Merge branch 'master' into tooomm-ci_qt-install-action

.github/workflows/desktop-build.yml

@@ -47,26 +47,21 @@ jobs:
       tag: ${{ steps.configure.outputs.tag }}
       sha: ${{ steps.configure.outputs.sha }}
 
-    steps:  
+    steps:
       - name: "Configure"
+        env:
+          RESOLVED_SHA: ${{ case(github.event_name == 'pull_request', github.event.pull_request.head.sha, github.sha) }}
         id: configure
         shell: bash
         run: |
-          tag_regex='^refs/tags/'
-          if [[ $GITHUB_EVENT_NAME == pull-request ]]; then    # pull request
-            sha="${{github.event.pull_request.head.sha}}"
-          elif [[ $GITHUB_REF =~ $tag_regex ]]; then    # release
-            sha="$GITHUB_SHA"
-            tag="${GITHUB_REF/refs\/tags\//}"
-            echo "tag=$tag" >>"$GITHUB_OUTPUT"
-          else    # push to branch
-            sha="$GITHUB_SHA"
+          if [[ "$GITHUB_REF_TYPE" == 'tag' ]]; then    # release
+            echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
           fi
-          echo "sha=$sha" >>"$GITHUB_OUTPUT"
+          echo "sha=$RESOLVED_SHA" >> "$GITHUB_OUTPUT"
 
       - name: "Checkout"
         if: steps.configure.outputs.tag != null
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0    # fetch all history for all branches and tags
 
@@ -92,7 +87,7 @@ jobs:
         run: |
           args=()
           [[ $prerelease == yes ]] && args+=(--prerelease)
-          
+
           gh release create "$tag_name" --verify-tag --draft "${args[@]}" \
             --target "$target" \
             --title "$release_name" \
@@ -105,48 +100,48 @@ jobs:
         # The files in ".ci/$distro$version" correspond to the values given here
         include:
           - distro: Arch
-            
+
             allow-failure: yes
             package: skip    # We are packaged in Arch already
 
           - distro: Servatrice_Debian
             version: 12
-            
+
             package: DEB
             server_only: yes
             test: skip
 
           - distro: Debian
             version: 12
-            
+
             package: DEB
             test: skip    # Running tests on all distros is superfluous
 
           - distro: Debian
             version: 13
-            
+
             package: DEB
 
           - distro: Fedora
             version: 43
-            
+
             package: RPM
             test: skip    # Running tests on all distros is superfluous
 
           - distro: Fedora
             version: 44
-            
+
             package: RPM
 
           - distro: Ubuntu
             version: 24.04
-            
+
             package: DEB
             test: skip    # Running tests on all distros is superfluous
 
           - distro: Ubuntu
             version: 26.04
-            
+
             package: DEB
 
     name: ${{ matrix.distro }} ${{ matrix.version }}
@@ -163,7 +158,7 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: "Restore compiler cache (ccache)"
         id: ccache_restore
@@ -203,7 +198,7 @@ jobs:
           args+=(--ccache "$CCACHE_SIZE")
           args+=(--cmake-generator "$CMAKE_GENERATOR")
           args+=(--suffix "$SUFFIX")
-          
+
           RUN --server --release --package "$package" "${args[@]}"
 
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
@@ -211,9 +206,10 @@ jobs:
         if: github.ref == 'refs/heads/master' && steps.ccache_restore.outputs.cache-hit
         continue-on-error: true
         env:
+          CACHE_PRIMARY_KEY: ${{ steps.ccache_restore.outputs.cache-primary-key }}
           GH_TOKEN: ${{ github.token }}
         run: |
-          if gh cache delete --repo ${{ github.repository }} ${{ steps.ccache_restore.outputs.cache-primary-key }}; then
+          if gh cache delete --repo "$GITHUB_REPOSITORY" "$CACHE_PRIMARY_KEY"; then
             echo "Cache deleted successfully"
           fi
 
