ohos: add the OpenHarmony platform host

.github/workflows/ohos.yml

@@ -0,0 +1,104 @@
+name: OpenHarmony hap
+
+# Tier 3 (platform/README.md): a community port built by a manually dispatched
+# workflow, never on pull requests. The HarmonyOS SDK and hvigor are not
+# anonymously downloadable, so the build job targets a self-hosted runner with
+# the toolchain described in platform/ohos/README.md.
+#
+# Pull request checks build unsigned: this workflow only runs on dispatch, and
+# signing material exists exclusively as repository secrets.
+
+on:
+  workflow_dispatch:
+    inputs:
+      app:
+        description: Application to package
+        type: choice
+        options:
+          - mail
+          - demo
+        default: mail
+      profile:
+        description: Cargo profile
+        type: choice
+        options:
+          - release
+          - debug
+        default: release
+      sign:
+        description: Sign with the AGC material stored in the repository secrets
+        type: boolean
+        default: false
+      run_quality:
+        description: Run the shared quality suite first
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ohos-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  quality:
+    if: inputs.run_quality
+    name: Shared quality suite
+    uses: ./.github/workflows/quality.yml
+
+  hap:
+    name: ${{ inputs.app }} hap (${{ inputs.profile }})
+    needs: quality
+    if: always() && (needs.quality.result == 'success' || needs.quality.result == 'skipped')
+    runs-on: [self-hosted, linux, ohos]
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Check the OHOS workspace formatting
+        run: cargo fmt --manifest-path platform/ohos/Cargo.toml --all -- --check
+
+      - name: Materialize signing material
+        if: inputs.sign
+        env:
+          KEYSTORE_BASE64: ${{ secrets.FLECTAR_OHOS_KEYSTORE_BASE64 }}
+          CERTIFICATE_BASE64: ${{ secrets.FLECTAR_OHOS_CERTIFICATE_BASE64 }}
+          PROFILE_BASE64: ${{ secrets.FLECTAR_OHOS_PROFILE_BASE64 }}
+        run: |
+          test -n "$KEYSTORE_BASE64"
+          test -n "$CERTIFICATE_BASE64"
+          test -n "$PROFILE_BASE64"
+          material="$RUNNER_TEMP/ohos-signing"
+          umask 077
+          mkdir -p "$material"
+          printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$material/keystore.p12"
+          printf '%s' "$CERTIFICATE_BASE64" | base64 --decode > "$material/certificate.cer"
+          printf '%s' "$PROFILE_BASE64" | base64 --decode > "$material/profile.p7b"
+          {
+            echo "RELEASE_SIGN=1"
+            echo "RELEASE_P12=$material/keystore.p12"
+            echo "RELEASE_CERT=$material/certificate.cer"
+            echo "RELEASE_PROFILE=$material/profile.p7b"
+            echo "RELEASE_KEY_ALIAS=${{ secrets.FLECTAR_OHOS_KEY_ALIAS }}"
+            echo "RELEASE_KEY_PWD=${{ secrets.FLECTAR_OHOS_KEY_PASSWORD }}"
+            echo "RELEASE_STORE_PWD=${{ secrets.FLECTAR_OHOS_STORE_PASSWORD }}"
+          } >> "$GITHUB_ENV"
+
+      - name: Build the hap
+        env:
+          APP: ${{ inputs.app }}
+          PROFILE: ${{ inputs.profile }}
+          CARGO_BUILD_JOBS: "4"
+          SKIP_SIGN: ${{ inputs.sign && '0' || '1' }}
+        run: sh platform/ohos/scripts/build-hap.sh
+
+      - name: Remove the signing material
+        if: always() && inputs.sign
+        run: rm -rf "$RUNNER_TEMP/ohos-signing"
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: flectar-ohos-${{ inputs.app }}-${{ inputs.profile }}
+          path: platform/ohos/build/*.hap
+          if-no-files-found: error

.github/workflows/quality.yml

@@ -84,6 +84,8 @@ jobs:
         run: python3 scripts/check-platform-gates.py
       - name: Verify the Blitz patch queue
         run: bash scripts/blitz-patches.sh verify
+      - name: Verify the Fontique patch queue
+        run: bash scripts/fontique-patches.sh verify
       - name: Verify and test the Parley backport
         run: |
           python3 scripts/verify-parley.py

Cargo.toml

@@ -1,6 +1,6 @@
 [workspace]
 members = ["crates/flectar-mail-core", "crates/renderer-probe"]
-exclude = ["crates/candle-core", "crates/blitz-dom", "crates/blitz-paint", "crates/i-slint-backend-winit", "crates/parley", "crates/parley_emoji"]
+exclude = ["crates/candle-core", "crates/blitz-dom", "crates/blitz-paint", "crates/fontique", "crates/i-slint-backend-winit", "crates/parley", "crates/parley_emoji"]
 resolver = "3"
 
 [workspace.dependencies]
@@ -174,7 +174,7 @@ objc2-foundation = { version = "0.3", default-features = false, features = ["std
 objc2-service-management = { version = "0.3", default-features = false, features = ["std", "objc2", "objc2-foundation", "SMAppService"] }
 
 # This is `desktop`; keep it in step with the `mobile` alias in build.rs.
-[target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
+[target.'cfg(not(any(target_os = "android", target_os = "ios", target_env = "ohos")))'.dependencies]
 arboard = { version = "3.6", default-features = false, features = ["wayland-data-control"] }
 rfd = { version = "0.16", default-features = false, features = ["tokio", "xdg-portal"] }
 

build.rs

@@ -5,7 +5,7 @@ fn main() {
     // operating system. A new platform joins these groups here (and in the
     // core's build.rs) instead of editing call sites. See platform/README.md.
     cfg_aliases! {
-        mobile: { any(target_os = "android", target_os = "ios") },
+        mobile: { any(target_os = "android", target_os = "ios", target_env = "ohos") },
         desktop: { not(mobile) },
         // OpenHarmony reports target_os = "linux" without a desktop session,
         // portals, X11 or a Secret Service.

crates/flectar-mail-core/Cargo.toml

@@ -104,6 +104,6 @@ rustix = { version = "1", features = ["fs"] }
 
 # This is `desktop`. Mobile hosts inject their storage paths and a
 # platform-owned credential store instead.
-[target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
+[target.'cfg(not(any(target_os = "android", target_os = "ios", target_env = "ohos")))'.dependencies]
 dirs = "6"
 keyring = { version = "3", features = ["sync-secret-service", "apple-native", "windows-native"] }

crates/flectar-mail-core/build.rs

@@ -12,7 +12,7 @@ fn main() {
     // Keep `mobile` identical to the application's build.rs; see
     // platform/README.md.
     cfg_aliases! {
-        mobile: { any(target_os = "android", target_os = "ios") },
+        mobile: { any(target_os = "android", target_os = "ios", target_env = "ohos") },
         desktop: { not(mobile) },
         // rustix exposes renameat2/renameatx_np with RENAME_NOREPLACE here.
         rename_noreplace: { any(target_os = "linux", target_os = "android", target_os = "macos", target_os = "ios") },

crates/fontique/.cargo_vcs_info.json

@@ -0,0 +1,6 @@
+{
+  "git": {
+    "sha1": "eea3503dd6cf17130cbb07348e0ff2c918300e94"
+  },
+  "path_in_vcs": "fontique"
+}