jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-09 11:33:25 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

pin used actions

Browse source 
plus some reordering and harmonization across files
This commit is contained in:
tooomm 2026-11-01 22:16:21 +01:00
parent e08402ac94
commit 39614a835f
8 changed files with 108 additions and 91 deletions
Download patch file Download diff file Expand all files Collapse all files

13
.github/dependabot.yml vendored
View file

@ -15,8 +15,11 @@ updates:
# Check for updates once a month # Check for updates once a month
schedule: schedule:
interval: "monthly" interval: "monthly"
# A new version is not considered for a version update until x days after its release (default = 3)
cooldown:
default-days: 3
# Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted) # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted)
open-pull-requests-limit: 2 open-pull-requests-limit: 3
# # Enable version updates for Docker # # Enable version updates for Docker
# Not yet possible to bump from one LTS version to the next and skip others, see: # Not yet possible to bump from one LTS version to the next and skip others, see:
@ -27,6 +30,9 @@ updates:
# # Check for updates once a week # # Check for updates once a week
# schedule: # schedule:
# interval: "weekly" # interval: "weekly"
# # A new version is not considered for a version update until x days after its release (default = 3)
# cooldown:
# default-days: 3
# # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted) # # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted)
# open-pull-requests-limit: 1 # open-pull-requests-limit: 1
@ -37,5 +43,8 @@ updates:
# Check for updates to GitHub Actions once a week # Check for updates to GitHub Actions once a week
schedule: schedule:
interval: "weekly" interval: "weekly"
# A new version is not considered for a version update until x days after its release (default = 3)
cooldown:
default-days: 3
# Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted) # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted)
open-pull-requests-limit: 2 open-pull-requests-limit: 5

