CI: Cleanup (#6959)

* Label & variables

* fix bracket

* other workflows

* fix trailing whitespace

* fixes

.github/workflows/desktop-build.yml

@@ -1,10 +1,10 @@
 name: Build Desktop
 
 permissions:
+  actions: write    # needed to delete entries in GHA cache (update ccache)
+  attestations: write    # needed to persist the attestation.
   contents: write
-  id-token: write
-  attestations: write
-  actions: write # needed for ccache action to be able to delete gha caches
+  id-token: write    # needed for signing certificate in attestation
 
 on:
   push:
@@ -19,7 +19,7 @@ on:
       - '.github/workflows/desktop-build.yml'
       - 'CMakeLists.txt'
       - 'vcpkg.json'
-      - 'vcpkg'
+      - 'vcpkg'    # needed to match submodule bumps (gitlink)
     tags:
       - '*'
   pull_request:
@@ -32,7 +32,7 @@ on:
       - '.github/workflows/desktop-build.yml'
       - 'CMakeLists.txt'
       - 'vcpkg.json'
-      - 'vcpkg'
+      - 'vcpkg'    # needed to match submodule bumps (gitlink)
 
 # Cancel earlier, unfinished runs of this workflow on the same branch (unless on release)
 concurrency:
@@ -44,11 +44,11 @@ jobs:
     name: Configure
     runs-on: ubuntu-slim
     outputs:
-      tag: ${{steps.configure.outputs.tag}}
-      sha: ${{steps.configure.outputs.sha}}
+      tag: ${{ steps.configure.outputs.tag }}
+      sha: ${{ steps.configure.outputs.sha }}
 
     steps:  
-      - name: Configure
+      - name: "Configure"
         id: configure
         shell: bash
         run: |
@@ -64,146 +64,150 @@ jobs:
           fi
           echo "sha=$sha" >>"$GITHUB_OUTPUT"
 
-      - name: Checkout
+      - name: "Checkout"
         if: steps.configure.outputs.tag != null
         uses: actions/checkout@v6
         with:
-          fetch-depth: 0
+          fetch-depth: 0    # fetch all history for all branches and tags
 
-      - name: Prepare release parameters
+      - name: "Prepare release parameters"
         id: prepare
         if: steps.configure.outputs.tag != null
         shell: bash
         env:
-          TAG: ${{steps.configure.outputs.tag}}
+          TAG: ${{ steps.configure.outputs.tag }}
         run: .ci/prep_release.sh
 
-      - name: Create release
+      - name: "Create release"
         if: steps.configure.outputs.tag != null
         id: create_release
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-          tag_name: ${{steps.configure.outputs.tag}}
-          target: ${{steps.configure.outputs.sha}}
-          release_name: ${{steps.prepare.outputs.title}}
-          body_path: ${{steps.prepare.outputs.body_path}}
-          prerelease: ${{steps.prepare.outputs.is_beta}}
+          GH_TOKEN: ${{ github.token }}
+          tag_name: ${{ steps.configure.outputs.tag }}
+          target: ${{ steps.configure.outputs.sha }}
+          release_name: ${{ steps.prepare.outputs.title }}
+          body_path: ${{ steps.prepare.outputs.body_path }}
+          prerelease: ${{ steps.prepare.outputs.is_beta }}
         run: |
-          if [[ $prerelease == yes ]]; then
-            args="--prerelease"
-          fi
-          gh release create "$tag_name" --draft --verify-tag $args \
-              --target "$target" --title "$release_name" \
-              --notes-file "$body_path"
+          args=()
+          [[ $prerelease == yes ]] && args+=(--prerelease)
+          
+          gh release create "$tag_name" --verify-tag --draft "${args[@]}" \
+            --target "$target" \
+            --title "$release_name" \
+            --notes-file "$body_path"
 
   build-linux:
     strategy:
       fail-fast: false
       matrix:
-        # These names correspond to the files in ".ci/$distro$version"
+        # The files in ".ci/$distro$version" correspond to the values given here
         include:
           - distro: Arch
-            package: skip    # We are packaged in Arch already
+            
             allow-failure: yes
+            package: skip    # We are packaged in Arch already
 
           - distro: Servatrice_Debian
             version: 12
+            
             package: DEB
-            test: skip
             server_only: yes
+            test: skip
 
           - distro: Debian
             version: 12
+            
             package: DEB
             test: skip    # Running tests on all distros is superfluous
 
           - distro: Debian
             version: 13
+            
             package: DEB
 
           - distro: Fedora
             version: 43
+            
             package: RPM
             test: skip    # Running tests on all distros is superfluous
 
           - distro: Fedora
             version: 44
+            
             package: RPM
 
           - distro: Ubuntu
             version: 24.04
+            
             package: DEB
             test: skip    # Running tests on all distros is superfluous
 
