Merge pre-release into main for v1.2.5 'Accolade Watch'

Author: vicrodh

.github/workflows/build-qbzd.yml

@@ -10,6 +10,12 @@ on:
   #     - 'qbzd-v*'
   workflow_dispatch:
 
+# Default to read-only; the `release` job below opts in to `contents: write`
+# explicitly. Without this top-level block the build jobs would inherit the
+# repository-wide write token. Closes CodeQL actions/missing-workflow-permissions.
+permissions:
+  contents: read
+
 jobs:
   build-x86_64:
     runs-on: ubuntu-22.04

.github/workflows/release-updater-manifest.yml

@@ -25,8 +25,19 @@ jobs:
     steps:
       - name: Resolve version from tag
         id: version
+        # `head_branch` on a `workflow_run` event is attacker-controllable
+        # (an outside contributor could push a branch with an injection
+        # payload as its name). Route it through an env var and validate
+        # the shape before letting it flow into shell or $GITHUB_OUTPUT.
+        env:
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
         run: |
-          TAG="${{ github.event.workflow_run.head_branch }}"
+          set -euo pipefail
+          if ! printf '%s' "$HEAD_BRANCH" | grep -Eq '^v[0-9][0-9A-Za-z._-]{0,63}$'; then
+            echo "::error::Rejected head_branch for manifest job: $HEAD_BRANCH"
+            exit 1
+          fi
+          TAG="$HEAD_BRANCH"
           VERSION="${TAG#v}"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"

crates/Cargo.lock

@@ -87,7 +87,9 @@ pub async fn run(mut config: DaemonConfig) -> Result<(), String> {
     // Try auto-login from saved OAuth token
     match try_auto_login(&core).await {
         Some(user_id) => {
-            log::info!("[qbzd] Auto-login successful (user_id: {})", user_id);
+            // Demoted from info to debug to keep user_id out of default-level
+            // logs (CodeQL rust/cleartext-logging). Set RUST_LOG=debug to see.
+            log::debug!("[qbzd] Auto-login successful (user_id: {})", user_id);
             // Activate per-user session (initialize stores, sync settings)
             match crate::session::activate_session(user_id, &core, &event_tx).await {
                 Ok(session) => {
@@ -214,7 +216,9 @@ async fn try_auto_login(core: &QbzCore<DaemonAdapter>) -> Option<u64> {
 
     match core.login_with_token(&token).await {
         Ok(session) => {
-            log::info!(
+            // Demoted from info to debug to keep user_id out of default-level
+            // logs (CodeQL rust/cleartext-logging). Set RUST_LOG=debug to see.
+            log::debug!(
                 "[qbzd] Session restored for user {} ({})",
                 session.display_name,
                 session.user_id

crates/qbzd/src/daemon.rs

@@ -22,7 +22,9 @@ pub async fn activate_session(
     core: &qbz_core::QbzCore<crate::adapter::DaemonAdapter>,
     event_tx: &tokio::sync::broadcast::Sender<DaemonEvent>,
 ) -> Result<UserSession, String> {
-    log::info!("[qbzd/session] Activating session for user {}", user_id);
+    // Demoted from info to debug to keep user_id out of default-level logs
+    // (CodeQL rust/cleartext-logging). Set RUST_LOG=debug to see.
+    log::debug!("[qbzd/session] Activating session for user {}", user_id);
 
     // Resolve per-user directories (same layout as desktop app)
     let global_data = dirs::data_dir()

crates/qbzd/src/session.rs

@@ -29,8 +29,13 @@ use crate::AppState;
 
 use super::{
     download_audio, v2_cache_notification_artwork, v2_format_notification_quality,
-    v2_prepare_notification_icon_bytes, v2_teardown_type_alias_state,
+    v2_teardown_type_alias_state,
 };
+// Linux-only: turns an artwork PNG into the raw bytes Ayatana notifications
+// expect. Only called inside the `cfg(target_os = "linux")` arm below, so the
+// import must match.
+#[cfg(target_os = "linux")]
+use super::v2_prepare_notification_icon_bytes;
 
 #[tauri::command]
 pub async fn v2_show_track_notification(

src-tauri/src/commands_v2/legacy_compat.rs

@@ -14,10 +14,15 @@ use crate::runtime::{CommandRequirement, RuntimeError, RuntimeManagerState};
 use crate::AppState;
 
 use super::{
-    cached_audio_incompatible_with_hw, cached_quality_below_requested, download_with_backoff,
-    limit_quality_for_device, parse_quality, try_cmaf_full_download, try_cmaf_streaming_setup,
-    v2_cmaf_stream, v2_download_and_stream, v2_get_stream_info, v2_library_get_tracks_by_ids,
+    cached_quality_below_requested, download_with_backoff, limit_quality_for_device,
+    parse_quality, try_cmaf_full_download, try_cmaf_streaming_setup, v2_cmaf_stream,
+    v2_download_and_stream, v2_get_stream_info, v2_library_get_tracks_by_ids,
 };
+// Linux-only: ALSA hardware capability check. The callsites that use it are
+// already gated on `cfg(target_os = "linux")`, so the import has to match or
+// macOS fails with "unresolved import".
+#[cfg(target_os = "linux")]
+use super::cached_audio_incompatible_with_hw;
 
 // ==================== Prefetch (V2) ====================
 

src-tauri/src/commands_v2/playback.rs

@@ -11,6 +11,8 @@ use crate::tray_linux_ksni;
 #[cfg(not(target_os = "linux"))]
 use image::GenericImageView;
 #[cfg(not(target_os = "linux"))]
+use std::path::PathBuf;
+#[cfg(not(target_os = "linux"))]
 use tauri::{
     image::Image,
     menu::{Menu, MenuItem, PredefinedMenuItem},