[CI] Cover the legacy distros and the slow macOS runner in a nightly (#7668)

* [CI] Cover the legacy distros and the slow macOS runner in a nightly

Every pull request built ten Linux legs and five macOS/Windows legs, including
the previous release of each distro and macOS 13 on the Intel runner. Those
legs exist to catch a regression for users on an older distribution, which a
change being reviewed almost never does, and macOS 13 Intel is the slowest leg
of the matrix - 28 minutes against 19 for the rest.

They now run in a nightly build of the default branch and on tag builds, which
is when a change actually ships. Pull requests keep the current release of each
distro, the sanitizer leg and the coverage leg.

* [CI] Run the nightly legs from their own jobs

jobs.<id>.if cannot read matrix, so the previous filter never validated and
no leg of this workflow ran. matrix.exclude cannot express it either: GitHub
processes exclude before include, and these matrices are include-only.

Split the regular and nightly legs into two jobs per platform, sharing the
step list through a YAML anchor and gating the jobs on the event instead of
on matrix. The nightly run now covers only the legs a push leaves out, and
the event name is part of the concurrency group so a nightly and a master
push do not cancel each other.

* [CI] Run the coverage leg in the nightly

gcovr.cfg sets no fail_under, so the leg cannot fail a build, and nothing
consumes coverage-report: it was an artifact produced on every pull request and
read by no one. In the nightly it becomes a trend over the default branch
instead, next to the legs a change being reviewed does not wait for.

The leg itself is unchanged - same distro, version and variant, so the image
name and ccache key still match the warm cache it built. It is marked
allow-failure so a reporting leg cannot redden the nightly run that
vcpkg-cache-import requires to conclude in success.

The release-test comment loses its per-leg parenthetical: it claimed the
sanitizer leg packages, which #7666 stopped being true, and the coverage leg is
no longer in this job.

---------

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

.github/workflows/desktop-build.yml

@@ -33,10 +33,18 @@ on:
       - 'CMakeLists.txt'
       - 'vcpkg.json'
       - 'vcpkg'    # needed to match submodule bumps (gitlink)
+  # The legs the pull-request matrix leaves out run here instead, so the legacy distros and
+  # the slow macOS runner stay covered without gating a pull request on them. Tags still
+  # build every leg, because a tag is what ships.
+  schedule:
+    - cron: '23 3 * * *'
 
 # Cancel earlier, unfinished runs of this workflow on the same branch (unless on tag --> release)
 concurrency:
-  group: "${{ github.workflow }} @ ${{ github.ref_name }}"
+  # The event name is part of the group because a nightly run and a push run on master share
+  # refs/heads/master but must not cancel each other: the nightly would drop the push's vcpkg
+  # import, and a merge landing during the nightly would drop that night's coverage.
+  group: "${{ github.workflow }} @ ${{ github.ref_name }} (${{ github.event_name }})"
   cancel-in-progress: ${{ github.ref_type != 'tag' }}
 
 jobs:
@@ -150,23 +158,11 @@ jobs:
             server_only: yes
             test: skip
 
-          - distro: Debian
-            version: 12
-
-            package: DEB
-            test: skip    # Running tests on all distros is superfluous
-
           - distro: Debian
             version: 13
 
             package: DEB
 
-          - distro: Fedora
-            version: 43
-
-            package: RPM
-            test: skip    # Running tests on all distros is superfluous
-
           - distro: Fedora
             version: 44
 
@@ -177,12 +173,6 @@ jobs:
             # new warning in either compiler still fails the build.
             debug_test: yes
 
-          - distro: Ubuntu
-            version: 24.04
-
-            package: DEB
-            test: skip    # Running tests on all distros is superfluous
-
           - distro: Ubuntu
             version: 26.04
 
@@ -204,21 +194,11 @@ jobs:
             package: skip
             sanitize: yes
 
-          - distro: Ubuntu
-            version: 26.04
-            variant: cover    # separate image and ccache, same distro
-
-            # The one leg that runs instrumented for line coverage and publishes the report as
-            # a workflow artifact. It is a separate leg rather than a second flag on the
-            # sanitizer leg because the two instruments answer different questions: the
-            # sanitizer leg reports what the run did wrong, the coverage leg reports what the
-            # run never touched at all. Combining them would also slow both down. Packaging is
-            # skipped because the plain Ubuntu 26.04 leg publishes the DEB for this distro.
-            coverage: yes
-            package: skip
-
     name: ${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}
     needs: configure
+    # The nightly legs live in build-linux-nightly below. A leg is in exactly one of the two
+    # matrices, so nothing that reviews a change waits for a distro nobody is changing for.
+    if: github.event_name != 'schedule'
     runs-on: ubuntu-latest    # https://github.com/actions/runner-images
     continue-on-error: ${{ matrix.allow-failure == 'yes' }}
     timeout-minutes: 70
@@ -239,7 +219,8 @@ jobs:
       DEBUG_TEST: ${{ matrix.sanitize == 'yes' || matrix.coverage == 'yes' || matrix.debug_test == 'yes' }}
       RUN_TESTS: ${{ matrix.test != 'skip' && !(matrix.sanitize == 'yes' || matrix.coverage == 'yes' || matrix.debug_test == 'yes') }}
 
-    steps:
+    # Shared with build-linux-nightly so the two leg sets run the same steps.
+    steps: &linux-steps
       - name: "Checkout"
         uses: actions/checkout@v7
 
@@ -302,9 +283,8 @@ jobs:
       # gets packaged, so a packaging leg no longer pays for a full Debug compile it then
       # throws away. macOS and Windows have always tested their release build.
       #
-      # Instrumented and debug-test legs reach this step only when they package (the sanitizer
+      # Instrumented and debug-test legs reach this step only when they also package; their
-      # leg currently does, the coverage leg does not); their suite already ran in the debug
+      # suite already ran in the debug step above, so the tests are not repeated here.
-      # step above, so the tests are not repeated here.
       - name: "Build release, test and package"
         id: build
         if: matrix.package != 'skip' || env.RUN_TESTS == 'true'
@@ -444,30 +424,72 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
 
+  build-linux-nightly:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: Debian
+            version: 12    # previous stable, still covered by the nightly
+
+            package: DEB
+            test: skip    # Running tests on all distros is superfluous
+
+          - distro: Fedora
+            version: 43    # previous release, still covered by the nightly
+
+            package: RPM
+            test: skip    # Running tests on all distros is superfluous
+
+          - distro: Ubuntu
+            version: 24.04    # previous LTS, still covered by the nightly
+
+            package: DEB
+            test: skip    # Running tests on all distros is superfluous
+
+          # The one leg that runs instrumented for line coverage and publishes the report as
+          # a workflow artifact. It stays a separate leg rather than a second flag on the
+          # sanitizer leg because the two instruments answer different questions: the
+          # sanitizer leg reports what the run did wrong, the coverage leg reports what the
+          # run never touched at all. Combining them would also slow both down.
+          #
+          # It moved here from build-linux: gcovr.cfg sets no fail_under, so the leg cannot
+          # fail a build, and nothing consumes the report per change, which made it an
+          # artifact nobody read on every pull request. On the default branch it becomes a
+          # trend instead. Image and ccache keys come from distro, version and variant, so
+          # they are unchanged and the warm cache that leg built still matches.
+          - distro: Ubuntu
+            version: 26.04
+            variant: cover    # separate image and ccache, same distro
+
+            coverage: yes
+            package: skip
+            # A report must not redden the nightly run: vcpkg-cache-import only imports the
+            # archives of a run whose conclusion is success.
+            allow-failure: yes
+
+    name: ${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}
+    needs: configure
+    # A nightly and a tag build cover the legs a pull request or a merge does not wait for:
+    # the previous release of each distro, and the one instrument that only reports.
+    if: github.event_name == 'schedule' || github.ref_type == 'tag'
+    runs-on: ubuntu-latest    # https://github.com/actions/runner-images
+    continue-on-error: ${{ matrix.allow-failure == 'yes' }}
+    timeout-minutes: 70
+    env:
+      CACHE: ${{ github.workspace }}/.cache/${{ matrix.distro }}${{ matrix.version }}${{ matrix.variant }}    # directory for caching docker image and ccache
+      CCACHE_EVICTION_AGE: 7d
+      CCACHE_SIZE: 600M    # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
+      CMAKE_GENERATOR: 'Ninja'
+      NAME: ${{ matrix.distro }}${{ matrix.version }}
+      IMAGE_SUFFIX: ${{ matrix.variant }}
+    steps: *linux-steps
+
   build-vcpkg:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: macOS
-            target: 13    # EOL 2025-09-15
-            runner: macos-15-intel    # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md
-                                      # macos-26-intel is very slow and fails in CPack during DMG config if not increasing Finder timeout
-
-            ccache_eviction_age: 7d
-            cmake_generator: Ninja
-            make_package: 1
-            override_target: 13
-            package_suffix: "-macOS13_Intel"
-            qt_version: 6.11.*
-            qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
-            soc: Intel
-            type: Release
-            use_ccache: 1
-            vcpkg_scope: 'vcpkg/macos13-x64-xcode26.3/'
-            vcpkg_upload: 1    # only one leg per vcpkg_scope hands its archives over
-            xcode: "26.3"
-
           - os: macOS
             target: 14    # EOL 2026-??
             runner: macos-26    # https://github.com/actions/runner-images/blob/main/images/macos/macos-26-arm64-Readme.md
@@ -543,13 +565,16 @@ jobs:
 
     name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
     needs: [configure, vcpkg-baseline]
+    # The nightly leg lives in build-vcpkg-nightly below, next to the Linux nightly legs.
+    if: github.event_name != 'schedule'
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 100
     env:
       CCACHE_DIR: ${{ github.workspace }}/.cache/
       CCACHE_SIZE: 600M    # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
 
-    steps:
+    # Shared with build-vcpkg-nightly so the two leg sets run the same steps.
+    steps: &vcpkg-steps
       - name: "Checkout"
         uses: actions/checkout@v7
         with:
@@ -1024,6 +1049,42 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
 
+  build-vcpkg-nightly:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macOS
+            target: 13    # EOL 2025-09-15
+            runner: macos-15-intel    # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md
+                                      # macos-26-intel is very slow and fails in CPack during DMG config if not increasing Finder timeout
+
+            ccache_eviction_age: 7d
+            cmake_generator: Ninja
+            make_package: 1
+            override_target: 13
+            package_suffix: "-macOS13_Intel"
+            qt_version: 6.11.*
+            qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
+            soc: Intel
+            type: Release
+            use_ccache: 1
+            vcpkg_scope: 'vcpkg/macos13-x64-xcode26.3/'
+            vcpkg_upload: 1    # only one leg per vcpkg_scope hands its archives over
+            xcode: "26.3"
+
+    name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
+    needs: configure
+    # The EOL target on the slowest runner is too slow to gate a change, so it runs in the
+    # nightly and on tags only, where the vcpkg cache import also has to accept schedule runs.
+    if: github.event_name == 'schedule' || github.ref_type == 'tag'
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 100
+    env:
+      CCACHE_DIR: ${{ github.workspace }}/.cache/
+      CCACHE_SIZE: 600M    # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
+    steps: *vcpkg-steps
+
   prune-caches:
     name: Prune caches
     # Only master writes caches at all, so only master may clean them up too
@@ -1042,8 +1103,9 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-          # Must list every vcpkg_scope of the build-vcpkg matrix above, or the entries of
+          # Must list every vcpkg_scope of the build-vcpkg and build-vcpkg-nightly
-          # a scope that is still in use get deleted on the next run.
+          # matrices above, or the entries of a scope that is still in use get deleted
+          # on the next run.
           LIVE_VCPKG_SCOPES: 'vcpkg/macos13-x64-xcode26.3/ vcpkg/macos14-arm64-xcode26.6/ vcpkg/windows10-x64-vs2026/'
         run: |
           gh api --paginate "repos/$GITHUB_REPOSITORY/actions/caches?per_page=100" \

.github/workflows/vcpkg-cache-import.yml

@@ -4,12 +4,14 @@ name: Import vcpkg cache
 # rebuilds protobuf, openssl and abseil from source and saves them into the shared
 # cache, where every later run can restore them.
 #
-# Only master pushes are imported here: the collect step, keys.txt and the zip
+# Only master pushes and the nightly schedule run on master are imported here: the
-# contents all come from the workflow run being imported, so importing from an
+# collect step, keys.txt and the zip contents all come from the workflow run being
-# unmerged pull request would let anyone who can push a branch — or a bot actor
+# imported, so importing from an unmerged pull request would let anyone who can push
-# such as Dependabot, whose PRs are same-repo — promote arbitrary binaries into
+# a branch — or a bot actor such as Dependabot, whose PRs are same-repo — promote
-# the scope that master and tag builds restore and link into signed releases.
+# arbitrary binaries into the scope that master and tag builds restore and link into
-# Forks build untrusted code and must never reach that scope either.
+# signed releases. Forks build untrusted code and must never reach that scope either.
+# A scheduled run is the default branch at the commit a master push already built, so
+# it carries the same trust as a push.
 #
 # repository_dispatch is not used on purpose: it would also resolve to the default branch,
 # but it counts as a low-trust trigger and may only write there when it declares a
@@ -38,7 +40,7 @@ jobs:
     # the shared scope even if they somehow target the default branch.
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
+      (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule') &&
       github.event.workflow_run.head_branch == 'master' &&
       github.event.workflow_run.head_repository.full_name == github.repository &&
       !endsWith(github.event.workflow_run.actor.login, '[bot]') &&