build(linux): release notes, JSON upgraders, arm64, hotfix, user docs

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -53,7 +53,9 @@ body:
     id: version
     attributes:
       label: TablePro version
-      description: TablePro > About TablePro. Updates install in the background, so this is often not the newest.
+      description: >-
+        About TablePro shows it. On macOS, updates install in the background, so this is often not the newest.
+        On Linux, `tablepro --version` prints it too.
       placeholder: "0.74.0"
     validations:
       required: true
@@ -74,14 +76,42 @@ body:
     id: os
     attributes:
       label: OS version & hardware
-      placeholder: "macOS 15.3 / Apple Silicon"
+      description: >-
+        On Linux, the distribution and its version, and the desktop and session,
+        which `echo $XDG_CURRENT_DESKTOP $XDG_SESSION_TYPE` prints.
+      placeholder: "macOS 15.3 / Apple Silicon, or Ubuntu 26.04 / GNOME, wayland"
+    validations:
+      required: false
+
+  - type: dropdown
+    id: linux-install
+    attributes:
+      label: Installed from (Linux)
+      options:
+        - Ubuntu PPA
+        - Fedora COPR
+        - Built from source
+    validations:
+      required: false
+
+  - type: textarea
+    id: linux-debug-info
+    attributes:
+      label: Debugging information (Linux)
+      description: >-
+        About TablePro > Troubleshooting > Debugging Information, then Copy Text.
+        It holds versions, not connection details.
+      render: text
     validations:
       required: false
 
   - type: textarea
     id: context
     attributes:
       label: Screenshots / Logs
-      description: If applicable, add screenshots, screen recordings, or crash logs.
+      description: >-
+        If applicable, add screenshots, screen recordings, or crash logs.
+        On Linux, `journalctl --user --boot | grep -i tablepro` shows the log, and crash reports
+        are in `~/.local/state/tablepro/crashes/`. Logs name your hosts and tables, so read them first.
     validations:
       required: false

.github/workflows/linux-packages.yml

@@ -8,6 +8,9 @@ name: Linux packages
 # fedora:44 with only its BuildRequires. Each package is then installed in
 # another fresh container with only its runtime dependencies and started.
 # release-linux.yml calls this workflow and uploads the source packages.
+# A run by hand can add arm64, which pushes and pull requests leave out.
+# Given a release tag, it packages that release's tarballs instead, with
+# the packaging from this checkout, for a PPA upload with a new revision.
 
 on:
   pull_request:
@@ -31,12 +34,29 @@ on:
       - "linux/**"
       - ".github/workflows/linux-packages.yml"
   workflow_dispatch:
+    inputs:
+      arm64:
+        description: Also build, test and install the arm64 .deb and .rpm
+        type: boolean
+        default: false
   workflow_call:
     inputs:
       deb-runners:
         description: JSON list of runners; each series' .deb is built once per runner architecture.
         type: string
         default: '["ubuntu-24.04"]'
+      rpm-runners:
+        description: JSON list of runners; the .rpm is built once per runner architecture.
+        type: string
+        default: '["ubuntu-24.04"]'
+      release-tag:
+        description: A published linux-vX.Y.Z whose tarballs are packaged, with the .deb packaging from this checkout. No .rpm is built.
+        type: string
+        default: ""
+      revision:
+        description: The PPA upload number, the N in X.Y.Z-0ppaN.
+        type: string
+        default: "1"
 
