Update CI and release workflows to use Fedora 43 and enhance RPM validation checks

Sopwit · Sopwit · commit 0a14a22c161a · 2026-05-10T20:34:15.000+03:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -20,12 +20,8 @@ jobs:
   build:
     name: Build & Test
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        fedora: [41, 42]
     container:
-      image: fedora:${{ matrix.fedora }}
+      image: fedora:43
 
     steps:
       - name: Checkout repository
@@ -45,7 +41,6 @@ jobs:
             kf6-qqc2-desktop-style \
             polkit-devel \
             clang-tools-extra \
-            qt6-qtbase-private-devel \
             desktop-file-utils \
             appstream
 
@@ -74,10 +69,10 @@ jobs:
           xargs -0 clang-format --dry-run --Werror
 
   package-rpm:
-    name: RPM Build Check
+    name: RPM Build Check (Fedora 43)
     runs-on: ubuntu-latest
     container:
-      image: fedora:42
+      image: fedora:43
 
     steps:
       - name: Checkout repository
@@ -94,12 +89,13 @@ jobs:
             gcc-c++ \
             ninja-build \
             qt6-qtbase-devel \
-            qt6-qtbase-private-devel \
             qt6-qtdeclarative-devel \
             qt6-qttools-devel \
             qt6-qtwayland-devel \
             kf6-qqc2-desktop-style \
-            polkit-devel
+            polkit-devel \
+            desktop-file-utils \
+            appstream
 
       - name: Prepare source tarball
         id: prep
@@ -123,9 +119,56 @@ jobs:
 
       - name: Build RPM
         run: |
+          FEDORA_VERSION=43
           rpmbuild -ba "${HOME}/rpmbuild/SPECS/ro-control.spec" \
             --define "_topdir ${HOME}/rpmbuild" \
-            --define "upstream_version ${{ steps.prep.outputs.version }}"
+            --define "upstream_version ${{ steps.prep.outputs.version }}" \
+            --define "dist .fc${FEDORA_VERSION}"
+
+      - name: Validate desktop metadata
+        run: |
+          desktop-file-validate data/icons/io.github.projectroasd.rocontrol.desktop
+          appstreamcli validate --no-net data/icons/io.github.projectroasd.rocontrol.metainfo.xml
+
+      - name: Verify Fedora 43 RPM compatibility
+        run: |
+          MAIN_RPM="$(find ~/rpmbuild/RPMS -maxdepth 2 -type f -name 'ro-control-*.x86_64.rpm' | head -n1)"
+          COMMON_RPM="$(find ~/rpmbuild/RPMS -maxdepth 2 -type f -name 'ro-control-common-*.noarch.rpm' | head -n1)"
+
+          if [[ -z "${MAIN_RPM}" ]]; then
+            echo "Failed to locate ro-control x86_64 RPM." >&2
+            exit 1
+          fi
+
+          if [[ -z "${COMMON_RPM}" ]]; then
+            echo "Failed to locate ro-control-common noarch RPM." >&2
+            exit 1
+          fi
+
+          rpm -qpR "${MAIN_RPM}" | tee /tmp/ro-control.requires
+          if grep -E 'Qt_6\.10|PRIVATE_API' /tmp/ro-control.requires; then
+            echo "Forbidden Qt private or Fedora 44-era Qt ABI dependency detected." >&2
+            exit 1
+          fi
+
+          rpm -qpl "${MAIN_RPM}" | grep -Fx '/usr/bin/ro-control'
+          if rpm -qpl "${COMMON_RPM}" | grep -Fx '/usr/bin/ro-control'; then
+            echo "/usr/bin/ro-control must not be shipped by ro-control-common." >&2
+            exit 1
+          fi
+
+      - name: Install and smoke-test RPMs
+        run: |
+          MAIN_RPM="$(find ~/rpmbuild/RPMS -maxdepth 2 -type f -name 'ro-control-*.x86_64.rpm' | head -n1)"
+          COMMON_RPM="$(find ~/rpmbuild/RPMS -maxdepth 2 -type f -name 'ro-control-common-*.noarch.rpm' | head -n1)"
+
+          dnf clean all
+          dnf -y --refresh --setopt=install_weak_deps=False install "${MAIN_RPM}" "${COMMON_RPM}"
+
+          rpm -q ro-control
+          command -v ro-control
+          rpm -q --whatprovides /usr/bin/ro-control | grep -Fx 'ro-control'
+          ldd -r /usr/bin/ro-control
 
