Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
90 changes: 90 additions & 0 deletions .github/workflows/package-registries.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,90 @@
name: Build package registry artifacts

on:
workflow_dispatch:

env:
CARGO_TERM_COLOR: always

jobs:
build_apt:
name: Build APT package
runs-on: ubuntu-latest

steps:
- name: Checkout
uses: actions/checkout@v4

- name: Install Rust toolchain
uses: actions-rs/toolchain@v1
with:
toolchain: stable
profile: minimal
override: true

- name: Install Debian packaging tools
run: |
sudo apt-get update
sudo apt-get install -y --no-install-recommends \
debhelper \
devscripts \
pkg-config

- name: Build Debian package
run: |
cd registries/apt
dpkg-buildpackage -us -uc -b

- name: Collect Debian artifacts
run: |
mkdir -p artifacts/apt
find registries -maxdepth 1 -type f -name "*.deb" -exec cp {} artifacts/apt/ \;

- name: Upload Debian artifacts
uses: actions/upload-artifact@v4
with:
name: apt-package
path: artifacts/apt/*.deb

build_flatpak:
Comment on lines +11 to +49

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 2 months ago

In general, the fix is to define an explicit permissions: block that grants only the minimal required scopes for the GITHUB_TOKEN, either at the workflow root (applies to all jobs) or per job. Since neither job needs to modify repository contents, a restrictive root‑level block such as permissions: { contents: read } is appropriate; the jobs use actions/checkout and actions/upload-artifact, both of which work with contents: read and do not require write access.

The best fix here without changing existing functionality is to add a single permissions: block at the top level of .github/workflows/package-registries.yml, between on: and env: (or directly under name: / on:), setting contents: read. No job appears to need any additional scopes (packages, pull-requests, etc.), and there are no GitHub API calls that would require broader access. This single block will satisfy CodeQL, document the required permissions, and ensure that if the repo/org defaults change, this workflow continues to run with only read access to repository contents.

Concretely, edit .github/workflows/package-registries.yml to insert:

permissions:
    contents: read

just after the on: block (line 5), leaving the rest of the workflow unchanged.

Suggested changeset 1
.github/workflows/package-registries.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/package-registries.yml b/.github/workflows/package-registries.yml
--- a/.github/workflows/package-registries.yml
+++ b/.github/workflows/package-registries.yml
@@ -3,6 +3,9 @@
 on:
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 env:
     CARGO_TERM_COLOR: always
 
EOF
@@ -3,6 +3,9 @@
on:
workflow_dispatch:

permissions:
contents: read

env:
CARGO_TERM_COLOR: always

Copilot is powered by AI and may make mistakes. Always verify output.
name: Build Flatpak bundle
runs-on: ubuntu-latest

steps:
- name: Checkout
uses: actions/checkout@v4

- name: Install Flatpak tools
run: |
sudo apt-get update
sudo apt-get install -y --no-install-recommends \
flatpak \
flatpak-builder \
curl

- name: Install Flatpak runtimes
run: |
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
flatpak install -y flathub org.freedesktop.Platform//24.08 org.freedesktop.Sdk//24.08

- name: Resolve source SHA when placeholder is present
run: |
manifest="registries/flatpak/io.github.ghimiresdp.furl.yml"
if grep -q "REPLACE_WITH_ACTUAL_SHA256" "$manifest"; then
url=$(grep -E "^[[:space:]]*url:" "$manifest" | head -n 1 | sed -E "s/^[[:space:]]*url:[[:space:]]*//")
curl -L "$url" -o /tmp/furl-source.tar.gz
sha=$(sha256sum /tmp/furl-source.tar.gz | awk '{print $1}')
sed -i "s/REPLACE_WITH_ACTUAL_SHA256/$sha/" "$manifest"
fi

- name: Build Flatpak repo and bundle
run: |
mkdir -p artifacts/flatpak
flatpak-builder --force-clean --repo=flatpak-repo flatpak-build registries/flatpak/io.github.ghimiresdp.furl.yml
flatpak build-bundle flatpak-repo artifacts/flatpak/io.github.ghimiresdp.furl.flatpak io.github.ghimiresdp.furl

- name: Upload Flatpak artifacts
uses: actions/upload-artifact@v4
with:
name: flatpak-bundle
path: artifacts/flatpak/*.flatpak
Comment on lines +50 to +90

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 2 months ago

In general, fix this by explicitly setting a restricted permissions block for the workflow (applies to all jobs) or for each job individually. For this workflow, both jobs only need to read repository contents (for checkout) and upload artifacts (which does not require repo write permissions), so we can safely restrict the GITHUB_TOKEN to contents: read at the top level. This documents the intended permissions and prevents the token from obtaining broader rights if repo/org defaults change or the workflow is copied elsewhere.

The best minimal fix without changing functionality is to add a root-level permissions: section beneath the on: block in .github/workflows/package-registries.yml, with contents: read. This will apply to both build_apt and build_flatpak jobs since neither defines its own permissions block. No other changes, imports, or YAML restructuring are necessary.

Suggested changeset 1
.github/workflows/package-registries.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/package-registries.yml b/.github/workflows/package-registries.yml
--- a/.github/workflows/package-registries.yml
+++ b/.github/workflows/package-registries.yml
@@ -3,6 +3,9 @@
 on:
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 env:
     CARGO_TERM_COLOR: always
 
EOF
@@ -3,6 +3,9 @@
on:
workflow_dispatch:

permissions:
contents: read

env:
CARGO_TERM_COLOR: always

Copilot is powered by AI and may make mistakes. Always verify output.
1 change: 1 addition & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ on:
push:
tags:
- "v*"
workflow_dispatch:

jobs:
build:
Expand Down
12 changes: 12 additions & 0 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -83,3 +83,15 @@ cargo ws version minor
# patch version
cargo ws version patch
```

After bumping the version, sync registry metadata files automatically:

```shell
./scripts/sync_registry_metadata.sh
```

You can run both in one line, for example:

```shell
cargo ws version patch && ./scripts/sync_registry_metadata.sh
```
5 changes: 5 additions & 0 deletions registries/apt/debian/changelog
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
furl-cli (0.6.2-1) unstable; urgency=medium

* Initial Debian packaging template for the project registry.

-- Sudip Ghimire <ghimiresdp@users.noreply.github.com> Sat, 15 Mar 2026 00:00:00 +0000
15 changes: 15 additions & 0 deletions registries/apt/debian/control
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
Source: furl-cli
Section: utils
Priority: optional
Maintainer: Sudip Ghimire <ghimiresdp@users.noreply.github.com>
Build-Depends: debhelper-compat (= 13), cargo, rustc, pkg-config
Standards-Version: 4.7.0
Homepage: https://github.com/ghimiresdp/furl-cli
Rules-Requires-Root: no

Package: furl-cli
Architecture: any
Depends: ${shlibs:Depends}, ${misc:Depends}
Description: Fast, multithreaded CLI downloader built in Rust
furl is a high-performance command-line downloader that can split
downloads into chunks and fetch them concurrently.
1 change: 1 addition & 0 deletions registries/apt/debian/install
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../target/release/furl usr/bin
7 changes: 7 additions & 0 deletions registries/apt/debian/rules
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
#!/usr/bin/make -f

%:
dh $@

override_dh_auto_build:
cargo build --manifest-path ../../Cargo.toml --release --locked
1 change: 1 addition & 0 deletions registries/apt/debian/source/format
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
3.0 (native)
16 changes: 16 additions & 0 deletions registries/flatpak/io.github.ghimiresdp.furl.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
app-id: io.github.ghimiresdp.furl
runtime: org.freedesktop.Platform
runtime-version: "24.08"
sdk: org.freedesktop.Sdk
command: furl
finish-args:
- --share=network
modules:
- name: furl
buildsystem: simple
build-commands:
- install -Dm755 furl /app/bin/furl
sources:
- type: archive
url: https://github.com/ghimiresdp/furl-cli/releases/download/v0.6.2/furl-v0.6.2-linux-x86_64.tar.gz
sha256: REPLACE_WITH_ACTUAL_SHA256
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# Created using wingetcreate 1.12.8.0
# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json

PackageIdentifier: ghimiresdp.furl
PackageVersion: 0.6.2
InstallerType: zip
NestedInstallerType: portable
NestedInstallerFiles:
- RelativeFilePath: furl.exe
PortableCommandAlias: furl
Installers:
- Architecture: x64
InstallerUrl: https://github.com/ghimiresdp/furl-cli/releases/download/v0.6.2/furl-v0.6.2-windows-x86_64.zip
InstallerSha256: A2AE2C1216CFCFBD4484AEF6E60C7451804ADC2CC81142ABB98434442CDFDD87
ManifestType: installer