           - distro: Ubuntu
             version: 26.04
+            
             package: DEB
 
-    name: ${{matrix.distro}} ${{matrix.version}}
+    name: ${{ matrix.distro }} ${{ matrix.version }}
     needs: configure
     runs-on: ubuntu-latest
-    continue-on-error: ${{matrix.allow-failure == 'yes'}}
+    continue-on-error: ${{ matrix.allow-failure == 'yes' }}
     timeout-minutes: 70
     env:
-      NAME: ${{matrix.distro}}${{matrix.version}}
-      CACHE: ${{github.workspace}}/.cache/${{matrix.distro}}${{matrix.version}}   # directory for caching docker image and ccache
-      # Cache size over the entire repo is 10Gi:
-      # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
-      CCACHE_SIZE: 550M
+      CACHE: ${{ github.workspace }}/.cache/${{ matrix.distro }}${{ matrix.version }}    # directory for caching docker image and ccache
       CCACHE_EVICTION_AGE: 7d
+      CCACHE_SIZE: 550M    # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
       CMAKE_GENERATOR: 'Ninja'
+      NAME: ${{ matrix.distro }}${{ matrix.version }}
 
     steps:
-      - name: Checkout
+      - name: "Checkout"
         uses: actions/checkout@v6
 
-      - name: Restore compiler cache (ccache)
+      - name: "Restore compiler cache (ccache)"
         id: ccache_restore
         uses: actions/cache/restore@v5
         env:
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
         with:
-          path: ${{env.CACHE}}
-          key: ccache-${{matrix.distro}}${{matrix.version}}-${{env.BRANCH_NAME}}
-          restore-keys: ccache-${{matrix.distro}}${{matrix.version}}-
+          key: ccache-${{ matrix.distro }}${{ matrix.version }}-${{ env.BRANCH_NAME }}
+          path: ${{ env.CACHE }}
+          restore-keys: ccache-${{ matrix.distro }}${{ matrix.version }}-
 
-      - name: Build ${{matrix.distro}} ${{matrix.version}} Docker image
+      - name: "Build ${{ matrix.distro }} ${{ matrix.version }} Docker image"
         shell: bash
         run: source .ci/docker.sh --build
 
-      - name: Build debug and test
+      - name: "Build debug and test"
         if: matrix.test != 'skip'
         shell: bash
         run: |
           source .ci/docker.sh
           RUN --server --debug --test --ccache "$CCACHE_SIZE" \
-                  --cmake-generator "$CMAKE_GENERATOR"
+            --cmake-generator "$CMAKE_GENERATOR"
 
-      - name: Build release package
+      - name: "Build release package"
         id: build
         if: matrix.package != 'skip'
         shell: bash
         env:
-          SUFFIX: '-${{matrix.distro}}${{matrix.version}}'
-          package: '${{matrix.package}}'
-          server_only: '${{matrix.server_only}}'
+          SUFFIX: '-${{ matrix.distro }}${{ matrix.version }}'
+          package: '${{ matrix.package }}'
+          server_only: '${{ matrix.server_only }}'
         run: |
           source .ci/docker.sh
           args=()
-          if [[ $server_only == yes ]]; then
-            args+=(--no-client)
-          fi
-          if [[ $GITHUB_REF == "refs/heads/master" ]]; then
-            args+=(--evict-ccache "$CCACHE_EVICTION_AGE")
-          fi
+          [[ $server_only == yes ]] && args+=(--no-client)
+          [[ $GITHUB_REF == "refs/heads/master" ]] && args+=(--evict-ccache "$CCACHE_EVICTION_AGE")
           args+=(--ccache "$CCACHE_SIZE")
           args+=(--cmake-generator "$CMAKE_GENERATOR")
           args+=(--suffix "$SUFFIX")
+          
           RUN --server --release --package "$package" "${args[@]}"
 
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
-      - name: Delete remote compiler cache (ccache)
+      - name: "Delete remote compiler cache (ccache)"
         if: github.ref == 'refs/heads/master' && steps.ccache_restore.outputs.cache-hit
         continue-on-error: true
         env:
@@ -213,47 +217,47 @@ jobs:
             echo "Cache deleted successfully"
           fi
 
-      - name: Save updated compiler cache (ccache)
+      - name: "Save updated compiler cache (ccache)"
         if: github.ref == 'refs/heads/master'
         uses: actions/cache/save@v5
         with:
-          path: ${{env.CACHE}}
           key: ${{ steps.ccache_restore.outputs.cache-primary-key }}
+          path: ${{ env.CACHE }}
 
-      - name: Upload artifact
+      - name: "Upload artifact"
         id: upload_artifact
         if: matrix.package != 'skip'
         uses: actions/upload-artifact@v7
         with:
-          path: ${{steps.build.outputs.path}}
           archive: false
           if-no-files-found: error
+          path: ${{ steps.build.outputs.path }}
 
