Label & variables

.github/workflows/desktop-build.yml

@@ -1,10 +1,10 @@
 name: Build Desktop
 
 permissions:
+  actions: write    # needed for ccache action to be able to delete gha caches
+  attestations: write
   contents: write
   id-token: write
-  attestations: write
-  actions: write # needed for ccache action to be able to delete gha caches
 
 on:
   push:
@@ -19,7 +19,6 @@ on:
       - '.github/workflows/desktop-build.yml'
       - 'CMakeLists.txt'
       - 'vcpkg.json'
-      - 'vcpkg'
     tags:
       - '*'
   pull_request:
@@ -32,7 +31,6 @@ on:
       - '.github/workflows/desktop-build.yml'
       - 'CMakeLists.txt'
       - 'vcpkg.json'
-      - 'vcpkg'
 
 # Cancel earlier, unfinished runs of this workflow on the same branch (unless on release)
 concurrency:
@@ -155,10 +153,10 @@ jobs:
       CMAKE_GENERATOR: 'Ninja'
 
     steps:
-      - name: Checkout
+      - name: "Checkout"
         uses: actions/checkout@v6
 
-      - name: Restore compiler cache (ccache)
+      - name: "Restore compiler cache (ccache)"
         id: ccache_restore
         uses: actions/cache/restore@v5
         env:
@@ -168,11 +166,11 @@ jobs:
           key: ccache-${{ matrix.distro }}${{ matrix.version }}-${{ env.BRANCH_NAME }}
           restore-keys: ccache-${{ matrix.distro }}${{ matrix.version }}-
 
-      - name: Build ${{matrix.distro}} ${{matrix.version}} Docker image
+      - name: "Build ${{ matrix.distro }} ${{ matrix.version }} Docker image"
         shell: bash
         run: source .ci/docker.sh --build
 
-      - name: Build debug and test
+      - name: "Build debug and test"
         if: matrix.test != 'skip'
         shell: bash
         run: |
@@ -180,7 +178,7 @@ jobs:
           RUN --server --debug --test --ccache "$CCACHE_SIZE" \
                   --cmake-generator "$CMAKE_GENERATOR"
 
-      - name: Build release package
+      - name: "Build release package"
         id: build
         if: matrix.package != 'skip'
         shell: bash
@@ -203,7 +201,7 @@ jobs:
           RUN --server --release --package "$package" "${args[@]}"
 
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
-      - name: Delete remote compiler cache (ccache)
+      - name: "Delete remote compiler cache (ccache)"
         if: github.ref == 'refs/heads/master' && steps.ccache_restore.outputs.cache-hit
         continue-on-error: true
         env:
@@ -213,14 +211,14 @@ jobs:
             echo "Cache deleted successfully"
           fi
 
-      - name: Save updated compiler cache (ccache)
+      - name: "Save updated compiler cache (ccache)"
         if: github.ref == 'refs/heads/master'
         uses: actions/cache/save@v5
         with:
-          path: ${{env.CACHE}}
+          path: ${{ env.CACHE }
           key: ${{ steps.ccache_restore.outputs.cache-primary-key }}
 
-      - name: Upload artifact
+      - name: "Upload artifact"
         id: upload_artifact
         if: matrix.package != 'skip'
         uses: actions/upload-artifact@v7
@@ -229,7 +227,7 @@ jobs:
           archive: false
           if-no-files-found: error
 
-      - name: Upload to release
+      - name: "Upload to release"
         id: upload_release
         if: matrix.package != 'skip' && needs.configure.outputs.tag != null
         shell: bash
@@ -240,7 +238,7 @@ jobs:
           asset_path: ${{ steps.build.outputs.path }}
         run: gh release upload "$tag_name" "$asset_path#$asset_name"
 
