release: OpenLess 2.0.2-Beta.5 desktop refresh and usage improvements

.github/actions/cache-npm/action.yml

@@ -9,17 +9,27 @@ runs:
       run: |
         echo "path=$(npm config get cache)" >> "$GITHUB_OUTPUT"
         echo "arch=$(node -p process.arch)" >> "$GITHUB_OUTPUT"
+        # Prefer verified tarballs already in the download cache. Keep network
+        # retries bounded; npm ci still validates the lockfile and integrity.
+        echo 'NPM_CONFIG_PREFER_OFFLINE=true' >> "$GITHUB_ENV"
+        echo 'NPM_CONFIG_AUDIT=false' >> "$GITHUB_ENV"
+        echo 'NPM_CONFIG_FUND=false' >> "$GITHUB_ENV"
+        echo 'NPM_CONFIG_FETCH_RETRIES=2' >> "$GITHUB_ENV"
+        echo 'NPM_CONFIG_FETCH_TIMEOUT=60000' >> "$GITHUB_ENV"
+        echo 'SEGMENT_DOWNLOAD_TIMEOUT_MINS=3' >> "$GITHUB_ENV"
     # Keep setup-node's existing key and path so the current beta cache remains
     # reusable. Cache lookup falls back to the PR base/default branch on a miss.
     - name: Restore npm outside beta builds
-      if: github.ref != 'refs/heads/beta' || (github.event_name != 'push' && github.event_name != 'workflow_dispatch')
+      if: github.ref != 'refs/heads/beta' || (github.event_name != 'push' && github.event_name != 'workflow_dispatch' && github.event_name != 'schedule')
       uses: actions/cache/restore@v4
       with:
         path: ${{ steps.npm.outputs.path }}
         key: node-cache-${{ runner.os }}-${{ steps.npm.outputs.arch }}-npm-${{ hashFiles('openless-all/app/package-lock.json') }}
+        restore-keys: node-cache-${{ runner.os }}-${{ steps.npm.outputs.arch }}-npm-
     - name: Maintain npm cache on beta builds
-      if: github.ref == 'refs/heads/beta' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+      if: github.ref == 'refs/heads/beta' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
       uses: actions/cache@v4
       with:
         path: ${{ steps.npm.outputs.path }}
         key: node-cache-${{ runner.os }}-${{ steps.npm.outputs.arch }}-npm-${{ hashFiles('openless-all/app/package-lock.json') }}
+        restore-keys: node-cache-${{ runner.os }}-${{ steps.npm.outputs.arch }}-npm-

.github/actions/setup-linux-dependencies/action.yml

@@ -0,0 +1,20 @@
+name: Linux build dependencies
+description: Bounded, noninteractive Ubuntu dependency setup shared by tests and packaging
+runs:
+  using: composite
+  steps:
+    - name: Install Ubuntu build dependencies
+      shell: bash
+      run: |
+        set -euo pipefail
+        # Hosted Ubuntu 24.04 already enables universe. Adding it again also
+        # refreshes every configured package feed before our own update.
+        apt_network=(-o Acquire::Retries=2 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30)
+        sudo timeout --kill-after=10s 180s apt-get "${apt_network[@]}" update
+        sudo DEBIAN_FRONTEND=noninteractive timeout --kill-after=10s 300s \
+          apt-get "${apt_network[@]}" install -y --no-install-recommends \
+          appstream build-essential cmake cpio desktop-file-utils \
+          fcitx5-modules-dev file libasound2-dev libdbus-1-dev \
+          libfcitx5config-dev libfcitx5core-dev libfcitx5utils-dev \
+          liblzma-dev libpipewire-0.3-dev libpulse-dev libssl-dev \
+          libwayland-dev libx11-dev libxkbcommon-dev pkg-config ripgrep rpm

.github/workflows/android-apk.yml

@@ -39,13 +39,15 @@ on:
         type: boolean
         default: false
 
-# Repeated pushes of the same tag run only the newest; workflow_dispatch isolates by run_id to avoid mutual cancellation.
+# Supersede equivalent manual builds; different ABI/profile/signing requests stay
+# independent. Tag publication must finish once started.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'push' }}
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}-${{ inputs.abis || 'aarch64' }}-${{ inputs.fast_profile || false }}-${{ inputs.signed_debug || false }}
+  cancel-in-progress: ${{ github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/heads/') }}
 
 jobs:
   plan:
+    timeout-minutes: 10
     name: Plan Android ABI matrix
     permissions:
       contents: read
@@ -148,6 +150,7 @@ jobs:
           echo "Resolved ABIs: $abi_list (fast_profile=$fast)"
 
   build-android-apk:
+    timeout-minutes: 90
     name: Build Android (${{ matrix.abi }})
     needs: plan
     # Publishing is `publish-android-release`. Branch and schedule builds only
@@ -226,6 +229,7 @@ jobs:
           packages: platform-tools
 
       - name: Install NDK and accept SDK licenses
+        timeout-minutes: 15
         shell: bash
         run: |
           set -euo pipefail
@@ -249,8 +253,8 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
-          cache: npm
-          cache-dependency-path: openless-all/app/package-lock.json
+      - name: Cache npm from beta
+        uses: ./.github/actions/cache-npm
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -265,13 +269,15 @@ jobs:
           shared-key: android-${{ matrix.abi }}
           workspaces: openless-all/app/src-tauri -> target
           cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/beta' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
 
       - uses: gradle/actions/setup-gradle@v4
         with:
-          # Keep Gradle caches for post-job save; do not wipe ~/.gradle before post.
-          cache-read-only: false
+          # Keep reusable baseline caches; avoid one large copy per release tag.
+          cache-read-only: ${{ github.ref != 'refs/heads/beta' || (github.event_name != 'schedule' && github.event_name != 'workflow_dispatch') }}
 
       - name: Install npm deps
+        timeout-minutes: 10
         working-directory: openless-all/app
         run: npm ci
 
@@ -318,6 +324,7 @@ jobs:
         run: node scripts/configure-android-release-signing.mjs
 
       - name: Prime Gradle wrapper
+        timeout-minutes: 10
         working-directory: openless-all/app
         shell: bash
         run: |
@@ -333,6 +340,7 @@ jobs:
           exit 1
 
       - name: Build Android debug APK
+        timeout-minutes: 70
         if: needs.plan.outputs.mode == 'debug'
         working-directory: openless-all/app
         env:
@@ -343,6 +351,7 @@ jobs:
         run: npm run tauri:android:build:debug
 
       - name: Build Android release APK
+        timeout-minutes: 70
         if: needs.plan.outputs.mode == 'release'
         working-directory: openless-all/app
         env:
@@ -379,6 +388,7 @@ jobs:
       - name: Upload Android APK artifact
         uses: actions/upload-artifact@v4
         with:
+          retention-days: 14
           name: ${{ needs.plan.outputs.mode == 'release' && format('openless-android-release-{0}', matrix.gradle_abi) || format('openless-android-debug-{0}', matrix.gradle_abi) }}
           path: ${{ steps.apk.outputs.apk_path }}
           if-no-files-found: error
@@ -413,6 +423,7 @@ jobs:
           fi
 
   publish-android-release:
+    timeout-minutes: 30
     name: Publish Android release assets
     if: needs.plan.outputs.is_tag_release == 'true'
     needs: [plan, build-android-apk]
@@ -431,10 +442,11 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
-          cache: npm
-          cache-dependency-path: openless-all/app/package-lock.json
+      - name: Cache npm from beta
+        uses: ./.github/actions/cache-npm
 
       - name: Install npm deps
+        timeout-minutes: 10
         working-directory: openless-all/app
         run: npm ci
 
@@ -532,6 +544,7 @@ jobs:
       - name: Upload Android updater manifests
         uses: actions/upload-artifact@v4
         with:
+          retention-days: 14
           name: openless-android-updater-manifests
           if-no-files-found: error
           path: |

.github/workflows/cache-maintenance.yml

@@ -6,12 +6,15 @@ name: Cache maintenance
 # cold build. This job keeps the budget visible and drops the scopes that can
 # never be restored again: pull requests that are already closed or merged.
 #
-# It runs weekly and on demand. It never touches branch or tag scopes, so the
-# caches the release path depends on are safe.
+# It runs daily, when a pull request closes, and on demand. It retains the
+# newest branch generations and never prunes tag scopes.
 on:
   schedule:
-    # Monday 03:17 UTC: after the weekend, before the working week.
-    - cron: '17 3 * * 1'
+    # Daily cleanup prevents superseded build generations evicting baseline caches.
+    - cron: '17 3 * * *'
+  pull_request:
+    types: [closed]
+    branches: [main, beta]
   workflow_dispatch:
 
 permissions:

.github/workflows/check-linux-egui.yml

@@ -68,18 +68,11 @@ jobs:
         if: inputs.scope != 'none'
 
