Files
voculinux/.github/workflows/distro-test-matrix.yml
T
Sergey SilaevandGitHub 582d494633 chore(build): uv tooling, a Python 3.11 floor, and verified model downloads (epic #701, phases 2.5 & 5) (#713)
* chore(build): migrate justfile tooling to uv

All recipes now run through 'uv run' against .venv, with a shared
DEV_EXTRAS variable (dev + vad) because uv syncs the environment
exactly and would otherwise uninstall the dev tools between
recipes. 'deps' installs dev+vad; new 'deps-all' covers every
extra. 'build' switches to 'uv build'; 'version' uses --no-sync.

Bump [tool.uv] required-version to >=0.12,<0.13 for uv 0.12.x, and
raise the mypy python_version target to 3.12: mypy 1.19 in the lock
cannot target 3.9 and numpy 2.x stubs need a 3.12 target to parse
(mypy is not run in CI or pre-commit; this only affects 'just
typecheck').

* fix(tests): isolate test runs from real XDG state; fix Arch model-path crash

Local test runs failed en masse (185 failures) while CI stayed
green: tests picked up the developer's real ~/.local/share/vocalinux
models via the default XDG paths and switched IBus/keyboard code
paths through the desktop session env (XDG_CURRENT_DESKTOP/
XDG_SESSION_TYPE on GNOME/Wayland, issue #478 branches). conftest
now points XDG base dirs at a throwaway session-wide directory and
clears session variables at import time, mirroring a fresh CI
runner (paths like MODELS_DIR freeze at first import during
collection, so fixture-time isolation is too late).

Also guard the Arch branch of _get_system_model_paths(): it removed
/usr/local/share/vocalinux/models unconditionally and crashed with
ValueError on Arch hosts when a custom XDG_DATA_DIRS never added
that path. Add regression tests, and make the lock-file test assert
the actual $XDG_DATA_HOME/vocalinux contract instead of the
hardcoded ~/.local/share default.

* fix(tests): keep the IBus engine double a plain class

Python 3.14's unittest.mock re-instantiates a user subclass when it builds
child mocks (klass(name=...)). VocalinuxEngine inherits from whatever
IBus.Engine resolves to, and the test module bound that to the MagicMock
class itself, so every engine instantiation raised

    TypeError: VocalinuxEngine.__init__() got an unexpected keyword argument 'name'

on 3.14 while passing on 3.13. Replace it with a plain stand-in class that
still hands out per-instance MagicMocks for the IBus API surface the engine
touches.

The same pattern remains in test_ibus_engine.py, test_ibus_engine_utils.py,
test_ibus_active_engine_guard.py and test_ibus_xkb_wayland.py; those never
instantiate the engine, so they are unaffected for now.

* fix(install): build the venv from the system Python

install.sh looked up a bare `python3` from PATH. Started from an activated
virtualenv — a shell left in uv's .venv after `just deps` — it built venv/
from that interpreter, where distro PyGObject is invisible even with
--system-site-packages, and the run aborted with

    Distro PyGObject (python3-gi / python3-gobject) is not importable in the venv.

A mismatched venv/ then survived every retry, because the installer reuses
whatever venv it finds.

- drop an inherited VIRTUAL_ENV (and its bin from PATH) before any
  interpreter lookup
- select the interpreter explicitly: $SYSTEM_PYTHON (default
  /usr/bin/python3) or PATH python3, preferring one that can import gi,
  and create the venv with it instead of `python3`
- recreate venv/ when it was built by a different interpreter
- name the interpreter in the PyGObject guard's error

Documents the two environments (uv's .venv for tooling, venv/ for the
installed app) in CONTRIBUTING, the justfile header and AGENTS.md, and adds
the mismatch symptom to the INSTALL troubleshooting section.

* chore(python): raise the supported floor to 3.11

requires-python promised 3.9 while the CI matrix ran 3.9/3.10/3.11/3.13,
the classifiers advertised up to 3.14, mypy targeted 3.12 and install.sh
enforced 3.9 — five different answers to "which Python does this support".

Settle on 3.11 everywhere: pyproject (requires-python, classifiers, black
targets), install.sh's MIN_VERSION, check-system-deps.sh, the distro package
map, the CI matrix (now 3.11-3.14, matching the classifiers), the release and
nightly workflows, and the docs.

mypy now targets the floor instead of 3.12, so type checking covers what we
promise; numpy 2.x ships stubs in 3.12 syntax that a 3.11 target cannot
parse, so its imports are skipped. (mypy has 71 pre-existing errors either
way; no CI job gates on it.)

uv.lock and the requirements/* exports are regenerated — dropping 3.9/3.10
removes most of the version-conditional resolution branches.

tests/test_python_version_policy.py pins the invariant: install.sh's floor,
requires-python, the classifiers and the CI matrix must agree.

* ci: run lint and tests from uv.lock

The lock file and the hash-pinned exports were not enforced anywhere: CI
still built a venv by hand and installed unpinned `PyGObject` plus
`-e ".[dev,vad]"`, so the tool versions it checked against had nothing to do
with the ones `just lint` uses locally.

Both Python jobs now use astral-sh/setup-uv and run through `uv sync
--locked` / `uv run --locked`, which also fails the build when uv.lock drifts
from pyproject.toml.

Partially covers phase 5 of #701 (tests install from the lock, lock freshness
gate); trusted publishing, artifact checksums and action SHA pinning are
still open there.

* ci: lint from a dedicated dependency group

The lint job failed on this branch: `uv run --extra dev` syncs the whole
project, so it tried to build pyaudio from source on a runner that installs
no system dependencies.

    src/pyaudio/device_api.c:9:10: fatal error: portaudio.h: No such file or directory

Move black/isort/flake8 out of the `dev` extra into a `lint` dependency
group. CI runs `uv run --locked --only-group lint`, which installs the three
pure-Python tools and skips the project entirely — no portaudio or
girepository headers needed. `just deps` and DEV_EXTRAS request the group
alongside the dev extras, so the local environment still carries test and
lint tooling at once and `just lint` matches CI version for version.

pre-commit is unaffected: its hooks pin their own tool versions upstream.

* fix(install): never configure an engine the venv cannot import

vosk became an optional extra in #705, but the installer still writes
`"engine": "vosk"` into config.json on the whisper.cpp fallback path even
when installing the extra only produced a warning. config.json also survives
reinstalls — every writer guards on "file does not exist" — so an engine
picked by an earlier attempt outlives the venv that supported it. Either way
Vocalinux dies at startup:

    ModuleNotFoundError: No module named 'vosk'

- the fallback now writes the vosk config only when `import vosk` actually
  succeeds, and otherwise leaves the engine configuration alone
- a new verify_configured_engine() runs near the end of the install: if
  config.json selects vosk and the venv cannot import it, it says so and
  prints both fixes instead of leaving a broken install behind

* feat(models): verify every model download against a pinned digest

Pins a sha256/md5 per downloadable speech model in
src/vocalinux/utils/model_checksums.txt and verifies against it in both
install.sh and the runtime downloaders, before the file is moved into place.
Verification fails closed. Covers phase 2.5 of #701; see the PR for details.

* docs(agents): rebase AGENTS.md onto the #727 rewrite

* fix(install): hash models that are already on disk instead of trusting them

* refactor(models): one download path per engine, and fix Whisper's

* docs(install): drop distros that cannot meet the 3.11 floor

* docs: retire the distros and Python versions the 3.11 floor rules out

* fix(install): abort instead of warning when Python is below the floor

* fix(install): fall back to the system Python, not the one on PATH

* fix(install): match an existing venv by installation, not by X.Y

* fix(install): repair a config naming an engine the venv cannot import

* fix(models): pin VOSK by the sha256 of bytes we fetched, not upstream's md5

* fix(justfile): request the dev set in every recipe that syncs

* test(version): scan the docs and website trees for a stale Python floor

* docs: correct the stale model-checksum and distro claims

* fix(models): stamp the VOSK tree the app extracts, as the installer does

* fix(install): replace an unverified VOSK model only once its successor is ready

* docs(install): align the Fedora floor with the rest of the tree

* test(install): drop an f-string with no placeholders

* test(models): stub the downloader probe the VOSK installer test relies on

* docs: drop the long dashes from two model-checksum comments

* fix(install): gate on the interpreter, not on the distro release label

* fix(justfile): export the lint group into requirements/dev.txt

* fix(models): unpack the VOSK tree into staging and stamp it before the swap

* fix(whisper): adopt a checkpoint an earlier release stored under the catalog name

* docs(settings): state what a stray Whisper copy really means for deletion

* fix(models): hash a whisper.cpp model found on disk before it reaches ctypes

* docs(contributing): stop telling readers to uninstall their linters

* fix(install): stop warning off distros the project documents as supported

* docs(distros): file the supported derivatives under supported
2026-08-24 00:25:06 -07:00

285 lines
11 KiB
YAML

name: Distro Test Matrix
on:
push:
branches: [ main, master ]
paths:
- 'install.sh'
- 'scripts/**'
- 'pyproject.toml'
- 'src/vocalinux/version.py'
- '.github/workflows/distro-test-matrix.yml'
pull_request:
branches: [ main, master ]
paths:
- 'install.sh'
- 'scripts/**'
- 'pyproject.toml'
- 'src/vocalinux/version.py'
- '.github/workflows/distro-test-matrix.yml'
workflow_dispatch:
jobs:
test:
name: Test on ${{ matrix.container }}
runs-on: ubuntu-latest
continue-on-error: true
strategy:
fail-fast: false
matrix:
container:
- ubuntu:24.04
- ubuntu:26.04
- debian:12
- fedora:39
container:
image: ${{ matrix.container }}
steps:
- name: Checkout code
uses: actions/checkout@v5
- name: Install basic dependencies
run: |
set -e
# Install bash and basic tools
if command -v apt-get >/dev/null 2>&1; then
apt-get update
apt-get install -y bash curl python3 git
elif command -v dnf >/dev/null 2>&1; then
# Fedora needs cache update first in container environment
dnf clean all || true
dnf makecache || true
dnf install -y bash curl python3 git || {
echo "⚠ dnf install failed, trying with --nogpgcheck..."
dnf install -y --nogpgcheck bash curl python3 git
}
fi
# ============================================================================
# TEST 1: Verify /etc/os-release exists and distro detection works
# ============================================================================
- name: Test distro detection
run: |
echo "=== Testing Distro Detection ==="
if [ -f /etc/os-release ]; then
echo "/etc/os-release exists: OK"
cat /etc/os-release
else
echo "/etc/os-release NOT found: FAIL"
exit 1
fi
# ============================================================================
# TEST 2: Test the distro detection logic from install.sh
# ============================================================================
# Note: We cannot source install.sh directly because it has a root check
# that fails in containers. Instead, we test the same logic independently.
- name: Test detect_distro() function
run: |
echo "=== Testing detect_distro() Function ==="
# Verify the function exists in install.sh
if grep -q "detect_distro()" install.sh; then
echo "✓ detect_distro() function found in install.sh"
else
echo "✗ detect_distro() function not found"
exit 1
fi
# Test the distro detection logic (same as in install.sh)
. /etc/os-release
DISTRO_NAME="$NAME"
DISTRO_ID="$ID"
DISTRO_VERSION="$VERSION_ID"
DISTRO_FAMILY="unknown"
if [[ "$ID" == "ubuntu" || "$ID_LIKE" == *"ubuntu"* || "$ID" == "pop" || "$ID" == "linuxmint" || "$ID" == "elementary" || "$ID" == "zorin" ]]; then
DISTRO_FAMILY="ubuntu"
elif [[ "$ID" == "debian" || "$ID_LIKE" == *"debian"* ]]; then
DISTRO_FAMILY="debian"
elif [[ "$ID" == "fedora" || "$ID_LIKE" == *"fedora"* || "$ID" == "rhel" || "$ID" == "centos" || "$ID" == "rocky" || "$ID" == "almalinux" ]]; then
DISTRO_FAMILY="fedora"
elif [[ "$ID" == "arch" || "$ID_LIKE" == *"arch"* || "$ID" == "manjaro" || "$ID" == "endeavouros" ]]; then
DISTRO_FAMILY="arch"
elif [[ "$ID" == "opensuse" || "$ID_LIKE" == *"suse"* ]]; then
DISTRO_FAMILY="suse"
elif [[ "$ID" == "gentoo" ]]; then
DISTRO_FAMILY="gentoo"
elif [[ "$ID" == "alpine" ]]; then
DISTRO_FAMILY="alpine"
elif [[ "$ID" == "void" ]]; then
DISTRO_FAMILY="void"
elif [[ "$ID" == "solus" ]]; then
DISTRO_FAMILY="solus"
elif [[ "$ID" == "mageia" ]]; then
DISTRO_FAMILY="mageia"
fi
echo "Detected: $DISTRO_NAME $DISTRO_VERSION ($DISTRO_FAMILY family)"
echo "DISTRO_FAMILY=$DISTRO_FAMILY"
echo "DISTRO_ID=$DISTRO_ID"
# Verify we detected a known family
if [[ "$DISTRO_FAMILY" == "unknown" ]]; then
echo "⚠ Warning: Distro family is 'unknown', this may indicate incomplete detection"
else
echo "✓ Distro detection successful"
fi
# ============================================================================
# TEST 3: Test detect_typelib_path() function
# ============================================================================
- name: Test detect_typelib_path() function
run: |
echo "=== Testing detect_typelib_path() Function ==="
# Install pkg-config first (needed for typelib detection)
if command -v apt-get >/dev/null 2>&1; then
apt-get install -y pkg-config libgirepository1.0-dev 2>/dev/null || true
elif command -v dnf >/dev/null 2>&1; then
dnf install -y pkg-config gobject-introspection-devel 2>/dev/null || true
fi
# Test typelib path detection
bash -c '
# Function from install.sh
detect_typelib_path() {
# Try pkg-config first (most reliable)
if command -v pkg-config >/dev/null 2>&1; then
local path=$(pkg-config --variable=typelibdir gobject-introspection-1.0 2>/dev/null)
if [ -n "$path" ] && [ -d "$path" ]; then
echo "$path"
return 0
fi
fi
# Fallback to common distribution-specific paths
for path in \
/usr/lib/x86_64-linux-gnu/girepository-1.0 \
/usr/lib/aarch64-linux-gnu/girepository-1.0 \
/usr/lib/arm-linux-gnueabihf/girepository-1.0 \
/usr/lib/riscv64-linux-gnu/girepository-1.0 \
/usr/lib/powerpc64le-linux-gnu/girepository-1.0 \
/usr/lib/s390x-linux-gnu/girepository-1.0 \
/usr/lib64/girepository-1.0 \
/usr/lib/girepository-1.0 \
/usr/local/lib/girepository-1.0 \
/usr/local/lib64/girepository-1.0; do
if [ -d "$path" ]; then
echo "$path"
return 0
fi
done
# Ultimate fallback
echo "/usr/lib/girepository-1.0"
return 1
}
TYPOB_PATH=$(detect_typelib_path)
echo "Detected typelib path: $TYPOB_PATH"
if [ -d "$TYPOB_PATH" ]; then
echo "✓ Typelib path exists: $TYPOB_PATH"
ls -la "$TYPOB_PATH" | head -5 || true
else
echo "⚠ Typelib path does not exist: $TYPOB_PATH (may be OK if pkg-config not available)"
fi
'
# ============================================================================
# TEST 4: Check install.sh syntax
# ============================================================================
- name: Check install.sh syntax
run: |
echo "=== Checking install.sh Syntax ==="
bash -n install.sh
echo "✓ install.sh: Syntax OK"
# ============================================================================
# TEST 5: Run the dependency checker
# ============================================================================
- name: Run dependency checker
run: |
echo "=== Running Dependency Checker ==="
bash scripts/check-system-deps.sh || echo "⚠ Some dependencies missing (expected in container)"
continue-on-error: true
# ============================================================================
# TEST 6: Test installer help command
# ============================================================================
- name: Test installer --help
run: |
echo "=== Testing Installer --help ==="
bash install.sh --help || true
# ============================================================================
# TEST 7: Test minimal install (venv setup only)
# ============================================================================
- name: Test minimal installer (dry-run venv setup)
run: |
echo "=== Testing Minimal Installer (venv setup) ==="
# Install minimal dependencies needed for venv creation
if command -v apt-get >/dev/null 2>&1; then
apt-get update -qq
apt-get install -y python3-venv python3-pip python3-dev 2>/dev/null || true
elif command -v dnf >/dev/null 2>&1; then
dnf install -y python3-virtualenv python3-pip python3-devel 2>/dev/null || true
fi
# Create a temporary venv to test the flow
python3 -m venv /tmp/test-venv || {
echo "⚠ Could not create venv (may need additional system deps)"
exit 0
}
echo "✓ Virtual environment created successfully"
ls -la /tmp/test-venv/bin/
rm -rf /tmp/test-venv
# ============================================================================
# TEST 8: Test Python import paths
# ============================================================================
- name: Test Python import paths
run: |
echo "=== Testing Python Import Paths ==="
python3 -c "import sys; sys.path.insert(0, 'src'); print('Python path configured')"
python3 --version
echo "✓ Python is available"
# ============================================================================
# SUMMARY: Aggregate results from all container tests
# ============================================================================
summary:
name: Test Summary
runs-on: ubuntu-latest
needs: test
if: always()
steps:
- name: Check test results
run: |
echo "===================================="
echo "Distro Test Matrix Results"
echo "===================================="
echo ""
echo "All container tests have completed."
echo "Check individual job logs for details."
echo ""
echo "Expected behavior:"
echo " ✓ ubuntu:24.04 - Full support expected"
echo " ✓ ubuntu:26.04 - Full support expected"
echo " ✓ debian:12 - Full support expected"
echo " ⚠ fedora:39 - Good support, minor differences expected"
echo ""
echo "Key tests performed:"
echo " 1. /etc/os-release availability"
echo " 2. Distro detection function"
echo " 3. Typelib path detection"
echo " 4. install.sh syntax validation"
echo " 5. Dependency checker"
echo " 6. Installer --help command"
echo " 7. Virtual environment creation"
echo " 8. Python availability"