-      - name: Attest binary provenance
+      - name: "Attest binary provenance"
         id: attestation
         if: steps.upload_release.outcome == 'success'
         uses: actions/attest@v4
@@ -248,7 +246,7 @@ jobs:
           subject-path: ${{ steps.build.outputs.path }}
           show-summary: false
 
-      - name: Verify binary attestation
+      - name: "Verify binary attestation"
         if: steps.attestation.outcome == 'success'
         shell: bash
         env:
@@ -342,24 +340,24 @@ jobs:
       CCACHE_SIZE: 550M
 
     steps:
-      - name: Checkout
+      - name: "Checkout"
         uses: actions/checkout@v6
         with:
           submodules: recursive
 
-      - name: Add msbuild to PATH
+      - name: "[Windows] Add msbuild to PATH"
         if: matrix.os == 'Windows'
         id: add-msbuild
         uses: microsoft/setup-msbuild@v3
         with:
           msbuild-architecture: x64
 
-      - name: Setup ccache
+      - name: "[macOS] Setup ccache"
-        if: matrix.use_ccache == 1 && matrix.os == 'macOS'
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1
         run: brew install ccache
 
-      - name: Restore compiler cache (ccache)
+      - name: "[macOS] Restore compiler cache (ccache)"
-        if: matrix.use_ccache == 1
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1
         id: ccache_restore
         uses: actions/cache/restore@v5
         env:
@@ -369,16 +367,16 @@ jobs:
           key: ccache-${{ matrix.runner }}-${{ matrix.soc }}-${{ matrix.type }}-${{ env.BRANCH_NAME }}
           restore-keys: ccache-${{ matrix.runner }}-${{ matrix.soc }}-${{ matrix.type }}-
 
-      - name: Install aqtinstall
+      - name: "Install aqtinstall"
         run: pipx install aqtinstall
 
       # Resolve given wildcard versions (e.g. Qt 6.6.*) to latest version via aqtinstall to avoid stale caches on new releases
-      - name: Resolve latest Qt patch version
+      - name: "Resolve latest Qt patch version"
         id: resolve_qt_version
         shell: bash
         run: .ci/resolve_latest_aqt_qt_version.sh "${{ matrix.qt_version }}"
 
-      - name: Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }} libraries (${{ matrix.soc }} macOS)
+      - name: "[macOS] Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }} libraries"
         if: matrix.os == 'macOS'
         id: restore_qt
         uses: actions/cache/restore@v5
@@ -387,8 +385,8 @@ jobs:
           key: thin-qt-macos-${{ matrix.soc }}-${{ steps.resolve_qt_version.outputs.version }}
 
       # Using jurplel/install-qt-action to install Qt without using brew
-      # qt build using vcpkg either just fails or takes too long to build
+      # Qt build using vcpkg either just fails or takes too long to build
-      - name: Install fat Qt ${{ steps.resolve_qt_version.outputs.version }} (${{ matrix.soc }} macOS)
+      - name: "[macOS] Install fat Qt ${{ steps.resolve_qt_version.outputs.version }}"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         uses: jurplel/install-qt-action@v4
         with:
@@ -398,18 +396,18 @@ jobs:
           cache: false
           dir: ${{ github.workspace }}
 
-      - name: Thin Qt libraries (${{ matrix.soc }} macOS)
+      - name: "[macOS] Create thin Qt libraries"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         run: .ci/thin_macos_qtlib.sh
 
-      - name: Cache thin Qt libraries (${{ matrix.soc }} macOS)
+      - name: "[macOS] Cache thin Qt libraries"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         uses: actions/cache/save@v5
         with:
           path: ${{ github.workspace }}/Qt
           key: thin-qt-macos-${{ matrix.soc }}-${{ steps.resolve_qt_version.outputs.version }}
 
-      - name: Install Qt ${{matrix.qt_version}} (Windows)
+      - name: "[Windows] Install Qt ${{matrix.qt_version}}"
         if: matrix.os == 'Windows'
         uses: jurplel/install-qt-action@v4
         with:
@@ -420,19 +418,19 @@ jobs:
           modules: ${{ matrix.qt_modules }}
           cache: true
 
