ci: automate FSDK source updates

.github/workflows/auto-update.yml

@@ -1,41 +1,27 @@
-name: Push new tag update to stable branch
+name: Update Snap dependencies
 
 on:
   schedule:
-    - cron: '9 7 * * *'
+    - cron: "9 7 * * *"
   workflow_dispatch:
-    inputs:
-      workflow_choice:
-        description: "Choose YAML to update"
-        required: true
-        default: "both"
-        type: choice
-        options:
-          - snapcraft
-          - rockcraft
-          - both
+
+concurrency:
+  group: update-snap-dependencies
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
 
 jobs:
-  update-yamls:
+  update-snap:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout this repo
-        uses: actions/checkout@v4
-
-      - name: Run desktop-snaps action (Snapcraft)
-        if: ${{ github.event_name == 'schedule' || github.event.inputs.workflow_choice == 'snapcraft' || github.event.inputs.workflow_choice == 'both' }}
-        uses: ubuntu/desktop-snaps@stable
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Update Snapcraft dependencies
+        uses: ubuntu/desktop-snaps@f1886f483e2251bc0a1d099951946966677ffbd4 # stable
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ github.token }}
           repo: ${{ github.repository }}
           version-schema: '^ghostpdl-(\d+\.\d+\.\d+)'
-
-      - name: Run desktop-snaps action (Rockcraft)
-        if: ${{ github.event_name == 'schedule' || github.event.inputs.workflow_choice == 'rockcraft' || github.event.inputs.workflow_choice == 'both' }}
-        uses: ubuntu/desktop-snaps@stable
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          repo: ${{ github.repository }}
-          rock-version-schema: '^ghostpdl-(\d+\.\d+\.\d+)'
-          yaml-path: 'rockcraft.yaml'
-          readme-path: 'README.md'

.github/workflows/update-fsdk-sources.yml

@@ -0,0 +1,76 @@
+name: Update FSDK sources
+
+on:
+  schedule:
+    - cron: "23 7 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: update-fsdk-sources
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  update:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2
+        with:
+          tool: just
+      - name: Install host dependencies
+        run: sudo apt-get update && sudo apt-get install --yes fuse3 podman
+      - name: Track sources and synchronize metadata
+        run: scripts/update-fsdk-sources.py --update
+      - name: Check for updates
+        id: changes
+        run: |
+          if git diff --quiet -- VERSION elements; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Verify CUPS patch compatibility
+        if: steps.changes.outputs.changed == 'true'
+        run: just verify-cups-patch-chain
+      - name: Verify updated appliance
+        if: steps.changes.outputs.changed == 'true'
+        run: just verify
+      - name: Mint Mergeraptor token
+        if: steps.changes.outputs.changed == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.MERGERAPTOR_APP_ID }}
+          private-key: ${{ secrets.MERGERAPTOR_PRIVATE_KEY }}
+      - name: Commit and propose atomic update
+        if: steps.changes.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          branch=auto/update-fsdk-sources
+          git config user.name 'mergeraptor[bot]'
+          git config user.email '${{ secrets.MERGERAPTOR_APP_ID }}+mergeraptor[bot]@users.noreply.github.com'
+          git switch --create "$branch"
+          git add VERSION elements
+          git commit -m 'chore(deps): update FSDK appliance sources'
+          basic="$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)"
+          echo "::add-mask::$basic"
+          git -c http.https://github.com/.extraheader="AUTHORIZATION: basic $basic" \
+            push --force "https://github.com/${REPOSITORY}.git" "HEAD:refs/heads/$branch"
+          if existing="$(gh pr list --head "$branch" --state open --json number --jq '.[0].number')" && [[ -n "$existing" ]]; then
+            printf 'Updated dependency PR #%s\n' "$existing"
+          else
+            gh pr create \
+              --base main \
+              --head "$branch" \
+              --title 'chore(deps): update FSDK appliance sources' \
+              --body 'Automated atomic update of the freedesktop-sdk junction and repository-owned BuildStream sources. The workflow completed the CUPS patch-chain gate and full appliance verification before opening this PR. Auto-merge is intentionally disabled.'
+          fi

Makefile

@@ -31,16 +31,16 @@ CFLAGS		+=	`pkg-config --cflags pappl` `cups-config --cflags` `pkg-config --cfla
 ifdef VERSION
 CFLAGS		+=	-DSYSTEM_VERSION_STR="\"$(VERSION)\""
 ifndef MAJOR
-MAJOR		=	`echo $(VERSION) | perl -p -e 's/^(\d+).*$$/\1/'`
+MAJOR		=	`echo $(VERSION) | perl -p -e 's/^(\d+).*$$/\1/; s/^0+(\d)/\1/'`
 endif
 ifndef MINOR
-MINOR		=	`echo $(VERSION) | perl -p -e 's/^\d+\D+(\d+).*$$/\1/'`
+MINOR		=	`echo $(VERSION) | perl -p -e 's/^\d+\D+(\d+).*$$/\1/; s/^0+(\d)/\1/'`
 endif
 ifndef PATCH
-PATCH		=	`echo $(VERSION) | perl -p -e 's/^\d+\D+\d+\D+(\d+).*$$/\1/'`
+PATCH		=	`echo $(VERSION) | perl -p -e 's/^\d+\D+\d+\D+(\d+).*$$/\1/; s/^0+(\d)/\1/'`
 endif
 ifndef PACKAGE
-PACKAGE		=	`echo $(VERSION) | perl -p -e 's/^\d+\D+\d+\D+\d+\D+(\d+).*$$/\1/'`
+PACKAGE		=	`echo $(VERSION) | perl -p -e 's/^\d+\D+\d+\D+\d+\D+(\d+).*$$/\1/; s/^0+(\d)/\1/'`
 endif
 endif
 ifdef MAJOR

docs/superpowers/plans/2026-09-16-fsdk-dependency-updates.md

@@ -0,0 +1,33 @@
+# FSDK Dependency Update Automation Plan
+
+**Goal:** Propose atomic, fully verified updates for the FSDK junction and every repository-owned external BuildStream source while preserving the Snap updater as an independent lane.
+
+**Architecture:** Give every Git source a deliberate moving selector and immutable resolved ref, keep CPAN name/suffix/checksum contracts, and keep the plugin tarball's version/checksum explicit. A standard-library Python coordinator runs BuildStream tracking for the complete root graph, refreshes the PyPI plugin tarball, derives the application version from the newly selected FSDK Ghostscript source, synchronizes the IJS source and OCI FSDK labels, and validates the source inventory. A scheduled workflow runs the CUPS patch-chain gate and complete appliance gate before minting a short-lived Mergeraptor token and opening one non-auto-merged PR containing every related version/ref change. The existing updater becomes Snap-only.
+
+## Task 1: Make every source trackable
+
+- [x] Use bounded wildcard selectors for release-series sources and moving branch selectors only where upstream has no releases.
+- [x] Retain immutable Git describe refs, CPAN SHA-256 sums, and the plugin tarball SHA-256 sum.
+- [x] Add a source-inventory check that rejects external Git sources without `track`/`ref`, CPAN sources without name/suffix/checksum, or tar sources without URL/checksum.
+
+## Task 2: Coordinate atomic metadata updates
+
+- [x] Track every root-project source without crossing into the FSDK junction project.
+- [x] Refresh the buildstream-plugins-community PyPI sdist URL and checksum from PyPI metadata.
+- [x] Read the selected FSDK Ghostscript element, derive `<ghostscript-version>-<packaging-revision>`, update `VERSION`, and synchronize the IJS track/ref.
+- [x] Synchronize the OCI FSDK release/ref labels with the selected junction.
+- [x] Fail without writing partial metadata when upstream responses are missing or malformed.
+
+## Task 3: Automate verified proposals
+
+- [x] Add a scheduled/manual FSDK-source workflow with read-only permissions during tracking and verification.
+- [x] Run `just verify-cups-patch-chain` and `just verify` before minting write credentials.
+- [x] Mint a short-lived Mergeraptor token only after verification, then commit all changes atomically and create or update one dependency PR.
+- [x] Never enable auto-merge in the updater; native PR CI remains the merge gate.
+- [x] Reduce the existing updater to the independent Snap dependency lane.
+
+## Task 4: Verify and publish
+
+- [x] Run source-inventory checks, an isolated updater smoke, `just verify`, workflow lint, script syntax checks, and `git diff --check`.
+- [x] Review the full diff from `feat/fsdk-secure-releases` and resolve all blocking findings.
+- [x] Resolve issue 09, commit and push `feat/fsdk-dependency-updates`, and open a stacked PR based on `feat/fsdk-secure-releases`.

elements/printer-app/brlaser.bst

@@ -4,7 +4,7 @@ description: Build the brlaser Brother laser raster filter.
 sources:
   - kind: git_repo
     url: github:pdewacht/brlaser.git
-    track: v6
+    track: v*
     ref: v6-0-g23117fe9e0266396e4791cdae84d979928aed135
 
 build-depends:

elements/printer-app/c2050.bst

@@ -4,7 +4,7 @@ description: Build the c2050 Lexmark raster converter.
 sources:
   - kind: git_repo
     url: salsa:printing-team/c2050.git
-    track: debian/0.3-7
+    track: debian/*
     ref: debian/0.3-7-0-ge2ee50d2da58e552b1ac70ae0b4d8913436921e1
   - kind: patch_queue
     path: patches/c2050

elements/printer-app/c2esp.bst

@@ -4,7 +4,7 @@ description: Build the c2esp Kodak raster filters and driver descriptions.
 sources:
   - kind: git_repo
     url: salsa:printing-team/c2esp.git
-    track: debian/27-11
+    track: debian/*
     ref: debian/27-11-0-g90a09ca4927fca5e1ae08307cd3ca9c0f0ca5b5b
   - kind: local
     path: patches/c2esp-libcupsfilters2-api.patch

elements/printer-app/cjet.bst

@@ -4,7 +4,7 @@ description: Build the cjet Canon CaPSL raster converter.
 sources:
   - kind: git_repo
     url: salsa:printing-team/cjet.git
-    track: debian/0.8.9-11
+    track: debian/*
     ref: debian/0.8.9-11-0-g2de422f1b08cdf8d18a2e2ea8ae0b14751702fba
 
 build-depends:

elements/printer-app/dymo-cups-drivers.bst

@@ -4,7 +4,7 @@ description: Build the DYMO CUPS raster filters and PPD archive.
 sources:
   - kind: git_repo
     url: salsa:printing-team/dymo-cups-drivers.git
-    track: debian/1.4.0-12
+    track: debian/*
     ref: debian/1.4.0-12-0-ge69dceba792dc23d2894d57b0468009e52109625
 
 build-depends:

elements/printer-app/foo2zjs.bst

@@ -4,7 +4,7 @@ description: Build foo2zjs drivers with persistent color-profile paths.
 sources:
   - kind: git_repo
     url: salsa:printing-team/foo2zjs.git
-    track: debian/20200505dfsg0-5
+    track: debian/*
     ref: debian/20200505dfsg0-5-0-g816bcd01d5fa0b3171fe6d09c093a9290ccf7c25
 
 build-depends:

elements/printer-app/fxlinuxprint.bst

@@ -4,7 +4,7 @@ description: Build the Fuji Xerox PDF printer CUPS filters and PPD archive.
 sources:
   - kind: git_repo
     url: salsa:printing-team/fxlinuxprint.git
-    track: debian/1.1.0+ds-4
+    track: debian/*
     ref: debian/1.1.0+ds-4-0-g3e640d5cf2881b01b6dab16e7d899290e61b0417
 
 build-depends:

elements/printer-app/hpijs.bst

@@ -4,7 +4,7 @@ description: Build the HPLIP HPIJS driver with persistent appliance configuratio
 sources:
   - kind: git_repo
     url: salsa:printing-team/hplip.v2.git
-    track: debian/3.26.4+dfsg0-3
+    track: debian/*
     ref: debian/3.26.4+dfsg0-3-0-gf27f786d5f1060cce7c92e42488bd5e5d00ba135
 
 build-depends:

elements/printer-app/m2300w.bst

@@ -4,7 +4,7 @@ description: Build the m2300w drivers with persistent color-profile paths.
 sources:
   - kind: git_repo
     url: salsa:printing-team/m2300w.git
-    track: debian/0.51-15
+    track: debian/*
     ref: debian/0.51-15-0-gf4ebe31fe93e8f2f56ecce2f927e59bb41432d53
 
 build-depends:

elements/printer-app/min12xxw.bst

@@ -4,7 +4,7 @@ description: Build the min12xxw Minolta raster converter.
 sources:
   - kind: git_repo
     url: salsa:printing-team/min12xxw.git
-    track: debian/0.0.9-11
+    track: debian/*
     ref: debian/0.0.9-11-0-g9a1fae0987e757c8d04e728eaec6e7adc1efca89
 
 build-depends:

elements/printer-app/pappl.bst

@@ -4,7 +4,7 @@ description: Build PAPPL for the Ghostscript Printer Application.
 sources:
   - kind: git_repo
     url: github:michaelrsweet/pappl.git
-    track: v1.4.12
+    track: v1.4.*
     ref: v1.4.12-0-g6db8e137557ad84662e78d24fdb2a591c621f4ac
   - kind: patch_queue
     path: patches/pappl

elements/printer-app/pnm2ppa.bst

@@ -4,7 +4,7 @@ description: Build the pnm2ppa HP PPA raster converter.
 sources:
   - kind: git_repo
     url: salsa:printing-team/pnm2ppa.git
-    track: debian/1.13-14
+    track: debian/*
     ref: debian/1.13-14-0-gca990cac53fb605d827f707e5f2d0c490639705c
 
 build-depends:

elements/printer-app/printer-driver-oki.bst

@@ -4,7 +4,7 @@ description: Package the OKI shell filters and PPD archive.
 sources:
   - kind: git_repo
     url: github:rbalint/printer-driver-oki.git
-    track: 1.0.2
+    track: 1.*
     ref: 1.0.2-0-g9f48d5a6c5938126a5aa91a902668aa877c3c22b
 
 build-depends:

elements/printer-app/psutils.bst

@@ -4,7 +4,7 @@ description: Build the legacy psnup helper required by stateful driver wrappers.
 sources:
   - kind: git_repo
     url: salsa:debian/psutils.git
-    track: debian/1.17.dfsg-5
+    track: debian/*
     ref: debian/1.17.dfsg-5-0-gafa3fccb4b77165a22b783f21feac35a082d8137
 
 build-depends:

elements/printer-app/ptouch-driver.bst

@@ -4,7 +4,7 @@ description: Build the P-Touch CUPS raster filter and Foomatic PPD archive.
 sources:
   - kind: git_repo
     url: salsa:printing-team/ptouch-driver.git
-    track: debian/1.7-1
+    track: debian/*
     ref: debian/1.7-1-0-gccfa92351be3ce601f212048b174147a5496d8be
 
 build-depends:

elements/printer-app/pxljr.bst

@@ -4,7 +4,7 @@ description: Build the pxljr HP Color LaserJet IJS driver and PPD archive.
 sources:
   - kind: git_repo
     url: salsa:printing-team/pxljr.git
-    track: debian/1.4+repack0-6
+    track: debian/*
     ref: debian/1.4+repack0-6-0-g6b0dafe66965e5fa398733c04160bd6436d13254
 
 build-depends:

elements/printer-app/pyppd.bst

@@ -4,7 +4,7 @@ description: Build the pyppd self-extracting PPD archive generator.
 sources:
   - kind: git_repo
     url: github:OpenPrinting/pyppd.git
-    track: release-1-1-0
+    track: release-*
     ref: release-1-1-0-0-g29ccf6cf85781315a696774e7458a2f1f61aac57
 
 build-depends:

elements/printer-app/rastertosag-gdi.bst

@@ -4,7 +4,7 @@ description: Package the rastertosag-gdi Ricoh raster filter and PPDs.
 sources:
   - kind: git_repo
     url: salsa:printing-team/rastertosag-gdi.git
-    track: debian/0.1-8
+    track: debian/*
     ref: debian/0.1-8-0-g6f4028f36f015692a602077b7060438d0bf9f634
 
 build-depends:

elements/printer-app/splix.bst

@@ -4,7 +4,7 @@ description: Build the SpliX QPDL printer filters and PPD archive.
 sources:
   - kind: git_repo
     url: salsa:printing-team/splix.git
-    track: debian/2.0.1-1
+    track: debian/*
     ref: debian/2.0.1-1-0-g505f24d43fdb86eaa41a44486e7ef88226bb2c0c
 
 build-depends: