docs(testing): log the v1.10.0-rc.3 macOS e2e run

.github/CODEOWNERS

@@ -1 +1,8 @@
 * @EtienneLescot
+
+# Linux / Wayland capture — @Beetix
+/electron/native/pipewire-capture/                          @Beetix @EtienneLescot
+/electron/native-bridge/capture/linuxNativeCaptureSession*  @Beetix @EtienneLescot
+/electron/native-bridge/cursor/recording/pipeWire*          @Beetix @EtienneLescot
+/crates/compositor/src/linux_*.rs                           @Beetix @EtienneLescot
+/crates/compositor/src/*_linux.rs                           @Beetix @EtienneLescot

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+
+github: [EtienneLescot]
+ko_fi: etiennelescot

.github/workflows/build-whisper-stt.yml

@@ -16,6 +16,13 @@ name: Build whisper-stt binaries
 on:
   workflow_dispatch:
   push:
+    # ALL branches, NO tags. `paths:` alone also matches a tag push, and it has:
+    # publishing `v0.0.0-onnxruntime-1.27.1` started a four-platform whisper build
+    # for a tag that touched none of these files. Listing `branches` is what
+    # excludes tags; `'**'` keeps every branch working, which is the point of this
+    # workflow — contributors push a branch to get binaries built.
+    branches:
+      - "**"
     paths:
       - "scripts/build-whisper-stt.sh"
       - "electron/native/whisper-stt/**"
@@ -139,6 +146,23 @@ jobs:
           "${VCPKG_ROOT_DIR}/vcpkg" install spirv-headers:x64-windows
           echo "CMAKE_PREFIX_PATH=${VCPKG_ROOT_DIR}/installed/x64-windows" >> "$GITHUB_ENV"
 
+      # `${{ env.ImageOS }}` DOES NOT WORK, and it fails silently — the `env`
+      # expression context holds only what a workflow/job/step `env:` block put
+      # there, and the runner sets ImageOS/ImageVersion into its own process
+      # environment instead. Written that way, both halves expanded to the empty
+      # string and the cache below was keyed on the tag and the CMakeLists hash
+      # alone, for every platform, for as long as the line existed: the repo's
+      # own cache list read `whisper-stt-build-darwin-arm64---<hash>`. Reading
+      # them here in a shell is what actually gets their values.
+      #
+      # `shell: bash` is required, not decorative: this matrix includes
+      # windows-latest, where the default shell is PowerShell and `${VAR:-default}`
+      # is not syntax. GitHub ships bash on the Windows image.
+      - name: Read the runner image
+        id: image
+        shell: bash
+        run: echo "tag=${ImageOS:-unknown}-${ImageVersion:-unknown}" >> "$GITHUB_OUTPUT"
+
       - name: Cache whisper.cpp build tree
         uses: actions/cache@v6
         with:
@@ -151,15 +175,15 @@ jobs:
           # bump there invalidates the cache instead of silently reusing a stale
           # FetchContent checkout; falls back to the newest cache for the same
           # platform + runner image on a miss so incremental compilation still
-          # helps. The runner image version ($ImageOS/$ImageVersion) is part of
+          # helps. The runner image version (read by the step above) is part of
           # the key AND the restore-keys prefix because CMake bakes absolute
           # toolchain paths (e.g. the Xcode SDK's libz.tbd) into the cached build
           # tree — when GitHub rolls the image's Xcode/SDK, those paths vanish and
           # a restored tree fails with "No rule to make target …libz.tbd". Scoping
           # the cache to the image version auto-busts it on every toolchain roll.
-          key: whisper-stt-build-${{ matrix.tag }}-${{ env.ImageOS }}-${{ env.ImageVersion }}-${{ hashFiles('electron/native/whisper-stt/CMakeLists.txt') }}
+          key: whisper-stt-build-${{ matrix.tag }}-${{ steps.image.outputs.tag }}-${{ hashFiles('electron/native/whisper-stt/CMakeLists.txt') }}
           restore-keys: |
-            whisper-stt-build-${{ matrix.tag }}-${{ env.ImageOS }}-${{ env.ImageVersion }}-
+            whisper-stt-build-${{ matrix.tag }}-${{ steps.image.outputs.tag }}-
 
       - name: Run whisper-stt build script
         run: bash scripts/build-whisper-stt.sh

.github/workflows/build.yml

@@ -4,6 +4,19 @@ on:
   push:
     tags:
       - "v*"
+      # `v0.0.0-*` is this repository's marker for a tag that is NOT a product
+      # version — a place to hang a binary that needs a permanent public URL, the
+      # way `v0.0.0-stt-models` hosts the 360 MB Whisper model. Without this
+      # exclusion, creating one runs the whole matrix — Windows, macOS x2, Linux,
+      # installers, notarisation — to publish an archive nobody asked it to build.
+      # That has already happened once.
+      #
+      # The other five release-triggered workflows do not need the same guard:
+      # AUR, Nix, winget and Homebrew all gate on
+      # `!github.event.release.prerelease`, and an internal release is marked as a
+      # prerelease. Only the Discord announcement still fires, which is noise
+      # rather than a wrong publication.
+      - "!v0.0.0-*"
   workflow_dispatch:
     inputs:
       arch:
@@ -353,6 +366,16 @@ jobs:
       - name: Build Metal compositor addon
         run: npm run build:native:compositor:mac
 