-      - name: Install NSIS
+      - name: "[Windows] Install NSIS"
         if: matrix.os == 'Windows'
         shell: bash
         run: choco install nsis
 
-      - name: Setup vcpkg cache
+      - name: "Setup vcpkg cache"
         id: vcpkg-cache
         uses: TAServers/vcpkg-cache@v3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       # uses environment variables, see compile.sh for more details
-      - name: Build Cockatrice
+      - name: "Build Cockatrice"
         id: build
         shell: bash
         env:
@@ -455,8 +453,8 @@ jobs:
         run: .ci/compile.sh --server --test --vcpkg
 
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
-      - name: Delete remote compiler cache (ccache)
+      - name: "[macOS] Delete remote compiler cache (ccache)"
-        if: github.ref == 'refs/heads/master' && matrix.use_ccache == 1 && steps.ccache_restore.outputs.cache-hit
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master' && steps.ccache_restore.outputs.cache-hit
         continue-on-error: true
         env:
           GH_TOKEN: ${{ github.token }}
@@ -465,14 +463,14 @@ jobs:
             echo "Cache deleted successfully"
           fi
 
-      - name: Save updated compiler cache (ccache)
+      - name: "[macOS] Save updated compiler cache (ccache)"
-        if: github.ref == 'refs/heads/master' && matrix.use_ccache == 1
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master'
         uses: actions/cache/save@v5
         with:
           path: ${{ env.CCACHE_DIR }}
           key: ${{ steps.ccache_restore.outputs.cache-primary-key }}
 
-      - name: Sign app bundle
+      - name: "[macOS] Sign app bundle"
         if: matrix.os == 'macOS' && matrix.make_package && needs.configure.outputs.tag != null
         id: sign_macos
         env:
@@ -485,8 +483,8 @@ jobs:
             /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "${{ steps.build.outputs.path }}"
           fi
 
-      - name: Notarize app bundle
+      - name: "[macOS] Notarize app bundle"
-        if: steps.sign_macos.outcome == 'success'
+        if: matrix.os == 'macOS' && steps.sign_macos.outcome == 'success'
         env:
           MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
           MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
@@ -517,7 +515,7 @@ jobs:
             xcrun stapler staple "${{ steps.build.outputs.path }}"
           fi
 
-      - name: Upload artifact
+      - name: "Upload artifact"
         if: matrix.make_package
         id: upload_artifact
         uses: actions/upload-artifact@v7
@@ -526,7 +524,7 @@ jobs:
           archive: false
           if-no-files-found: error
 
-      - name: Upload PDBs (Program Databases)
+      - name: "[Windows] Upload PDBs (Program Databases)"
         if: matrix.os == 'Windows' && github.ref_type != 'tag'
         uses: actions/upload-artifact@v7
         with:
@@ -537,7 +535,7 @@ jobs:
             build/servatrice/Release/*.pdb
           if-no-files-found: error
 
-      - name: Upload to release
+      - name: "Upload to release"
         if: needs.configure.outputs.tag != null && matrix.make_package == '1'
         id: upload_release
         shell: bash
@@ -548,7 +546,7 @@ jobs:
           asset_path: ${{ steps.build.outputs.path }}
         run: gh release upload "$tag_name" "$asset_path#$asset_name"
 
-      - name: Attest binary provenance
+      - name: "Attest binary provenance"
         if: steps.upload_release.outcome == 'success'
         id: attestation
         uses: actions/attest@v4
@@ -556,7 +554,7 @@ jobs:
           subject-path: ${{ steps.build.outputs.path }}
           show-summary: false
 
-      - name: Verify binary attestation
+      - name: "Verify binary attestation"
         if: steps.attestation.outcome == 'success'
         shell: bash
         env: