Fix build pipeline: sandbox handling, source mirrors, cache pulls, prefix staging

.github/workflows/build-version.yml

@@ -61,9 +61,25 @@ jobs:
           bst --version
 
       - name: Lift AppArmor restrictions for bubblewrap
+        # Ubuntu 24.04+ runners restrict unprivileged user namespaces, which
+        # BuildStream's bubblewrap sandbox needs. The sysctls don't exist on
+        # older kernels (or inside unprivileged containers), so tolerate
+        # failures here.
         run: |
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 || true
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+
+      - name: Verify bubblewrap sandbox works
+        # Fail fast with a clear message if the sandbox is unusable,
+        # instead of failing deep inside a build element.
+        run: |
+          if ! bwrap --ro-bind / / --dev-bind /dev /dev true; then
+            echo "::error::bubblewrap cannot create namespaces."
+            echo "::error::On GitHub runners the AppArmor step above must succeed;"
+            echo "::error::locally (act/docker) run with --privileged."
+            exit 1
+          fi
+          echo "bubblewrap sandbox OK"
 
       # BuildStream CAS (Content Addressable Storage) cache
       # Shared across all Proton-GE versions to reuse expensive artifacts like GCC, MinGW

.github/workflows/smoke-test.yml

@@ -0,0 +1,81 @@
+# Fast smoke test for the BuildStream project.
+#
+# Runs on every push/PR to catch breakage early, without running the
+# multi-hour full prefix build. Verifies that:
+#   - the CI dependency set installs
+#   - the bubblewrap sandbox works (see docs/build-infrastructure.md)
+#   - the element graph resolves
+#   - a real sandboxed build succeeds on a cheap element
+#
+# Full builds are done by build-single.yml / build-matrix.yml.
+
+name: Smoke Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: smoke-test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  smoke:
+    name: Project loads and sandboxed build works
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      # Pinned Proton-GE version with known SHA256, so no large download
+      # is needed to validate the configuration include.
+      SMOKE_PROTON_VERSION: GE-Proton10-4
+      SMOKE_PROTON_SHA256: 13cbc2d3c18b3c117d439911db10e5d9d0ffb2f5fd28c27ce0cd9fa5cd4d278a
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install BuildStream and dependencies
+        run: |
+          pip install buildstream buildstream-plugins dulwich==0.24.0 requests tomlkit
+          sudo apt update
+          sudo apt install -y bubblewrap lzip
+          bst --version
+
+      - name: Lift AppArmor restrictions for bubblewrap
+        # Ubuntu 24.04+ runners restrict unprivileged user namespaces, which
+        # BuildStream's bubblewrap sandbox needs. The sysctls don't exist on
+        # older kernels (or inside unprivileged containers), so tolerate
+        # failures here.
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 || true
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+
+      - name: Verify bubblewrap sandbox works
+        # Fail fast with a clear message if the sandbox is unusable,
+        # instead of failing deep inside a build element.
+        run: |
+          if ! bwrap --ro-bind / / --dev-bind /dev /dev true; then
+            echo "::error::bubblewrap cannot create namespaces."
+            echo "::error::On GitHub runners the AppArmor step above must succeed;"
+            echo "::error::locally (act/docker) run with --privileged."
+            exit 1
+          fi
+          echo "bubblewrap sandbox OK"
+
+      - name: Update Proton-GE configuration
+        run: |
+          ./scripts/update-proton-config.py "$SMOKE_PROTON_VERSION" "$SMOKE_PROTON_SHA256"
+
+      - name: Element graph resolves
+        run: bst show deploy/prefix.bst
+
+      - name: Sandboxed build of a cheap element
+        # winetricks.bst exercises fetch -> sandbox -> build -> cache
+        # against the freedesktop-sdk junction without a long compile.
+        run: bst --network-retries 10 build components/winetricks.bst

README.md

@@ -177,7 +177,9 @@ See `elements/components/trainer-monitor.bst` for a complete example.
 
 ### GitHub Actions Workflows
 
-- **build-prefix.yml**: Multi-version build with matrix generation
+- **build-matrix.yml**: Multi-version build with matrix generation
+- **build-version.yml**: Reusable single-version build workflow
+- **smoke-test.yml**: Fast push/PR smoke test (sandbox + element graph + cheap build)
 - **build-single.yml**: Single Proton-GE version build
 - **pages.yml**: Publishes release metadata to GitHub Pages
 

docs/build-infrastructure.md

@@ -30,10 +30,10 @@ options:
 environment:
   WINEPREFIX: "%{prefix-root}"
   WINE: "%{proton-root}/files/bin/wine"
-  WINEARCH: win64
+  WINEARCH: win32
   DISPLAY: ":99"
   STEAM_COMPAT_DATA_PATH: "%{prefix-root}"
-  STEAM_COMPAT_CLIENT_INSTALL_PATH: "%{proton-root}"
+  STEAM_COMPAT_CLIENT_INSTALL_PATH: "/tmp/steam-dummy"
   MAXJOBS: "%{max-jobs}"
 ```
 
@@ -84,6 +84,14 @@ Defined in `include/_private/aliases.yml`, source aliases provide:
 
 ## Local Development
 
+### Filesystem Requirements
+
+Build from a checkout on a POSIX-permission filesystem (ext4, btrfs, xfs,
+tmpfs). NTFS/FAT mounts report mode `0777` for every file; BuildStream
+includes the executable bit in the CAS digests of `local` sources, so all
+subproject keys diverge from `cache.freedesktop-sdk.io` and junction
+artifacts miss (`waiting`) instead of pulling.
+
 ### Justfile Commands
 
 The `Justfile` provides task automation:
@@ -124,7 +132,7 @@ nix develop  # Enter development shell
 
 ## GitHub Actions CI/CD
 
-### build-prefix.yml
+### build-matrix.yml
 
 Multi-version build workflow with matrix strategy.
 

elements/components/i686-wine-libs.bst

@@ -0,0 +1,16 @@
+# i686 GCC runtime libraries (libgcc_s / libstdc++) for running Proton's
+# 32-bit wine binaries under an x86_64 host.
+#
+# Filters the freedesktop-sdk i686 junction's gcc-libs artifact down to its
+# `gcc-libs` split only. Depending on the junction element directly would also
+# stage its runtime closure (full i686 glibc), which overlaps the x86_64 base
+# system.
+kind: filter
+
+build-depends:
+- freedesktop-sdk.bst:cross-compilers/freedesktop-sdk-i686.bst:components/gcc-libs.bst
+
+config:
+  include:
+  - runtime
+  include-orphans: False

elements/deploy/prefix.bst

@@ -42,6 +42,7 @@ build-depends:
 - freedesktop-sdk.bst:components/curl.bst
 - freedesktop-sdk.bst:components/freetype.bst
 - freedesktop-sdk.bst:components/gawk.bst
+- freedesktop-sdk.bst:components/gnutls.bst
 - freedesktop-sdk.bst:components/grep.bst
 - freedesktop-sdk.bst:components/gzip.bst
 - freedesktop-sdk.bst:components/sed.bst
@@ -52,14 +53,13 @@ build-depends:
 
 (?):
   - target_arch == 'x86_64':
-# i686 cross-compiler for 32-bit Wine components
+# 32-bit glibc (multiarch dirs + ld-linux.so.2 loader) and GCC runtime libs
+# so Proton's 32-bit wine binaries can execute. Both stage only multiarch
+# content, so they do not overlap the x86_64 base system.
       build-depends:
-        (>):
-        - freedesktop-sdk.bst:cross-compilers/freedesktop-sdk-i686.bst:components/gnutls.bst
+        (<):
         - freedesktop-sdk.bst:cross-compilers/standard-libs-i686.bst
-        - freedesktop-sdk.bst:cross-compilers/gcc-i686.bst
-      environment:
-        LD_LIBRARY_PATH: "/lib/sdk/toolchain-i386/i686-unknown-linux-gnu/lib/i386-linux-gnu:/usr/lib/i386-linux-gnu:/proton/files/lib64:/proton/files/lib/proton/files/lib"
+        - components/i686-wine-libs.bst
   - target_arch == 'i686':
 # Native 32-bit compiler for 32-bit Wine components
       build-depends:
@@ -90,7 +90,7 @@ config:
     echo "Initializing Wine prefix with wineboot..."
     $WINE wineboot -i || (export WINE="/proton/files/bin/wine64"; export WINEARCH=win64; rm -rf "%{prefix-root}"; $WINE wineboot -i)
 
-  # Step 3: Install Windows components via winetricks
+  # Step 4: Install Windows components via winetricks using the mode chosen above
   # -q flag runs in quiet/unattended mode
   - |
     echo "Installing dependencies via winetricks..."

elements/freedesktop-sdk.bst

@@ -17,7 +17,7 @@ kind: junction
 sources:
 - kind: git_repo
   url: gitlab:freedesktop-sdk/freedesktop-sdk.git
-  ref: freedesktop-sdk-25.08.11-0-g30517eb37d146e6dcfa1b0e9337ff835e3473ee5
+  ref: freedesktop-sdk-25.08.16-0-gc4f8b7234c787e8282fb9d4f208b08f9f677eba9
   track: freedesktop-sdk-25.08.*
 
 config:

elements/toolchains/mingw/gcc-core-i686.bst

@@ -96,7 +96,7 @@ sources:
 - kind: git_repo
   url: gcc_gnu_org:gcc.git
   track: releases/gcc-14
-  ref: releases/gcc-14.3.0-704-ge3fd57923aa30fff2496960e65a47bc13992985d
+  ref: releases/gcc-14.3.0-0-gc9cd41fba9ebd288c4f101e4b99da934bcb96a11
 
 # GMP - GNU Multiple Precision Arithmetic Library (required by GCC)
 - kind: tar

elements/toolchains/mingw/gcc-i686.bst

@@ -113,7 +113,7 @@ sources:
 - kind: git_repo
   url: gcc_gnu_org:gcc.git
   track: releases/gcc-14
-  ref: releases/gcc-14.3.0-704-ge3fd57923aa30fff2496960e65a47bc13992985d
+  ref: releases/gcc-14.3.0-0-gc9cd41fba9ebd288c4f101e4b99da934bcb96a11
 
 # GMP - GNU Multiple Precision Arithmetic Library (required by GCC)
 - kind: tar

elements/toolchains/rust-mingw-i686.bst

@@ -27,7 +27,7 @@
 #
 # Output: Rustlib at /usr/lib/rustlib/i686-pc-windows-gnu
 #
-# Source: Rust 1.92.0 source distribution
+# Source: Rust 1.95.0 source distribution (matches freedesktop-sdk 25.08.16 rustc)
 #
 kind: manual
 

flake.nix

@@ -19,12 +19,17 @@
             lzip
             buildbox
             buildstream
+            # Required by BuildStream to sandbox builds
+            bubblewrap
           ] ++ (with pkgs.python3Packages; [
             packaging
             pip
             tomlkit
             requests
             dulwich
+            # Provides the autotools element and git/patch sources (loaded
+            # via `origin: pip` in project.conf)
+            buildstream-plugins
           ]);
         };
       }

include/proton-ge-config.yml

@@ -1,4 +1,4 @@
 variables:
-  proton_ge_version: ""
-  proton_ge_hash: ""
-  proton_ge_url: ""
+  proton_ge_version: "GE-Proton10-4"
+  proton_ge_hash: "13cbc2d3c18b3c117d439911db10e5d9d0ffb2f5fd28c27ce0cd9fa5cd4d278a"
+  proton_ge_url: "github:GloriousEggroll/proton-ge-custom/releases/download/GE-Proton10-4/GE-Proton10-4.tar.gz"

project.conf

@@ -10,6 +10,9 @@ aliases:
 
 (@):
   - freedesktop-sdk.bst:include/runtime.yml
+  # Mirror definitions for source aliases (gcc.gnu.org, sourceware.org, etc.
+  # are rate-limited or flaky; mirrors fall back to freedesktop-sdk GitLab)
+  - freedesktop-sdk.bst:include/_private/mirrors.yml
 
 fatal-warnings:
 - overlaps