-      - name: Upload to release
+      - name: "Upload to release"
         id: upload_release
         if: matrix.package != 'skip' && needs.configure.outputs.tag != null
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-          tag_name: ${{needs.configure.outputs.tag}}
-          asset_name: ${{steps.build.outputs.fullname}}
-          asset_path: ${{steps.build.outputs.path}}
+          asset_name: ${{ steps.build.outputs.fullname }}
+          asset_path: ${{ steps.build.outputs.path }}
+          GH_TOKEN: ${{ github.token }}
+          tag_name: ${{ needs.configure.outputs.tag }}
         run: gh release upload "$tag_name" "$asset_path#$asset_name"
 
-      - name: Attest binary provenance
+      - name: "Attest binary provenance"
         id: attestation
         if: steps.upload_release.outcome == 'success'
         uses: actions/attest@v4
         with:
-          subject-path: ${{steps.build.outputs.path}}
           show-summary: false
+          subject-path: ${{ steps.build.outputs.path }}
 
-      - name: Verify binary attestation
+      - name: "Verify binary attestation"
         if: steps.attestation.outcome == 'success'
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-        run: gh attestation verify "${{steps.build.outputs.path}}" --repo Cockatrice/Cockatrice
+          GH_TOKEN: ${{ github.token }}
+        run: gh attestation verify "${{ steps.build.outputs.path }}" --repo Cockatrice/Cockatrice
 
   build-vcpkg:
     strategy:
@@ -263,200 +267,202 @@ jobs:
           - os: macOS
             target: 13
             runner: macos-15-intel
-            soc: Intel
-            xcode: "16.4"
-            type: Release
-            override_target: 13
+            
+            ccache_eviction_age: 7d
+            cmake_generator: Ninja
             make_package: 1
+            override_target: 13
             package_suffix: "-macOS13_Intel"
             qt_version: 6.11.0
             qt_arch: clang_64
             qt_modules: qtimageformats qtmultimedia qtwebsockets
-            cmake_generator: Ninja
+            soc: Intel
+            type: Release
             use_ccache: 1
-            ccache_eviction_age: 7d
+            xcode: "16.4"
 
           - os: macOS
             target: 14
             runner: macos-14
-            soc: Apple
-            xcode: "15.4"
-            type: Release
+            
+            ccache_eviction_age: 7d
+            cmake_generator: Ninja
             make_package: 1
             package_suffix: "-macOS14"
             qt_version: 6.11.0
             qt_arch: clang_64
             qt_modules: qtimageformats qtmultimedia qtwebsockets
-            cmake_generator: Ninja
+            soc: Apple
+            type: Release
             use_ccache: 1
-            ccache_eviction_age: 7d
+            xcode: "15.4"
 
           - os: macOS
             target: 15
             runner: macos-15
-            soc: Apple
-            xcode: "16.4"
-            type: Release
+            
+            ccache_eviction_age: 7d
+            cmake_generator: Ninja
             make_package: 1
             package_suffix: "-macOS15"
             qt_version: 6.11.0
             qt_arch: clang_64
             qt_modules: qtimageformats qtmultimedia qtwebsockets
-            cmake_generator: Ninja
+            soc: Apple
+            type: Release
             use_ccache: 1
-            ccache_eviction_age: 7d
+            xcode: "16.4"
 
           - os: macOS
             target: 15
             runner: macos-15
-            soc: Apple
-            xcode: "16.4"
-            type: Debug
+            
+            ccache_eviction_age: 7d
+            cmake_generator: Ninja
             qt_version: 6.11.0
             qt_arch: clang_64
             qt_modules: qtimageformats qtmultimedia qtwebsockets
-            cmake_generator: Ninja
+            soc: Apple
+            type: Debug
             use_ccache: 1
-            ccache_eviction_age: 7d
+            xcode: "16.4"
 
           - os: Windows
             target: 10
             runner: windows-2025
-            type: Release
+            
+            cmake_generator: "Visual Studio 17 2022"
+            cmake_generator_platform: x64
             make_package: 1
             package_suffix: "-Win10"
             qt_version: 6.11.0
             qt_arch: win64_msvc2022_64
             qt_modules: qtimageformats qtmultimedia qtwebsockets
-            cmake_generator: "Visual Studio 17 2022"
-            cmake_generator_platform: x64
+            type: Release
 
-    name: ${{matrix.os}} ${{matrix.target}}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
+    name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
     needs: configure
-    runs-on: ${{matrix.runner}}
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 100
     env:
-      CCACHE_DIR: ${{github.workspace}}/.cache/
-      # Cache size over the entire repo is 10Gi:
-      # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
-      CCACHE_SIZE: 550M
+      CCACHE_DIR: ${{ github.workspace }}/.cache/
+      CCACHE_SIZE: 550M    # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
 
     steps:
-      - name: Checkout
+      - name: "Checkout"
         uses: actions/checkout@v6
         with:
           submodules: recursive
 