92
.github/workflows/desktop-build.yml vendored
View file

@ -41,8 +41,9 @@ concurrency:
jobs: jobs:
configure: configure:
name: Configure name: "Configure"
runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
outputs: outputs:
tag: ${{ steps.configure.outputs.tag }} tag: ${{ steps.configure.outputs.tag }}
sha: ${{ steps.configure.outputs.sha }} sha: ${{ steps.configure.outputs.sha }}
@ -54,10 +55,10 @@ jobs:
steps: steps:
- name: "Configure" - name: "Configure"
env:
RESOLVED_SHA: ${{ case(github.event_name == 'pull_request', github.event.pull_request.head.sha, github.sha) }}
id: configure id: configure
shell: bash shell: bash
env:
RESOLVED_SHA: ${{ case(github.event_name == 'pull_request', github.event.pull_request.head.sha, github.sha) }}
run: | run: |
if [[ "$GITHUB_REF_TYPE" == 'tag' ]]; then # release if [[ "$GITHUB_REF_TYPE" == 'tag' ]]; then # release
echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT" echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
@ -69,7 +70,7 @@ jobs:
- name: "Checkout" - name: "Checkout"
if: steps.configure.outputs.tag != null if: steps.configure.outputs.tag != null
uses: actions/checkout@v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
fetch-depth: 0 # fetch all history for all branches and tags fetch-depth: 0 # fetch all history for all branches and tags
@ -102,6 +103,10 @@ jobs:
--notes-file "$body_path" --notes-file "$body_path"
build-linux: build-linux:
name: "${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}"
needs: configure
runs-on: ubuntu-latest # https://github.com/actions/runner-images#available-images
strategy: strategy:
fail-fast: false fail-fast: false
matrix: matrix:
@ -110,7 +115,7 @@ jobs:
- distro: Arch - distro: Arch
allow-failure: yes allow-failure: yes
package: skip # We are packaged in Arch already package: skip # we are packaged in Arch already
- distro: Servatrice_Debian - distro: Servatrice_Debian
version: 12 version: 12
@ -123,7 +128,7 @@ jobs:
version: 12 version: 12
package: DEB package: DEB
test: skip # Running tests on all distros is superfluous test: skip # running tests on all distros is superfluous
- distro: Debian - distro: Debian
version: 13 version: 13
@ -134,7 +139,7 @@ jobs:
version: 43 version: 43
package: RPM package: RPM
test: skip # Running tests on all distros is superfluous test: skip # running tests on all distros is superfluous
- distro: Fedora - distro: Fedora
version: 44 version: 44
@ -145,7 +150,7 @@ jobs:
version: 24.04 version: 24.04
package: DEB package: DEB
test: skip # Running tests on all distros is superfluous test: skip # running tests on all distros is superfluous
- distro: Ubuntu - distro: Ubuntu
version: 26.04 version: 26.04
@ -170,26 +175,23 @@ jobs:
coverage: yes coverage: yes
package: skip package: skip
name: ${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}
needs: configure
runs-on: ubuntu-latest # https://github.com/actions/runner-images
continue-on-error: ${{ matrix.allow-failure == 'yes' }} continue-on-error: ${{ matrix.allow-failure == 'yes' }}
timeout-minutes: 70 timeout-minutes: 70
env: env:
CACHE: ${{ github.workspace }}/.cache/${{ matrix.distro }}${{ matrix.version }}${{ matrix.variant }} # directory for caching docker image and ccache CACHE: ${{ github.workspace }}/.cache/${{ matrix.distro }}${{ matrix.version }}${{ matrix.variant }} # directory for caching docker image and ccache
CCACHE_EVICTION_AGE: 7d CCACHE_EVICTION_AGE: 7d
CCACHE_SIZE: 600M # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy CCACHE_SIZE: 600M # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
CMAKE_GENERATOR: 'Ninja' CMAKE_GENERATOR: Ninja
NAME: ${{ matrix.distro }}${{ matrix.version }} NAME: ${{ matrix.distro }}${{ matrix.version }}
IMAGE_SUFFIX: ${{ matrix.variant }} IMAGE_SUFFIX: ${{ matrix.variant }}
steps: steps:
- name: "Checkout" - name: "Checkout"
uses: actions/checkout@v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: "Restore compiler cache (ccache)" - name: "Restore compiler cache (ccache)"
id: restore_ccache id: restore_ccache
uses: actions/cache/restore@v6 uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with: with:
key: ccache-${{ matrix.distro }}${{ matrix.version }}${{ matrix.variant }} key: ccache-${{ matrix.distro }}${{ matrix.version }}${{ matrix.variant }}
