diff --git a/.cargo/config.toml b/.cargo/config.toml index 2594963..3cd3665 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -2,8 +2,11 @@ # Development quality enforcement aliases check-all = "clippy --all-targets --workspace -- -D warnings" test-all = "test --workspace" -cov = "llvm-cov --workspace --fail-under-lines 100" -verify = ["fmt --all -- --check", "check-all", "test-all"] +cov = "llvm-cov --workspace --ignore-filename-regex main\\.rs --summary-only" +# Dogfooding: build the runnable daemon + reference CLI in release mode. +build-release = ["build", "--release", "-p", "nunciod", "-p", "nuncio-cli"] +# Remove the entire workspace target directory (all crates, all profiles). +clean-all = "clean" [build] # Treat warnings as errors and forbid unsafe code at local build time diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 272defa..34460c6 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -1,6 +1,6 @@ # Contributing to Nuncio -Thank you for contributing to Nuncio ([nuncio.mx](https://nuncio.mx))! +Thank you for contributing to Nuncio! ## Semantic Versioning 2.0.0 & Tagging @@ -9,7 +9,10 @@ Nuncio follows **Semantic Versioning 2.0.0** (`vMAJOR.MINOR.PATCH`): - `MINOR`: Incremented for new functionality added in a backward-compatible manner. - `PATCH`: Incremented for backward-compatible bug fixes. -Tagging a commit with `vX.Y.Z` triggers [.github/workflows/release.yml](file:///R:/Git.Local/KofTwentyTwo/nuncio/.github/workflows/release.yml) to automatically compile cross-platform release artifacts (Windows `.zip`/`.msi`, macOS `.tar.gz`/`.dmg`, Linux `.tar.gz`/`.AppImage`), generate release notes from Conventional Commits, compute SHA256 checksums, and publish an official GitHub Release. +Tagging a commit with `vX.Y.Z` is intended to drive the release workflow under +`.github/workflows/`. **Pre-alpha note:** the release pipeline is being rebuilt and +**no functional release exists yet** — see roadmap milestone M7 (issue #209). Do not +tag releases until the backend is declared client-ready. ## Architecture Decoupling Rules diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 257b825..c066030 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -1,13 +1,17 @@ # Security Policy -Nuncio ([nuncio.mx](https://nuncio.mx)) takes security and data privacy seriously. Because Nuncio handles sensitive mail payloads, calendar schedules, and authentication credentials across Windows, macOS, and Linux, we maintain strict security disclosures and cryptographic standards. +Nuncio handles sensitive mail, calendar, and contact data plus authentication +credentials, so security is a first-class concern. **Status: pre-alpha.** Several +hardening items — at-rest encryption correctness, key zeroization, a fail-closed +signature-verifying updater, and transport/egress hardening — are tracked under +roadmap milestone M6 and are not all complete. **Do not use Nuncio with real +accounts or sensitive data yet.** ## Supported Versions | Version | Supported | | :--- | :--- | -| `0.1.x` | Supported | -| `< 0.1.0` | Unsupported | +| all pre-1.0 | **Not supported** — non-functional pre-alpha, under active reconstruction | ## Reporting a Vulnerability diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 29049ba..b3c72cd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,23 +2,27 @@ name: CI Quality Gates & Build Pipeline on: push: - branches: [ main ] + branches: [ main, dev, rc ] pull_request: - branches: [ main ] + branches: [ main, dev, rc ] env: CARGO_TERM_COLOR: always RUSTFLAGS: "-D warnings" +permissions: + contents: read + jobs: fmt: name: Code Formatting Check runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: dtolnay/rust-toolchain@stable - with: - components: rustfmt + # No toolchain-install action: rust-toolchain.toml pins 1.97.1 (+ rustfmt, + # clippy) and rustup auto-installs it on first cargo/rustc invocation, so + # CI always matches the local pinned toolchain instead of a drifting + # `stable`. - name: Check Formatting run: cargo fmt --all -- --check @@ -27,49 +31,39 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: dtolnay/rust-toolchain@stable - with: - components: clippy - - name: Install Linux Desktop Dependencies - run: | - sudo apt-get update - sudo apt-get install -y libglib2.0-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev build-essential curl wget file libssl-dev - name: Cache Cargo Dependencies uses: Swatinem/rust-cache@v2 - - name: Run Clippy Linter - run: cargo clippy --workspace -- -D warnings + - name: Run Clippy Linter (all targets, matches local `cargo check-all`) + run: cargo check-all test: name: Test Suite Execution runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: dtolnay/rust-toolchain@stable - - name: Install Linux Desktop Dependencies - run: | - sudo apt-get update - sudo apt-get install -y libglib2.0-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev build-essential curl wget file libssl-dev - name: Cache Cargo Dependencies uses: Swatinem/rust-cache@v2 - name: Run Workspace Tests - run: cargo test --workspace + run: cargo test-all coverage: - name: Enforce 100% Code Coverage Threshold + name: Code Coverage (informational) runs-on: ubuntu-latest + continue-on-error: true steps: - uses: actions/checkout@v7 - - uses: dtolnay/rust-toolchain@stable - - name: Install Linux Desktop Dependencies - run: | - sudo apt-get update - sudo apt-get install -y libglib2.0-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev build-essential curl wget file libssl-dev + - name: Install llvm-tools component + run: rustup component add llvm-tools-preview - name: Install cargo-llvm-cov uses: taiki-e/install-action@cargo-llvm-cov - name: Cache Cargo Dependencies uses: Swatinem/rust-cache@v2 - - name: Measure & Enforce Code Coverage Threshold - run: cargo llvm-cov --workspace --ignore-filename-regex "main\.rs" --fail-under-lines 100 + # Coverage is informational only (matches the local `cargo cov` alias): + # no --fail-under-lines threshold, and the job is continue-on-error so a + # coverage regression or tooling hiccup never reds the pipeline. A + # realistic coverage gate is a separate roadmap story. + - name: Measure Code Coverage (informational) + run: cargo cov build-matrix: name: Cross-Platform Build Matrix (${{ matrix.os }}) @@ -81,7 +75,6 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v7 - - uses: dtolnay/rust-toolchain@stable - name: Cache Cargo Dependencies uses: Swatinem/rust-cache@v2 - name: Build All Workspace Crates diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml deleted file mode 100644 index d20a09c..0000000 --- a/.github/workflows/release-desktop.yml +++ /dev/null @@ -1,94 +0,0 @@ -name: Nuncio Desktop GUI Release Pipeline (MSI, DMG, AppImage, Deb) - -on: - push: - branches: - - main - - rc - - dev - tags: - - 'v*' - workflow_dispatch: - -permissions: - contents: write - packages: write - -jobs: - build-tauri: - name: Build Desktop (${{ matrix.platform }}) - strategy: - fail-fast: false - matrix: - include: - - platform: 'macos-latest' - args: '--target aarch64-apple-darwin' - - platform: 'macos-13' - args: '--target x86_64-apple-darwin' - - platform: 'ubuntu-22.04' - args: '' - - platform: 'windows-latest' - args: '' - - runs-on: ${{ matrix.platform }} - steps: - - name: Checkout Code - uses: actions/checkout@v7 - - - name: Setup Node.js - uses: actions/setup-node@v7 - with: - node-version: 20 - - - name: Install Rust Toolchain - uses: dtolnay/rust-toolchain@stable - with: - targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin' || matrix.platform == 'macos-13' && 'x86_64-apple-darwin' || '' }} - - - name: Install Linux Dependencies (Ubuntu) - if: matrix.platform == 'ubuntu-22.04' - run: | - sudo apt-get update - sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf - - - name: Install Frontend UI Dependencies - working-directory: crates/nuncio-gui/ui - run: npm install --legacy-peer-deps - - - name: Install Tauri CLI Dependencies - working-directory: crates/nuncio-gui/src-tauri - run: npm install --legacy-peer-deps - - - name: Determine Environment Channel & Tag - id: env_prep - shell: bash - run: | - if [[ "${{ github.ref }}" == refs/heads/dev ]]; then - echo "channel=dev" >> $GITHUB_OUTPUT - echo "tag_name=dev-latest" >> $GITHUB_OUTPUT - echo "release_name=Nuncio Desktop (Development Nightly)" >> $GITHUB_OUTPUT - echo "is_prerelease=true" >> $GITHUB_OUTPUT - elif [[ "${{ github.ref }}" == refs/heads/rc || "${{ github.ref }}" == refs/tags/*rc* ]]; then - echo "channel=rc" >> $GITHUB_OUTPUT - echo "tag_name=rc-latest" >> $GITHUB_OUTPUT - echo "release_name=Nuncio Desktop (Release Candidate)" >> $GITHUB_OUTPUT - echo "is_prerelease=true" >> $GITHUB_OUTPUT - else - echo "channel=prod" >> $GITHUB_OUTPUT - echo "tag_name=${{ github.ref_name }}" >> $GITHUB_OUTPUT - echo "release_name=Nuncio Desktop Release ${{ github.ref_name }}" >> $GITHUB_OUTPUT - echo "is_prerelease=false" >> $GITHUB_OUTPUT - fi - - - name: Build Tauri Desktop Installers (.msi, .dmg, .AppImage, .deb) - uses: tauri-apps/tauri-action@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - projectPath: 'crates/nuncio-gui/src-tauri' - tagName: ${{ steps.env_prep.outputs.tag_name }} - releaseName: ${{ steps.env_prep.outputs.release_name }} - releaseBody: 'Production Tauri v2 Desktop GUI installers (.msi, .dmg, .AppImage, .deb).' - releaseDraft: false - prerelease: ${{ steps.env_prep.outputs.is_prerelease == 'true' }} - args: ${{ matrix.args }} diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml index 2f67704..4e5490d 100644 --- a/.github/workflows/release-nightly.yml +++ b/.github/workflows/release-nightly.yml @@ -1,11 +1,9 @@ name: Nuncio Nightly & Snapshot Release Pipeline on: - push: - branches: - - dev - schedule: - - cron: '0 2 * * *' # Daily Nightly Build at 02:00 UTC + # Auto-nightly is DISABLED during the pre-alpha rebuild: no public releases + # until V3, and this pipeline builds the presentation GUI now archived under + # _reference/. Manual-only until the release path is restored in Phase 4. workflow_dispatch: permissions: @@ -50,8 +48,6 @@ jobs: run: | mkdir -p dist cp target/${{ matrix.target }}/release/nuncio-cli dist/nuncio-cli - cp target/${{ matrix.target }}/release/nuncio-tui dist/nuncio-tui - cp target/${{ matrix.target }}/release/nuncio-mcp dist/nuncio-mcp cp target/${{ matrix.target }}/release/nunciod dist/nunciod tar -czf ${{ matrix.artifact_name }} -C dist . @@ -61,8 +57,6 @@ jobs: run: | New-Item -ItemType Directory -Path dist Copy-Item target/${{ matrix.target }}/release/nuncio-cli.exe dist/nuncio-cli.exe - Copy-Item target/${{ matrix.target }}/release/nuncio-tui.exe dist/nuncio-tui.exe - Copy-Item target/${{ matrix.target }}/release/nuncio-mcp.exe dist/nuncio-mcp.exe Copy-Item target/${{ matrix.target }}/release/nunciod.exe dist/nunciod.exe Compress-Archive -Path dist/* -DestinationPath ${{ matrix.artifact_name }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 12e7898..bbd97fb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,15 +1,13 @@ name: Nuncio Multi-Platform Release Pipeline (Dev, RC, Prod) on: + # Releases are cut ONLY from version tags (vMAJOR.MINOR.PATCH), per the release + # policy (no public release until V3). Branch-push and nightly-cron triggers were + # removed during the pre-alpha rebuild: they ran on every dev push and failed + # (they build the presentation GUI now archived under _reference/). push: - branches: - - main - - rc - - dev tags: - 'v*' - schedule: - - cron: '0 0 * * *' # Daily Nightly Build at 00:00 UTC workflow_dispatch: permissions: @@ -54,8 +52,6 @@ jobs: run: | mkdir -p dist cp target/${{ matrix.target }}/release/nuncio-cli dist/nuncio-cli - cp target/${{ matrix.target }}/release/nuncio-tui dist/nuncio-tui - cp target/${{ matrix.target }}/release/nuncio-mcp dist/nuncio-mcp cp target/${{ matrix.target }}/release/nunciod dist/nunciod tar -czf ${{ matrix.artifact_name }} -C dist . @@ -65,8 +61,6 @@ jobs: run: | New-Item -ItemType Directory -Path dist Copy-Item target/${{ matrix.target }}/release/nuncio-cli.exe dist/nuncio-cli.exe - Copy-Item target/${{ matrix.target }}/release/nuncio-tui.exe dist/nuncio-tui.exe - Copy-Item target/${{ matrix.target }}/release/nuncio-mcp.exe dist/nuncio-mcp.exe Copy-Item target/${{ matrix.target }}/release/nunciod.exe dist/nunciod.exe Compress-Archive -Path dist/* -DestinationPath ${{ matrix.artifact_name }} @@ -124,17 +118,16 @@ jobs: prerelease: ${{ steps.prep.outputs.is_prerelease == 'true' }} files: dist-final/* body: | - ## Nuncio Sovereign Mail, Calendar & Contacts Suite + ## Nuncio Engine (nunciod + nuncio-cli) **Release Channel**: ${{ steps.prep.outputs.channel }} - ### 📦 Official Installer & Package Downloads - - **Windows Installer**: `Nuncio_x64.msi` (WiX Installer) / `Nuncio_x64-setup.exe` (NSIS) - - **macOS Disk Image**: `Nuncio_x64.dmg` (Intel) / `Nuncio_aarch64.dmg` (Apple Silicon) - - **Linux Packages**: `Nuncio_amd64.AppImage` / `Nuncio_amd64.deb` - - **CLI & Daemon Archives**: `nuncio-x86_64-unknown-linux-gnu.tar.gz`, `nuncio-aarch64-apple-darwin.tar.gz`, `nuncio-x86_64-apple-darwin.tar.gz`, `nuncio-x86_64-pc-windows-msvc.zip` + ### 📦 Daemon & CLI Archives + - `nuncio-x86_64-unknown-linux-gnu.tar.gz` + - `nuncio-aarch64-apple-darwin.tar.gz` + - `nuncio-x86_64-apple-darwin.tar.gz` + - `nuncio-x86_64-pc-windows-msvc.zip` - ### 🚀 Package Managers - - **Homebrew Tap**: `brew install koftwentytwo/tap/nuncio` - - **Cargo Source**: `cargo install --git https://github.com/KofTwentyTwo/nuncio.git nuncio-cli nuncio-tui nuncio-mcp nunciod` + ### 🚀 Cargo Source + - `cargo install --git https://github.com/KofTwentyTwo/nuncio.git nuncio-cli nunciod` Verify payload hashes against `SHA256SUMS.txt`. diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml index 51e9a18..0ef4340 100644 --- a/.github/workflows/wiki-sync.yml +++ b/.github/workflows/wiki-sync.yml @@ -10,6 +10,9 @@ on: - '.github/workflows/wiki-sync.yml' workflow_dispatch: +permissions: + contents: write + jobs: sync-wiki: name: Sync docs/ to GitHub Wiki @@ -27,15 +30,18 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} path: wiki-repo - - name: Sync docs and assets to Wiki + - name: Sync docs and assets to Wiki (mirror with delete) run: | + # Mirror docs/ -> wiki so that files removed from docs/ are also removed + # from the wiki. Preserve only the wiki's .git directory. + find wiki-repo -mindepth 1 -maxdepth 1 -not -name '.git' -exec rm -rf {} + mkdir -p wiki-repo/assets cp -r docs/* wiki-repo/ 2>/dev/null || true cp -r assets/* wiki-repo/assets/ 2>/dev/null || true cd wiki-repo git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" - git add . + git add -A if git diff --staged --quiet; then echo "No changes to commit to Wiki." else diff --git a/.gitignore b/.gitignore index 12c6284..e3a6a68 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,10 @@ Thumbs.db **/build/ package-lock.json + +# Agent scratch + regenerable build artifacts (keep out of the repo) +.superpowers/ +excalidraw.log +_reference/**/gen/ +**/node_modules/ +**/dist/ diff --git a/.idea/runConfigurations/Run_nuncio_gui.xml b/.idea/runConfigurations/Cargo_Build_Release.xml similarity index 70% rename from .idea/runConfigurations/Run_nuncio_gui.xml rename to .idea/runConfigurations/Cargo_Build_Release.xml index 299ad39..b3897b9 100644 --- a/.idea/runConfigurations/Run_nuncio_gui.xml +++ b/.idea/runConfigurations/Cargo_Build_Release.xml @@ -1,13 +1,12 @@ - -