ci: no sccache install on the bare aarch64 (klokka) runner; builtin:checkout

Gate the sccache install to the ephemeral x86_64 container; on the bare klokka
runner check-and-fail (the tarball was x86_64-only, so it was a host mutation
and a wrong-arch binary). Switch checkout to v4 builtin:checkout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.cargo/config.toml

@@ -0,0 +1,11 @@
+# Alpine/musl hosts: rustup's *-linux-musl targets default to crt-static, which
+# tries to statically link system libraries as well. Alpine ships libxkbcommon.so
+# but no libxkbcommon.a, so the final link fails with:
+#     ld: cannot find -lxkbcommon
+#     ld: have you installed the static version of the xkbcommon library ?
+# Link dynamically instead, which is what a binary running on the host wants.
+[target.aarch64-unknown-linux-musl]
+rustflags = ["-C", "target-feature=-crt-static"]
+
+[target.x86_64-unknown-linux-musl]
+rustflags = ["-C", "target-feature=-crt-static"]

.gitea/workflows/release.yml

@@ -16,14 +16,16 @@ jobs:
           - arch: x86_64
             target: x86_64-unknown-linux-gnu
             runs-on: ubuntu-latest
+            sccache_dir: /sccache
           - arch: aarch64
             target: aarch64-unknown-linux-gnu
             runs-on: aarch64
+            sccache_dir: /var/lib/gitea-runner/sccache
 
     runs-on: ${{ matrix.runs-on }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: builtin:checkout
 
       - name: Install system dependencies
         if: matrix.arch == 'x86_64'
@@ -36,11 +38,26 @@ jobs:
         with:
           targets: ${{ matrix.target }}
 
-      - name: Cache cargo registry
+      # Compiled-crate cache via sccache. x86_64 uses /sccache (a persistent
-        uses: actions/cache@v3
+      # host dir bind-mounted into the job container by the runner config);
-        with:
+      # aarch64 runs on the klokka host and uses a runner-owned dir. Both
-          path: ~/.cargo/registry
+      # persist across releases, unlike the (unreachable) Gitea cache service.
-          key: ${{ runner.os }}-${{ matrix.arch }}-cargo-${{ hashFiles('Cargo.lock') }}
+      - name: Set up sccache
+        run: |
+          echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+          echo "SCCACHE_DIR=${{ matrix.sccache_dir }}" >> "$GITHUB_ENV"
+          mkdir -p "${{ matrix.sccache_dir }}"
+          if command -v sccache >/dev/null 2>&1; then sccache --version; exit 0; fi
+          # Bare runners (aarch64 = klokka host) are pre-provisioned; CI must not
+          # install onto them (and this tarball is x86_64-only). Only the
+          # ephemeral x86_64 container installs; a bare host missing it fails loud.
+          if [ "${{ matrix.arch }}" != x86_64 ]; then
+            echo "::error::sccache missing on the bare ${{ matrix.arch }} runner — provision klokka; CI must not install on bare hosts"; exit 1
+          fi
+          V=0.8.2
+          curl -sSL "https://github.com/mozilla/sccache/releases/download/v${V}/sccache-v${V}-x86_64-unknown-linux-musl.tar.gz" | tar -xz
+          sudo install -m0755 "sccache-v${V}-x86_64-unknown-linux-musl/sccache" /usr/local/bin/sccache
+          sccache --version
 
       - name: Build
         run: cargo build --release --target ${{ matrix.target }}
@@ -60,7 +77,7 @@ jobs:
       - name: Create release
         run: |
           curl -sX POST \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             -H "Content-Type: application/json" \
             "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases" \
             -d "{\"tag_name\":\"${{ gitea.ref_name }}\",\"name\":\"${{ gitea.ref_name }}\"}" \
@@ -69,24 +86,24 @@ jobs:
       - name: Upload assets
         run: |
           RELEASE_ID=$(curl -s \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/tags/${{ gitea.ref_name }}" \
             | jq -r '.id')
 
           for FILE in "${{ env.TARBALL }}" "${{ env.TARBALL }}.sha256"; do
             # Remove any existing asset with the same name so re-runs stay clean
             EXISTING=$(curl -s \
-              -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+              -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
               "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${RELEASE_ID}/assets" \
               | jq -r ".[] | select(.name == \"${FILE}\") | .id")
             for AID in $EXISTING; do
               curl -sX DELETE \
-                -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+                -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
                 "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${RELEASE_ID}/assets/${AID}"
             done
 
             curl -sX POST \
-              -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+              -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
               -H "Content-Type: application/octet-stream" \
               "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${RELEASE_ID}/assets?name=${FILE}" \
               --data-binary "@${FILE}" --fail-with-body
@@ -97,7 +114,7 @@ jobs:
     runs-on: aarch64
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: builtin:checkout
 
