punktfunk

Files

T

enricobuehlerandClaude Fable 5 c14308bf71 ci: the supply chain accounts for itself — per-release SBOM, full-tree audits, a real license gate

CRA Annex I Part II groundwork (see punktfunk-planning design/cra-readiness.md, Phase 1):

* sbom.yml + scripts/ci/gen-sbom.sh: every vX.Y.Z release gets a CycloneDX
  SBOM attached — syft over both Cargo.locks, all Bun/pnpm trees and the
  Swift Package.resolved (2,667 components), merged with
  compliance/sbom/manual-components.cdx.json for what no lockfile records
  (pyrowave/Granite/volk/Vulkan-Headers pins, libvpl, FFmpeg, SDL3,
  VB-CABLE, punktfunk-gamescope).
* audit.yml: bun audit now covers sdk + plugin-kit (not just web), decky's
  pnpm tree is scanned, and docs-site runs non-blocking until its known
  CMS-chain advisories are cleared. All shipping trees verified green today.
* license-gate: about.toml's allowlist claim is finally enforced —
  cargo-about 0.9.1 with --fail over BOTH workspaces. The old [crate.clarify]
  license-only syntax fails to deserialize under 0.9; migrated ring to a
  per-crate accepted extension and dropped the stale aws-lc-sys entry
  (workspace is ring-only). Both gates validated green locally.
* drivers/Cargo.lock: sync the pf-dualsense→pf-gamepad rename — the crate
  rename updated the manifest but the Windows-only lockfile was never
  regenerated; cargo-about's metadata pass caught it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-28 22:21:59 +02:00

check-android-jni-imports.sh

fix(android): client loads again on Android < 13 — dlsym the API-33 render callback

2026-07-10 10:06:31 +02:00

discord-announce.sh

feat(ci/release): author release notes in-repo + announce stable releases to Discord

2026-07-23 16:43:18 +02:00

docker-prune.service

ci(runner): cap the act_runner cache + 30-min prune (fix recurring disk-full)

2026-06-19 07:53:08 +00:00

docker-prune.sh

ci(runner): cap the act_runner cache + 30-min prune (fix recurring disk-full)