jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-05 01:23:24 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

[CI] Cover the legacy distros and the slow macOS runner in a nightly (#7668)

Browse source 
* [CI] Cover the legacy distros and the slow macOS runner in a nightly

Every pull request built ten Linux legs and five macOS/Windows legs, including
the previous release of each distro and macOS 13 on the Intel runner. Those
legs exist to catch a regression for users on an older distribution, which a
change being reviewed almost never does, and macOS 13 Intel is the slowest leg
of the matrix - 28 minutes against 19 for the rest.

They now run in a nightly build of the default branch and on tag builds, which
is when a change actually ships. Pull requests keep the current release of each
distro, the sanitizer leg and the coverage leg.

* [CI] Run the nightly legs from their own jobs

jobs.<id>.if cannot read matrix, so the previous filter never validated and
no leg of this workflow ran. matrix.exclude cannot express it either: GitHub
processes exclude before include, and these matrices are include-only.

Split the regular and nightly legs into two jobs per platform, sharing the
step list through a YAML anchor and gating the jobs on the event instead of
on matrix. The nightly run now covers only the legs a push leaves out, and
the event name is part of the concurrency group so a nightly and a master
push do not cancel each other.

* [CI] Run the coverage leg in the nightly

gcovr.cfg sets no fail_under, so the leg cannot fail a build, and nothing
consumes coverage-report: it was an artifact produced on every pull request and
read by no one. In the nightly it becomes a trend over the default branch
instead, next to the legs a change being reviewed does not wait for.

The leg itself is unchanged - same distro, version and variant, so the image
name and ccache key still match the warm cache it built. It is marked
allow-failure so a reporting leg cannot redden the nightly run that
vcpkg-cache-import requires to conclude in success.

The release-test comment loses its per-leg parenthetical: it claimed the
sanitizer leg packages, which #7666 stopped being true, and the coverage leg is
no longer in this job.

---------

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
This commit is contained in:
BruebachL 2026-11-04 07:42:35 +01:00 • committed by GitHub
parent 3f7aa4ca82
commit 140fbb4484
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 129 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

178
.github/workflows/desktop-build.yml vendored
View file

@ -33,10 +33,18 @@ on:
- 'CMakeLists.txt'
- 'vcpkg.json'
- 'vcpkg' # needed to match submodule bumps (gitlink)
# The legs the pull-request matrix leaves out run here instead, so the legacy distros and
# the slow macOS runner stay covered without gating a pull request on them. Tags still
# build every leg, because a tag is what ships.
schedule:
- cron: '23 3 * * *'
# Cancel earlier, unfinished runs of this workflow on the same branch (unless on tag --> release)
concurrency:
group: "${{ github.workflow }} @ ${{ github.ref_name }}"
# The event name is part of the group because a nightly run and a push run on master share
# refs/heads/master but must not cancel each other: the nightly would drop the push's vcpkg
# import, and a merge landing during the nightly would drop that night's coverage.
group: "${{ github.workflow }} @ ${{ github.ref_name }} (${{ github.event_name }})"
cancel-in-progress: ${{ github.ref_type != 'tag' }}
jobs:
@ -150,23 +158,11 @@ jobs:
server_only: yes
test: skip
- distro: Debian
version: 12
package: DEB
test: skip # Running tests on all distros is superfluous
- distro: Debian
version: 13
package: DEB
- distro: Fedora
version: 43
package: RPM
test: skip # Running tests on all distros is superfluous
- distro: Fedora
version: 44
@ -177,12 +173,6 @@ jobs:
# new warning in either compiler still fails the build.
debug_test: yes
- distro: Ubuntu
version: 24.04
package: DEB
test: skip # Running tests on all distros is superfluous
- distro: Ubuntu
version: 26.04
@ -204,21 +194,11 @@ jobs:
package: skip
sanitize: yes
- distro: Ubuntu
version: 26.04
variant: cover # separate image and ccache, same distro
# The one leg that runs instrumented for line coverage and publishes the report as
# a workflow artifact. It is a separate leg rather than a second flag on the
# sanitizer leg because the two instruments answer different questions: the
# sanitizer leg reports what the run did wrong, the coverage leg reports what the
# run never touched at all. Combining them would also slow both down. Packaging is
# skipped because the plain Ubuntu 26.04 leg publishes the DEB for this distro.
coverage: yes
package: skip
name: ${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}
needs: configure
# The nightly legs live in build-linux-nightly below. A leg is in exactly one of the two
# matrices, so nothing that reviews a change waits for a distro nobody is changing for.
if: github.event_name != 'schedule'
runs-on: ubuntu-latest # https://github.com/actions/runner-images
continue-on-error: ${{ matrix.allow-failure == 'yes' }}
timeout-minutes: 70
@ -239,7 +219,8 @@ jobs:
DEBUG_TEST: ${{ matrix.sanitize == 'yes' || matrix.coverage == 'yes' || matrix.debug_test == 'yes' }}
RUN_TESTS: ${{ matrix.test != 'skip' && !(matrix.sanitize == 'yes' || matrix.coverage == 'yes' || matrix.debug_test == 'yes') }}
steps:
# Shared with build-linux-nightly so the two leg sets run the same steps.
steps: &linux-steps
- name: "Checkout"
uses: actions/checkout@v7
@ -302,9 +283,8 @@ jobs:
# gets packaged, so a packaging leg no longer pays for a full Debug compile it then
# throws away. macOS and Windows have always tested their release build.
#
# Instrumented and debug-test legs reach this step only when they package (the sanitizer
# leg currently does, the coverage leg does not); their suite already ran in the debug
# step above, so the tests are not repeated here.
# Instrumented and debug-test legs reach this step only when they also package; their
# suite already ran in the debug step above, so the tests are not repeated here.
- name: "Build release, test and package"
id: build
if: matrix.package != 'skip' || env.RUN_TESTS == 'true'
@ -444,30 +424,72 @@ jobs:
GH_TOKEN: ${{ github.token }}
run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
build-linux-nightly:
strategy:
fail-fast: false
matrix:
include:
- distro: Debian
version: 12 # previous stable, still covered by the nightly
package: DEB
test: skip # Running tests on all distros is superfluous
- distro: Fedora
version: 43 # previous release, still covered by the nightly
package: RPM
test: skip # Running tests on all distros is superfluous
- distro: Ubuntu
version: 24.04 # previous LTS, still covered by the nightly
package: DEB
test: skip # Running tests on all distros is superfluous
# The one leg that runs instrumented for line coverage and publishes the report as
# a workflow artifact. It stays a separate leg rather than a second flag on the
# sanitizer leg because the two instruments answer different questions: the
# sanitizer leg reports what the run did wrong, the coverage leg reports what the
# run never touched at all. Combining them would also slow both down.
#
# It moved here from build-linux: gcovr.cfg sets no fail_under, so the leg cannot
# fail a build, and nothing consumes the report per change, which made it an
# artifact nobody read on every pull request. On the default branch it becomes a
# trend instead. Image and ccache keys come from distro, version and variant, so
# they are unchanged and the warm cache that leg built still matches.
- distro: Ubuntu
version: 26.04
variant: cover # separate image and ccache, same distro
coverage: yes
package: skip
# A report must not redden the nightly run: vcpkg-cache-import only imports the
# archives of a run whose conclusion is success.
allow-failure: yes
name: ${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}
needs: configure
# A nightly and a tag build cover the legs a pull request or a merge does not wait for:
# the previous release of each distro, and the one instrument that only reports.
if: github.event_name == 'schedule' || github.ref_type == 'tag'
runs-on: ubuntu-latest # https://github.com/actions/runner-images
continue-on-error: ${{ matrix.allow-failure == 'yes' }}
timeout-minutes: 70
env:
CACHE: ${{ github.workspace }}/.cache/${{ matrix.distro }}${{ matrix.version }}${{ matrix.variant }} # directory for caching docker image and ccache
CCACHE_EVICTION_AGE: 7d
CCACHE_SIZE: 600M # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
CMAKE_GENERATOR: 'Ninja'
NAME: ${{ matrix.distro }}${{ matrix.version }}
IMAGE_SUFFIX: ${{ matrix.variant }}
steps: *linux-steps
build-vcpkg:
strategy:
fail-fast: false
matrix:
include:
- os: macOS
target: 13 # EOL 2025-09-15
runner: macos-15-intel # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md
# macos-26-intel is very slow and fails in CPack during DMG config if not increasing Finder timeout
ccache_eviction_age: 7d
cmake_generator: Ninja
make_package: 1
override_target: 13
package_suffix: "-macOS13_Intel"
qt_version: 6.11.*
qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
soc: Intel
type: Release
use_ccache: 1
vcpkg_scope: 'vcpkg/macos13-x64-xcode26.3/'
vcpkg_upload: 1 # only one leg per vcpkg_scope hands its archives over
xcode: "26.3"
- os: macOS
target: 14 # EOL 2026-??
runner: macos-26 # https://github.com/actions/runner-images/blob/main/images/macos/macos-26-arm64-Readme.md
@ -543,13 +565,16 @@ jobs:
name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
needs: [configure, vcpkg-baseline]
# The nightly leg lives in build-vcpkg-nightly below, next to the Linux nightly legs.
if: github.event_name != 'schedule'
runs-on: ${{ matrix.runner }}
timeout-minutes: 100
env:
CCACHE_DIR: ${{ github.workspace }}/.cache/
CCACHE_SIZE: 600M # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
steps:
# Shared with build-vcpkg-nightly so the two leg sets run the same steps.
steps: &vcpkg-steps
- name: "Checkout"
uses: actions/checkout@v7
with:
@ -1024,6 +1049,42 @@ jobs:
GH_TOKEN: ${{ github.token }}
run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
build-vcpkg-nightly:
strategy:
fail-fast: false
matrix:
include:
- os: macOS
target: 13 # EOL 2025-09-15
runner: macos-15-intel # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md
# macos-26-intel is very slow and fails in CPack during DMG config if not increasing Finder timeout
ccache_eviction_age: 7d
cmake_generator: Ninja
make_package: 1
override_target: 13
package_suffix: "-macOS13_Intel"
qt_version: 6.11.*
qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
soc: Intel
type: Release
use_ccache: 1
vcpkg_scope: 'vcpkg/macos13-x64-xcode26.3/'
vcpkg_upload: 1 # only one leg per vcpkg_scope hands its archives over
xcode: "26.3"
name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
needs: configure
# The EOL target on the slowest runner is too slow to gate a change, so it runs in the
# nightly and on tags only, where the vcpkg cache import also has to accept schedule runs.
if: github.event_name == 'schedule' || github.ref_type == 'tag'
runs-on: ${{ matrix.runner }}
timeout-minutes: 100
env:
CCACHE_DIR: ${{ github.workspace }}/.cache/
CCACHE_SIZE: 600M # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
steps: *vcpkg-steps
prune-caches:
name: Prune caches
# Only master writes caches at all, so only master may clean them up too
@ -1042,8 +1103,9 @@ jobs:
shell: bash
env:
GH_TOKEN: ${{ github.token }}
# Must list every vcpkg_scope of the build-vcpkg matrix above, or the entries of
# a scope that is still in use get deleted on the next run.
# Must list every vcpkg_scope of the build-vcpkg and build-vcpkg-nightly
# matrices above, or the entries of a scope that is still in use get deleted
# on the next run.
LIVE_VCPKG_SCOPES: 'vcpkg/macos13-x64-xcode26.3/ vcpkg/macos14-arm64-xcode26.6/ vcpkg/windows10-x64-vs2026/'
run: |
gh api --paginate "repos/$GITHUB_REPOSITORY/actions/caches?per_page=100" \

16
.github/workflows/vcpkg-cache-import.yml vendored
View file

@ -4,12 +4,14 @@ name: Import vcpkg cache
# rebuilds protobuf, openssl and abseil from source and saves them into the shared
# cache, where every later run can restore them.
#
# Only master pushes are imported here: the collect step, keys.txt and the zip
# contents all come from the workflow run being imported, so importing from an
# unmerged pull request would let anyone who can push a branch — or a bot actor
# such as Dependabot, whose PRs are same-repo — promote arbitrary binaries into
# the scope that master and tag builds restore and link into signed releases.
# Forks build untrusted code and must never reach that scope either.
# Only master pushes and the nightly schedule run on master are imported here: the
# collect step, keys.txt and the zip contents all come from the workflow run being
# imported, so importing from an unmerged pull request would let anyone who can push
# a branch — or a bot actor such as Dependabot, whose PRs are same-repo — promote
# arbitrary binaries into the scope that master and tag builds restore and link into
# signed releases. Forks build untrusted code and must never reach that scope either.
# A scheduled run is the default branch at the commit a master push already built, so
# it carries the same trust as a push.
#
# repository_dispatch is not used on purpose: it would also resolve to the default branch,
# but it counts as a low-trust trigger and may only write there when it declares a
@ -38,7 +40,7 @@ jobs:
# the shared scope even if they somehow target the default branch.
if: >-
github.event.workflow_run.conclusion == 'success' &&
github.event.workflow_run.event == 'push' &&
(github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule') &&
github.event.workflow_run.head_branch == 'master' &&
github.event.workflow_run.head_repository.full_name == github.repository &&
!endsWith(github.event.workflow_run.actor.login, '[bot]') &&