CI on dev, the app started on X11 and Wayland; no silent re-release

ci.yml runs on dev too, adds the hygiene check, check-ui.sh (the modules parsed
as modules; nothing sets HTML) and the vendor pin, and a start job: a debug
build with the bundled page, started under Xvfb and under a headless Weston with
GTK's Wayland backend, which must still be running after 25 seconds.
release.yml refuses a tag that already has a release unless run by hand with
replace, marks betas as pre-releases, and gives a beta's .deb a ~beta version
so it sorts below its release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/check-ui.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# The page's JavaScript parses: the app's modules and the vendored ones as ES modules (a plain
+# `node --check file.js` treats a .js file as CommonJS and passes a module with a syntax error in
+# it), the generated i18n.js as the classic script it is.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+bad=0
+for f in ui/js/*.js ui/vendor/*.mjs; do
+  node --input-type=module --check < "$f" || { echo "check-ui: $f does not parse" >&2; bad=1; }
+done
+node --check ui/i18n.js || { echo "check-ui: ui/i18n.js does not parse" >&2; bad=1; }
+# Nothing the page draws is set as HTML: text goes in as text (ui/js/dom.js).
+if grep -nE '\.(innerHTML|outerHTML)\s*=|insertAdjacentHTML|document\.write' ui/js/*.js; then
+  echo "check-ui: the lines above set HTML from a string" >&2
+  bad=1
+fi
+[ "$bad" -eq 0 ] && echo "check-ui: the page's scripts parse, and none sets HTML"
+exit "$bad"

scripts/ci-start.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Start the built app on a display without a screen and check it is still running 25 seconds
+# later, with nothing in its log saying it stopped. For CI (ci.yml, job `start`):
+#
+#   scripts/ci-start.sh x11        under Xvfb
+#   scripts/ci-start.sh wayland    under a headless Weston, GTK's Wayland backend forced
+#
+# The app starts with an empty home, so it shows its first-run page and talks to no server.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+APP="${LLEMBAS_DESKTOP_BIN:-src-tauri/target/debug/llembas-desktop}"
+[ -x "$APP" ] || { echo "ci-start: no app at $APP; build it first" >&2; exit 1; }
+how="${1:?usage: ci-start.sh x11|wayland}"
+
+home="$(mktemp -d)"
+runtime="$(mktemp -d)"
+chmod 700 "$runtime"
+pids=()
+cleanup() {
+  for p in "${pids[@]}"; do kill "$p" 2>/dev/null || true; done
+  rm -rf "$home" "$runtime"
+}
+trap cleanup EXIT
+
+export HOME="$home" XDG_CONFIG_HOME="$home/.config" XDG_DATA_HOME="$home/.local/share" \
+  XDG_STATE_HOME="$home/.local/state" XDG_CACHE_HOME="$home/.cache" XDG_RUNTIME_DIR="$runtime"
+# No GPU on a runner: Mesa's software renderer.
+export LIBGL_ALWAYS_SOFTWARE=1
+log="$XDG_DATA_HOME/eu.llembas.desktop/logs/desktop.log"
+
+case "$how" in
+  x11)
+    run=(xvfb-run -a -s "-screen 0 1280x840x24")
+    ;;
+  wayland)
+    weston --backend=headless-backend.so --socket=wayland-ci --idle-time=0 --use-pixman \
+      > "$runtime/weston.log" 2>&1 &
+    pids+=("$!")
+    for _ in $(seq 1 50); do
+      [ -S "$runtime/wayland-ci" ] && break
+      sleep 0.2
+    done
+    [ -S "$runtime/wayland-ci" ] || { echo "ci-start: weston did not start" >&2; cat "$runtime/weston.log" >&2; exit 1; }
+    export WAYLAND_DISPLAY=wayland-ci GDK_BACKEND=wayland
+    unset DISPLAY
+    run=()
+    ;;
+  *)
+    echo "ci-start: x11 or wayland, not $how" >&2
+    exit 2
+    ;;
+esac
+
+code=0
+dbus-run-session -- "${run[@]}" timeout 25 "$APP" > "$runtime/app.log" 2>&1 || code=$?
+echo "--- the app's output ($how)"
+cat "$runtime/app.log"
+if [ -f "$log" ]; then
+  echo "--- desktop.log"
+  cat "$log"
+fi
+if [ "$code" -ne 124 ]; then
+  echo "ci-start: on $how the app ended by itself within 25 seconds (exit $code)" >&2
+  exit 1
+fi
+if [ -f "$log" ] && grep -q 'stopped:\|could not start\|could not open the window' "$log"; then
+  echo "ci-start: on $how the app logged a failure" >&2
+  exit 1
+fi
+echo "ci-start: on $how the app was still running after 25 seconds"

scripts/hygiene.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# The repository is public: nothing in it may name the private estate it was written on.
+# The LLeMbas section rule ("everything public is current-state and estate-free"), as a check
+# that runs in CI on every push rather than a sentence somebody has to remember.
+#
+# Patterns are the kinds of thing that leak: a private domain, an internal `.lan` name, a
+# container number, a private address range, a machine's name. This file is the one place that
+# may spell them, and is skipped.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+patterns=(
+  'houmeres'
+  '\b[a-z0-9-]+\.lan\b'
+  '\bCT ?2[0-9]{2}\b'
+  '\b10\.0\.0\.[0-9]+'
+  '\b192\.168\.[0-9]+\.[0-9]+'
+  '\bgamebox\b'
+  '\bthor\b'
+)
+found=0
+for pattern in "${patterns[@]}"; do
+  if git ls-files -z | grep -zv '^scripts/hygiene.sh$' | xargs -0 grep -nIEi -- "$pattern" ; then
+    echo "hygiene: the lines above match /$pattern/" >&2
+    found=1
+  fi
+done
+[ "$found" -eq 0 ] && echo "hygiene: nothing private in the tracked files"
+exit "$found"