desktops: tier system, install/remove correctness, and a pile of small fixes

.github/workflows/maintenance-desktop-audit.yml

@@ -0,0 +1,187 @@
+name: "Maintenance: Desktop matrix audit"
+
+# Periodic audit of the desktop YAML matrix against:
+#   1. armbian/build's config/distributions/ — flag releases the build
+#      supports but no DE YAML covers
+#   2. packages.debian.org / packages.ubuntu.com — flag DESKTOP_PACKAGES
+#      entries that don't exist in the upstream archive for the
+#      requested (release, arch)
+#
+# When the audit finds work to do, hand the report to Claude (via the
+# Anthropic API) and let it propose YAML edits. Then open a PR with
+# whatever Claude wrote, using peter-evans/create-pull-request.
+#
+# The audit_apply.py script short-circuits when there's nothing to do,
+# so a "no changes" run never burns API tokens or opens an empty PR.
+
+on:
+  schedule:
+    # Mondays at 06:00 UTC. Weekly is enough — release / package
+    # availability changes slowly.
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+    inputs:
+      tier:
+        description: "Tier to audit (minimal, mid, full, or empty for all)"
+        required: false
+        default: ""
+      release:
+        description: "Release codename to audit (empty for all)"
+        required: false
+        default: ""
+      dry_run:
+        description: "Dry run — do not call Claude or open a PR"
+        required: false
+        default: "false"
+        type: choice
+        options:
+          - "false"
+          - "true"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: desktop-audit
+  cancel-in-progress: false
+
+jobs:
+  audit:
+    name: "Desktop matrix audit"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout configng"
+        uses: actions/checkout@v4
+        with:
+          path: configng
+
+      - name: "Checkout armbian/build"
+        uses: actions/checkout@v4
+        with:
+          repository: armbian/build
+          path: build
+          # Only the config/distributions/ directory matters for the
+          # audit, but a sparse checkout would complicate things —
+          # the build repo is small enough to clone shallowly.
+          fetch-depth: 1
+
+      - name: "Set up Python"
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: "Install Python dependencies"
+        run: |
+          pip install --quiet pyyaml anthropic
+
+      - name: "Run deterministic audit"
+        id: audit
+        working-directory: configng
+        run: |
+          set -euo pipefail
+          args=(
+            --build-repo "${{ github.workspace }}/build"
+            --configng-repo "${{ github.workspace }}/configng"
+            --output "${{ github.workspace }}/audit-report.json"
+          )
+          if [[ -n "${{ github.event.inputs.tier }}" ]]; then
+            args+=(--tier "${{ github.event.inputs.tier }}")
+          fi
+          if [[ -n "${{ github.event.inputs.release }}" ]]; then
+            args+=(--release "${{ github.event.inputs.release }}")
+          fi
+          python3 tools/desktops/audit.py "${args[@]}"
+
+          # Surface a summary in the workflow's job summary so reviewers
+          # can read it without downloading artifacts.
+          {
+            echo "## Desktop matrix audit"
+            echo
+            python3 - <<'PY'
+          import json
+          r = json.load(open("${{ github.workspace }}/audit-report.json"))
+          print(f"- **Desktops scanned:** {r['stats']['desktops']}")
+          print(f"- **(release, arch) combinations in scope:** {r['stats']['scope']}")
+          print(f"- **Package availability checks:** {r['stats']['package_lookups']}")
+          print(f"- **Holes found:** {r['stats']['holes']}")
+          print(f"- **Releases not covered:** {len(r['missing_releases'])}")
+          print()
+          if r['missing_releases']:
+              print("### Missing releases")
+              print()
+              print("| release | status | name | architectures |")
+              print("|---|---|---|---|")
+              for m in r['missing_releases']:
+                  print(f"| `{m['release']}` | {m['support_status']} | {m['name']} | `{','.join(m['architectures'])}` |")
+              print()
+          if r['package_holes']:
+              print("### Package holes")
+              print()
+              print("| de | release | arch | tier | missing |")
+              print("|---|---|---|---|---|")
+              for h in r['package_holes']:
+                  pkgs = ", ".join(f"`{p}`" for p in h['missing'])
+                  print(f"| `{h['de']}` | `{h['release']}` | `{h['arch']}` | `{h['tier']}` | {pkgs} |")
+          PY
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          # Set step output: did we find anything actionable?
+          python3 - <<'PY' >> "$GITHUB_OUTPUT"
+          import json
+          r = json.load(open("${{ github.workspace }}/audit-report.json"))
+          actionable = bool(r['package_holes'] or r['missing_releases'])
+          print(f"actionable={'true' if actionable else 'false'}")
+          PY
+
+      - name: "Upload audit report"
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: audit-report
+          path: ${{ github.workspace }}/audit-report.json
+          retention-days: 30
+
+      - name: "Run Claude apply step"
+        id: apply
+        if: steps.audit.outputs.actionable == 'true' && github.event.inputs.dry_run != 'true'
+        working-directory: configng
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${ANTHROPIC_API_KEY:-}" ]]; then
+            echo "::warning::ANTHROPIC_API_KEY secret not set; skipping Claude apply step"
+            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          python3 tools/desktops/audit_apply.py \
+            --report "${{ github.workspace }}/audit-report.json" \
+            --configng-repo "${{ github.workspace }}/configng" \
+            --summary-output "${{ github.workspace }}/audit-summary.md"
+          echo "skipped=false" >> "$GITHUB_OUTPUT"
+
+      - name: "Open / update pull request"
+        if: |
+          steps.audit.outputs.actionable == 'true' &&
+          github.event.inputs.dry_run != 'true' &&
+          steps.apply.outputs.skipped != 'true'
+        uses: peter-evans/create-pull-request@v6
+        with:
+          path: configng
+          branch: bot/desktop-matrix-audit
+          delete-branch: true
+          base: main
+          commit-message: |
+            desktops: weekly matrix audit fixes (bot)
+
+            Generated by .github/workflows/maintenance-desktop-audit.yml
+            via Claude API based on the deterministic findings of
+            tools/desktops/audit.py.
+          title: "desktops: weekly matrix audit fixes (bot)"
+          body-path: ${{ github.workspace }}/audit-summary.md
+          labels: |
+            bot
+            desktops
+            documentation
+          draft: true

tests/BUDG01.conf

@@ -4,6 +4,6 @@ TESTNAME="Budgie desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=budgie
-	./bin/armbian-config --api module_desktops remove de=budgie
+	./bin/armbian-config --api module_desktops install de=budgie tier=minimal
+	./bin/armbian-config --api module_desktops remove  de=budgie
 )}

tests/CINM01.conf

@@ -4,6 +4,6 @@ TESTNAME="Cinnamon desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=cinnamon
-	./bin/armbian-config --api module_desktops remove de=cinnamon
+	./bin/armbian-config --api module_desktops install de=cinnamon tier=full
+	./bin/armbian-config --api module_desktops remove  de=cinnamon
 )}

tests/DEEP01.conf

@@ -4,6 +4,6 @@ TESTNAME="Deepin desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=deepin
-	./bin/armbian-config --api module_desktops remove de=deepin
+	./bin/armbian-config --api module_desktops install de=deepin tier=minimal
+	./bin/armbian-config --api module_desktops remove  de=deepin
 )}

tests/ENLI01.conf

@@ -4,6 +4,6 @@ TESTNAME="enlightenment desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=enlightenment
-	./bin/armbian-config --api module_desktops remove de=enlightenment
+	./bin/armbian-config --api module_desktops install de=enlightenment tier=full
+	./bin/armbian-config --api module_desktops remove  de=enlightenment
 )}

tests/GNME01.conf

@@ -4,6 +4,6 @@ TESTNAME="GNOME desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=gnome
-	./bin/armbian-config --api module_desktops remove de=gnome
+	./bin/armbian-config --api module_desktops install de=gnome tier=full
+	./bin/armbian-config --api module_desktops remove  de=gnome
 )}

tests/I3WM01.conf

@@ -4,6 +4,6 @@ TESTNAME="i3-wm desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=i3-wm
-	./bin/armbian-config --api module_desktops remove de=i3-wm
+	./bin/armbian-config --api module_desktops install de=i3-wm tier=full
+	./bin/armbian-config --api module_desktops remove  de=i3-wm
 )}

tests/KDEN01.conf

@@ -4,6 +4,9 @@ TESTNAME="KDE Neon desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=kde-neon
-	./bin/armbian-config --api module_desktops remove de=kde-neon
+	# kde-neon is status: unsupported and only declares a minimal
+	# tier; do not push mid/full common-tier extras (chromium etc.)
+	# into a desktop that doesn't expect them.
+	./bin/armbian-config --api module_desktops install de=kde-neon tier=minimal
+	./bin/armbian-config --api module_desktops remove  de=kde-neon
 )}

tests/KDEP01.conf

@@ -4,6 +4,6 @@ TESTNAME="KDE Plasma desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=kde-plasma
-	./bin/armbian-config --api module_desktops remove de=kde-plasma
+	./bin/armbian-config --api module_desktops install de=kde-plasma tier=full
+	./bin/armbian-config --api module_desktops remove  de=kde-plasma
 )}

tests/MATE01.conf

@@ -4,6 +4,6 @@ TESTNAME="Mate desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=mate
-	./bin/armbian-config --api module_desktops remove de=mate
+	./bin/armbian-config --api module_desktops install de=mate tier=full
+	./bin/armbian-config --api module_desktops remove  de=mate
 )}

tests/XFCE01.conf

@@ -4,6 +4,6 @@ TESTNAME="XFCE desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=xfce
-	./bin/armbian-config --api module_desktops remove de=xfce
+	./bin/armbian-config --api module_desktops install de=xfce tier=full
+	./bin/armbian-config --api module_desktops remove  de=xfce
 )}

tests/XMON01.conf

@@ -4,6 +4,6 @@ TESTNAME="xmonad desktop"
 
 testcase() {(
 	set -e
-	./bin/armbian-config --api module_desktops install de=xmonad
-	./bin/armbian-config --api module_desktops remove de=xmonad
+	./bin/armbian-config --api module_desktops install de=xmonad tier=full
+	./bin/armbian-config --api module_desktops remove  de=xmonad
 )}