :latest/:debug-latest for stable releases)
@@ -34,6 +34,16 @@ name: Docker image
 #   intact) and the bare version flows straight to the semver parser. On a
 #   real push event value= is empty and the match strips relay-v from the ref.
 #
+# ghcr.io/block/buzz-push-gateway carries the same :main, :sha-<7> and
+# :main-<commit UTC>-<7> tags on main pushes, and publishes only after the
+# relay's `qualify` job accepts the same source SHA.
+#
+# :main-<YYYYMMDDHHmmss>-<7> names the same main build as :sha-<7>, prefixed
+# with its UTC commit time so the tag sorts by build order. Kargo's Lexical
+# strategy picks the newest from the tag list alone; :sha-<7> cannot be
+# ordered without fetching every image's metadata. It uses the commit date,
+# not the run date, so a rerun of the same commit re-pushes the same tag.
+#
 # The :latest tag tracks the latest STABLE relay release: metadata-action's
 # `flavor.latest=auto` (its default) emits :latest only for non-prerelease
 # semver, so relay-v0.3.0-rc.1 publishes :0.3.0-rc.1 without moving :latest,
@@ -162,6 +172,7 @@ jobs:
            type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
            type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
            type=semver,pattern={{major}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=raw,value=main-{{commit_date 'YYYYMMDDHHmmss'}}-{{sha}},enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
          labels: |
            org.opencontainers.image.title=Buzz
            org.opencontainers.image.description=WebSocket relay server for the Buzz communications platform
@@ -371,6 +382,7 @@ jobs:
            type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
            type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
            type=semver,pattern={{major}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=raw,value=main-{{commit_date 'YYYYMMDDHHmmss'}}-{{sha}},enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}

      - name: Create and push manifest list
        id: manifest
@@ -606,7 +618,9 @@ jobs:
    name: Publish public push gateway image
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-24.04
-    needs: push-gateway-build
+    # Staging promotes every published main gateway image automatically, so the
+    # gateway publishes only from a source the relay's same-SHA CI qualified.
+    needs: [push-gateway-build, qualify]
    timeout-minutes: 15
    permissions:
      contents: read
@@ -638,6 +652,7 @@ jobs:
            type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
            type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
            type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=raw,value=main-{{commit_date 'YYYYMMDDHHmmss'}}-{{sha}},enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
      - name: Merge and publish manifest
        id: manifest
        working-directory: /tmp/gateway-digests
--- a/.github/workflows/mobile-release-candidate.yml
+++ b/.github/workflows/mobile-release-candidate.yml
@@ -12,8 +12,13 @@ on:
        description: Expected next release-candidate number
        required: true
        type: string
+      source_branch:
+        description: Source branch (main or mobile-vMAJOR.MINOR matching version)
+        required: true
+        default: main
+        type: string
      target_sha:
-        description: Exact current block/buzz main commit
+        description: Pinned commit in the selected source branch history
        required: true
        type: string

@@ -65,5 +70,6 @@ jobs:
          GH_TOKEN: ${{ steps.release-tagger.outputs.token }}
          MOBILE_VERSION: ${{ inputs.version }}
          CANDIDATE_NUMBER: ${{ inputs.candidate_number }}
+          SOURCE_BRANCH: ${{ inputs.source_branch }}
          TARGET_SHA: ${{ inputs.target_sha }}
-        run: scripts/publish-mobile-release-candidate.sh "$MOBILE_VERSION" "$CANDIDATE_NUMBER" "$TARGET_SHA"
+        run: scripts/publish-mobile-release-candidate.sh "$MOBILE_VERSION" "$CANDIDATE_NUMBER" "$TARGET_SHA" "$SOURCE_BRANCH"