@@ -256,8 +252,9 @@ jobs:
         if: steps.attestation.outcome == 'success'
         shell: bash
         env:
+          BUILD_PATH: ${{ steps.build.outputs.path }}
           GH_TOKEN: ${{ github.token }}
-        run: gh attestation verify "${{ steps.build.outputs.path }}" --repo Cockatrice/Cockatrice
+        run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
 
   build-vcpkg:
     strategy:
@@ -267,7 +264,7 @@ jobs:
           - os: macOS
             target: 13
             runner: macos-15-intel
-            
+
             ccache_eviction_age: 7d
             cmake_generator: Ninja
             make_package: 1
@@ -284,7 +281,7 @@ jobs:
           - os: macOS
             target: 14
             runner: macos-14
-            
+
             ccache_eviction_age: 7d
             cmake_generator: Ninja
             make_package: 1
@@ -300,7 +297,7 @@ jobs:
           - os: macOS
             target: 15
             runner: macos-15
-            
+
             ccache_eviction_age: 7d
             cmake_generator: Ninja
             make_package: 1
@@ -316,7 +313,7 @@ jobs:
           - os: macOS
             target: 15
             runner: macos-15
-            
+
             ccache_eviction_age: 7d
             cmake_generator: Ninja
             qt_version: 6.11.*
@@ -330,7 +327,7 @@ jobs:
           - os: Windows
             target: 10
             runner: windows-2025
-            
+
             cmake_generator: "Visual Studio 18 2026"
             cmake_generator_platform: x64
             make_package: 1
@@ -350,7 +347,7 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -456,9 +453,10 @@ jobs:
         if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master' && steps.ccache_restore.outputs.cache-hit
         continue-on-error: true
         env:
+          CACHE_PRIMARY_KEY: ${{ steps.ccache_restore.outputs.cache-primary-key }}
           GH_TOKEN: ${{ github.token }}
         run: |
-          if gh cache delete --repo ${{ github.repository }} ${{ steps.ccache_restore.outputs.cache-primary-key }}; then
+          if gh cache delete --repo "$GITHUB_REPOSITORY" "$CACHE_PRIMARY_KEY"; then
             echo "Cache deleted successfully"
           fi
 
@@ -473,18 +471,20 @@ jobs:
         if: matrix.os == 'macOS' && matrix.make_package && needs.configure.outputs.tag != null
         id: sign_macos
         env:
+          BUILD_PATH: ${{ steps.build.outputs.path }}
           MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
           MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
         run: |
           if [[ -n "$MACOS_CERTIFICATE_NAME" ]]
           then
             security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
-            /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "${{ steps.build.outputs.path }}"
+            /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "$BUILD_PATH"
           fi
 
       - name: "[macOS] Notarize app bundle"
         if: matrix.os == 'macOS' && steps.sign_macos.outcome == 'success'
         env:
+          BUILD_PATH: ${{ steps.build.outputs.path }}
           MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
           MACOS_NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
           MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
@@ -499,7 +499,7 @@ jobs:
             # Therefore, we create a zip file containing our app bundle, so that we can send it to the
             # notarization service
             echo "Creating temp notarization archive"
-            ditto -c -k --keepParent "${{ steps.build.outputs.path }}" "notarization.zip"
+            ditto -c -k --keepParent "$BUILD_PATH" "notarization.zip"
 
             # Here we send the notarization request to the Apple's Notarization service, waiting for the result.
             # This typically takes a few seconds inside a CI environment, but it might take more depending on the App
@@ -511,7 +511,7 @@ jobs:
             # Finally, we need to "attach the staple" to our executable, which will allow our app to be
             # validated by macOS even when an internet connection is not available.
             echo "Attach staple"
-            xcrun stapler staple "${{ steps.build.outputs.path }}"
+            xcrun stapler staple "$BUILD_PATH"
           fi
 
       - name: "Upload artifact"
@@ -557,5 +557,6 @@ jobs:
         if: steps.attestation.outcome == 'success'
         shell: bash
         env:
+          BUILD_PATH: ${{ steps.build.outputs.path }}
           GH_TOKEN: ${{ github.token }}
-        run: gh attestation verify "${{ steps.build.outputs.path }}" --repo Cockatrice/Cockatrice
+        run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice

.github/workflows/desktop-lint.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
     - name: "Checkout"
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         fetch-depth: 20    # should be enough to find merge base
 

.github/workflows/docker-release.yml

@@ -31,7 +31,7 @@ jobs:
   
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: "Docker metadata"
         id: metadata

.github/workflows/documentation-build.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 

.github/workflows/translations-pull.yml

@@ -20,9 +20,11 @@ jobs:
 
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: "Pull translated strings from Transifex"
+        # Do not run this step for PR's from forks, they don't have access to the secret
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
         uses: transifex/cli-action@v2
         with:
           # Used config file: https://github.com/Cockatrice/Cockatrice/blob/master/.tx/config
@@ -41,11 +43,11 @@ jobs:
           author: github-actions <github-actions@github.com>    # owner of the commit
           body: |
             Pulled all translated strings from [Transifex][1].
-            
+
             ---
             *This PR is automatically generated and updated by the workflow at `.github/workflows/translations-pull.yml`. Review [action runs][2].*<br>
             *After merging, all new languages and translations are available in the next build.*
-            
+
             [1]: https://explore.transifex.com/cockatrice/cockatrice/
             [2]: https://github.com/Cockatrice/Cockatrice/actions/workflows/translations-pull.yml?query=branch%3Amaster
           branch: ci-update_translations
@@ -61,11 +63,9 @@ jobs:
         if: github.event_name != 'pull_request'
         shell: bash
         env:
-          STATUS: ${{ steps.create_pr.outputs.pull-request-operation }}
+          PR_NUMBER: ${{ steps.create_pr.outputs.pull-request-number }}
+          PR_URL: ${{ steps.create_pr.outputs.pull-request-url }}
+          STATUS: ${{ case(steps.create_pr.outputs.pull-request-operation == 'none', 'unchanged', steps.create_pr.outputs.pull-request-operation) }}
         run: |
-          if [[ "$STATUS" == "none" ]]; then
-            echo "PR #${{ steps.create_pr.outputs.pull-request-number }} unchanged!" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "PR #${{ steps.create_pr.outputs.pull-request-number }} $STATUS!" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "URL: ${{ steps.create_pr.outputs.pull-request-url }}" >> $GITHUB_STEP_SUMMARY
+          echo "PR #$PR_NUMBER $STATUS!" >> "$GITHUB_STEP_SUMMARY"
+          echo "URL: $PR_URL" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/translations-push.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: "Install lupdate"
         shell: bash
@@ -29,12 +29,13 @@ jobs:
           sudo apt-get install -y --no-install-recommends qttools5-dev-tools
 
       - name: "Update Cockatrice translation source"
+        env:
+          FILE: cockatrice/cockatrice_en@source.ts
         id: cockatrice
         shell: bash
-        run: |
-          FILE="cockatrice/cockatrice_en@source.ts"
-          export DIRS="cockatrice/src $(find . -maxdepth 1 -type d -name 'libcockatrice_*')"
-          FILE="$FILE" DIRS="$DIRS" .ci/update_translation_source_strings.sh
+        run: >
+          DIRS="cockatrice/src $(find . -maxdepth 1 -type d -name 'libcockatrice_*')"
+          .ci/update_translation_source_strings.sh
 
       - name: "Update Oracle translation source"
         id: oracle
@@ -77,11 +78,9 @@ jobs:
         if: github.event_name != 'pull_request'
         shell: bash
         env:
-          STATUS: ${{ steps.create_pr.outputs.pull-request-operation }}
+          PR_NUMBER: ${{ steps.create_pr.outputs.pull-request-number }}
+          PR_URL: ${{ steps.create_pr.outputs.pull-request-url }}
+          STATUS: ${{ case(steps.create_pr.outputs.pull-request-operation == 'none', 'unchanged', steps.create_pr.outputs.pull-request-operation) }}
         run: |
-          if [[ "$STATUS" == "none" ]]; then
-            echo "PR #${{ steps.create_pr.outputs.pull-request-number }} unchanged!" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "PR #${{ steps.create_pr.outputs.pull-request-number }} $STATUS!" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "URL: ${{ steps.create_pr.outputs.pull-request-url }}" >> $GITHUB_STEP_SUMMARY
+          echo "PR #$PR_NUMBER $STATUS!" >> "$GITHUB_STEP_SUMMARY"
+          echo "URL: $PR_URL" >> "$GITHUB_STEP_SUMMARY"