       - name: Lint built RPMs
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -120,7 +120,7 @@ jobs:
           - arch: aarch64
             runs_on: ubuntu-24.04-arm
     container:
-      image: fedora:latest
+      image: fedora:43
 
     steps:
       - name: Checkout repository
@@ -142,7 +142,6 @@ jobs:
             gcc-c++ \
             ninja-build \
             qt6-qtbase-devel \
-            qt6-qtbase-private-devel \
             qt6-qtdeclarative-devel \
             qt6-qttools-devel \
             qt6-qtwayland-devel \
@@ -160,7 +159,7 @@ jobs:
           mkdir -p ~/rpmbuild/SOURCES ~/rpmbuild/SPECS dist/rpm
           cp "dist/${ARCHIVE_PREFIX}.tar.gz" "${HOME}/rpmbuild/SOURCES/"
           cp packaging/rpm/ro-control.spec "${HOME}/rpmbuild/SPECS/ro-control.spec"
-          FEDORA_VERSION="$(rpm -E %fedora)"
+          FEDORA_VERSION=43
           MAIN_RPM_PATTERN="ro-control-[0-9]*.${RPM_ARCH}.rpm"
           COMMON_RPM_PATTERN="ro-control-common-[0-9]*.noarch.rpm"
 
@@ -191,6 +190,33 @@ jobs:
           rpm -qp --info "${RPM_FILE}" > "dist/rpm/ro-control-${VERSION}-${RPM_ARCH}-info.txt"
           rpm -qp --requires "${RPM_FILE}" | sort > "dist/rpm/ro-control-${VERSION}-${RPM_ARCH}-requires.txt"
           rpm -qlp "${RPM_FILE}" | sort > "dist/rpm/ro-control-${VERSION}-${RPM_ARCH}-files.txt"
+          if grep -E 'Qt_6\.10|PRIVATE_API' "dist/rpm/ro-control-${VERSION}-${RPM_ARCH}-requires.txt"; then
+            echo "Forbidden Qt private ABI dependency detected." >&2
+            exit 1
+          fi
+          grep -Fx '/usr/bin/ro-control' "dist/rpm/ro-control-${VERSION}-${RPM_ARCH}-files.txt"
+
+      - name: Verify main/common package split
+        env:
+          RPM_ARCH: ${{ matrix.arch }}
+        run: |
+          MAIN_RPM_FILE="$(find dist/rpm -maxdepth 1 -type f -name "ro-control-*.${RPM_ARCH}.rpm" | head -n1)"
+          COMMON_RPM_FILE="$(find dist/rpm -maxdepth 1 -type f -name 'ro-control-common-*.noarch.rpm' | head -n1)"
+
+          if [[ -z "${MAIN_RPM_FILE}" ]]; then
+            echo "Main ro-control RPM is missing." >&2
+            exit 1
+          fi
+
+          if [[ -z "${COMMON_RPM_FILE}" ]]; then
+            echo "ro-control-common noarch RPM is missing." >&2
+            exit 1
+          fi
+
+          if rpm -qpl "${COMMON_RPM_FILE}" | grep -Fx '/usr/bin/ro-control'; then
+            echo "/usr/bin/ro-control must not be shipped by ro-control-common." >&2
+            exit 1
+          fi
 
       - name: Validate desktop metadata
         run: |
@@ -226,6 +252,10 @@ jobs:
             exit 1
           fi
 
+          rpm -q ro-control
+          command -v ro-control
+          rpm -q --whatprovides /usr/bin/ro-control | grep -Fx 'ro-control'
+          ldd -r /usr/bin/ro-control
           ro-control --help > /dev/null
 
       - name: Generate per-arch checksums
diff --git a/.github/workflows/rpm-artifacts.yml b/.github/workflows/rpm-artifacts.yml
@@ -77,7 +77,7 @@ jobs:
           - arch: aarch64
             runs_on: ubuntu-24.04-arm
     container:
-      image: fedora:latest
+      image: fedora:43
 
     steps:
       - name: Checkout repository
@@ -99,12 +99,13 @@ jobs:
             gcc-c++ \
             ninja-build \
             qt6-qtbase-devel \
-            qt6-qtbase-private-devel \
             qt6-qtdeclarative-devel \
             qt6-qttools-devel \
             qt6-qtwayland-devel \
             kf6-qqc2-desktop-style \
-            polkit-devel
+            polkit-devel \
+            desktop-file-utils \
+            appstream
 
       - name: Build RPM artifacts
         env:
@@ -115,24 +116,53 @@ jobs:
           mkdir -p ~/rpmbuild/SOURCES ~/rpmbuild/SPECS dist/rpm
           cp "dist/${ARCHIVE_PREFIX}.tar.gz" "${HOME}/rpmbuild/SOURCES/"
           cp packaging/rpm/ro-control.spec "${HOME}/rpmbuild/SPECS/ro-control.spec"
-          FEDORA_VERSION="$(rpm -E %fedora)"
-          RPM_PATTERN="ro-control-[0-9]*.${RPM_ARCH}.rpm"
+          FEDORA_VERSION=43
+          MAIN_RPM_PATTERN="ro-control-[0-9]*.${RPM_ARCH}.rpm"
+          COMMON_RPM_PATTERN="ro-control-common-[0-9]*.noarch.rpm"
 
           rpmbuild -ba "${HOME}/rpmbuild/SPECS/ro-control.spec" \
             --define "_topdir ${HOME}/rpmbuild" \
             --define "upstream_version ${VERSION}" \
             --define "dist .fc${FEDORA_VERSION}"
 
-          RPM_FILE="$(find ~/rpmbuild/RPMS -maxdepth 2 -type f -name "${RPM_PATTERN}" | head -n1)"
-          if [[ -z "${RPM_FILE}" ]]; then
-            echo "Failed to find built ${RPM_ARCH} RPM." >&2
+          MAIN_RPM_FILE="$(find ~/rpmbuild/RPMS -maxdepth 2 -type f -name "${MAIN_RPM_PATTERN}" | head -n1)"
+          if [[ -z "${MAIN_RPM_FILE}" ]]; then
+            echo "Failed to find built ${RPM_ARCH} main RPM." >&2
+            exit 1
+          fi
+
+          cp "${MAIN_RPM_FILE}" dist/rpm/
+
+          COMMON_RPM_FILE="$(find ~/rpmbuild/RPMS -maxdepth 2 -type f -name "${COMMON_RPM_PATTERN}" | head -n1)"
+          if [[ -n "${COMMON_RPM_FILE}" ]]; then
+            cp "${COMMON_RPM_FILE}" dist/rpm/
+          fi
+
+      - name: Validate metadata and RPM dependency surface
+        env:
+          RPM_ARCH: ${{ matrix.arch }}
+        run: |
+          desktop-file-validate data/icons/io.github.projectroasd.rocontrol.desktop
+          appstreamcli validate --no-net data/icons/io.github.projectroasd.rocontrol.metainfo.xml
+
+          MAIN_RPM_FILE="$(find dist/rpm -maxdepth 1 -type f -name "ro-control-*.${RPM_ARCH}.rpm" | head -n1)"
+          COMMON_RPM_FILE="$(find dist/rpm -maxdepth 1 -type f -name 'ro-control-common-*.noarch.rpm' | head -n1)"
+
+          rpm -qpR "${MAIN_RPM_FILE}" | tee /tmp/ro-control.requires
+          if grep -E 'Qt_6\.10|PRIVATE_API' /tmp/ro-control.requires; then
+            echo "Forbidden Qt private ABI dependency detected." >&2
+            exit 1
+          fi
+
+          rpm -qpl "${MAIN_RPM_FILE}" | grep -Fx '/usr/bin/ro-control'
+          if [[ -n "${COMMON_RPM_FILE}" ]] && rpm -qpl "${COMMON_RPM_FILE}" | grep -Fx '/usr/bin/ro-control'; then
+            echo "/usr/bin/ro-control must only be shipped by the main RPM." >&2
             exit 1
           fi
-          cp "${RPM_FILE}" "dist/rpm/ro-control-${RPM_ARCH}.rpm"
 
       - name: Upload RPM artifacts
         uses: actions/upload-artifact@v4
         with:
           name: ro-control-${{ matrix.arch }}-rpm
           path: |
-            dist/rpm/ro-control-${{ matrix.arch }}.rpm
+            dist/rpm/*