       - name: Compute checksums and update PKGBUILD
         run: |
@@ -110,6 +127,32 @@ jobs:
           sed -i "s/sha256sums_x86_64=('.*')/sha256sums_x86_64=('${SUM_X86}')/" aur/PKGBUILD
           sed -i "s/sha256sums_aarch64=('.*')/sha256sums_aarch64=('${SUM_AARCH}')/" aur/PKGBUILD
 
+      # Also publish the built packages to this instance's Arch registry
+      # (docs.gitea.com/usage/packages/arch). The PKGBUILD only repacks the
+      # release tarballs, so CARCH can produce both architectures from this
+      # one host. Consumers: see the infrastructure README.
+      # Best-effort mirror to the instance Arch registry. The ephemeral
+      # GITHUB_TOKEN is not accepted as a package-write credential, so this
+      # uses a dedicated REGISTRY_TOKEN secret (a write:package token for bl);
+      # if it is unset the step is skipped, and continue-on-error keeps a
+      # registry hiccup from failing the release or the AUR push.
+      - name: Publish to the Arch package registry
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
+            echo "::warning::REGISTRY_TOKEN not set — skipping Arch registry publish"
+            exit 0
+          fi
+          cd aur
+          for carch in aarch64 x86_64; do
+            pkgfile=$(CARCH="$carch" makepkg --packagelist | tail -1)
+            CARCH="$carch" makepkg -f --nodeps --noconfirm --skipinteg
+            curl --fail-with-body --user "bl:${{ secrets.REGISTRY_TOKEN }}" \
+              --upload-file "$pkgfile" \
+              "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/arch/uhhm"
+          done
+
       - name: Push to AUR
         env:
           AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
@@ -122,6 +165,7 @@ jobs:
           echo "  User aur" >> ~/.ssh/config
           ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
 
+          rm -rf /tmp/aur-gpupaper
           git clone ssh://aur@aur.archlinux.org/gpupaper.git /tmp/aur-gpupaper
           cp aur/PKGBUILD /tmp/aur-gpupaper/
           cd /tmp/aur-gpupaper

Cargo.lock

@@ -473,7 +473,7 @@ dependencies = [
 
 [[package]]
 name = "gpupaper"
-version = "0.1.1"
+version = "0.1.4"
 dependencies = [
  "anyhow",
  "bytemuck",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gpupaper"
-version = "0.1.1"
+version = "0.1.4"
 edition = "2021"
 
 [[bin]]

aur/PKGBUILD

@@ -1,10 +1,11 @@
 # Maintainer: Bendik Aagaard Lynghaug <bendik.lynghaug@gmail.com>
 pkgname=gpupaper
-pkgver=0.1.1
+pkgver=0.1.4
 pkgrel=1
 pkgdesc="Wayland layer-surface wallpaper runner powered by GLSL/WGSL fragment shaders (wgpu)"
 arch=('x86_64' 'aarch64')
-url="https://prosjekt.klingenbergbygg.no/bl/gpupaper"
+options=('!strip')
+url="https://project.uhhm.no/bl/gpupaper"
 license=('MIT')
 depends=('wayland' 'libglvnd')
 optdepends=(
@@ -14,8 +15,8 @@ optdepends=(
 )
 provides=('gpupaper')
 conflicts=('gpupaper-git' 'gpupaper-bin')
-source_x86_64=("gpupaper-v${pkgver}-x86_64.tar.gz::https://prosjekt.klingenbergbygg.no/bl/gpupaper/releases/download/v${pkgver}/gpupaper-v${pkgver}-x86_64.tar.gz")
+source_x86_64=("gpupaper-v${pkgver}-x86_64.tar.gz::https://project.uhhm.no/bl/gpupaper/releases/download/v${pkgver}/gpupaper-v${pkgver}-x86_64.tar.gz")
-source_aarch64=("gpupaper-v${pkgver}-aarch64.tar.gz::https://prosjekt.klingenbergbygg.no/bl/gpupaper/releases/download/v${pkgver}/gpupaper-v${pkgver}-aarch64.tar.gz")
+source_aarch64=("gpupaper-v${pkgver}-aarch64.tar.gz::https://project.uhhm.no/bl/gpupaper/releases/download/v${pkgver}/gpupaper-v${pkgver}-aarch64.tar.gz")
 sha256sums_x86_64=('SKIP')
 sha256sums_aarch64=('SKIP')
 

shaders/fuzzy_clouds.frag

@@ -0,0 +1,29 @@
+// i don't remember what i based this off of or if it was just fiddling,
+// found it in my shader list and thought the clouds were pretty good,
+// for what it is
+uniform float time;
+uniform vec2 resolution;
+
+float noise(vec3 p) {
+	float v = 0.0, a;
+	for (a = .85; a > .15; a *=.75) {
+		v += a * abs(dot( sin( .1*time + .1*p.z + .1*p/a) , vec3(a*3.)) );
+		p += p;
+	}
+	return v;
+}
+
+void mainImage(out vec4 o, vec2 u) {
+    float i = 0.0, s = 0.0;
+    o = vec4(0.0);
+    vec3 p = vec3(0.0);
+    vec2 r = resolution;
+    u = ( u+u - r.xy ) / r.y;
+    for( ; i++ < 1e2; ) {
+        p += vec3(u * s, s);
+        s = .1 + .2* abs( 12.-abs(p.y) - noise(p) );
+        o += 1./s;
+    }
+    o = tanh(vec4(5,2,1,0)*o /3e3/ length(u));
+}
+

src/renderer.rs

@@ -243,11 +243,21 @@ impl SurfaceRenderer {
         fps: u32,
     ) -> Result<Self> {
         let caps = surface.get_capabilities(&gpu.adapter);
+
+        // A surface may advertise formats that need features we never requested when
+        // creating the device (see `required_features` above). Picking one of those
+        // fails validation at `create_render_pipeline`. Turnip/Adreno enumerates
+        // 16-bit-norm formats (needing TEXTURE_FORMAT_16BIT_NORM) before the plain
+        // 8-bit ones, so filter by what the device actually supports rather than
+        // relying on enumeration order.
+        let supported = gpu.device.features();
+        let usable = |f: &wgpu::TextureFormat| supported.contains(f.required_features());
         let format = caps
             .formats
             .iter()
             .copied()
-            .find(|f| !f.is_srgb())
+            .find(|f| !f.is_srgb() && usable(f))
+            .or_else(|| caps.formats.iter().copied().find(usable))
             .unwrap_or(caps.formats[0]);
 
         let present_mode =

src/wayland.rs

@@ -118,7 +118,7 @@ pub fn parse_layer(s: &str) -> Result<Layer> {
         "bottom" => Ok(Layer::Bottom),
         "top" => Ok(Layer::Top),
         "overlay" => Ok(Layer::Overlay),
-        other => bail!("unknown layer: {}", other),
+        other => bail!("unknown layer '{}' (valid: background, bottom, top, overlay)", other),
     }
 }
 
@@ -168,14 +168,11 @@ pub fn run(
     let is_all = target_output == "all" || target_output == "*";
 
     if is_all {
-        let wl_outputs: Vec<_> = state.output_state.outputs().collect();
+        // OutputHandler::new_output already attached one layer per existing
-        if wl_outputs.is_empty() {
+        // output during the roundtrip above. Only fall back to a compositor-
-            // No outputs reported yet; let the compositor assign.
+        // assigned surface if none arrived.
+        if state.outputs.is_empty() {
             state.attach_output(&qh, None);
-        } else {
-            for wl_out in &wl_outputs {
-                state.attach_output(&qh, Some(wl_out));
-            }
         }
     } else {
         let wl_out = find_output(&state.output_state, &target_output);
@@ -343,6 +340,12 @@ impl OutputHandler for AppState {
         output: wl_output::WlOutput,
     ) {
         if self.target_output == "all" || self.target_output == "*" {
+            let name = self
+                .output_state
+                .info(&output)
+                .and_then(|i| i.name)
+                .unwrap_or_else(|| "<unnamed>".into());
+            log::info!("attaching output: {}", name);
             self.attach_output(qh, Some(&output));
         }
     }