fix: content-height for the picker list, and the small things the review left

.github/actions/prepare/action.yml

@@ -12,11 +12,9 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: The stable toolchain, brought up to date
-      shell: bash
-      env:
-        TARGETS: ${{ inputs.targets }}
-      run: rustup toolchain install stable --no-self-update --component rustfmt,clippy && rustup target add ${TARGETS//,/ }
+    - uses: ./.github/actions/toolchain
+      with:
+        targets: ${{ inputs.targets }}
 
     - name: Stamp the version
       shell: bash

.github/actions/toolchain/action.yml

@@ -0,0 +1,24 @@
+name: The stable toolchain
+description: Stable Rust brought up to date, with rustfmt and clippy, and whatever else a job asks for.
+
+inputs:
+  components:
+    description: More components to add, comma separated.
+    required: false
+    default: ""
+  targets:
+    description: Rust targets to add, comma separated.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    # Named, so an install the runner image already carries is updated rather than reused as it is.
+    - shell: bash
+      env:
+        COMPONENTS: ${{ inputs.components }}
+        TARGETS: ${{ inputs.targets }}
+      run: |
+        rustup toolchain install stable --no-self-update --component "rustfmt,clippy${COMPONENTS:+,$COMPONENTS}"
+        if [ -n "$TARGETS" ]; then rustup target add ${TARGETS//,/ }; fi

.github/dependabot.yml

@@ -63,6 +63,7 @@ updates:
 
   - package-ecosystem: npm
     directory: /app
+    # package.json overrides qs under typed-rest-client 2.3.x (GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g); drop it once Stryker reaches typed-rest-client >= 3.1.1.
     schedule:
       interval: monthly
     open-pull-requests-limit: 3

.github/workflows/bundle.yml

@@ -66,9 +66,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
+      - uses: ./.github/actions/toolchain
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -134,9 +132,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy && rustup target add aarch64-apple-darwin
+      - uses: ./.github/actions/toolchain
+        with:
+          targets: aarch64-apple-darwin
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}

.github/workflows/ci.yml

@@ -29,9 +29,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
+      - uses: ./.github/actions/toolchain
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           shared-key: workspace
@@ -60,9 +58,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
+      - uses: ./.github/actions/toolchain
       - run: cargo fmt --all --check
 
   picker:
@@ -110,6 +106,9 @@ jobs:
         with:
           persist-credentials: false
       - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
+      - name: npm advisories in the picker
+        working-directory: app
+        run: npm audit --package-lock-only --audit-level=moderate
 
   coverage:
     name: coverage
@@ -120,18 +119,15 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy && rustup component add llvm-tools-preview
+      - uses: ./.github/actions/toolchain
+        with:
+          components: llvm-tools-preview
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
         with:
-          tool: cargo-llvm-cov
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        with:
-          tool: nextest
+          tool: cargo-llvm-cov,nextest
 
       - name: What a desktop is not needed to build
         run: |
@@ -177,18 +173,15 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy && rustup component add llvm-tools-preview
+      - uses: ./.github/actions/toolchain
+        with:
+          components: llvm-tools-preview
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
         with:
-          tool: cargo-llvm-cov
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        with:
-          tool: nextest
+          tool: cargo-llvm-cov,nextest
       - name: The Mac crate, and the Mac branches of the core and the picker
         run: cargo llvm-cov nextest -p linkunbound-mac -p linkunbound-core -p linkunbound-shell --lcov --output-path lcov-mac.info
       - name: Every path is relative to the repository, which is what Sonar reads

.github/workflows/cla.yml

@@ -29,11 +29,12 @@ jobs:
     with:
       project: linkunbound
       document-url: https://github.com/rgdevment/LinkUnbound/blob/main/CLA.md
+      allowlist: rgdevment,dependabot[bot],github-actions[bot]
       not-signed-message: >-
         Thanks for the pull request. LinkUnbound is released under the GPL-3.0 and offered under
         separate commercial terms, which requires a signature from whoever opened it and every
         author and co-author of its commits before it can be merged. You keep the copyright on
-        your work — see [CLA.md](https://github.com/rgdevment/LinkUnbound/blob/main/CLA.md).
+        your work.
         To sign, post a comment on this pull request with:
     secrets:
       signatures-token: ${{ secrets.CLA_SIGNATURES_TOKEN }}

.github/workflows/mutants-sweep.yml

@@ -25,19 +25,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
+      - uses: ./.github/actions/toolchain
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           shared-key: workspace
           save-if: false
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
         with:
-          tool: nextest
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        with:
-          tool: cargo-mutants
+          tool: nextest,cargo-mutants
 
       - name: Every mutant the core carries
         id: run
@@ -72,19 +67,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
+      - uses: ./.github/actions/toolchain
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           shared-key: workspace
           save-if: false
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
         with:
-          tool: nextest
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        with:
-          tool: cargo-mutants
+          tool: nextest,cargo-mutants
 
       - name: What a desktop is not needed to build
         run: |
@@ -125,19 +115,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
+      - uses: ./.github/actions/toolchain
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           shared-key: workspace
           save-if: false
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
         with:
-          tool: nextest
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        with:
-          tool: cargo-mutants
+          tool: nextest,cargo-mutants
 
       - name: What a desktop is not needed to build
         run: |
@@ -181,18 +166,13 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
+      - uses: ./.github/actions/toolchain
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
         with:
-          tool: nextest
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        with:
-          tool: cargo-mutants
+          tool: nextest,cargo-mutants
 
       - name: One half of every mutant the Mac crate carries, and what only a Mac compiles elsewhere
         id: run

.github/workflows/mutants.yml

@@ -60,10 +60,8 @@ jobs:
           git diff "$from" -- crates/linkunbound-core crates/linkunbound-shell > branch.diff
           if [ -s branch.diff ]; then echo "any=yes" >> "$GITHUB_OUTPUT"; fi
 
-      - name: The stable toolchain, brought up to date
+      - uses: ./.github/actions/toolchain
         if: steps.touched.outputs.any == 'yes'
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           shared-key: workspace
@@ -72,11 +70,7 @@ jobs:
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
         if: steps.touched.outputs.any == 'yes'
         with:
-          tool: nextest
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        if: steps.touched.outputs.any == 'yes'
-        with:
-          tool: cargo-mutants
+          tool: nextest,cargo-mutants
 
       - name: What a desktop is not needed to build
         if: steps.touched.outputs.any == 'yes'
@@ -128,10 +122,8 @@ jobs:
           git diff "$from" -- crates > branch.diff
           if [ -s branch.diff ]; then echo "any=yes" >> "$GITHUB_OUTPUT"; fi
 
-      - name: The stable toolchain, brought up to date
+      - uses: ./.github/actions/toolchain
         if: steps.touched.outputs.any == 'yes'
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           shared-key: workspace
@@ -140,11 +132,7 @@ jobs:
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
         if: steps.touched.outputs.any == 'yes'
         with:
-          tool: nextest
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        if: steps.touched.outputs.any == 'yes'
-        with:
-          tool: cargo-mutants
+          tool: nextest,cargo-mutants
 
       - name: A mutant that lives on a line this branch wrote
         id: run
@@ -190,10 +178,8 @@ jobs:
           git diff "$from" -- app/src-tauri/src > branch.diff
           if [ -s branch.diff ]; then echo "any=yes" >> "$GITHUB_OUTPUT"; fi
 
-      - name: The stable toolchain, brought up to date
+      - uses: ./.github/actions/toolchain
         if: steps.touched.outputs.any == 'yes'
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           shared-key: workspace
@@ -202,11 +188,7 @@ jobs:
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
         if: steps.touched.outputs.any == 'yes'
         with:
-          tool: nextest
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        if: steps.touched.outputs.any == 'yes'
-        with:
-          tool: cargo-mutants
+          tool: nextest,cargo-mutants
 
       - name: What a desktop is not needed to build
         if: steps.touched.outputs.any == 'yes'

.github/workflows/release.yml

@@ -42,9 +42,7 @@ jobs:
           npm ci
           npm run lint
       # About links to the copy on main, so that copy is the one people read, and it trails every bump.
-      - name: The stable toolchain, brought up to date
-        shell: bash
-        run: rustup toolchain install stable --no-self-update --component rustfmt,clippy
+      - uses: ./.github/actions/toolchain
       - name: The notices on main name what this build ships
         if: startsWith(github.ref, 'refs/tags/v')
         run: |
@@ -1420,6 +1418,7 @@ jobs:
           echo "::error::could not push the tap after 5 attempts"
           exit 1
 
+  # Set up job resolves every action, skipped steps included, so WINGET_PUBLISH has to gate the job itself.
   winget:
     name: Windows Package Manager
     needs: [version, publish, verify]
@@ -1428,31 +1427,24 @@ jobs:
       && needs.version.result == 'success' && needs.publish.result == 'success'
       && needs.verify.result == 'success'
       && needs.version.outputs.prerelease == 'false'
+      && vars.WINGET_PUBLISH == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     concurrency:
       group: release-winget-${{ github.ref }}
       cancel-in-progress: false
     env:
-      WINGET_PUBLISH: ${{ vars.WINGET_PUBLISH }}
       WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
     steps:
-      - name: Is there anything to add a version to
-        id: gate
+      - name: The token is there
         shell: bash
         run: |
-          if [ "$WINGET_PUBLISH" != "true" ]; then
-            echo "::notice::WINGET_PUBLISH is not true; winget-pkgs gets nothing until it is"
-            echo "go=no" >> "$GITHUB_OUTPUT"
-          elif [ -z "$WINGET_TOKEN" ]; then
+          if [ -z "$WINGET_TOKEN" ]; then
             echo "::error::WINGET_PUBLISH is true but WINGET_TOKEN is empty"
             exit 1
-          else
-            echo "go=yes" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Open the pull request that adds this version
-        if: steps.gate.outputs.go == 'yes'
         uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
         with:
           identifier: rgdevment.LinkUnbound