validate-mseries.yml

# M-series: fast validation of the Apple Silicon build wiring. Parses every
# mkosi config (catches bad references/typos in mkosi.images/**) and syntax-
# checks the layer's scripts. Does NOT build images — full arm64 builds run
# via workflow_dispatch on Daily OS 9.
name: Validate M-series wiring

on:
  workflow_dispatch:
  # No path filter: branch protection requires these jobs, and a skipped required
  # check blocks the PR forever (e.g. Cargo.lock-only Dependabot bumps, #585).
  pull_request:

# New commits replace only checks for this workflow and PR. Publishing is not preempted.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  teams-web:
    name: Teams desktop launcher contracts
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install desktop integration test dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-gi desktop-file-utils
      - name: Test without browsers, accounts or network
        run: |
          bash -n mseries/install-teams.sh
          python3 -B -m unittest discover -s mseries/teams-web -p 'test_*.py' -v

  speech-release:
    name: English F5 release contracts (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install private GTK test dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-gi gir1.2-gtk-4.0 gir1.2-ibus-1.0 gir1.2-atspi-2.0 dbus-x11 xvfb xauth
      - name: Verify source-only release, rollback and host checks
        run: |
          bash -n mseries/releases/v0.0.1/install.sh
          python3 -B -m unittest discover -s mseries/releases -p 'test_*.py'
          python3 -B mseries/releases/v0.0.1/test_preflight.py
      - name: Verify transcript-only UI without microphone or models
        run: |
          python3 -B mseries/dictation/speech-only-panel-smoke.py
          python3 -B mseries/dictation/speech-only-panel-smoke.py --default-review
      - name: Dictation pauses and mutes other audio, then restores it (fake PipeWire and D-Bus)
        run: python3 -B mseries/dictation/test_media.py -v

  ui-scale:
    name: Size system ladder and Quick Settings text size (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install native GTK and private D-Bus test dependencies
        run: sudo apt-get update && sudo apt-get install -y valac libgtk-4-dev libgranite-7-dev python3-gi gsettings-desktop-schemas libglib2.0-bin dbus-x11 xvfb xauth
      - name: Planner, dock token and size-lint unit tests
        run: python3 -m unittest discover -s mseries/ui-scale -p 'test_*.py' -v
      - name: RepoBar account and panel-preference tests (fake gh)
        run: python3 -B -m unittest discover -s mseries -p 'test_repobar_accounts.py' -v
      - name: No new hard-coded UI sizes (allowlist is the only exception)
        run: bash mseries/ui-scale/check-ui-sizes.sh --strict
      - name: Dock writers keep their shell syntax
        run: sh -n mseries/dock-policy/enable-permanent.sh
      - name: Compiled dock taskbar policy on isolated settings
        run: bash mseries/ui-scale/tests/test-taskbar-size.sh
      - name: Drive the text-size widget on a private display
        run: bash mseries/ui-scale/tests/test-text-scale.sh
  bluetooth:
    name: Quick Settings Bluetooth controls (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install native GTK and private D-Bus test dependencies
        run: sudo apt-get update && sudo apt-get install -y valac libgtk-4-dev libgranite-7-dev python3-dbus python3-gi dbus-x11 xvfb xauth
      - name: Keep all Quick Settings builds on shared source preparation
        run: python3 mseries/quick-settings/tests/test-source-preparation.py
      - name: Exercise BlueZ controls without touching hardware
        run: bash mseries/quick-settings/tests/test-bluetooth.sh
      - name: Validate shared sliders and battery summary in both themes
        run: |
          python3 mseries/panel-ui-probes/run-probes.py --output "$RUNNER_TEMP/panel-ui" --theme light
          python3 mseries/panel-ui-probes/run-probes.py --output "$RUNNER_TEMP/panel-ui" --theme dark

  native-ui-responsiveness:
    name: Native UI asynchronous backends (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install private GTK fixture dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-gi gir1.2-gtk-3.0 gir1.2-gtk-4.0 xvfb xauth dbus-x11 ffmpeg xdotool gir1.2-pango-1.0 python3-gi-cairo
      - name: Check responsiveness, error recovery and scale in both themes
        run: bash mseries/ui-audit/run-private-checks.sh "$RUNNER_TEMP/native-ui"
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: native-ui-responsiveness
          path: ${{ runner.temp }}/native-ui

  orchard:
    name: Orchard GTK output and lifecycle regressions (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install GTK and Granite test dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-gi gir1.2-gtk-4.0 gir1.2-granite-7.0 xvfb xauth dbus-x11 git meson ninja-build valac gcc pkg-config libgtk-4-dev libgranite-7-dev libgee-0.8-dev libjson-glib-dev libsoup-3.0-dev libsecret-1-dev
      - name: Test without a daemon or real guests
        run: |
          python3 -m py_compile mseries/orchard-incus/orchard_incus/*.py mseries/orchard-incus/tools/*.py
          xvfb-run -a env -u DBUS_SESSION_BUS_ADDRESS GSK_RENDERER=cairo GDK_BACKEND=x11 \
            PYTHONWARNINGS=ignore::DeprecationWarning G_DEBUG=fatal-criticals \
            python3 -m unittest discover -s mseries/orchard-incus/tests

      - name: Preserve screenshot originals across drag outcomes
        run: bash mseries/screenshot-shelf/test-retention.sh

      - name: Verify Signal palette, cache migration and restore
        run: python3 -B mseries/test-signal-accent.py

      - name: Prepare native indicator API
        run: bash mseries/codexbar-wingpanel/probe/ci-build-deps.sh "$RUNNER_TEMP/orchard-prefix" >> "$GITHUB_ENV"
      - name: Build and test Orchard (machines, Incus, Podman) with the Wingpanel indicator
        run: |
          sudo apt-get install -y qemu-utils genisoimage curl
          meson setup "$RUNNER_TEMP/orchard-native" mseries/orchard -Dwingpanel=enabled
          meson compile -C "$RUNNER_TEMP/orchard-native"
          xvfb-run -a env GSK_RENDERER=cairo dbus-run-session -- meson test -C "$RUNNER_TEMP/orchard-native" --print-errorlogs
      - name: Build and test the Tailscale panel menu
        run: |
          meson setup "$RUNNER_TEMP/tailscale-wingpanel" mseries/tailscale-wingpanel
          meson test -C "$RUNNER_TEMP/tailscale-wingpanel" --print-errorlogs

  work-mode:
    name: Windows Work Mode schedule and work-network rules (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install GSettings test dependencies
        run: sudo apt-get update && sudo apt-get install -y python3-gi libglib2.0-bin gsettings-desktop-schemas iproute2
      - name: Test with keyfile GSettings, a local IP service and no user services
        run: python3 -B mseries/work-mode/test_work_mode.py

  dock-startup:
    name: Dock startup and launcher regressions (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install native test dependencies
        run: sudo apt-get update && sudo apt-get install -y git valac libglib2.0-dev
      - name: Verify activation, delayed Gala readiness and session stops
        run: |
          bash mseries/dock-tests/test-startup.sh
          bash mseries/dock-tests/test-running-apps.sh
          python3 mseries/dock-tests/test-launcher.py

  desktop-space:
    name: Native top-bar scale and notch GTK allocation (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install GTK test dependencies
        run: sudo apt-get update && sudo apt-get install -y git valac libgtk-4-dev libgranite-7-dev xvfb xauth build-essential python3-gi libglib2.0-bin
      - name: Test top-bar 130 percent measurement and allocation
        run: bash mseries/display-space/test-panel-scale.sh
      - name: Test production notch geometry and crowded panel allocation
        run: bash mseries/display-space/test-notch-layout.sh
      - name: Verify exact-kernel boot profile and rollback
        run: python3 -m unittest discover -s mseries/display-space -p 'test_*.py'

  orchard-app:
    name: Orchard app build, tests, metadata and Debian package (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install build dependencies
        run: sudo apt-get update && sudo apt-get install -y meson ninja-build valac gcc pkg-config libgtk-4-dev libgranite-7-dev libjson-glib-dev libsoup-3.0-dev libsecret-1-dev python3 appstream desktop-file-utils xvfb xauth dbus-x11 genisoimage curl qemu-utils
      - name: Build and run the tests (machines, QMP, clipboard, display, Incus, Podman, window)
        run: |
          meson setup build-orchard mseries/orchard -Dwingpanel=disabled
          meson compile -C build-orchard
          xvfb-run -a env GSK_RENDERER=cairo dbus-run-session -- meson test -C build-orchard --print-errorlogs
      - name: Check the version flag and desktop metadata
        run: |
          xvfb-run -a build-orchard/orchard --version
          desktop-file-validate mseries/orchard/data/com.github.techmore.orchard.desktop
          appstreamcli validate --no-net mseries/orchard/data/com.github.techmore.orchard.metainfo.xml
      - name: Build the Debian package
        run: |
          sudo apt-get install -y dpkg-dev
          ORCHARD_OUTPUT_DIR="$RUNNER_TEMP/orchard-deb" bash mseries/orchard/build-deb.sh

  # The dev branch protection still requires a status check with Machine Lab's old job name; this
  # alias satisfies it from the Orchard app job until the protection list names the new job.
  codexbar-wingpanel:
    name: CodexBar Wingpanel module, render and interaction probes (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install native build and headless test dependencies
        run: >-
          sudo apt-get update && sudo apt-get install -y git meson ninja-build valac gcc pkg-config
          libgtk-4-dev libjson-glib-dev libgee-0.8-dev libgranite-7-dev sassc gettext
          libadwaita-1-dev libx11-dev libwayland-dev libwayland-bin
          python3 python3-gi xvfb xauth dbus-x11 librsvg2-common xdotool ffmpeg
      - name: Provide Granite 7.7 and the pinned Wingpanel indicator API when the distro lacks them
        run: bash mseries/codexbar-wingpanel/probe/ci-build-deps.sh "$RUNNER_TEMP/prefix" >> "$GITHUB_ENV"
      - name: Build the module; run unit tests, generated-C guard, Switch/ingestion/token/Grok probes
        run: |
          meson setup "$RUNNER_TEMP/codexbar" mseries/codexbar-wingpanel
          ninja -C "$RUNNER_TEMP/codexbar"
          meson test -C "$RUNNER_TEMP/codexbar" --print-errorlogs
          meson setup "$RUNNER_TEMP/t3-panel" mseries/t3-wingpanel
          ninja -C "$RUNNER_TEMP/t3-panel"
          bash mseries/t3-wingpanel/test.sh "$RUNNER_TEMP/t3-panel" "$RUNNER_TEMP/t3-panel-receipts"
          bash mseries/dock-taskbar/test-build.sh
      - name: RepoBar resolved-account cache and private indicator race/error probes
        run: |
          meson setup "$RUNNER_TEMP/repobar" mseries/repobar-wingpanel
          meson compile -C "$RUNNER_TEMP/repobar"
          bash mseries/repobar-wingpanel/probe/test-account-cache.sh "$RUNNER_TEMP/repobar"

  calendar-agenda:
    name: Calendar Events/Tasks/Homeboard agenda on a private EDS (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install build and headless EDS test dependencies
        run: >-
          sudo apt-get update && sudo apt-get install -y git meson ninja-build valac gcc pkg-config gettext sassc
          libgtk-4-dev libgranite-7-dev libadwaita-1-dev libgee-0.8-dev libjson-glib-dev libecal2.0-dev libedataserver1.2-dev
          libical-dev evolution-data-server gsettings-desktop-schemas libglib2.0-bin python3 xvfb xauth dbus
          dbus-x11 librsvg2-common accountsservice
      - name: Add elementary's AccountsService extension (the clock reads its TimeFormat)
        run: |
          # elementary/default-settings, GPL-3.0; the same file elementary OS installs.
          url=https://raw.githubusercontent.com/elementary/default-settings/915d1a0b63865ce3f0d44a68318d55ef9ca90fe6/accountsservice/io.elementary.pantheon.AccountsService.xml
          sudo curl -fsSL "$url" -o /usr/share/dbus-1/interfaces/io.elementary.pantheon.AccountsService.xml
          sudo mkdir -p /usr/share/accountsservice/interfaces
          sudo ln -sf ../../dbus-1/interfaces/io.elementary.pantheon.AccountsService.xml /usr/share/accountsservice/interfaces/
          sudo systemctl restart accounts-daemon
      - name: Build the pinned indicator with our patch and run every agenda group
        run: bash mseries/calendar/ci-test-agenda.sh "$RUNNER_TEMP/agenda"

  validate:
    name: mkosi summary + script checks (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 25
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Fetch the immutable capability audit source
        run: |
          audit_revision=$(python3 -c 'import json; print(json.load(open("docs/capabilities.json"))["source_revision"])')
          [[ "$audit_revision" =~ ^[0-9a-f]{40}$ ]] || exit 1
          git fetch --no-tags --depth=1 origin "$audit_revision"

      - uses: ./.github/actions/fast-apt

      - name: Install deps
        run: sudo apt-get update && sudo apt-get install just podman zstd bison flex device-tree-compiler mtools fdisk shellcheck dpkg-dev -y

      # The check list lives in mseries/validate.sh so the same command works on a
      # developer machine (`just check`); add new checks there, not here.
      - name: Syntax, shellcheck and unit checks (bash mseries/validate.sh)
        run: bash mseries/validate.sh

      # codeload.github.com rate-limits busy runners (HTTP 429 failed PR #290, and again on 2026-10-23 for several
      # branches at once, after six 30-second retries each). The tarball is kept in the Actions cache. On a miss:
      # download with the job token (authenticated requests are limited separately), retry with growing waits, and
      # fall back to a shallow `git fetch` of the same commit, which does not go through codeload. `git archive` with
      # the same prefix gives the layout validate-dock-patches.py expects (`linux-<sha>/...`). The cache is saved
      # right after a successful download, so a later failing step cannot throw the tarball away.
      - name: Restore the pinned Fairydust source tarball
        id: fairydust-cache
        uses: actions/cache/restore@v6
        with:
          path: ${{ runner.temp }}/fairydust.tar.gz
          key: fairydust-source-ce9f2eba72c061a50b2d790450e90af3439d8c24
      - name: Download the pinned Fairydust source tarball
        id: fairydust-download
        if: steps.fairydust-cache.outputs.cache-hit != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          sha=ce9f2eba72c061a50b2d790450e90af3439d8c24
          out="$RUNNER_TEMP/fairydust.tar.gz"
          fetched=false
          for wait in 0 20 60 120; do
            sleep "$wait"
            if curl --fail --location --proto '=https' --tlsv1.2 \
                 -H "Authorization: Bearer $GH_TOKEN" \
                 "https://codeload.github.com/AsahiLinux/linux/tar.gz/$sha" -o "$out"; then
              fetched=true
              break
            fi
            echo "::warning::codeload download failed; retrying after the next wait"
          done
          if [ "$fetched" != true ]; then
            echo "::warning::codeload kept failing; falling back to a shallow git fetch of $sha"
            rm -f "$out"
            src="$RUNNER_TEMP/fairydust-src"
            rm -rf "$src"
            git init -q "$src"
            git -C "$src" fetch -q --depth 1 https://github.com/AsahiLinux/linux.git "$sha"
            git -C "$src" archive --format=tar.gz --prefix="linux-$sha/" -o "$out" FETCH_HEAD
          fi
          test -s "$out"
          echo "source=$([ "$fetched" = true ] && echo codeload || echo git)" >> "$GITHUB_OUTPUT"
      # Cache only the real codeload tarball: a git-archive copy never matches ARCHIVE_SHA256, and caching it
      # made every rerun of the same branch fail (#390, #675, #677 on 2026-10-28).
      - name: Save the pinned Fairydust source tarball
        if: steps.fairydust-cache.outputs.cache-hit != 'true' && steps.fairydust-download.outputs.source == 'codeload'
        uses: actions/cache/save@v6
        with:
          path: ${{ runner.temp }}/fairydust.tar.gz
          key: fairydust-source-ce9f2eba72c061a50b2d790450e90af3439d8c24
      - name: Validate experimental dock patches offline
        env:
          FAIRYDUST_SOURCE: ${{ steps.fairydust-download.outputs.source }}
        run: |
          set -euo pipefail
          extra=()
          [ "${FAIRYDUST_SOURCE:-}" = git ] && extra=(--git-archive)
          python3 mseries/fairydust/usb4/tools/validate-dock-patches.py --archive "$RUNNER_TEMP/fairydust.tar.gz" --output "$RUNNER_TEMP/dock-patch-validation" "${extra[@]}"

      - name: mkosi config parse check (all images)
        run: |
          set -euo pipefail
          just mkosi summary | tee /tmp/mseries-mkosi-summary.txt
          python3 mseries/test-image-wiring.py --summary /tmp/mseries-mkosi-summary.txt

  hardware-support:
    name: Hardware diagnostics and recovery fixtures
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install offline test tools
        run: sudo apt-get update && sudo apt-get install -y mtools fdisk shellcheck python3-libarchive-c keyutils
      - name: Validate hardware ports without target hardware
        run: |
          set -euo pipefail
          python3 -m unittest discover -s mseries/aurora-sep -p 'test_touchid*.py'
          python3 -m unittest discover -s mseries/power -p 'test_diagnostics.py'
          python3 -B -m unittest discover -s mseries/power -p 'test_sensors.py'
          MSERIES_REQUIRE_ESP_TOOLS=1 python3 -m unittest discover -s mseries/hardware -p 'test_*.py'
          bash mseries/hardware/test-bluetooth.sh
          shellcheck -S warning mseries/install-hardware-support.sh mseries/hardware/bluetooth-resume-fix mseries/hardware/bluetooth-supported mseries/power/mseries-sleep-cost-hook
          bash -n mseries/enhance.sh mseries/stage-factory-enhancements.sh mseries/aurora-sep/install-touchid-gui.sh
          python3 mseries/test-image-wiring.py
          python3 mseries/video-decode/test-brave-factory.py
          python3 mseries/video-decode/test-youtube-launch.py
          python3 mseries/boot/test-prepare-uki-kernels.py
          python3 mseries/test-power-install.py
          python3 mseries/test-omdrop-installer.py
          python3 -m unittest discover -s mseries/omdrop-awdl/tests
          python3 -m unittest discover -s mseries/omdrop/tests

  claude-pantheon-rs:
    name: Claude (T3 client) build, tests, desktop metadata and .deb (arm64)
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7
      # The crate pins gtk4 0.11 (v4_20) and granite-rs 3.3 (v7_8); Ubuntu's libgranite-7-dev is 7.8, enough
      # for the bindings, so no PPA is needed here (RUST-UPSTREAM-MAINTENANCE.md). The indicator needs the
      # wingpanel-9 API, which the daily PPA ships.
      - uses: ./.github/actions/fast-apt

      - name: Add elementary daily PPA (wingpanel-9 for the indicator)
        run: |
          for attempt in 1 2 3 4 5; do
            if sudo add-apt-repository -y ppa:elementary-os/daily && sudo apt-get update; then exit 0; fi
            echo "attempt $attempt failed; retrying" >&2
            sleep $((attempt * 20))
          done
          echo "the elementary daily PPA is unreachable" >&2
          exit 1
      - name: Install build dependencies
        run: |
          for attempt in 1 2 3 4 5; do
            if sudo apt-get install -y --no-install-recommends -o Acquire::Retries=5 \
              cargo rustc rustfmt rust-clippy pkg-config libgtk-4-dev libgranite-7-dev \
              meson ninja-build valac libwingpanel-9-dev libjson-glib-dev libgee-0.8-dev \
              libgtksourceview-5-dev libvte-2.91-gtk4-dev libwebkitgtk-6.0-dev \
              librsvg2-bin dpkg-dev appstream desktop-file-utils xvfb xauth dbus-x11; then exit 0; fi
            echo "attempt $attempt failed; retrying" >&2
            sudo apt-get update || true
            sleep $((attempt * 30))
          done
          exit 1
      - uses: actions/cache@v6
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            rust/target
          key: claude-pantheon-rs-${{ runner.arch }}-${{ hashFiles('rust/Cargo.lock') }}
          restore-keys: claude-pantheon-rs-${{ runner.arch }}-
      - name: Formatting and lints (cargo fmt --check, clippy -D warnings)
        run: |
          cd rust
          cargo fmt -p claude-pantheon-rs --check
          cargo clippy --release -p claude-pantheon-rs --all-targets -- -D warnings
      - name: Build and run the protocol and model tests (recorded frames)
        run: |
          cd rust
          cargo build --release -p claude-pantheon-rs
          cargo test --release -p claude-pantheon-rs --lib
          python3 -B -m unittest discover -s ../mseries/fleet-shepherd/tests
      # Upstream moves daily; a drift here is a note to run scripts/refresh-contracts.sh, not a red build.
      - name: Contracts drift against pingdotgg/t3code main (advisory)
        continue-on-error: true
        run: |
          cd rust/claude-pantheon-rs
          if ! T3_CONTRACTS_REPO="$RUNNER_TEMP/t3code" ./scripts/refresh-contracts.sh --check; then
            echo "::warning title=T3 contracts drift::contracts/ no longer matches t3code main; run rust/claude-pantheon-rs/scripts/refresh-contracts.sh"
            exit 1
          fi
      - name: Check the desktop entry and the AppStream metainfo
        run: |
          desktop-file-validate rust/claude-pantheon-rs/data/io.github.techmore.ClaudePantheonRs.desktop
          appstreamcli validate --no-net rust/claude-pantheon-rs/data/io.github.techmore.ClaudePantheonRs.metainfo.xml
      - name: Native T3 activity and subscription render gates (isolated offline home)
        run: |
          CLAUDE_PANTHEON_RENDER_RELEASE=1 CLAUDE_PANTHEON_FEATURE_PROBE="$RUNNER_TEMP/t3-features/light" \
            bash rust/claude-pantheon-rs/tests/run-render-sandbox.sh
          CLAUDE_PANTHEON_DARK=1 CLAUDE_PANTHEON_RENDER_RELEASE=1 \
            CLAUDE_PANTHEON_FEATURE_PROBE="$RUNNER_TEMP/t3-features/dark" \
            bash rust/claude-pantheon-rs/tests/run-render-sandbox.sh
      - name: Upload native T3 feature renders
        uses: actions/upload-artifact@v7
        with:
          name: t3-feature-renders-${{ github.run_id }}
          path: ${{ runner.temp }}/t3-features/
          if-no-files-found: error
      - name: Indicator probe (headless)
        run: |
          meson setup "$RUNNER_TEMP/indicator" rust/claude-pantheon-rs/wingpanel-indicator
          meson compile -C "$RUNNER_TEMP/indicator"
          xvfb-run -a env GSK_RENDERER=cairo dbus-run-session -- meson test -C "$RUNNER_TEMP/indicator" --print-errorlogs
      - name: Build the Debian package
        run: CLAUDE_PANTHEON_OUTPUT_DIR="$RUNNER_TEMP/cpr-deb" bash rust/claude-pantheon-rs/build-deb.sh
      - name: Upload the package
        uses: actions/upload-artifact@v7
        with:
          name: claude-pantheon-rs-deb-${{ github.run_id }}
          path: ${{ runner.temp }}/cpr-deb/*.deb
          retention-days: 14