gtk4: migrate phrog and Rust bindings

.dockerignore

@@ -0,0 +1,5 @@
+.git
+target
+libphosh-rs
+phosh/_build
+*.log

.github/Dockerfile

@@ -2,32 +2,56 @@
 
 FROM registry.gitlab.gnome.org/world/phosh/phosh/debian:v0.0.2025-11-06
 
-ARG PHOSH_REMOTE=https://gitlab.gnome.org/World/Phosh/phosh.git
-ARG PHOSH_REF=v0.51.0
+# GTK with the custom surface / GtkPlain work that the GTK4 phosh build needs.
+# Pinned to a commit rather than a branch so image builds stay reproducible.
+# Bump this together with the phosh/ subtree in the phrog repo.
+ARG GTK_REMOTE=https://gitlab.gnome.org/guidog/gtk.git
+ARG GTK_REF=a4cba2e3c84fafc4745c7d4cacbe062b32774e0e
 
-ARG PHOC_REMOTE=https://gitlab.gnome.org/World/Phosh/phoc.git
-ARG PHOC_REF=v0.51.0
+# The shared and embedded modes use the same checked-in Phosh subtree,
+# including downstream GTK4 compatibility fixes.
 
+# The custom GTK in /usr/local must win over the distro GTK for building and
+# running phrog. phoc comes from the base image (phosh's own CI image ships
+# it); building it here would drag in wlroots, which Debian does not package.
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
+ENV LD_LIBRARY_PATH=/usr/local/lib
+
+# Keep dependency installation and native builds in separate layers so a Phosh
+# setup failure does not discard a successfully built custom GTK.
 RUN export DEBIAN_FRONTEND=noninteractive \
    && apt-get -y update \
    && apt-get -y install --no-install-recommends \
-    curl \
-    dh-cargo \
-    foot \
-    wf-recorder \
-   && eatmydata git clone ${PHOC_REMOTE} \
-   && cd phoc \
-   && git checkout ${PHOC_REF} \
-   && DEB_BUILD_PROFILES=pkg.phoc.embedwlroots eatmydata apt-get --no-install-recommends -y build-dep . \
-   && eatmydata meson setup --prefix=/usr -Dembed-wlroots=enabled _build . \
-   && eatmydata meson compile -C _build \
-   && eatmydata meson install -C _build \
-   && cd .. \
-   && eatmydata git clone ${PHOSH_REMOTE} \
-   && cd phosh \
-   && git checkout ${PHOSH_REF} \
+    curl dh-cargo foot wf-recorder \
+    meson ninja-build pkg-config glslc \
+    libglib2.0-dev libgdk-pixbuf-2.0-dev libpango1.0-dev libcairo2-dev \
+    libgraphene-1.0-dev libepoxy-dev libegl1-mesa-dev libwayland-dev \
+    wayland-protocols libxkbcommon-dev iso-codes shared-mime-info
+
+RUN eatmydata git clone ${GTK_REMOTE} /gtk \
+   && git -C /gtk checkout ${GTK_REF}
+
+RUN apt-get -y install --no-install-recommends libdrm-dev libgbm-dev
+
+RUN eatmydata meson setup --prefix=/usr/local -Dlibdir=lib \
+    -Dbuild-tests=false -Dbuild-demos=false -Dbuild-examples=false \
+    -Ddocumentation=false -Dintrospection=disabled -Dmedia-gstreamer=disabled \
+    /gtk/_build /gtk \
+   && eatmydata meson compile -C /gtk/_build \
+   && eatmydata meson install -C /gtk/_build
+
+COPY phosh /phosh
+
+RUN export DEBIAN_FRONTEND=noninteractive \
+   && apt-get -y update \
+   && cd /phosh \
    && eatmydata apt-get --no-install-recommends -y build-dep . \
-   && eatmydata meson setup --prefix=/usr -Dbindings-lib=true _build . \
-   && eatmydata meson compile -C _build \
-   && eatmydata meson install -C _build \
+   && apt-get --no-install-recommends -y install \
+    libgcr-4-dev libgnome-desktop-4-dev libgnome-bg-4-dev phoc
+
+RUN eatmydata meson setup --prefix=/usr -Dbindings-lib=true -Dtests=false \
+    -Dphoc_tests=disabled -Dlockscreen-plugins=false -Dquick-setting-plugins=false \
+    /phosh/_build /phosh \
+   && eatmydata meson compile -C /phosh/_build \
+   && eatmydata meson install -C /phosh/_build \
    && eatmydata apt-get clean

.github/workflows/alpine.yml

@@ -21,7 +21,8 @@ permissions:
 
 jobs:
   alpine:
-    if: inputs.release_mode == 'pr' || inputs.release_mode == 'tag' || github.event_name != 'pull_request' || (contains(github.event.pull_request.labels.*.name, 'apk') && !startsWith(github.event.pull_request.head.ref || '', 'release/v'))
+    # Re-enable with a distro repository providing the pinned GTK4/Phosh stack.
+    if: ${{ false }}
     runs-on: ubuntu-24.04${{ matrix.arch == 'aarch64' && '-arm' || '' }}
     strategy:
       fail-fast: false

.github/workflows/build-image.yml

@@ -28,11 +28,11 @@ jobs:
         id: hash
         run: |
           set -uexo pipefail
-          echo "value=${{ hashFiles('.github/Dockerfile') }}" >> $GITHUB_OUTPUT
+          echo "value=${{ hashFiles('.github/Dockerfile', '.dockerignore', 'phosh/**') }}" >> $GITHUB_OUTPUT
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
-          context: .github/
+          context: .
           file: .github/Dockerfile
           push: true
           tags: ghcr.io/samcday/phrog-ci:${{ steps.hash.outputs.value }}

.github/workflows/build.yml

@@ -9,14 +9,14 @@ on:
         type: boolean
         default: false
   push:
-    branches: [main]
+    branches: [gtk4]
   pull_request_target:
-    branches: [main, vendor-base]
+    branches: [gtk4, main, vendor-base]
     types: [labeled, opened, reopened, synchronize]
   workflow_dispatch: {}
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.head.sha || github.sha }}
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.head.sha || github.sha }}
   cancel-in-progress: true
 
 env:
@@ -42,7 +42,7 @@ jobs:
         id: hash
         run: |
           set -uexo pipefail
-          echo "value=${{ hashFiles('.github/Dockerfile') }}" >> $GITHUB_OUTPUT
+          echo "value=${{ hashFiles('.github/Dockerfile', '.dockerignore', 'phosh/**') }}" >> $GITHUB_OUTPUT
   build:
     if: inputs.release_mode || github.event_name != 'pull_request_target' || !startsWith(github.event.pull_request.head.ref || '', 'release/v')
     needs: image-hash
@@ -99,15 +99,15 @@ jobs:
       - name: Lint
         run: |
           ${{ matrix.cargo }} clippy --locked --all-targets --no-deps --verbose -- -D warnings
+      - name: Check Rust/C ABI
+        if: matrix.libphosh == 'system'
+        run: cargo test --locked --manifest-path libphosh-rs/Cargo.toml -p libphosh-sys --test abi
       - name: Test embedding build support
         if: matrix.libphosh == 'bundled'
         run: cargo vendored-phosh test --locked --manifest-path libphosh-rs/Cargo.toml -p libphosh-sys --test native_source
-      - name: Verify registry package
-        if: matrix.libphosh == 'system'
-        run: cargo package --locked --no-verify
       - name: Lint (fmt)
         run: |
-          ${{ matrix.cargo }} fmt --all --check
+          ${{ matrix.cargo }} fmt -p phrog -p xtask --check
       - uses: actions/upload-artifact@v4
         with:
           name: x86-64-debug${{ matrix.libphosh == 'bundled' && '-bundled' || '' }}

.github/workflows/debian-unstable.yml

@@ -20,7 +20,8 @@ concurrency:
 
 jobs:
   build:
-    if: inputs.release_mode == 'pr' || inputs.release_mode == 'tag' || github.event_name != 'pull_request' || (contains(github.event.pull_request.labels.*.name, 'debs') && !startsWith(github.event.pull_request.head.ref || '', 'release/v'))
+    # Re-enable with a distro repository providing the pinned GTK4/Phosh stack.
+    if: ${{ false }}
     name: Build unstable .debs
     runs-on: ${{ matrix.runner }}
     container: debian:unstable

.github/workflows/next-rc-on-merge.yml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   tag-release-pr:
-    if: github.event.pull_request.merged == true && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.event.pull_request.head.ref, 'release/v')
+    if: github.event.pull_request.base.ref == 'main' && github.event.pull_request.merged == true && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.event.pull_request.head.ref, 'release/v')
     runs-on: ubuntu-latest
     steps:
       - name: Require release automation token
@@ -66,7 +66,7 @@ jobs:
             -f sha="$MERGE_SHA" >/dev/null
 
   next-rc:
-    if: github.event.pull_request.merged == true && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.event.pull_request.head.ref, 'release/v')
+    if: github.event.pull_request.base.ref == 'main' && github.event.pull_request.merged == true && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.event.pull_request.head.ref, 'release/v')
     runs-on: ubuntu-latest
     steps:
       - name: Parse next rc version from merged release branch

.github/workflows/release.yml

@@ -14,6 +14,8 @@ permissions:
 
 jobs:
   gate:
+    # GTK4 snapshots are CI artifacts; stable/RC publication belongs to main.
+    if: ${{ false }}
     runs-on: ubuntu-latest
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}

.packit.yaml

@@ -16,35 +16,6 @@ actions:
     - cargo vendor --locked --versioned-dirs vendor
     - tar -H pax --create --gzip --sort=name --owner=0 --group=0 --numeric-owner --file phrog-vendor.tar.gz vendor
 
-jobs:
-  # Build PRs against the non-vendor path, leaning on the gtk3-rs RPMs
-  # resurrected in samcday/phrog-nightly.
-  - job: copr_build
-    manual_trigger: true
-    trigger: pull_request
-    additional_repos:
-      - copr://samcday/phosh-nightly
-      - copr://samcday/phrog-nightly
-    targets:
-      fedora-41-aarch64: &opts
-        without_opts:
-          - vendor
-      fedora-41-x86_64: *opts
-      fedora-rawhide-aarch64: *opts
-      fedora-rawhide-x86_64: *opts
-
-  # Build main commits in samcday/phrog-nightly COPR via the vendor path,
-  # mirroring what ships in Fedora dist-git.
-  - job: copr_build
-    trigger: commit
-    branch: main
-    owner: samcday
-    project: phrog-nightly
-    additional_repos:
-      - copr://samcday/phosh-nightly
-
-  # Build tagged releases in samcday/phrog COPR via the vendor path.
-  - job: copr_build
-    trigger: release
-    owner: samcday
-    project: phrog
+# GTK4 depends on unreleased GTK/Phosh. Existing stable and nightly COPRs
+# remain GTK3 channels managed from main; GTK4 currently produces CI artifacts.
+jobs: []