       - name: Install native build and test dependencies
+        timeout-minutes: 10
         if: inputs.scope != 'none'
         # Same list as the packaging job: the fcitx5 plugin build and the
         # `pwsh` contract scripts both live here now.
-        run: |
-          sudo add-apt-repository -y universe || true
-          sudo apt-get update
-          sudo apt-get install -y \
-            appstream build-essential cmake cpio desktop-file-utils \
-            fcitx5-modules-dev file libasound2-dev libdbus-1-dev \
-            libfcitx5config-dev libfcitx5core-dev libfcitx5utils-dev \
-            liblzma-dev libpipewire-0.3-dev libpulse-dev libssl-dev \
-            libwayland-dev libx11-dev libxkbcommon-dev pkg-config ripgrep rpm
+        uses: ./.github/actions/setup-linux-dependencies
 
       - uses: swatinem/rust-cache@v2
         if: inputs.scope != 'none'
@@ -103,6 +96,7 @@ jobs:
           test -s build/openless.conf
 
       - name: Test Core, Linux host, and platform boundaries
+        timeout-minutes: 40
         if: inputs.scope != 'none'
         working-directory: openless-all/app
         run: |
@@ -136,6 +130,7 @@ jobs:
           pwsh -NoProfile -File ./scripts/check-linux-public-surface.ps1
 
       - name: Test remote input TLS identity and Unix key permissions
+        timeout-minutes: 20
         if: inputs.scope != 'none'
         working-directory: openless-all/app
         run: cargo test --locked --manifest-path src-tauri/backend-tests/Cargo.toml --test remote_tls
@@ -162,16 +157,9 @@ jobs:
           ref: ${{ inputs.checkout_ref || github.ref }}
 
       - name: Install native build and packaging dependencies
+        timeout-minutes: 10
         if: inputs.scope != 'none'
-        run: |
-          sudo add-apt-repository -y universe || true
-          sudo apt-get update
-          sudo apt-get install -y \
-            appstream build-essential cmake cpio desktop-file-utils \
-            fcitx5-modules-dev file libasound2-dev libdbus-1-dev \
-            libfcitx5config-dev libfcitx5core-dev libfcitx5utils-dev \
-            liblzma-dev libpipewire-0.3-dev libpulse-dev libssl-dev \
-            libwayland-dev libx11-dev libxkbcommon-dev pkg-config ripgrep rpm
+        uses: ./.github/actions/setup-linux-dependencies
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -235,11 +223,13 @@ jobs:
           appstreamcli validate --no-net openless-all/app/linux-egui/packaging/top.openless.OpenLess.metainfo.xml
 
       - name: Build Linux egui host
+        timeout-minutes: 40
         if: inputs.scope != 'none'
         working-directory: openless-all/app
         run: cargo build --locked --release -p openless-linux-egui
 
       - name: Package deb and rpm without Tauri
+        timeout-minutes: 10
         if: inputs.scope != 'none'
         working-directory: openless-all/app
         env:
@@ -285,6 +275,7 @@ jobs:
         if: inputs.scope != 'none' && (github.event_name != 'push' || env.RELEASE_TAG != '')
         uses: actions/upload-artifact@v7
         with:
+          retention-days: 14
           name: openless-linux-egui-x86_64
           path: openless-all/app/target/linux-egui-packages/*
           if-no-files-found: error
@@ -293,6 +284,7 @@ jobs:
         if: inputs.scope != 'none' && (github.event_name != 'push' || env.RELEASE_TAG != '')
         uses: actions/upload-artifact@v7
         with:
+          retention-days: 14
           name: openless-linux-egui-direct-download
           path: ${{ runner.temp }}/openless-linux-egui-direct-download/*
           if-no-files-found: error
@@ -306,7 +298,15 @@ jobs:
       GH_REPO: ${{ github.repository }}
       GH_TOKEN: ${{ github.token }}
       RELEASE_TAG: ${{ inputs.release_tag }}
+      LINUX_ACCEPTED_RELEASE_TAG: ${{ vars.LINUX_ACCEPTED_RELEASE_TAG }}
     steps:
+      - name: Verify exact-tag Linux acceptance
+        run: |
+          set -euo pipefail
+          if [ -z "$RELEASE_TAG" ] || [ "$LINUX_ACCEPTED_RELEASE_TAG" != "$RELEASE_TAG" ]; then
+            echo "::error::Linux device acceptance must be recorded for this exact release tag before publication."
+            exit 1
+          fi
       - name: Download verified Linux packages
         uses: actions/download-artifact@v8
         with: