Merge branch 'main' into fix/4764-nvidia-slim-initramfs

bashilias · web-flow · commit 8c22fa61e856 · 2026-07-08T14:33:11.000+02:00
diff --git a/.github/ISSUE_TEMPLATE/bug-report.yml b/.github/ISSUE_TEMPLATE/bug-report.yml
@@ -41,4 +41,4 @@ body:
     id: extra-context
     attributes:
       label: Extra information or context
-      description: If you are reporting a regression, use `ujust rebase-helper` to find the version that used to work. Report the working version and the broken version so that other users can rebase and confirm the issue!
+      description: If you are reporting a regression, use `ujust rebase-helper` to find the version that used to work. Report the working version and the broken version so that other users can rebase and confirm the issue!
diff --git a/.github/workflows/build-image-beta.yml b/.github/workflows/build-image-beta.yml
@@ -48,4 +48,4 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/generate-release.yml
     with:
-      stream_name: '["beta"]'
+      stream_name: '["beta"]'
diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout last 500 commits (for <commits> to work)
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 500
 
@@ -58,7 +58,7 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
 
       - name: Create Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         if: contains(fromJson('["stable"]'), matrix.version) && (github.event.schedule == '0 1 * * TUE' || contains(fromJson('["workflow_dispatch", "workflow_call"]'), github.event_name))
         with:
           name: ${{ steps.generate-release-text.outputs.title }}
diff --git a/.github/workflows/moderator.yml b/.github/workflows/moderator.yml
@@ -16,7 +16,7 @@ jobs:
       models: read
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: github/ai-moderator@81159c370785e295c97461ade67d7c33576e9319 # v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
@@ -48,7 +48,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           submodules: recursive
 
@@ -100,7 +100,7 @@ jobs:
           echo "allow_cache_write=${ALLOW_CACHE_WRITE}" >> "$GITHUB_OUTPUT"
 
       - name: Restore DNF package cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         env:
           CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }}
         with:
@@ -128,7 +128,7 @@ jobs:
 
       - name: Write new DNF package cache
         if: steps.setup-cache.outputs.allow_cache_write == 'true'
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         env:
           CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }}
         with:
@@ -304,7 +304,7 @@ jobs:
 
       - name: Attestation
         if: github.event_name != 'pull_request'
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
         with:
           subject-name: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -73,6 +73,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/validate-renovate.yml b/.github/workflows/validate-renovate.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,7 +1,7 @@
-# CONTRIBUTING 
+# CONTRIBUTING
 
-Thanks for helping out! 
+Thanks for helping out!
 
 Check the [Contributing Guide](https://docs.projectbluefin.io/contributing) for contribution information.
 
-This repository is for building the images, you are probably looking for [@projectbluefin/common](https://github.com/projectbluefin/common) to change something in Bluefin. Make sure you check [the architecture diagram](https://docs.projectbluefin.io/contributing#understanding-bluefins-architecture). 
+This repository is for building the images, you are probably looking for [@projectbluefin/common](https://github.com/projectbluefin/common) to change something in Bluefin. Make sure you check [the architecture diagram](https://docs.projectbluefin.io/contributing#understanding-bluefins-architecture).
diff --git a/Containerfile b/Containerfile
@@ -11,11 +11,12 @@ FROM ${COMMON_IMAGE}@${COMMON_IMAGE_SHA} AS common
 FROM ${BREW_IMAGE}@${BREW_IMAGE_SHA} AS brew
 
 FROM scratch AS ctx
-COPY /system_files /system_files
 COPY /build_files /build_files
 COPY --from=common /system_files/shared /system_files/shared
 COPY --from=common /system_files/bluefin /system_files/shared
 COPY --from=brew /system_files /system_files/shared
+# bluefin-owned files overlay last so they take precedence over common
+COPY /system_files /system_files
 
 ## bluefin image section
 FROM ${BASE_IMAGE}:${FEDORA_MAJOR_VERSION} AS base
diff --git a/image-versions.yml b/image-versions.yml
@@ -2,12 +2,12 @@ images:
   - name: silverblue-main
     image: ghcr.io/ublue-os/silverblue-main
     tag: latest
-    digest: sha256:a5de2125afa358b6eacc5a7fe2ec8d22e41c24a1c5009ba69bdcdbc2ef661d03
+    digest: sha256:30f04a978ca4fae65b178bcd1d1f5ee5c70a26f1a47f7c9fbaa255203b7757ab
   - name: common
     image: ghcr.io/projectbluefin/common
     tag: latest
     digest: sha256:fbcef9b1636bc67c2cb58327527f01c9798280229ad5a91c2f8dac0a5d3b6f3c
   - name: brew
     image: ghcr.io/ublue-os/brew
     tag: latest
-    digest: sha256:48be52bde586f6637ce83f128bf9ba1580b7e4de4d093fed94bec587082850ce
+    digest: sha256:5c5b6dea4b9faaab4d6fa81d7fc4f37f218c8a75a0839c72ae70b268bfdf4b0f
diff --git a/system_files/shared/etc/bazaar/bazaar.yaml b/system_files/shared/etc/bazaar/bazaar.yaml
@@ -0,0 +1,56 @@
+yaml-blocklist-paths:
+  - /run/host/etc/bazaar/blocklist.yaml
+
+
+hooks:
+  - id: jetbrains-toolbox
+    when: before-transaction
+    dialogs:
+      - id: jetbrains-warning
+        title: >-
+          JetBrains IDEs are not supported in this format
+        # If true, render inline markup commands in body; see
+        # https://docs.gtk.org/Pango/pango_markup.html
+        body-use-markup: true
+        body: >-
+          This is a <a href="https://www.jetbrains.com/">JetBrains</a>
+          application and is not officially supported on Flatpak. We
+          recommend using the Toolbox app to manage JetBrains IDEs.
+        # Determines which option will be assumed if the user hits the
+        # escape key or otherwise cancels the dialog
+        default-response-id: cancel
+        options:
+          - id: cancel
+            string: "Cancel"
+          - id: run-ujust
+            string: "Download JetBrains Toolbox"
+            # can be "destructive" or "suggested" or omit for no
+            # styling
+            style: suggested
+    shell: exec python3 /run/host/etc/bazaar/hooks.py
+
+  - id: code
+    when: before-transaction
+    dialogs:
+      - id: code-warning
+        title: >-
+          VS Code like IDEs are not supported in this format
+        # If true, render inline markup commands in body; see
+        # https://docs.gtk.org/Pango/pango_markup.html
+        body-use-markup: true
+        body: >-
+          This is an app based on <a href="https://code.visualstudio.com/">Visual Studio Code</a>
+          and is not officially supported on Flatpak. We
+          recommend using the Homebrew version of the app instead.
+        # Determines which option will be assumed if the user hits the
+        # escape key or otherwise cancels the dialog
+        default-response-id: cancel
+        options:
+          - id: cancel
+            string: "Cancel"
+          - id: download
+            string: "Download from Homebrew"
+            # can be "destructive" or "suggested" or omit for no
+            # styling
+            style: suggested
+    shell: exec python3 /run/host/etc/bazaar/hooks.py
diff --git a/system_files/shared/etc/bazaar/blocklist.yaml b/system_files/shared/etc/bazaar/blocklist.yaml
@@ -0,0 +1,12 @@
+blocklists:
+  - block:
+    - com.visualstudio.code-oss
+    - com.vscodium.codium-insiders
+    - io.neovim.nvim
+    - org.vim.Vim
+    - io.github.zyedidia.micro
+    - com.helix_editor.Helix
+    - org.gnu.emacs
+    - app.devsuite.Ptyxis
+    - org.freedesktop.fwupd
+    - io.github.kolunmi.Bazaar
diff --git a/system_files/shared/etc/dconf/db/distro.d/05-blur-my-shell-extension b/system_files/shared/etc/dconf/db/distro.d/05-blur-my-shell-extension
@@ -0,0 +1,3 @@
+# Disable Blur my Shell popup blur by default system-wide
+[org/gnome/shell/extensions/blur-my-shell/popup]
+blur=false
diff --git a/system_files/shared/usr/lib/systemd/user/bazaar.service b/system_files/shared/usr/lib/systemd/user/bazaar.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Bazaar background service
+Documentation=https://github.com/bazaar-org/bazaar
+After=graphical-session.target
+StartLimitBurst=10
+
+[Service]
+Type=simple
+ExecStart=flatpak run --command=bazaar io.github.kolunmi.Bazaar --no-window
+StandardOutput=journal
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=graphical-session.target
diff --git a/system_files/shared/usr/share/glib-2.0/schemas/zz1-bluefin-extensions.gschema.override b/system_files/shared/usr/share/glib-2.0/schemas/zz1-bluefin-extensions.gschema.override
@@ -0,0 +1,2 @@
+[org.gnome.shell.extensions.blur-my-shell.popup]
+blur=false
diff --git a/system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx b/system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx
@@ -1 +1 @@
-Subproject commit fcd5d023c402dda5ca7982bd82f0fba808725ee8
+Subproject commit 5c53fff9efa9e44d51c946ebdcb4dff49586d93b
diff --git a/system_files/shared/usr/share/ublue-os/user-setup.hooks.d/12-gnupg.sh b/system_files/shared/usr/share/ublue-os/user-setup.hooks.d/12-gnupg.sh
@@ -6,4 +6,4 @@ if [[ -f /usr/libexec/scdaemon ]]; then
     if ! grep -q "scdaemon-program" "${HOME}/.gnupg/gpg-agent.conf" 2>/dev/null; then
         echo "scdaemon-program /usr/libexec/scdaemon" >> "${HOME}/.gnupg/gpg-agent.conf"
     fi
-fi
+fi