+      # Third step this job has to spell out, same reason as the two above: it is in
+      # `npm run build:mac`, which this job does not run — it needs `--dir` plus a
+      # hand-rolled DMG. Windows and Linux get it free from `build:win` / `build:linux`.
+      # Unlike the compositor addon, a missing ONNX Runtime does not fail the pack: the
+      # camera-background control just does nothing, on every shipped Mac, with nothing
+      # in CI raising a word. No-ops on x64 — upstream publishes no osx-x64 asset, so the
+      # script says so and exits 0 rather than failing that build.
+      - name: Stage ONNX Runtime
+        run: npm run fetch:onnxruntime
+
       - name: Package .app bundle
         run: npx electron-builder --mac --${{ matrix.arch }} --dir --publish never
         env:
@@ -988,6 +1011,12 @@ jobs:
         # with a tag ref and failed its deploy every time. See docs.yml.
         if: ${{ steps.release.outputs.is_prerelease == 'false' }}
         timeout-minutes: 20
+        # Bookkeeping, not publishing: the release itself is already out by the time
+        # this runs. Letting it fail the job silently skipped publish-msstore on
+        # v1.10.0 (an unrelated Store submission, gated on this job's `needs` success)
+        # even though "Publish release assets" above had already succeeded. Allowed
+        # to fail so a flaky docs deploy never blocks a downstream publish step.
+        continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.OPENSCREEN_RELEASE_TOKEN }}
         run: |

.github/workflows/ci.yml

@@ -159,9 +159,19 @@ jobs:
       # [env] block (cargo has no [target.<cfg>.env] — the macOS section in that file
       # is inert and cargo warns "unused key"), so before that change this job pointed
       # bindgen at the win64 tree and could never have gone green.
+      #
+      # Without a library on ORT_DYLIB_PATH, `runtime_available()` is false and every
+      # segmentation test returns early — the suite goes green having exercised no
+      # inference at all, which is exactly how the `ort`-panics-when-absent bug got
+      # in. Staging it here is what makes `the_whole_loop_produces_a_mask_from_
+      # compose_frame_alone` a real test on this runner instead of a skipped one.
+      # ~30 MB, next to nothing beside `brew install ffmpeg` above.
+      - name: Stage ONNX Runtime
+        run: node scripts/fetch-onnxruntime.mjs
       - name: cargo test (compositor, aarch64-apple-darwin)
         env:
           MAC_FFMPEG_DIR: /opt/homebrew/opt/ffmpeg
+          ORT_DYLIB_PATH: ${{ github.workspace }}/electron/native/bin/darwin-arm64/libonnxruntime.dylib
         run: |
           cd crates
           cargo test -p openscreen-compositor --lib --tests
@@ -266,11 +276,21 @@ jobs:
           # et rendre une erreur qui ne designe pas la cause non plus.
           test -n "$libclang" || { echo "libclang introuvable apres l'installation"; exit 1; }
           echo "LIBCLANG_PATH=$(dirname "$libclang")" >> "$GITHUB_ENV"
+      # Meme raison que sur le job macOS : sans bibliotheque sur ORT_DYLIB_PATH,
+      # `runtime_available()` est faux et chaque test de segmentation rend la main
+      # tout de suite — la suite passe au vert sans avoir exerce la moindre
+      # inference, ce qui est exactement par ou le bug « ort panique quand elle
+      # manque » est entre. C'est ce qui fait de
+      # `the_whole_loop_produces_a_mask_from_compose_frame_alone` un vrai test ici
+      # plutot qu'un test saute. Builtins node uniquement, comme fetch:ffmpeg:sdk.
+      - name: Stage ONNX Runtime
+        run: node scripts/fetch-onnxruntime.mjs
       - name: cargo test (compositor)
         env:
           # Les .so ffmpeg vendorises ne sont dans aucun chemin systeme : sans ca
           # le binaire de test se lance puis meurt sur `libavformat.so.62`.
           LD_LIBRARY_PATH: ${{ github.workspace }}/crates/thirdparty/ffmpeg-linux64-lgpl-shared/lib
+          ORT_DYLIB_PATH: ${{ github.workspace }}/electron/native/bin/linux-x64/libonnxruntime.so
           # Fait ECHOUER `cpu_backend_linux.rs` s'il n'obtient pas le backend CPU,
           # au lieu de le sauter en silence comme sur un poste sans lavapipe.
           OPENSCREEN_REQUIRE_CPU_BACKEND: "1"