 permissions:
   contents: read
@@ -59,7 +79,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Make the source and vendor tarballs
+        if: inputs.release-tag == ''
         run: linux/build-aux/packaging/make-sources.sh --install-deps _packages/sources
+      - name: Download the released source and vendor tarballs
+        if: inputs.release-tag != ''
+        env:
+          TAG: ${{ inputs.release-tag }}
+        run: linux/build-aux/packaging/fetch-release-sources.sh --install-deps "$GITHUB_REPOSITORY" "$TAG" _packages/sources
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: linux-sources
@@ -88,11 +114,18 @@ jobs:
           path: _packages/sources
       - name: Build an unsigned source package for each series
         id: build
+        env:
+          RELEASE_TAG: ${{ inputs.release-tag }}
+          REVISION: ${{ inputs.revision || '1' }}
         run: |
           dist="$(find _packages/sources -name 'tablepro-*.tar.xz' ! -name '*-vendor.tar.xz')"
           vendor="$(find _packages/sources -name 'tablepro-*-vendor.tar.xz')"
+          set -- --revision "$REVISION"
+          if [ -n "$RELEASE_TAG" ]; then
+            set -- "$@" --debian linux/build-aux/debian
+          fi
           # shellcheck disable=SC2086 # one word per series
-          linux/build-aux/packaging/build-source.sh --install-deps "$dist" "$vendor" _packages/source $UBUNTU_SERIES
+          linux/build-aux/packaging/build-source.sh --install-deps "$@" "$dist" "$vendor" _packages/source $UBUNTU_SERIES
           series=""
           for name in $UBUNTU_SERIES; do
             series="$series${series:+, }\"$name\""
@@ -112,7 +145,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner: ${{ fromJSON(inputs.deb-runners || '["ubuntu-24.04"]') }}
+        runner: ${{ fromJSON(inputs.deb-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
         series: ${{ fromJSON(needs.source-package.outputs.series) }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 300
@@ -151,9 +184,14 @@ jobs:
           if-no-files-found: error
 
   rpm:
-    name: RPM package
+    name: RPM package (${{ matrix.runner }})
     needs: sources
-    runs-on: ubuntu-24.04
+    if: inputs.release-tag == ''
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 300
     container:
       image: fedora:44
@@ -174,20 +212,24 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: linux-rpm-testlog
+          name: linux-rpm-testlog-${{ runner.arch }}
           path: _packages/rpm/testlog.txt
           if-no-files-found: ignore
           retention-days: 7
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: linux-rpm
+          name: linux-rpm-${{ runner.arch }}
           path: _packages/rpm
           if-no-files-found: error
 
   rpm-install:
-    name: Install the RPM package
+    name: Install the RPM package (${{ matrix.runner }})
     needs: rpm
-    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: ${{ fromJSON(inputs.rpm-runners || (inputs.arm64 && '["ubuntu-24.04", "ubuntu-24.04-arm"]') || '["ubuntu-24.04"]') }}
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 20
     container:
       image: fedora:44
@@ -197,7 +239,7 @@ jobs:
           persist-credentials: false
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: linux-rpm
+          name: linux-rpm-${{ runner.arch }}
           path: _packages/rpm
       - name: Install, start and validate
         run: linux/build-aux/packaging/smoke-test.sh "$(find _packages/rpm -name 'tablepro-[0-9]*.rpm' ! -name '*.src.rpm')"

.github/workflows/release-linux.yml

@@ -8,7 +8,13 @@ name: Release Linux
 # A pre-release tag such as linux-v0.2.0-rc.1 publishes a GitHub
 # pre-release and skips the PPA and COPR.
 #
-# Environment linux-release, limited to linux-v* tags, holds two secrets.
+# Run by hand on a branch, it uploads a published release to the PPA again
+# as X.Y.Z-0ppaN, from that release's tarballs with the branch's .deb
+# packaging: a packaging fix that needs no new version. linux/docs/releasing.md
+# has the steps.
+#
+# Environment linux-release, limited to linux-v* tags and the branch a
+# packaging fix runs on, with a required reviewer, holds two secrets.
 # LINUX_PPA_SIGNING_KEY: the ASCII-armored OpenPGP secret key, with no
 # passphrase, that signs the uploads. Its public key is registered on a
 # Launchpad account that may upload to the PPA.
@@ -20,6 +26,16 @@ name: Release Linux
 on:
   push:
     tags: ["linux-v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: The published release to upload again, such as linux-v0.1.0
+        required: true
+        type: string
+      revision:
+        description: The PPA upload number, 2 or more (X.Y.Z-0ppaN)
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -31,6 +47,7 @@ concurrency:
 jobs:
   verify:
     name: Tag, version and release notes
+    if: github.event_name == 'push'
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     container:
@@ -74,6 +91,7 @@ jobs:
     uses: ./.github/workflows/linux-packages.yml
     with:
       deb-runners: '["ubuntu-24.04", "ubuntu-24.04-arm"]'
+      rpm-runners: '["ubuntu-24.04", "ubuntu-24.04-arm"]'
 
   github-release:
     name: GitHub release
@@ -108,10 +126,53 @@ jobs:
           gh release create "$TAG" release/* --repo "$GITHUB_REPOSITORY" --verify-tag --latest=false \
             --title "TablePro for Linux $version" --notes-file notes.md "$@"
 
+  revision:
+    name: Release and revision to upload again
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: The tag is a published release, and the revision a new upload
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+          REVISION: ${{ inputs.revision }}
+        run: |
+          version="${TAG#linux-v}"
+          case "$version" in
+            "$TAG" | "" | *[!0-9.]*)
+              echo "::error::$TAG is not the tag of a Linux release; a pre-release is not on the PPA"
+              exit 1
+              ;;
+          esac
+          case "$REVISION" in
+            "" | *[!0-9]* | 0* | 1)
+              echo "::error::Revision $REVISION is not 2 or more; 1 was the release's own upload"
+              exit 1
+              ;;
+          esac
+          prerelease="$(gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json isPrerelease --jq .isPrerelease)"
+          if [ "$prerelease" != false ]; then
+            echo "::error::$TAG is not a published release"
+            exit 1
+          fi
+
+  revision-packages:
+    name: Packages
+    needs: revision
+    uses: ./.github/workflows/linux-packages.yml
+    with:
+      deb-runners: '["ubuntu-24.04", "ubuntu-24.04-arm"]'
+      release-tag: ${{ inputs.tag }}
+      revision: ${{ inputs.revision }}
+
   ppa:
     name: Upload to the Launchpad PPA
-    needs: [verify, packages]
-    if: needs.verify.outputs.prerelease == 'false'
+    needs: [verify, packages, revision-packages]
+    if: >-
+      !cancelled() && (
+        (needs.packages.result == 'success' && needs.verify.outputs.prerelease == 'false') ||
+        needs.revision-packages.result == 'success')
     runs-on: ubuntu-24.04
     environment: linux-release
     timeout-minutes: 30

SECURITY.md

@@ -6,8 +6,8 @@ Email **hello@tablepro.app**. Do not open a public issue, discussion or pull req
 
 Include:
 
-- What is affected and its version: the Mac app, the iPhone and iPad app, a plugin, or tablepro.app.
-- The macOS or iOS version, and the database type when a driver is involved.
+- What is affected and its version: the Mac app, the iPhone and iPad app, the Linux app, a plugin, or tablepro.app.
+- The macOS or iOS version, or the Linux distribution and where the app came from, and the database type when a driver is involved.
 - Steps to reproduce, or a proof of concept.
 - What an attacker gains: the data or access exposed.
 
@@ -17,9 +17,10 @@ Write in English or Vietnamese.
 
 - The Mac app.
 - The iPhone and iPad app.
+- The Linux app, from the Launchpad PPA, the COPR project or a source build of a release.
 - The plugins, bundled with the app or installed from the [plugin registry](https://github.com/TableProApp/plugins).
 - The website, [tablepro.app](https://tablepro.app).
 
 ## Supported versions
 
-Only the latest release of each app and plugin gets security fixes. A fix ships in a new release and is listed under **Security** in [CHANGELOG.md](CHANGELOG.md). Older releases are not patched. Check that the problem is still in the latest release before you report it.
+Only the latest release of each app and plugin gets security fixes. A fix ships in a new release and is listed under **Security** in [CHANGELOG.md](CHANGELOG.md), or in `linux/CHANGELOG.md` for the Linux app. Older releases are not patched. Check that the problem is still in the latest release before you report it.