-      - name: Add msbuild to PATH
+      - name: "[Windows] Add msbuild to PATH"
         if: matrix.os == 'Windows'
         id: add-msbuild
         uses: microsoft/setup-msbuild@v3
         with:
           msbuild-architecture: x64
 
-      - name: Setup ccache
-        if: matrix.use_ccache == 1 && matrix.os == 'macOS'
+      - name: "[macOS] Setup ccache"
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1
         run: brew install ccache
 
-      - name: Restore compiler cache (ccache)
-        if: matrix.use_ccache == 1
+      - name: "[macOS] Restore compiler cache (ccache)"
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1
         id: ccache_restore
         uses: actions/cache/restore@v5
         env:
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
         with:
-          path: ${{env.CCACHE_DIR}}
-          key: ccache-${{matrix.runner}}-${{matrix.soc}}-${{matrix.type}}-${{env.BRANCH_NAME}}
-          restore-keys: ccache-${{matrix.runner}}-${{matrix.soc}}-${{matrix.type}}-
+          key: ccache-${{ matrix.runner }}-${{ matrix.soc }}-${{ matrix.type }}-${{ env.BRANCH_NAME }}
+          path: ${{ env.CCACHE_DIR }}
+          restore-keys: ccache-${{ matrix.runner }}-${{ matrix.soc }}-${{ matrix.type }}-
 
-      - name: Install aqtinstall
+      - name: "Install aqtinstall"
         run: pipx install aqtinstall
 
       # Resolve given wildcard versions (e.g. Qt 6.6.*) to latest version via aqtinstall to avoid stale caches on new releases
-      - name: Resolve latest Qt patch version
+      - name: "Resolve latest Qt patch version"
         id: resolve_qt_version
         shell: bash
-        run: .ci/resolve_latest_aqt_qt_version.sh "${{matrix.qt_version}}"
+        run: .ci/resolve_latest_aqt_qt_version.sh "${{ matrix.qt_version }}"
 
-      - name: Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }} libraries (${{ matrix.soc }} macOS)
+      - name: "[macOS] Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }} libraries"
         if: matrix.os == 'macOS'
         id: restore_qt
         uses: actions/cache/restore@v5
         with:
-          path: ${{ github.workspace }}/Qt
           key: thin-qt-macos-${{ matrix.soc }}-${{ steps.resolve_qt_version.outputs.version }}
+          path: ${{ github.workspace }}/Qt
 
       # Using jurplel/install-qt-action to install Qt without using brew
-      # qt build using vcpkg either just fails or takes too long to build
-      - name: Install fat Qt ${{ steps.resolve_qt_version.outputs.version }} (${{ matrix.soc }} macOS)
+      # Qt build using vcpkg either just fails or takes too long to build
+      - name: "[macOS] Install fat Qt ${{ steps.resolve_qt_version.outputs.version }}"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         uses: jurplel/install-qt-action@v4
         with:
-          version: ${{ steps.resolve_qt_version.outputs.version }}
-          arch: ${{matrix.qt_arch}}
-          modules: ${{matrix.qt_modules}}
+          arch: ${{ matrix.qt_arch }}
           cache: false
-          dir: ${{github.workspace}}
+          dir: ${{ github.workspace }}
+          modules: ${{ matrix.qt_modules }}
+          version: ${{ steps.resolve_qt_version.outputs.version }}
 
-      - name: Thin Qt libraries (${{ matrix.soc }} macOS)
+      - name: "[macOS] Create thin Qt libraries"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         run: .ci/thin_macos_qtlib.sh
 
-      - name: Cache thin Qt libraries (${{ matrix.soc }} macOS)
+      - name: "[macOS] Cache thin Qt libraries"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         uses: actions/cache/save@v5
         with:
-          path: ${{ github.workspace }}/Qt
           key: thin-qt-macos-${{ matrix.soc }}-${{ steps.resolve_qt_version.outputs.version }}
+          path: ${{ github.workspace }}/Qt
 
-      - name: Install Qt ${{matrix.qt_version}} (Windows)
+      - name: "[Windows] Install Qt ${{ matrix.qt_version }}"
         if: matrix.os == 'Windows'
         uses: jurplel/install-qt-action@v4
         with:
-          # qt 6.11.0 only works with aqtinstall directly from git until aqtinstall 3.4 is released
+          # Qt 6.11.0 only works with aqtinstall directly from git until aqtinstall 3.4 is released
           aqtsource: git+https://github.com/miurahr/aqtinstall.git
-          version: ${{ steps.resolve_qt_version.outputs.version }}
-          arch: ${{matrix.qt_arch}}
-          modules: ${{matrix.qt_modules}}
+          arch: ${{ matrix.qt_arch }}
           cache: true
+          modules: ${{ matrix.qt_modules }}
+          version: ${{ steps.resolve_qt_version.outputs.version }}
 
-      - name: Install NSIS
+      - name: "[Windows] Install NSIS"
         if: matrix.os == 'Windows'
         shell: bash
         run: choco install nsis
 
-      - name: Setup vcpkg cache
+      - name: "Setup vcpkg cache"
         id: vcpkg-cache
         uses: TAServers/vcpkg-cache@v3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      # uses environment variables, see compile.sh for more details
-      - name: Build Cockatrice
+      # Uses environment variables, see compile.sh for more details
+      - name: "Build Cockatrice"
         id: build
         shell: bash
         env:
-          BUILDTYPE: '${{matrix.type}}'
-          MAKE_PACKAGE: '${{matrix.make_package}}'
-          PACKAGE_SUFFIX: '${{matrix.package_suffix}}'
-          CMAKE_GENERATOR: ${{matrix.cmake_generator}}
-          CMAKE_GENERATOR_PLATFORM: ${{matrix.cmake_generator_platform}}
-          USE_CCACHE: ${{matrix.use_ccache}}
-          VCPKG_DISABLE_METRICS: 1
-          VCPKG_BINARY_SOURCES: 'clear;files,${{ steps.vcpkg-cache.outputs.path }},readwrite'
-          # macOS-specific environment variables, will be ignored on Windows
-          MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
-          MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
-          MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
-          MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
-          DEVELOPER_DIR: '/Applications/Xcode_${{matrix.xcode}}.app/Contents/Developer'
-          TARGET_MACOS_VERSION: ${{ matrix.override_target }}
+          BUILDTYPE: '${{ matrix.type }}'
           CCACHE_EVICTION_AGE: ${{ matrix.ccache_eviction_age }}
+          CMAKE_GENERATOR: ${{ matrix.cmake_generator }}
+          CMAKE_GENERATOR_PLATFORM: ${{ matrix.cmake_generator_platform }}
+          DEVELOPER_DIR: '/Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer'
+          MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
+          MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
+          MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
+          MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
+          MAKE_PACKAGE: '${{ matrix.make_package }}'
+          PACKAGE_SUFFIX: '${{ matrix.package_suffix }}'
+          TARGET_MACOS_VERSION: ${{ matrix.override_target }}
+          USE_CCACHE: ${{ matrix.use_ccache }}
+          VCPKG_BINARY_SOURCES: 'clear;files,${{ steps.vcpkg-cache.outputs.path }},readwrite'
+          VCPKG_DISABLE_METRICS: 1
         run: .ci/compile.sh --server --test --vcpkg
 
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
-      - name: Delete remote compiler cache (ccache)
-        if: github.ref == 'refs/heads/master' && matrix.use_ccache == 1 && steps.ccache_restore.outputs.cache-hit
+      - name: "[macOS] Delete remote compiler cache (ccache)"
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master' && steps.ccache_restore.outputs.cache-hit
         continue-on-error: true
         env:
           GH_TOKEN: ${{ github.token }}
@@ -465,14 +471,14 @@ jobs:
             echo "Cache deleted successfully"
           fi
 
-      - name: Save updated compiler cache (ccache)
-        if: github.ref == 'refs/heads/master' && matrix.use_ccache == 1
+      - name: "[macOS] Save updated compiler cache (ccache)"
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master'
         uses: actions/cache/save@v5
         with:
-          path: ${{env.CCACHE_DIR}}
           key: ${{ steps.ccache_restore.outputs.cache-primary-key }}
+          path: ${{ env.CCACHE_DIR }}
 
-      - name: Sign app bundle
+      - name: "[macOS] Sign app bundle"
         if: matrix.os == 'macOS' && matrix.make_package && needs.configure.outputs.tag != null
         id: sign_macos
         env:
@@ -482,15 +488,15 @@ jobs:
           if [[ -n "$MACOS_CERTIFICATE_NAME" ]]
           then
             security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
-            /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "${{steps.build.outputs.path}}"
+            /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "${{ steps.build.outputs.path }}"
           fi
 
-      - name: Notarize app bundle
-        if: steps.sign_macos.outcome == 'success'
+      - name: "[macOS] Notarize app bundle"
+        if: matrix.os == 'macOS' && steps.sign_macos.outcome == 'success'
         env:
           MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
-          MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
           MACOS_NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
+          MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
         run: |
           if [[ -n "$MACOS_NOTARIZATION_APPLE_ID" ]]
           then
@@ -502,7 +508,7 @@ jobs:
             # Therefore, we create a zip file containing our app bundle, so that we can send it to the
             # notarization service
             echo "Creating temp notarization archive"
-            ditto -c -k --keepParent "${{steps.build.outputs.path}}" "notarization.zip"
+            ditto -c -k --keepParent "${{ steps.build.outputs.path }}" "notarization.zip"
 
             # Here we send the notarization request to the Apple's Notarization service, waiting for the result.
             # This typically takes a few seconds inside a CI environment, but it might take more depending on the App
@@ -514,51 +520,51 @@ jobs:
             # Finally, we need to "attach the staple" to our executable, which will allow our app to be
             # validated by macOS even when an internet connection is not available.
             echo "Attach staple"
-            xcrun stapler staple "${{steps.build.outputs.path}}"
+            xcrun stapler staple "${{ steps.build.outputs.path }}"
           fi
 
-      - name: Upload artifact
+      - name: "Upload artifact"
         if: matrix.make_package
         id: upload_artifact
         uses: actions/upload-artifact@v7
         with:
-          path: ${{steps.build.outputs.path}}
           archive: false
           if-no-files-found: error
+          path: ${{ steps.build.outputs.path }}
 
-      - name: Upload PDBs (Program Databases)
+      - name: "[Windows] Upload PDBs (Program Databases)"
         if: matrix.os == 'Windows' && github.ref_type != 'tag'
         uses: actions/upload-artifact@v7
         with:
-          name: ${{steps.build.outputs.name}}-PDBs
+          if-no-files-found: error
+          name: ${{ steps.build.outputs.name }}-PDBs
           path: |
             build/cockatrice/Release/*.pdb
             build/oracle/Release/*.pdb
             build/servatrice/Release/*.pdb
-          if-no-files-found: error
 
-      - name: Upload to release
+      - name: "Upload to release"
         if: needs.configure.outputs.tag != null && matrix.make_package == '1'
         id: upload_release
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-          tag_name: ${{needs.configure.outputs.tag}}
-          asset_name: ${{steps.build.outputs.fullname}}
-          asset_path: ${{steps.build.outputs.path}}
+          asset_name: ${{ steps.build.outputs.fullname }}
+          asset_path: ${{ steps.build.outputs.path }}
+          GH_TOKEN: ${{ github.token }}
+          tag_name: ${{ needs.configure.outputs.tag }}
         run: gh release upload "$tag_name" "$asset_path#$asset_name"
 
-      - name: Attest binary provenance
+      - name: "Attest binary provenance"
         if: steps.upload_release.outcome == 'success'
         id: attestation
         uses: actions/attest@v4
         with:
-          subject-path: ${{steps.build.outputs.path}}
           show-summary: false
+          subject-path: ${{ steps.build.outputs.path }}
 
-      - name: Verify binary attestation
+      - name: "Verify binary attestation"
         if: steps.attestation.outcome == 'success'
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-        run: gh attestation verify "${{steps.build.outputs.path}}" --repo Cockatrice/Cockatrice
+          GH_TOKEN: ${{ github.token }}
+        run: gh attestation verify "${{ steps.build.outputs.path }}" --repo Cockatrice/Cockatrice

.github/workflows/desktop-lint.yml

@@ -1,7 +1,7 @@
 name: Code Style (C++) 
 
 on:
-  # push trigger not needed for linting, we do not allow direct pushes to master
+  # Push trigger not needed for linting, we do not allow direct pushes to master
   pull_request:
     paths:
       - '*/**'    # matches all files not in root
@@ -21,17 +21,20 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-    - name: Checkout
+    - name: "Checkout"
       uses: actions/checkout@v6
       with:
         fetch-depth: 20    # should be enough to find merge base
 
-    - name: Install dependencies
+    - name: "Install dependencies"
       shell: bash
       run: |
         sudo apt-get update
-        sudo apt-get install -y --no-install-recommends clang-format cmake-format shellcheck
+        sudo apt-get install -y --no-install-recommends \
+          clang-format \
+          cmake-format \
+          shellcheck
 
-    - name: Check code formatting
+    - name: "Check code formatting"
       shell: bash
       run: ./.ci/lint_cpp.sh

.github/workflows/docker-release.yml

@@ -1,9 +1,10 @@
 name: Build Docker Image
 
+permissions:
+  contents: read
+  packages: write
+
 on:
-  release:
-    types:
-      - released    # publishing of stable releases
   push:
     branches:
       - master
@@ -13,6 +14,9 @@ on:
     paths:
       - '.github/workflows/docker-release.yml'
       - 'Dockerfile'
+  release:
+    types:
+      - released    # publishing of stable releases
 
 # Cancel earlier, unfinished runs of this workflow on the same branch (unless on release)
 concurrency:
@@ -24,54 +28,50 @@ jobs:
     name: amd64 & arm64
     if: ${{ github.repository_owner == 'Cockatrice' }}
     runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      packages: write
   
     steps:
-      - name: Checkout
+      - name: "Checkout"
         uses: actions/checkout@v6
 
-      - name: Docker metadata
+      - name: "Docker metadata"
         id: metadata
         uses: docker/metadata-action@v6
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: index    # needed for GHCR
         with:
+          annotations: |
+            org.opencontainers.image.title=Servatrice
+            org.opencontainers.image.url=https://cockatrice.github.io/
+            org.opencontainers.image.description=Server for Cockatrice, a cross-platform virtual tabletop for multiplayer card games
           images: |
             ghcr.io/cockatrice/servatrice
           labels: |
             org.opencontainers.image.title=Servatrice
             org.opencontainers.image.url=https://cockatrice.github.io/
             org.opencontainers.image.description=Server for Cockatrice, a cross-platform virtual tabletop for multiplayer card games
-          annotations: |
-            org.opencontainers.image.title=Servatrice
-            org.opencontainers.image.url=https://cockatrice.github.io/
-            org.opencontainers.image.description=Server for Cockatrice, a cross-platform virtual tabletop for multiplayer card games  
 
-      - name: Set up QEMU
+      - name: "Set up QEMU"
         uses: docker/setup-qemu-action@v4
 
-      - name: Set up Docker buildx
+      - name: "Set up Docker buildx"
         uses: docker/setup-buildx-action@v4
 
-      - name: Login to GitHub Container Registry
+      - name: "Login to GitHub Container Registry"
         if: contains(github.event.release.tag_name, 'Release') && github.event.release.target_commitish == 'master'
         uses: docker/login-action@v4
         with:
+          password: ${{ github.token }}
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ github.token }}
 
-      - name: Build and push Docker image
+      - name: "Build and push Docker image"
         uses: docker/build-push-action@v7
         with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: ${{ github.ref_type == 'tag' }}
-          tags: ${{ steps.metadata.outputs.tags }}
-          labels: ${{ steps.metadata.outputs.labels }}
           annotations: ${{ steps.metadata.outputs.annotations }}
           cache-from: type=gha,scope=servatrice
           cache-to: type=gha,mode=max,scope=servatrice
+          context: .
+          labels: ${{ steps.metadata.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.ref_type == 'tag' }}
+          tags: ${{ steps.metadata.outputs.tags }}

.github/workflows/documentation-build.yml

@@ -1,18 +1,18 @@
 name: Generate Docs
 
 on:
-  release:
-    types:
-      - published    # publishing of stable releases and pre-releases
   pull_request:
     paths:
       - 'doc/doxygen/**'
       - '.github/workflows/documentation-build.yml'
       - 'Doxyfile'
+  release:
+    types:
+      - published    # publishing of stable releases and pre-releases
   workflow_dispatch:
 
 env:
-  COCKATRICE_REF: ${{ github.ref_name }}    # Tag name if the commit is tagged, otherwise branch name
+  COCKATRICE_REF: ${{ github.ref_name }}    # tag name if the commit is tagged, otherwise branch name
 
 jobs:
   docs:
@@ -20,22 +20,22 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout code
+      - name: "Checkout code"
         uses: actions/checkout@v6
         with:
           submodules: recursive
 
-      - name: Install Graphviz
+      - name: "Install Graphviz"
         run: |
           sudo apt-get install -y graphviz
           dot -V
 
-      - name: Install Doxygen
+      - name: "Install Doxygen"
         uses: ssciwr/doxygen-install@v2
         with:
           version: "1.16.1"
 
-      - name: Update Doxygen Configuration
+      - name: "Update Doxygen Configuration"
         run: |
           git diff Doxyfile
           doxygen -u Doxyfile
@@ -48,16 +48,16 @@ jobs:
             exit 1
           fi
 
-      - name: Generate Documentation
+      - name: "Generate Documentation"
         if: always()
         run: doxygen Doxyfile
 
-      - name: Deploy to cockatrice.github.io
+      - name: "Deploy to cockatrice.github.io"
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         uses: peaceiris/actions-gh-pages@v4
         with:
           deploy_key: ${{ secrets.DOCS_DEPLOY_KEY }}
+          destination_dir: docs    # docs will be available at https://cockatrice.github.io/docs/
           external_repository: Cockatrice/cockatrice.github.io
           publish_branch: master
           publish_dir: ./docs/html
-          destination_dir: docs    # Docs will live under https://cockatrice.github.io/docs/

.github/workflows/translations-pull.yml

@@ -1,14 +1,14 @@
 name: Update Translations
 
 on:
-  workflow_dispatch:
-  schedule:
-    # runs in the middle of each month starting a quarter (UTC) = two weeks after new strings are built
-    - cron: '0 0 15 1,4,7,10 *'
   pull_request:
     paths:
       - '.tx/**'
       - '.github/workflows/translations-pull.yml'
+  schedule:
+    # Runs in the middle of each month starting a quarter (UTC) = two weeks after new strings are built
+    - cron: '0 0 15 1,4,7,10 *'
+  workflow_dispatch:
 
 jobs:
   translations:
@@ -19,18 +19,18 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-      - name: Checkout repo
+      - name: "Checkout repo"
         uses: actions/checkout@v6
 
-      - name: Pull translated strings from Transifex
+      - name: "Pull translated strings from Transifex"
         uses: transifex/cli-action@v2
         with:
-          # used config file: https://github.com/Cockatrice/Cockatrice/blob/master/.tx/config
-          # https://github.com/transifex/cli#pulling-files-from-transifex
-          token: ${{ secrets.TX_TOKEN }}
+          # Used config file: https://github.com/Cockatrice/Cockatrice/blob/master/.tx/config
+          # Docs: https://github.com/transifex/cli#pulling-files-from-transifex
           args: pull --force --all
+          token: ${{ secrets.TX_TOKEN }}
 
-      - name: Create pull request
+      - name: "Create pull request"
         if: github.event_name != 'pull_request'
         id: create_pr
         uses: peter-evans/create-pull-request@v8
@@ -38,12 +38,7 @@ jobs:
           add-paths: |
             cockatrice/translations/*.ts
             oracle/translations/*.ts
-          commit-message: Update translation files
-          # author is the owner of the commit
-          author: github-actions <github-actions@github.com>
-          branch: ci-update_translations
-          delete-branch: true
-          title: 'Update translations'
+          author: github-actions <github-actions@github.com>    # owner of the commit
           body: |
             Pulled all translated strings from [Transifex][1].
             
@@ -53,12 +48,16 @@ jobs:
             
             [1]: https://explore.transifex.com/cockatrice/cockatrice/
             [2]: https://github.com/Cockatrice/Cockatrice/actions/workflows/translations-pull.yml?query=branch%3Amaster
+          branch: ci-update_translations
+          commit-message: Update translation files
+          delete-branch: true
+          draft: false
           labels: |
             CI
             Translation
-          draft: false
+          title: 'Update translations'
 
-      - name: PR Status
+      - name: "PR Status"
         if: github.event_name != 'pull_request'
         shell: bash
         env:

.github/workflows/translations-push.yml

@@ -1,14 +1,14 @@
 name: Update Translation Source
 
 on:
-  workflow_dispatch:
-  schedule:
-    # runs at the start of each quarter (UTC)
-    - cron: '0 0 1 1,4,7,10 *'
   pull_request:
     paths:
       - '.ci/update_translation_source_strings.sh'
       - '.github/workflows/translations-push.yml'
+  schedule:
+    # Runs at the start of each quarter (UTC)
+    - cron: '0 0 1 1,4,7,10 *'
+  workflow_dispatch:
 
 jobs:
   translations:
@@ -19,16 +19,16 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-      - name: Checkout repo
+      - name: "Checkout repo"
         uses: actions/checkout@v6
 
-      - name: Install lupdate
+      - name: "Install lupdate"
         shell: bash
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends qttools5-dev-tools
 
-      - name: Update Cockatrice translation source
+      - name: "Update Cockatrice translation source"
         id: cockatrice
         shell: bash
         run: |
@@ -36,15 +36,15 @@ jobs:
           export DIRS="cockatrice/src $(find . -maxdepth 1 -type d -name 'libcockatrice_*')"
           FILE="$FILE" DIRS="$DIRS" .ci/update_translation_source_strings.sh
 
-      - name: Update Oracle translation source
+      - name: "Update Oracle translation source"
         id: oracle
         shell: bash
         env:
-          FILE: 'oracle/oracle_en@source.ts'
           DIRS: 'oracle/src'
+          FILE: 'oracle/oracle_en@source.ts'
         run: .ci/update_translation_source_strings.sh
 
-      - name: Render template
+      - name: "Render template"
         id: template
         uses: chuhlomin/render-template/binary@v1
         with:
@@ -54,7 +54,7 @@ jobs:
             oracle_output: ${{ steps.oracle.outputs.output }}
             commit: ${{ github.sha }}
 
-      - name: Create pull request
+      - name: "Create pull request"
         if: github.event_name != 'pull_request'
         id: create_pr
         uses: peter-evans/create-pull-request@v8
@@ -62,19 +62,18 @@ jobs:
           add-paths: |
             cockatrice/cockatrice_en@source.ts
             oracle/oracle_en@source.ts
-          commit-message: Update translation source strings
-          # author is the owner of the commit
-          author: github-actions <github-actions@github.com>
-          branch: ci-update_translation_source
-          delete-branch: true
-          title: 'Update source strings'
+          author: github-actions <github-actions@github.com>    # owner of the commit
           body: ${{ steps.template.outputs.result }}
+          branch: ci-update_translation_source
+          commit-message: Update translation source strings
+          delete-branch: true
+          draft: false
           labels: |
             CI
             Translation
-          draft: false
+          title: 'Update source strings'
 
-      - name: PR Status
+      - name: "PR Status"
         if: github.event_name != 'pull_request'
         shell: bash
         env: