Repository navigation
Prepare the compatible RC host for GitHub app publishing - #370
Merged
Merged
Conversation
ymote
marked this pull request as draft
October 8, 2026 05:21
…veloper-host-release
ymote
changed the title
ymote
changed the title
# Conflicts: # runtime-patches.lock.json
ymote
marked this pull request as ready for review
October 8, 2026 09:31
Contributor
Author
|
Local CI passed on 933abbc ( GitHub would run for this PR: desktop.yml, phone.yml, apps.yml. Merged on this local pass (macOS runner queue); GitHub CI runs on the merge commit on main.
Notes:
Native GitHub acceptance passed on the same head: embedded-browser.yml. |
This was referenced Oct 8, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Developer submissions need a released host that executes declared app tools, discovers supported host APIs and verifies GitHub publisher proofs. This prepares the compatible host for desktop-v0.1.0-rc.1, pinned to merged App Hub ba36df05 and published app-contract 1.8.0. Store, installed-agent admission, backend refresh and Glance launch use the authenticated GitHub catalog by default, retaining publisher history and refusing a cached-channel downgrade.
The integration includes desktop embedded browsers (#361), native platform/backend acceptance (#369), raw host-response JSON forwarding (#371), and Wasm invocation isolation (#367). It also fixes installed L0 cards displaced inside an app pane or clipped below its viewport, through App Hub #162. Both measured cards and responsive role-based cards are covered; script apps retain their layout. The reviewed Makepad tree is 6c080f31, including main’s #376 Splash test-budget override; release builds retain the default 64 ms budget. These implementation PRs are superseded only after this integration merges.
The release pipeline now reads AppImages with a bounded ELF parser and trusted unsquashfs instead of executing an artifact during the privileged scan. Publishing tokens are scoped to GitHub CLI steps, and local builds remove APPLE_API_KEY_P8. Digest-bound exceptions remain limited to independently verified public OctosCode fixtures; private paths, identity patterns and extra scan rules still reject matches. No developer keys, OAuth tokens, personal accounts or provider profiles are included.
Validation on final candidate
933abbcf2737e652acd9cae2a4c9ffc16bfdaec6:128b0524and 14 final-source reopen groups on933abbcf; exact release proofs and drafts persisted. Camera’s public upgrade and final-source Library reopen passed; its first automated post-update Open timeout is preserved as a limitation, not counted as a pass.Preserved earlier evidence, not substitutes for final-head checks:
5a4b3af: 9/9 real native checks, original images reviewed; Hub 91 library tests passedRequired final merge checks have passed. Google/GitHub client registrations are not shipped, and public Google verification is not established. Connected sample listings are macOS-only; live provider writes/model behavior are separate acceptance scopes. Windows/Linux embedded backend login remains unavailable even though ordinary WebReader works. Wasm is still opt-in, off in the default desktop package.