Fix audit findings, expand tests, add a CI quality gate #3

Merged

Breadway merged 1 commit from fix/deepseek-audit into main

2026-08-31 18:56:06 +08:00

Breadway commented

2026-08-31 18:54:03 +08:00

Owner

Folds in the local fix/deepseek-audit branch (the user's own audit-fix commit). No rebase needed — based on current main.

The commit

Wallpaper crop now centred on the software (wl_shm) path so it agrees with the GPU path and the greeter (was top-left anchored).
Desktop-entry Exec tokenizer honours single quotes + backslash escaping per the freedesktop spec.
Greeter: dispatches CancelSession on every reset to the username stage (no stale PAM conversation left in greetd); per-roundtrip timeout so a wedged greetd peer can't strand the "Working" spinner.
start_locker returns an error instead of spawning a child that expect()-panics when WAYLAND_DISPLAY is unset.
PAM concurrency cap — libpam can't be cancelled, so a stuck module previously leaked an uncancellable thread per retry.
Tests → 157 (tokenizer edge cases + pseudo-fuzz, blit offset/clamp, H+V cover centring, greetd roundtrip-timeout + connection-recovery).
New .forgejo/workflows/ci.yml — fmt --check, clippy -D warnings, all-target tests, locked release build. Previously the only workflow was the Arch package builder.

Stripped the Generated with Codebuff / Co-Authored-By: Codebuff trailers from the message to match the rest of the repo history.

Checks (local, mirrors the new CI gate)

cargo fmt --all -- --check · cargo clippy --workspace --all-targets -- -D warnings · cargo test --workspace --all-targets (157 pass) · cargo build --release --locked — all clean.

Folds in the local `fix/deepseek-audit` branch (the user's own audit-fix commit). No rebase needed — based on current `main`. ## The commit - **Wallpaper crop** now centred on the software (`wl_shm`) path so it agrees with the GPU path and the greeter (was top-left anchored). - **Desktop-entry Exec tokenizer** honours single quotes + backslash escaping per the freedesktop spec. - **Greeter**: dispatches `CancelSession` on every reset to the username stage (no stale PAM conversation left in greetd); per-roundtrip timeout so a wedged greetd peer can't strand the "Working" spinner. - **`start_locker`** returns an error instead of spawning a child that `expect()`-panics when `WAYLAND_DISPLAY` is unset. - **PAM concurrency cap** — libpam can't be cancelled, so a stuck module previously leaked an uncancellable thread per retry. - **Tests → 157** (tokenizer edge cases + pseudo-fuzz, blit offset/clamp, H+V cover centring, greetd roundtrip-timeout + connection-recovery). - **New `.forgejo/workflows/ci.yml`** — `fmt --check`, `clippy -D warnings`, all-target tests, locked release build. Previously the only workflow was the Arch package builder. Stripped the `Generated with Codebuff` / `Co-Authored-By: Codebuff` trailers from the message to match the rest of the repo history. ## Checks (local, mirrors the new CI gate) `cargo fmt --all -- --check` · `cargo clippy --workspace --all-targets -- -D warnings` · `cargo test --workspace --all-targets` (157 pass) · `cargo build --release --locked` — all clean.

Breadway added 1 commit 2026-08-31 18:54:03 +08:00

Fix audit findings, expand tests, and add a CI quality gate

CI / check (pull_request) Failing after 6s

Details

1636eb86d0

Addresses the deep codebase audit:

- Center the static wallpaper cover-fit crop so the software (wl_shm)
  path agrees with the GPU path and the greeter, instead of anchoring
  the crop top-left.
- Desktop-entry Exec tokenizer: respect single quotes and proper
  backslash escaping per the freedesktop spec.
- Greeter: dispatch CancelSession whenever the UI resets to the
  username stage so the error path can't leave greetd holding a stale
  PAM conversation; add a per-roundtrip timeout so a wedged greetd peer
  can't strand the "Working" spinner.
- start_locker: return an error instead of spawning a child that
  expect()-panics when WAYLAND_DISPLAY is unset.
- Bound in-flight PAM checks with a concurrency cap, since libpam
  cannot be cancelled and a stuck module would otherwise leak one
  uncancellable thread per retry.
- Expand unit/regression tests (157 total): tokenizer edge cases and a
  pseudo-fuzz, blit offset/clamp cases, horizontal+vertical cover
  centering, greetd roundtrip-timeout and connection-recovery.
- Reformat the workspace to rustfmt-clean and add a Forgejo CI gate
  (fmt --check, clippy -D warnings, all-target tests, locked release
  build) — previously the only workflow was an Arch package builder.

Breadway merged commit 758a5d9f9c into main

2026-08-31 18:56:06 +08:00

Breadway referenced this pull request from a commit

2026-08-31 18:56:09 +08:00

Merge pull request 'Fix audit findings, expand tests, add a CI quality gate' (#3) from fix/deepseek-audit into main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Breadway/breadlock#3

No description provided.

Rows
Columns