s1d3sw1ped/SwipedModSwitcher

Fork 0

build: Pin the fyne CLI and build Windows on the windows runner #44

Merged

linus merged 4 commits from ash/windows-runner-43 into develop

2026-10-22 23:34:08 +00:00

ash commented

2026-10-22 12:04:19 +00:00

Collaborator

Lands #38 (fyne CLI pin + toolchain preflight) together with #43 (native Windows build), so the two don't fight.

#38: preflight and pins

scripts/check-toolchain.sh is the forge-standards copy (develop, after #3) plus one repo-specific block. That block requires the fyne CLI to equal go.mod's fyne.io/fyne/v2 version, with the fix go install fyne.io/fyne/v2/cmd/fyne@v2.3.5.
New Makefile: build, package and lint depend on check-toolchain, and test doesn't. golangci-lint v2.14.0 is only checked for make lint.
go.mod gets toolchain go1.27.2. Every go install fyne.io/fyne/v2/cmd/fyne uses @v2.3.5 (none use @latest), and golangci-lint goes from v2.13.2 to v2.14.0 in all three workflows.
CI runs sh scripts/check-toolchain.sh right after the fyne install, before go mod tidy.
README gets a Building section listing what's checked and how to fix a mismatch.

#43: Windows on the windows runner

Each "Build for windows" step is now its own build-windows job on runs-on: windows. It runs the preflight, then fyne build --os=windows natively with the same output name, and uploads swiped-mod-switcher-windows. It uses the runner's Go, MinGW gcc and fyne v2.3.5, with nothing installed by the workflow.
tag-release.yaml: release needs build-windows and downloads its exe into bin/ before publishing bin/**.
gcc-mingw-w64 and the cross CC are gone from the Linux build/release jobs only. Lint and test keep their apt lines as they were.

Preflight proof (jumpbox, GNU make 4.4.1)

Right toolchain: sh scripts/check-toolchain.sh exits 0.
No fyne CLI: make build stops in check-toolchain and prints found none, required v2.3.5 and the fix. Nothing changes in the tree.
go.mod toolchain line edited to go1.27.1: caught, showing found and required, with the fix git checkout -- go.mod.
make lint with no golangci-lint: stops and prints the v2.14.0 fix.
I couldn't finish a full Linux make build on the jumpbox because it has no X11/GL headers (X11/Xlib.h: No such file). The preflight passed before that error. CI's Linux build has those headers.

Windows run (all green on head fcd4aaf: CI / Build windows 1m59s, Build, Test, Lint): https://git.s1d3sw1ped.com/s1d3sw1ped/SwipedModSwitcher/actions/runs/163. Lint has timeout-minutes: 15 because it hung in run 162.

Windows runner notes: host-mode steps have no bash on PATH and checkouts come out CRLF, so the Windows jobs run in PowerShell, the preflight runs through Git for Windows' sh.exe (next to git), and .gitattributes pins *.sh, go.mod and go.sum to LF.

Closes #38
Closes #43

Lands #38 (fyne CLI pin + toolchain preflight) together with #43 (native Windows build), so the two don't fight. **#38: preflight and pins** - `scripts/check-toolchain.sh` is the forge-standards copy (develop, after #3) plus one repo-specific block. That block requires the fyne CLI to equal go.mod's `fyne.io/fyne/v2` version, with the fix `go install fyne.io/fyne/v2/cmd/fyne@v2.3.5`. - New `Makefile`: `build`, `package` and `lint` depend on `check-toolchain`, and `test` doesn't. golangci-lint v2.14.0 is only checked for `make lint`. - go.mod gets `toolchain go1.27.2`. Every `go install fyne.io/fyne/v2/cmd/fyne` uses `@v2.3.5` (none use `@latest`), and golangci-lint goes from v2.13.2 to v2.14.0 in all three workflows. - CI runs `sh scripts/check-toolchain.sh` right after the fyne install, before `go mod tidy`. - README gets a Building section listing what's checked and how to fix a mismatch. **#43: Windows on the windows runner** - Each "Build for windows" step is now its own `build-windows` job on `runs-on: windows`. It runs the preflight, then `fyne build --os=windows` natively with the same output name, and uploads `swiped-mod-switcher-windows`. It uses the runner's Go, MinGW gcc and fyne v2.3.5, with nothing installed by the workflow. - `tag-release.yaml`: `release` needs `build-windows` and downloads its exe into `bin/` before publishing `bin/**`. - `gcc-mingw-w64` and the cross `CC` are gone from the Linux build/release jobs only. Lint and test keep their apt lines as they were. **Preflight proof (jumpbox, GNU make 4.4.1)** - Right toolchain: `sh scripts/check-toolchain.sh` exits 0. - No fyne CLI: `make build` stops in check-toolchain and prints found `none`, required `v2.3.5` and the fix. Nothing changes in the tree. - go.mod toolchain line edited to go1.27.1: caught, showing found and required, with the fix `git checkout -- go.mod`. - `make lint` with no golangci-lint: stops and prints the v2.14.0 fix. - I couldn't finish a full Linux `make build` on the jumpbox because it has no X11/GL headers (`X11/Xlib.h: No such file`). The preflight passed before that error. CI's Linux build has those headers. Windows run (all green on head fcd4aaf: `CI / Build windows` 1m59s, Build, Test, Lint): https://git.s1d3sw1ped.com/s1d3sw1ped/SwipedModSwitcher/actions/runs/163. Lint has `timeout-minutes: 15` because it hung in run 162. Windows runner notes: host-mode steps have no `bash` on PATH and checkouts come out CRLF, so the Windows jobs run in PowerShell, the preflight runs through Git for Windows' `sh.exe` (next to `git`), and `.gitattributes` pins `*.sh`, `go.mod` and `go.sum` to LF. Closes #38 Closes #43

ash added 2 commits

2026-10-22 12:04:19 +00:00

build: Pin the fyne CLI and build Windows on the windows runner 0fea4df713

Adds scripts/check-toolchain.sh (forge standard plus a fyne CLI check
against go.mod) and a small Makefile whose build, package and lint
targets run it. CI runs the preflight after the fyne install. Pins go.mod
to toolchain go1.27.2, the fyne CLI to v2.3.5 everywhere, and
golangci-lint to v2.14.0.

The Windows build moves out of the Linux jobs into a build-windows job on
the windows runner that runs fyne build --os=windows natively. The tag
release collects the exe from that job. The mingw apt package and cross
CC are gone from the Linux build jobs.

Closes #38
Closes #43

build: Only check golangci-lint for make lint

CI / Build windows (pull_request) Failing after 5s

Details

CI / Lint (pull_request) Successful in 1m39s

Details

CI / Build (pull_request) Successful in 59s

Details

CI / Test (pull_request) Successful in 7m47s

Details

251942ef37

make build and make package don't run golangci-lint, so they shouldn't need
it installed.

ash requested reviews from blake, eva

2026-10-22 12:04:19 +00:00

eva commented

2026-10-22 12:05:12 +00:00

Owner

Review on 251942e: GO from me, once the Windows run is green.

The diff matches #38 and #43. Every fyne install is @v2.3.5, golangci-lint is v2.14.0 in all three workflows, and go.mod has toolchain go1.27.2. The preflight runs right after the fyne install and before go mod tidy, so the go.mod pin check still sees the committed file. The Windows build is its own runs-on: windows job with nothing installed by the workflow, and the release waits for it and pulls its exe into bin/ before publishing. Mingw and the cross CC are gone only from the Linux build and release jobs. Lint and test are untouched.

Before merge:

Run 161 needs to go green, including Build windows, and the run link needs to go in the body as promised. That run is the first proof that sh scripts/check-toolchain.sh (sort -V, awk, fyne version) works under the runner's bash.
Blake has to GO the CI config change, per #43. After that it goes to Linus.

Nit, not blocking: the Windows artifact uses forgejo/upload-artifact@v4 and the Linux one is still actions/upload-artifact@v3. The release download matches the v4 upload, so it works. It would be cleaner to move both to the same action later.

Review on 251942e: GO from me, once the Windows run is green. The diff matches #38 and #43. Every fyne install is `@v2.3.5`, golangci-lint is v2.14.0 in all three workflows, and go.mod has `toolchain go1.27.2`. The preflight runs right after the fyne install and before `go mod tidy`, so the go.mod pin check still sees the committed file. The Windows build is its own `runs-on: windows` job with nothing installed by the workflow, and the release waits for it and pulls its exe into `bin/` before publishing. Mingw and the cross `CC` are gone only from the Linux build and release jobs. Lint and test are untouched. Before merge: - Run 161 needs to go green, including Build windows, and the run link needs to go in the body as promised. That run is the first proof that `sh scripts/check-toolchain.sh` (`sort -V`, awk, `fyne version`) works under the runner's bash. - Blake has to GO the CI config change, per #43. After that it goes to Linus. Nit, not blocking: the Windows artifact uses `forgejo/upload-artifact@v4` and the Linux one is still `actions/upload-artifact@v3`. The release download matches the v4 upload, so it works. It would be cleaner to move both to the same action later.

ash added 1 commit

2026-10-22 12:28:47 +00:00

ci: Run the Windows steps in PowerShell with LF checkouts

CI / Test (pull_request) Successful in 1m0s

Details

CI / Build windows (pull_request) Successful in 2m45s

Details

CI / Build (pull_request) Successful in 2m53s

Details

CI / Lint (pull_request) Has been cancelled

Details

cc85ff48a2

The windows runner has no bash on PATH and checks out with CRLF, so the
first native run failed within seconds. Run the steps in PowerShell, call
the preflight through Git for Windows' sh, and pin scripts and go.mod
to LF in .gitattributes.

eva commented

2026-10-22 12:29:19 +00:00

Owner

Re-review on cc85ff4 (delta from 251942e): still GO from me once run 162 is green, including Build windows.

The fix matches why run 161 failed. The Windows job now runs in PowerShell, finds Git for Windows' sh.exe next to git for the preflight and stops with a clear message if it's missing, and every step checks $LASTEXITCODE. The .gitattributes keeps *.sh, go.mod and go.sum as LF so the pin check compares like with like. The tag-release v strip moved to -replace "^v","", which gives the same file name as before.

Still needed before Linus merges: the green Windows run link in the body, and Blake's GO on the CI config.

Re-review on cc85ff4 (delta from 251942e): still GO from me once run 162 is green, including Build windows. The fix matches why run 161 failed. The Windows job now runs in PowerShell, finds Git for Windows' `sh.exe` next to git for the preflight and stops with a clear message if it's missing, and every step checks `$LASTEXITCODE`. The `.gitattributes` keeps `*.sh`, `go.mod` and `go.sum` as LF so the pin check compares like with like. The tag-release `v` strip moved to `-replace "^v",""`, which gives the same file name as before. Still needed before Linus merges: the green Windows run link in the body, and Blake's GO on the CI config.

eva reviewed

2026-10-22 12:52:18 +00:00

eva left a comment

Not GO yet on cc85ff4. Nothing has changed since my re-review in comment 7031, and the body links run 162. But run 162 isn't green yet. Build windows, Build and Test passed, and CI / Lint has been "running" for over 30 minutes, so it may be stuck.

Ash, please get Lint to finish green on cc85ff4. If it's hung, rerun the job. If it fails, fix it on this same branch and update the run link in the body. My GO follows as soon as the whole run is green. Blake still needs to GO the CI config before Linus merges.

Not GO yet on cc85ff4. Nothing has changed since my re-review in comment 7031, and the body links run 162. But [run 162](https://git.s1d3sw1ped.com/s1d3sw1ped/SwipedModSwitcher/actions/runs/162) isn't green yet. `Build windows`, `Build` and `Test` passed, and `CI / Lint` has been "running" for over 30 minutes, so it may be stuck. Ash, please get Lint to finish green on cc85ff4. If it's hung, rerun the job. If it fails, fix it on this same branch and update the run link in the body. My GO follows as soon as the whole run is green. Blake still needs to GO the CI config before Linus merges.

ash added 1 commit

2026-10-22 12:53:05 +00:00

ci: Time out a hung lint job after 15 minutes

CI / Test (pull_request) Successful in 46s

Details

CI / Lint (pull_request) Successful in 1m25s

Details

CI / Build windows (pull_request) Successful in 1m59s

Details

CI / Build (pull_request) Successful in 2m6s

Details

fcd4aaff58

Lint in run 162 sat at started running for over 30 minutes. Cap it so a
hang fails instead of blocking the PR.

eva commented

2026-10-22 12:53:53 +00:00

Owner

Re-review on fcd4aaf (delta from cc85ff4): the only change is timeout-minutes: 15 on the Lint job in all three workflows. That's fine and I'd keep it, since a hung lint now fails in 15 minutes instead of sitting forever.

It doesn't lift my hold on its own, though. A timeout turns a hang into a red Lint, not a green one. My GO stands once run 163 is fully green, Lint included. If Lint times out again, that points at the runner or golangci-lint v2.14.0 itself, so please say which in the PR before pushing anything else. Blake's CI-config GO is still needed before Linus merges.

Re-review on fcd4aaf (delta from cc85ff4): the only change is `timeout-minutes: 15` on the Lint job in all three workflows. That's fine and I'd keep it, since a hung lint now fails in 15 minutes instead of sitting forever. It doesn't lift my hold on its own, though. A timeout turns a hang into a red Lint, not a green one. My GO stands once [run 163](https://git.s1d3sw1ped.com/s1d3sw1ped/SwipedModSwitcher/actions/runs/163) is fully green, Lint included. If Lint times out again, that points at the runner or golangci-lint v2.14.0 itself, so please say which in the PR before pushing anything else. Blake's CI-config GO is still needed before Linus merges.

eva approved these changes

2026-10-22 13:18:19 +00:00

eva left a comment

APPROVE from Eva on fcd4aaff58. This lifts my hold in review 720 and comment 7052.

Run 163 is fully green on this exact sha: Test 46s, Lint 1m25s (well inside the new 15-minute timeout), Build windows 1m59s, Build 2m6s.
Nothing has changed since my re-review of fcd4aaf in comment 7052, and the PR body links run 163.

This PR changes CI config and the release workflow, so Blake needs to give his GO before Linus merges.

APPROVE from Eva on fcd4aaff58. This lifts my hold in review 720 and comment 7052. - [Run 163](https://git.s1d3sw1ped.com/s1d3sw1ped/SwipedModSwitcher/actions/runs/163) is fully green on this exact sha: Test 46s, Lint 1m25s (well inside the new 15-minute timeout), Build windows 1m59s, Build 2m6s. - Nothing has changed since my re-review of fcd4aaf in comment 7052, and the PR body links run 163. This PR changes CI config and the release workflow, so Blake needs to give his GO before Linus merges.

blake approved these changes

2026-10-22 23:32:52 +00:00

blake left a comment

Approving on fcd4aaff58.

Read all 8 files. This is an improvement: fyne@latest becomes fyne@v2.3.5, Go is pinned with toolchain go1.27.2, golangci-lint goes to v2.14.0, lint gets a timeout, and check-toolchain.sh only reads files and prints. Windows builds move to the windows runner. github.ref_name and run_number reach PowerShell through env: and are read as $env:VERSION/$env:BUILD, not pasted into the script, so a tag name can't inject code. The release job keeps the only contents: write, and the windows job has no token use.

Notes, not blocking:

actions/checkout@v4, golangci-lint-action@v8, actions/upload-artifact@v3 and forgejo/upload/download-artifact@v4 are moving tags. Please pin them by sha, especially in tag-release.yaml.
The released Windows exe is now built on the shared host-mode runner and comes into the release job as an artifact. Run go mod verify before fyne build in tag-release.yaml so a tampered C:\ci module cache can't ship.
pull-request-ci/push-ci have no permissions: block. That predates this PR, but contents: read would be the right default.

Approving on fcd4aaff58. Read all 8 files. This is an improvement: `fyne@latest` becomes `fyne@v2.3.5`, Go is pinned with `toolchain go1.27.2`, golangci-lint goes to v2.14.0, lint gets a timeout, and check-toolchain.sh only reads files and prints. Windows builds move to the windows runner. `github.ref_name` and `run_number` reach PowerShell through `env:` and are read as `$env:VERSION`/`$env:BUILD`, not pasted into the script, so a tag name can't inject code. The release job keeps the only `contents: write`, and the windows job has no token use. Notes, not blocking: - `actions/checkout@v4`, `golangci-lint-action@v8`, `actions/upload-artifact@v3` and `forgejo/upload/download-artifact@v4` are moving tags. Please pin them by sha, especially in tag-release.yaml. - The released Windows exe is now built on the shared host-mode runner and comes into the release job as an artifact. Run `go mod verify` before `fyne build` in tag-release.yaml so a tampered `C:\ci` module cache can't ship. - pull-request-ci/push-ci have no `permissions:` block. That predates this PR, but `contents: read` would be the right default.