Cherry-picked from PR #377 (thanks @Mar0xy) — Node-only portion, no
Discord IPC additions:
- 4 workflows (release-{linux,linux-aarch64,macos,flatpak}.yml) now
install Node 24
- packaging/flatpak/com.blitzfc.qbz.yml: SDK extension node20 → node24,
build append-path and npm_config_nodedir aligned
Forcing function: @icons-pack/svelte-simple-icons@7.x already in use
declares engines.node >=24, so Node 20 produces an EBADENGINE warning
in CI. Node 20 also reached EOL on 2026-04-30. Node 24 has been LTS
since October 2025 (~7 months of maturity).
Discord IPC permissions and qbz-wrapper script from #377 were
intentionally NOT cherry-picked — there's no Discord RPC feature in
QBZ today (#336 is still planned but not implemented), so adding the
sandbox permission and the launch wrapper now would expand the
attack surface for nothing. They'll land together with the actual
feature when it ships.
cc
Flatpak uses the <releases> section in metainfo.xml to display the
application version. Added a placeholder release entry and updated
the workflow to inject the actual version and date during build.
Changes:
- Renamed Flatpak manifest, desktop file, and AppStream metainfo
- Updated App ID in all metadata files
- Fixed MPRIS name: qbz_nix → qbz
- Added NAS support permissions: /mnt, /media, /run/media
- Updated CI workflow to use new filenames
- Updated tauri.conf.json bundle identifier
BREAKING CHANGE: Users will need to migrate data from old App ID directories
Data migration will be implemented in next commit
All API credentials are now managed server-side through the Cloudflare
Workers proxy. Build workflows no longer need to inject secrets into
the binary.
Removed:
- SPOTIFY_API_CLIENT_ID/SECRET from release-linux.yml
- TIDAL_API_CLIENT_ID/SECRET from release-linux.yml
- DISCOGS_API_CLIENT_KEY/SECRET from release-linux.yml
- LAST_FM_API_KEY/SHARED_SECRET from release-linux.yml
- Complete 'Inject API secrets' step from release-flatpak.yml
This completes the API keys refactor for Flathub compliance.
- Switch to GNOME SDK 48 which includes webkit2gtk-4.1
- Install Node.js 20 LTS directly from tarball (no SDK extension needed)
- Install Rust via rustup for latest stable version
- Add flatpak build directories to .gitignore
SDK 24.08 doesn't have javascriptcoregtk-4.1 (uses webkit 6.0).
SDK 23.08 has Rust 1.81 which doesn't support edition2024.
Solution: use SDK 23.08 with webkit2gtk 4.1 but install Rust via rustup.
The zbus 5.x crate requires Rust edition2024 which needs Rust 1.85+.
SDK 23.08 only has Rust 1.81. Upgrade to 24.08 which has a newer Rust.
Also upgrade node extension from node20 to node22.
- Add option_env! for Discogs, Spotify, Tidal credentials
- Credentials embedded in binary during CI build
- Falls back to runtime env vars for development/user override
- Add secrets to GitHub Actions workflows for Linux and Flatpak builds
- Fix Linux build: add libasound2-dev, libssl-dev
- Fix Flatpak build: use --user flag for flatpak operations
vicrodh