ManifestVersion: 1.12.0
ReleaseDate: 2026-03-15
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# Created using wingetcreate 1.12.8.0
# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json

PackageIdentifier: ghimiresdp.furl
PackageVersion: 0.6.2
PackageLocale: en-US
Publisher: Sudip Ghimire
PublisherUrl: https://github.com/ghimiresdp
PublisherSupportUrl: https://github.com/ghimiresdp/furl-cli/issues
PackageName: furl-cli
PackageUrl: https://github.com/ghimiresdp/furl-cli
License: Apache-2.0
ShortDescription: A fast, multithreaded CLI downloader built in Rust.
Tags:
- download-manager
- downloader
- file-downloader
- network-util
ReleaseNotesUrl: https://github.com/ghimiresdp/furl-cli/releases/tag/v0.6.2
Documentations:
- DocumentLabel: Wiki
DocumentUrl: https://github.com/ghimiresdp/furl-cli/wiki
ManifestType: defaultLocale
ManifestVersion: 1.12.0
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Created using wingetcreate 1.12.8.0
# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json

PackageIdentifier: ghimiresdp.furl
PackageVersion: 0.6.2
DefaultLocale: en-US
ManifestType: version
ManifestVersion: 1.12.0
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# Created using wingetcreate 1.12.8.0
# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json

PackageIdentifier: ghimiresdp.furl
PackageVersion: 0.7.0
InstallerType: zip
NestedInstallerType: portable
NestedInstallerFiles:
- RelativeFilePath: furl.exe
PortableCommandAlias: furl
Installers:
- Architecture: x64
InstallerUrl: https://github.com/ghimiresdp/furl-cli/releases/download/v0.7.0/furl-v0.7.0-windows-x86_64.zip
InstallerSha256: 1C08229C611F344ACC91089418ADD3665070DDC1143E27B2383A553C4D5F2336
ManifestType: installer
ManifestVersion: 1.12.0
ReleaseDate: 2026-03-28
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# Created using wingetcreate 1.12.8.0
# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json

PackageIdentifier: ghimiresdp.furl
PackageVersion: 0.7.0
PackageLocale: en-US
Publisher: Sudip Ghimire
PublisherUrl: https://github.com/ghimiresdp
PublisherSupportUrl: https://github.com/ghimiresdp/furl-cli/issues
PackageName: furl-cli
PackageUrl: https://github.com/ghimiresdp/furl-cli
License: Apache-2.0
ShortDescription: A fast, multithreaded CLI downloader built in Rust.
Tags:
- download-manager
- downloader
- file-downloader
- network-util
ReleaseNotesUrl: https://github.com/ghimiresdp/furl-cli/releases/tag/v0.7.0
Documentations:
- DocumentLabel: Wiki
DocumentUrl: https://github.com/ghimiresdp/furl-cli/wiki
ManifestType: defaultLocale
ManifestVersion: 1.12.0
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Created using wingetcreate 1.12.8.0
# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json

PackageIdentifier: ghimiresdp.furl
PackageVersion: 0.7.0
DefaultLocale: en-US
ManifestType: version
ManifestVersion: 1.12.0
35 changes: 35 additions & 0 deletions scripts/sync_registry_metadata.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
#!/usr/bin/env bash
set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

version="${1:-}"
if [[ -z "$version" ]]; then
version="$(sed -nE 's/^version = "([^"]+)"/\1/p' "$repo_root/Cargo.toml" | head -n 1)"
fi

if [[ -z "$version" ]]; then
echo "Could not determine version from Cargo.toml" >&2
exit 1
fi

tag="v${version}"

winget_file="$repo_root/registries/winget/ghimiresdp.furl.yml"
flatpak_file="$repo_root/registries/flatpak/io.github.ghimiresdp.furl.yml"
apt_changelog="$repo_root/registries/apt/debian/changelog"

if [[ -f "$winget_file" ]]; then
sed -Ei "s|^(PackageVersion: ).*$|\\1${version}|" "$winget_file"
sed -Ei "s|(InstallerUrl: .*?/download/)v[^/]+(/furl-)v[^-]+(-windows-x86_64\\.zip)|\\1${tag}\\2${tag}\\3|" "$winget_file"
fi

if [[ -f "$flatpak_file" ]]; then
sed -Ei "s|(url: .*?/download/)v[^/]+(/furl-)v[^-]+(-linux-x86_64\\.tar\\.gz)|\\1${tag}\\2${tag}\\3|" "$flatpak_file"
fi

if [[ -f "$apt_changelog" ]]; then
sed -Ei "1 s/^furl-cli \([^)-]+-([0-9]+)\) /furl-cli (${version}-\\1) /" "$apt_changelog"
fi

echo "Synchronized registry metadata to version ${version}."
Loading