feat: v1.3.1 prep

.github/CICD.md

@@ -49,11 +49,19 @@ Image tags are computed by `docker/metadata-action`. The highest-priority tag pe
 Moving pointer tags:
 
 - **`latest`** — always points to the most recent **non-prerelease** GitHub Release. Never moved by branch pushes.
-- **`latest-pre-release`** — always points to the most recent **prerelease** GitHub Release (e.g. `-alpha.N`, `-rc.N`).
+- **`latest-pre-release`** — always points to the most recent **prerelease** GitHub Release (e.g. `-alpha.N`, `-rc.N`). Point demo/staging servers (e.g. via Watchtower) at this tag to track published pre-releases.
 - **`main`** / **`dev`** — track the tip of the respective branch.
 
 `workflow_dispatch` intentionally produces only `sha-{short}` so that manual runs cannot accidentally reassign `latest`, `main`, `dev`, or any other pointer tag.
 
+> **Version stamping of non-release builds.** `dev`, `main`, and feature-branch
+> builds bake a `git describe --tags --always` version (e.g. `v1.3.0-7-gabc1234`)
+> into the binary via ldflags, so the server `/version` endpoint reports a version
+> clearly *ahead* of the last release. Previously these builds used
+> `git describe --abbrev=0`, which stamped them with the **previous** release tag —
+> the reason a branch-tracking demo server appeared to run "exactly one version
+> behind" even when the image content was current.
+
 #### Build Features
 
 - **Multi-platform**: Builds for `linux/amd64` and `linux/arm64` using Buildah
@@ -97,6 +105,8 @@ Tagging follows the same strategy as the Synkronus server image (`latest`, `dev`
 
 Release assets: `synkronus-cli-{os}-{arch}.tar.gz` attached to GitHub Releases. Custom app CI should pin a release tag via `SYNK_CLI_VERSION` and download `synkronus-cli-linux-amd64.tar.gz`.
 
+**CI matrix:** pull requests build **linux-amd64** only; push to `main`/`dev` builds all six OS/arch pairs; release attaches all six to the GitHub Release.
+
 Non-interactive CI login: `synk login -u USER --password "$SYNK_PASSWORD"` (v1.1.2+).
 
 ### Formulus Android Build
@@ -139,9 +149,13 @@ Formplayer assets are **not committed to git** and are ignored via `.gitignore`.
 
 #### Build Types
 
-- **Pull Requests**: Debug APK (unsigned)
-- **Push to main/dev**: Release APK (signed with secrets)
-- **Release**: Release APK published to GitHub Release
+- **Pull Requests**: Debug APK (unsigned), **arm64-v8a only** (smoke)
+- **Push to main/dev**: Release APK + AAB (signed), **arm64-v8a only** — CI artifacts, not F-Droid shippable
+- **GitHub Release**: Release APK + AAB (signed), **all four ABIs** from `formulus/android/gradle.properties` (F-Droid / Play); assets attached to the release
+
+APK and AAB are built in **one** Gradle invocation (`assembleRelease bundleRelease`) so Metro/native work is shared. Gradle uses `gradle/actions/setup-gradle` (daemon left on). Vendored Notifee (`formulus/third_party/notifee`) is cached across runs (key = hash of `vendor-notifee-core.mjs`). CI enables parallel workers (local `gradle.properties` keeps them low for laptops).
+
+NDK `ccache` is **not** wired yet: it needs CI-only CMake launcher hooks into React Native’s native build and can flake; revisit if release builds are still too slow after the above.
 
 #### Secrets Required
 
@@ -377,7 +391,7 @@ Ubuntu job: installs and builds `@ode/tokens`, runs `pnpm install --frozen-lockf
 
 **Jobs `build-desktop-bundles` (CI) and `release-desktop-bundles` (release)**
 
-Matrix build (mirrors CLI OS/arch coverage): **linux** amd64 + arm64, **windows** amd64 + arm64, **darwin** amd64 (`macos-15-intel`) + arm64 (`macos-latest`). Each runner installs Node + pnpm, restores formplayer artifact, installs Linux WebKitGTK packages where needed, runs `pnpm exec tauri build --target …` with a merged config so `beforeBuildCommand` runs **`pnpm build` only** (frontend + Vite output; embedded formplayer is already present). Builds use `Swatinem/rust-cache` scoped per platform.
+Matrix build (mirrors CLI OS/arch coverage): **linux** amd64 + arm64, **windows** amd64 + arm64, **darwin** amd64 (`macos-14`) + arm64 (`macos-latest`). **Pull requests** build **linux-amd64 only** (smoke packaging); **push to `main`/`dev`** and **release** build all six platforms. Each runner installs Node + pnpm, restores formplayer artifact, installs Linux WebKitGTK packages where needed, runs `pnpm exec tauri build --target …` with a merged config so `beforeBuildCommand` runs **`pnpm build` only** (frontend + Vite output; embedded formplayer is already present). Builds use `Swatinem/rust-cache` scoped per platform.
 
 **CI artifacts**
 

.github/workflows/ci.yml

@@ -73,7 +73,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -116,7 +116,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/e2e-attachments.yml

@@ -78,7 +78,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/formulus-android.yml

@@ -29,6 +29,9 @@ concurrency:
 
 env:
   NODE_VERSION: '24'
+  # Full ABI set matches formulus/android/gradle.properties (F-Droid / Play shippable).
+  FORMULUS_ABIS_FULL: armeabi-v7a,arm64-v8a,x86,x86_64
+  FORMULUS_ABIS_SMOKE: arm64-v8a
 
 jobs:
   build-formplayer-assets:
@@ -39,15 +42,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d # v4.1
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node.js for assets
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
@@ -83,7 +86,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Download formplayer assets artifact
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -92,12 +95,12 @@ jobs:
           path: formulus/android/app/src/main/assets/formplayer_dist
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d # v4.1
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
@@ -117,6 +120,13 @@ jobs:
         working-directory: formulus
         run: pnpm install --frozen-lockfile
 
+      # vendor-notifee-core.mjs is a no-op when third_party/notifee is already at the pinned commit.
+      - name: Cache vendored Notifee
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: formulus/third_party/notifee
+          key: notifee-${{ hashFiles('formulus/scripts/vendor-notifee-core.mjs') }}
+
       - name: Vendor Notifee Android core (source build; dir is gitignored)
         working-directory: formulus
         run: pnpm run vendor:notifee
@@ -132,11 +142,18 @@ jobs:
         run: pnpm run generate
 
       - name: Set up Java
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: 'temurin'
           java-version: '17'
-          cache: 'gradle'
+          # Gradle dependency/wrapper caching is handled by gradle/actions/setup-gradle below.
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        with:
+          # Persist the Gradle build cache across CI runs (wrapper + deps + task outputs).
+          # Leave the daemon on so assembleRelease + bundleRelease share one JVM.
+          cache-read-only: false
 
       - name: Make Gradle wrapper executable
         working-directory: formulus/android
@@ -166,20 +183,43 @@ jobs:
           echo "FORMULUS_RELEASE_KEY_ALIAS=${FORMULUS_RELEASE_KEY_ALIAS}" >> formulus/android/local.properties
           echo "FORMULUS_RELEASE_KEY_PASSWORD=${FORMULUS_RELEASE_KEY_PASSWORD}" >> formulus/android/local.properties
 
-      - name: Build debug APK (PR)
+      # ABI policy:
+      # - PR + push to main/dev: arm64-v8a only (smoke / CI artifacts — not F-Droid shippable)
+      # - release: all four ABIs (F-Droid / Play)
+      # Local gradle.properties keeps parallel/workers low for laptops; CI overrides those.
+      # setup-gradle prefers leaving the daemon on (no --no-daemon).
+      - name: Build debug APK (PR, arm64-v8a only)
         if: github.event_name == 'pull_request'
         working-directory: formulus/android
-        run: ./gradlew assembleDebug --no-daemon
-
-      - name: Build release APK (main/dev/release)
-        if: github.event_name != 'pull_request'
+        env:
+          ORG_GRADLE_PROJECT_reactNativeArchitectures: ${{ env.FORMULUS_ABIS_SMOKE }}
+        run: >
+          ./gradlew assembleDebug --stacktrace
+          -Dorg.gradle.parallel=true
+          -Dorg.gradle.workers.max=4
+          -PreactNativeArchitectures=${{ env.FORMULUS_ABIS_SMOKE }}
+
+      - name: Build release APK + AAB (push main/dev, arm64-v8a only)
+        if: github.event_name == 'push'
         working-directory: formulus/android
-        run: ./gradlew assembleRelease --no-daemon
-
-      - name: Build release AAB for Play Store (main/dev/release)
-        if: github.event_name != 'pull_request'
+        env:
+          ORG_GRADLE_PROJECT_reactNativeArchitectures: ${{ env.FORMULUS_ABIS_SMOKE }}
+        run: >
+          ./gradlew assembleRelease bundleRelease --stacktrace
+          -Dorg.gradle.parallel=true
+          -Dorg.gradle.workers.max=4
+          -PreactNativeArchitectures=${{ env.FORMULUS_ABIS_SMOKE }}
+
+      - name: Build release APK + AAB (GitHub Release, all ABIs)
+        if: github.event_name == 'release'
         working-directory: formulus/android
-        run: ./gradlew bundleRelease --no-daemon
+        env:
+          ORG_GRADLE_PROJECT_reactNativeArchitectures: ${{ env.FORMULUS_ABIS_FULL }}
+        run: >
+          ./gradlew assembleRelease bundleRelease --stacktrace
+          -Dorg.gradle.parallel=true
+          -Dorg.gradle.workers.max=4
+          -PreactNativeArchitectures=${{ env.FORMULUS_ABIS_FULL }}
 
       - name: Upload APK artifact
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6

.github/workflows/ode-desktop.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -122,7 +122,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -172,25 +172,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - platform: linux-amd64
-            runner: ubuntu-24.04
-            rust_target: x86_64-unknown-linux-gnu
-          - platform: linux-arm64
-            runner: ubuntu-24.04-arm
-            rust_target: aarch64-unknown-linux-gnu
-          - platform: windows-amd64
-            runner: windows-latest
-            rust_target: x86_64-pc-windows-msvc
-          - platform: windows-arm64
-            runner: windows-11-arm
-            rust_target: aarch64-pc-windows-msvc
-          - platform: darwin-amd64
-            runner: macos-14
-            rust_target: x86_64-apple-darwin
-          - platform: darwin-arm64
-            runner: macos-latest
-            rust_target: aarch64-apple-darwin
+        include: ${{ fromJSON(
+          github.event_name == 'pull_request'
+          && '[{"platform":"linux-amd64","runner":"ubuntu-24.04","rust_target":"x86_64-unknown-linux-gnu"}]'
+          || '[{"platform":"linux-amd64","runner":"ubuntu-24.04","rust_target":"x86_64-unknown-linux-gnu"},{"platform":"linux-arm64","runner":"ubuntu-24.04-arm","rust_target":"aarch64-unknown-linux-gnu"},{"platform":"windows-amd64","runner":"windows-latest","rust_target":"x86_64-pc-windows-msvc"},{"platform":"windows-arm64","runner":"windows-11-arm","rust_target":"aarch64-pc-windows-msvc"},{"platform":"darwin-amd64","runner":"macos-14","rust_target":"x86_64-apple-darwin"},{"platform":"darwin-arm64","runner":"macos-latest","rust_target":"aarch64-apple-darwin"}]'
+          ) }}
 
     steps:
       - name: Checkout repository
@@ -205,7 +191,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -366,7 +352,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/sbom-release.yml

@@ -29,7 +29,7 @@ jobs:
         # scripts/sbom/generate-sboms.mjs shells out to `pnpm list`; needs pnpm on PATH.
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/synkronus-cli-docker.yml

@@ -41,7 +41,13 @@ jobs:
           if [ "${{ github.event_name }}" == "release" ]; then
             VERSION="${{ github.event.release.tag_name }}"
           else
-            VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo "1.0.0")
+            # Non-release (dev/main/branch) builds: describe as
+            # "<last-tag>-<commits>-g<sha>" so the baked version is clearly AHEAD
+            # of the last release, never equal to it. Using --abbrev=0 here labelled
+            # every dev/main image with the PREVIOUS release tag, which is why the
+            # binary always reported exactly one version behind. Needs fetch-depth: 0
+            # (set on checkout above) for tags to be present.
+            VERSION=$(git describe --tags --always 2>/dev/null || echo "0.0.0-dev")
           fi
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
           echo "Building synkronus-cli with version: ${VERSION}"

.github/workflows/synkronus-cli.yml

@@ -23,8 +23,11 @@ jobs:
 
     strategy:
       matrix:
-        goos: [linux, windows, darwin]
-        goarch: [amd64, arm64]
+        include: ${{ fromJSON(
+          github.event_name == 'pull_request'
+          && '[{"goos":"linux","goarch":"amd64"}]'
+          || '[{"goos":"linux","goarch":"amd64"},{"goos":"linux","goarch":"arm64"},{"goos":"windows","goarch":"amd64"},{"goos":"windows","goarch":"arm64"},{"goos":"darwin","goarch":"amd64"},{"goos":"darwin","goarch":"arm64"}]'
+          ) }}
 
     env:
       CGO_ENABLED: 0

.github/workflows/synkronus-docker.yml

@@ -51,7 +51,13 @@ jobs:
           if [ "${{ github.event_name }}" == "release" ]; then
             VERSION="${{ github.event.release.tag_name }}"
           else
-            VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo "1.0.0")
+            # Non-release (dev/main/branch) builds: describe as
+            # "<last-tag>-<commits>-g<sha>" so the baked version is clearly AHEAD
+            # of the last release, never equal to it. Using --abbrev=0 here labelled
+            # every dev/main image with the PREVIOUS release tag, which is why the
+            # running server always reported exactly one version behind. Needs
+            # fetch-depth: 0 (set on checkout above) for tags to be present.
+            VERSION=$(git describe --tags --always 2>/dev/null || echo "0.0.0-dev")
           fi
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
           echo "Building Synkronus with version: ${VERSION}"
@@ -65,7 +71,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          version: 10.33.2
+          version: 11.22.0
 
       - name: Set up Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

Dockerfile

@@ -5,7 +5,7 @@ FROM node:24-alpine AS portal-builder
 # OpenAPI Generator CLI invokes Java during synkronus-portal prebuild (not installed in node:alpine)
 RUN apk add --no-cache openjdk21-jre-headless
 
-RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
+RUN corepack enable && corepack prepare pnpm@11.22.0 --activate
 
 WORKDIR /app