path: ${{ env.CACHE }}/.ccache path: ${{ env.CACHE }}/.ccache
@ -217,8 +219,8 @@ jobs:
RUN --server --debug --test "${extra[@]}" "${args[@]}" RUN --server --debug --test "${extra[@]}" "${args[@]}"
# RUN bind-mounts the workspace into the container, so the report the build wrote into # RUN bind-mounts the workspace into the container, so the report the build wrote
# build/ is already on the host and no second container is needed to collect it. # into build/ is already on the host and no second container is needed to collect it.
- name: "Collect coverage report" - name: "Collect coverage report"
if: matrix.coverage == 'yes' if: matrix.coverage == 'yes'
shell: bash shell: bash
@ -233,7 +235,7 @@ jobs:
- name: "Upload coverage artifact" - name: "Upload coverage artifact"
if: matrix.coverage == 'yes' if: matrix.coverage == 'yes'
uses: actions/upload-artifact@v7 uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with: with:
name: coverage-report name: coverage-report
path: coverage/ path: coverage/
@ -327,7 +329,7 @@ jobs:
- name: "Save updated compiler cache (ccache)" - name: "Save updated compiler cache (ccache)"
if: github.ref == 'refs/heads/master' if: github.ref == 'refs/heads/master'
uses: actions/cache/save@v6 uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with: with:
key: ${{ steps.restore_ccache.outputs.cache-primary-key }} key: ${{ steps.restore_ccache.outputs.cache-primary-key }}
path: ${{ env.CACHE }}/.ccache path: ${{ env.CACHE }}/.ccache
@ -335,7 +337,7 @@ jobs:
- name: "Upload artifact" - name: "Upload artifact"
id: upload_artifact id: upload_artifact
if: matrix.package != 'skip' if: matrix.package != 'skip'
uses: actions/upload-artifact@v7 uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with: with:
archive: false archive: false
if-no-files-found: error if-no-files-found: error
@ -355,7 +357,7 @@ jobs:
- name: "Attest binary provenance" - name: "Attest binary provenance"
id: attestation id: attestation
if: steps.upload_release.outcome == 'success' if: steps.upload_release.outcome == 'success'
uses: actions/attest@v4 uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
with: with:
show-summary: false show-summary: false
subject-path: ${{ steps.build.outputs.path }} subject-path: ${{ steps.build.outputs.path }}
@ -369,6 +371,10 @@ jobs:
run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
build-vcpkg: build-vcpkg:
name: "${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}"
needs: configure
runs-on: ${{ matrix.runner }}
strategy: strategy:
fail-fast: false fail-fast: false
matrix: matrix:
@ -465,9 +471,6 @@ jobs:
vcpkg_scope: 'vcpkg/windows10-x64-vs2026/' vcpkg_scope: 'vcpkg/windows10-x64-vs2026/'
vcpkg_upload: 1 # only one leg per vcpkg_scope hands its archives over vcpkg_upload: 1 # only one leg per vcpkg_scope hands its archives over
name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
needs: configure
runs-on: ${{ matrix.runner }}
timeout-minutes: 100 timeout-minutes: 100
env: env:
CCACHE_DIR: ${{ github.workspace }}/.cache/ CCACHE_DIR: ${{ github.workspace }}/.cache/
@ -475,24 +478,24 @@ jobs:
steps: steps:
- name: "Checkout" - name: "Checkout"
uses: actions/checkout@v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
submodules: recursive submodules: recursive
- name: "[Windows] Add msbuild to PATH" - name: "[Windows] Add msbuild to PATH"
if: matrix.os == 'Windows' if: matrix.os == 'Windows'
uses: microsoft/setup-msbuild@v3 uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0
with: with:
msbuild-architecture: x64 msbuild-architecture: x64
- name: "[macOS] Setup ccache" - name: "[macOS] Install ccache"
if: matrix.os == 'macOS' && matrix.use_ccache == 1 if: matrix.os == 'macOS' && matrix.use_ccache == 1
run: brew install ccache run: brew install ccache
- name: "[macOS] Restore compiler cache (ccache)" - name: "[macOS] Restore compiler cache (ccache)"
if: matrix.os == 'macOS' && matrix.use_ccache == 1 if: matrix.os == 'macOS' && matrix.use_ccache == 1
id: restore_ccache id: restore_ccache
uses: actions/cache/restore@v6 uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with: with:
key: ccache-${{ matrix.runner }}_${{ matrix.override_target }}-Xcode${{ matrix.xcode }} key: ccache-${{ matrix.runner }}_${{ matrix.override_target }}-Xcode${{ matrix.xcode }}
path: ${{ env.CCACHE_DIR }} path: ${{ env.CCACHE_DIR }}
@ -513,7 +516,7 @@ jobs:
- name: "[macOS] Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }}" - name: "[macOS] Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }}"
if: matrix.os == 'macOS' if: matrix.os == 'macOS'
id: restore_qt id: restore_qt
uses: actions/cache/restore@v6 uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with: with:
key: Qt-${{ steps.resolve_qt_version.outputs.version }}-macOS-${{ matrix.soc }}-${{ matrix.qt_modules }}-thin key: Qt-${{ steps.resolve_qt_version.outputs.version }}-macOS-${{ matrix.soc }}-${{ matrix.qt_modules }}-thin
path: ${{ github.workspace }}/Qt path: ${{ github.workspace }}/Qt
@ -522,7 +525,7 @@ jobs:
# Qt build using vcpkg either just fails or takes too long to build # Qt build using vcpkg either just fails or takes too long to build
- name: "[macOS] Install fat Qt ${{ matrix.qt_version }}" - name: "[macOS] Install fat Qt ${{ matrix.qt_version }}"
if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true' if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
uses: jurplel/install-qt-action@v4 uses: jurplel/install-qt-action@b344308e4483fc892e0d27b3cd1b173ebdd95f06 # v4.5.0
with: with:
cache: false cache: false
# cache-key-prefix: Qt # cache-key-prefix: Qt
@ -536,14 +539,14 @@ jobs:
- name: "[macOS] Cache thin Qt libraries" - name: "[macOS] Cache thin Qt libraries"
if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true' && github.ref == 'refs/heads/master' if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true' && github.ref == 'refs/heads/master'
uses: actions/cache/save@v6 uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with: with:
key: ${{ steps.restore_qt.outputs.cache-primary-key }} key: ${{ steps.restore_qt.outputs.cache-primary-key }}
path: ${{ github.workspace }}/Qt path: ${{ github.workspace }}/Qt
- name: "[Windows] Install Qt ${{ matrix.qt_version }}" - name: "[Windows] Install Qt ${{ matrix.qt_version }}"
if: matrix.os == 'Windows' if: matrix.os == 'Windows'
uses: jurplel/install-qt-action@v4 uses: jurplel/install-qt-action@b344308e4483fc892e0d27b3cd1b173ebdd95f06 # v4.5.0
with: with:
# Qt 6.11.0 only works with aqtinstall directly from git until aqtinstall 3.4 is released # Qt 6.11.0 only works with aqtinstall directly from git until aqtinstall 3.4 is released
aqtsource: git+https://github.com/miurahr/aqtinstall.git aqtsource: git+https://github.com/miurahr/aqtinstall.git
@ -566,7 +569,7 @@ jobs:
- name: "Setup vcpkg cache" - name: "Setup vcpkg cache"
id: vcpkg-cache id: vcpkg-cache
uses: TAServers/vcpkg-cache@v3 uses: TAServers/vcpkg-cache@4f07be616a4604dd29f3c6885975cf2c04abee71 # v3.4.2
with: with:
# Every entry is keyed by vcpkg ABI hash, and one hash set exists per platform, # Every entry is keyed by vcpkg ABI hash, and one hash set exists per platform,
# target and toolchain. The action restores every entry it finds under the # target and toolchain. The action restores every entry it finds under the
@ -716,7 +719,7 @@ jobs:
if [[ -f ${runtime_path:-} ]]; then if [[ -f ${runtime_path:-} ]]; then
paths+=("$runtime_path") paths+=("$runtime_path")
else else
echo "::warning::shipped Qt runtime $runtime not found under $qt_dir" echo "::warning::Shipped Qt runtime $runtime not found under $qt_dir"
fi fi
done < <(grep -E '^(Qt6[^/]*\.dll|Plugins/)' build/required-runtime.txt) done < <(grep -E '^(Qt6[^/]*\.dll|Plugins/)' build/required-runtime.txt)
fi fi
@ -812,7 +815,7 @@ jobs:
- name: "Upload new vcpkg entries" - name: "Upload new vcpkg entries"
# An empty count means the step above did not run at all, on master and on forks # An empty count means the step above did not run at all, on master and on forks
if: steps.vcpkg_new.outputs.count != '' && steps.vcpkg_new.outputs.count != '0' if: steps.vcpkg_new.outputs.count != '' && steps.vcpkg_new.outputs.count != '0'
uses: actions/upload-artifact@v7 uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with: with:
if-no-files-found: error # a count above zero with nothing staged is a bug if-no-files-found: error # a count above zero with nothing staged is a bug
name: vcpkg-new-${{ steps.vcpkg_new.outputs.slug }} name: vcpkg-new-${{ steps.vcpkg_new.outputs.slug }}
@ -833,7 +836,7 @@ jobs:
- name: "[macOS] Cache updated compiler cache (ccache)" - name: "[macOS] Cache updated compiler cache (ccache)"
if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master' if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master'
uses: actions/cache/save@v6 uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with: with:
key: ${{ steps.restore_ccache.outputs.cache-primary-key }} key: ${{ steps.restore_ccache.outputs.cache-primary-key }}
path: ${{ env.CCACHE_DIR }} path: ${{ env.CCACHE_DIR }}
@ -888,7 +891,7 @@ jobs:
- name: "Upload artifact" - name: "Upload artifact"
if: matrix.make_package if: matrix.make_package
id: upload_artifact id: upload_artifact
uses: actions/upload-artifact@v7 uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with: with:
archive: false archive: false
if-no-files-found: error if-no-files-found: error
@ -920,7 +923,7 @@ jobs:
# debug identifier, and the PE is what carries the unwind information. # debug identifier, and the PE is what carries the unwind information.
- name: "[Windows] Upload debug symbols (exe + pdb)" - name: "[Windows] Upload debug symbols (exe + pdb)"
if: matrix.os == 'Windows' && needs.configure.outputs.tag != null if: matrix.os == 'Windows' && needs.configure.outputs.tag != null
uses: actions/upload-artifact@v7 uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with: with:
if-no-files-found: error if-no-files-found: error
name: ${{ steps.build.outputs.name }}-Symbols name: ${{ steps.build.outputs.name }}-Symbols
@ -935,7 +938,7 @@ jobs:
- name: "Attest binary provenance" - name: "Attest binary provenance"
if: steps.upload_release.outcome == 'success' if: steps.upload_release.outcome == 'success'
id: attestation id: attestation
uses: actions/attest@v4 uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
with: with:
show-summary: false show-summary: false
subject-path: ${{ steps.build.outputs.path }} subject-path: ${{ steps.build.outputs.path }}
@ -949,10 +952,11 @@ jobs:
run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
prune-caches: prune-caches:
name: Prune caches name: "Prune caches"
# Only master writes caches at all, so only master may clean them up too # Only master writes caches at all, so only master may clean them up too
if: github.ref == 'refs/heads/master' if: github.ref == 'refs/heads/master'
runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
continue-on-error: true # freeing space must never fail a build continue-on-error: true # freeing space must never fail a build
steps: steps:
@ -987,27 +991,27 @@ jobs:
reason="" reason=""
if [[ $ref != refs/heads/master ]]; then if [[ $ref != refs/heads/master ]]; then
reason="scoped to $ref" reason="Scoped to $ref"
elif [[ $key == vcpkg/* ]]; then elif [[ $key == vcpkg/* ]]; then
# "<scope>/<abi hash>", cut the hash off the end to get the scope # "<scope>/<abi hash>", cut the hash off the end to get the scope
scope="vcpkg/${key#vcpkg/}" scope="vcpkg/${key#vcpkg/}"
scope="${scope%/*}/" scope="${scope%/*}/"
if [[ $live != *" $scope "* ]]; then if [[ $live != *" $scope "* ]]; then
reason="no matrix leg uses $scope" reason="No matrix leg uses $scope"
fi fi
fi fi
if [[ -z $reason ]]; then if [[ -z $reason ]]; then
stamp="$(date -u -d "$accessed" +%s 2>/dev/null || echo 0)" stamp="$(date -u -d "$accessed" +%s 2>/dev/null || echo 0)"
if [[ $stamp -ne 0 && $stamp -lt $cutoff ]]; then if [[ $stamp -ne 0 && $stamp -lt $cutoff ]]; then
reason="unused since $accessed" reason="Unused since $accessed"
fi fi
fi fi
if [[ -n $reason ]]; then if [[ -n $reason ]]; then
echo "::notice::deleting $key, $reason" echo "::notice::Deleting $key, $reason"
gh api -X DELETE "repos/$GITHUB_REPOSITORY/actions/caches/$id" gh api -X DELETE "repos/$GITHUB_REPOSITORY/actions/caches/$id"
deleted=$((deleted + 1)) deleted=$((deleted + 1))
fi fi
done <"$RUNNER_TEMP/caches.tsv" done <"$RUNNER_TEMP/caches.tsv"
echo "::notice::deleted $deleted of $(wc -l <"$RUNNER_TEMP/caches.tsv") cache entries" echo "::notice::Deleted $deleted of $(wc -l <"$RUNNER_TEMP/caches.tsv") cache entries"

7
.github/workflows/desktop-lint.yml vendored
View file

@ -1,7 +1,7 @@
name: Code Style (C++) name: Code Style (C++)
permissions: permissions:
contents: read contents: read # needed to checkout repo
on: on:
# Push trigger not needed for linting, we do not allow direct pushes to master # Push trigger not needed for linting, we do not allow direct pushes to master
@ -21,11 +21,12 @@ on:
jobs: jobs:
format: format:
runs-on: ubuntu-slim name: "Check formatting"
runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
steps: steps:
- name: "Checkout" - name: "Checkout"
uses: actions/checkout@v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
fetch-depth: 20 # should be enough to find merge base fetch-depth: 20 # should be enough to find merge base

22
.github/workflows/docker-release.yml vendored
View file

@ -56,7 +56,7 @@ jobs:
include: include:
- label: x86 - label: x86
platform: linux/amd64 platform: linux/amd64
runner: ubuntu-latest # https://github.com/actions/runner-images runner: ubuntu-latest # https://github.com/actions/runner-images#available-images
- label: arm - label: arm
platform: linux/arm64 platform: linux/arm64
@ -67,17 +67,17 @@ jobs:
steps: steps:
- name: "Checkout" - name: "Checkout"
uses: actions/checkout@v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
ref: ${{ case(github.event_name == 'workflow_dispatch', format('refs/tags/{0}', inputs.tag), '') }} ref: ${{ case(github.event_name == 'workflow_dispatch', format('refs/tags/{0}', inputs.tag), '') }}
- name: "Set up Docker buildx" - name: "Set up Docker buildx"
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
- name: "Login to GitHub Container Registry (GHCR)" - name: "Login to GitHub Container Registry (GHCR)"
if: (github.event_name == 'release' && github.event.release.prerelease == false) || github.event_name == 'workflow_dispatch' if: (github.event_name == 'release' && github.event.release.prerelease == false) || github.event_name == 'workflow_dispatch'
id: login id: login
uses: docker/login-action@v4 uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.actor }} username: ${{ github.actor }}
@ -86,7 +86,7 @@ jobs:
# Don't push for non-publishing triggers # Don't push for non-publishing triggers
- name: "Build image" - name: "Build image"
if: steps.login.outcome != 'success' if: steps.login.outcome != 'success'
uses: docker/build-push-action@v7 uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
with: with:
cache-from: type=gha,scope=${{ env.CACHE_SCOPE }} cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
cache-to: ${{ case(github.ref == 'refs/heads/master', format('type=gha,mode=max,scope={0}', env.CACHE_SCOPE), '') }} cache-to: ${{ case(github.ref == 'refs/heads/master', format('type=gha,mode=max,scope={0}', env.CACHE_SCOPE), '') }}
@ -98,7 +98,7 @@ jobs:
- name: "Build image and push by digest" - name: "Build image and push by digest"
if: steps.login.outcome == 'success' if: steps.login.outcome == 'success'
id: build id: build
uses: docker/build-push-action@v7 uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
with: with:
cache-from: type=gha,scope=${{ env.CACHE_SCOPE }} cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
cache-to: type=gha,mode=max,scope=${{ env.CACHE_SCOPE }} cache-to: type=gha,mode=max,scope=${{ env.CACHE_SCOPE }}
@ -109,7 +109,7 @@ jobs:
org.opencontainers.image.url=${{ env.OCI_URL }} org.opencontainers.image.url=${{ env.OCI_URL }}
outputs: type=image,name=${{ env.GHCR_IMAGE }},name-canonical=true,push=true,push-by-digest=true outputs: type=image,name=${{ env.GHCR_IMAGE }},name-canonical=true,push=true,push-by-digest=true
platforms: ${{ matrix.platform }} platforms: ${{ matrix.platform }}
provenance: mode=max # Do not pass secrets as build arguments with this option provenance: mode=max # do not pass secrets as build arguments with this option
sbom: true sbom: true
- name: "Export digest" - name: "Export digest"
@ -122,7 +122,7 @@ jobs:
- name: "Upload digest" - name: "Upload digest"
if: steps.login.outcome == 'success' if: steps.login.outcome == 'success'
uses: actions/upload-artifact@v7 uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with: with:
if-no-files-found: error if-no-files-found: error
name: digest-${{ matrix.label }} name: digest-${{ matrix.label }}
@ -139,14 +139,14 @@ jobs:
steps: steps:
- name: "Download digests" - name: "Download digests"
uses: actions/download-artifact@v8 uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with: with:
path: ${{ runner.temp }}/digests path: ${{ runner.temp }}/digests
pattern: digest-* pattern: digest-*
merge-multiple: true merge-multiple: true
- name: "Login to GitHub Container Registry (GHCR)" - name: "Login to GitHub Container Registry (GHCR)"
uses: docker/login-action@v4 uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.actor }} username: ${{ github.actor }}
@ -154,7 +154,7 @@ jobs:
- name: "Docker metadata" - name: "Docker metadata"
id: metadata id: metadata
uses: docker/metadata-action@v6 uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with: with:
images: ${{ env.GHCR_IMAGE }} images: ${{ env.GHCR_IMAGE }}
flavor: | flavor: |

12
.github/workflows/documentation-build.yml vendored
View file

@ -1,4 +1,4 @@
name: Generate Docs name: Build Documentation
permissions: permissions:
contents: read # write permission to the destination repo come from 'deploy_key' contents: read # write permission to the destination repo come from 'deploy_key'
@ -24,12 +24,12 @@ env:
jobs: jobs:
docs: docs:
name: Doxygen name: "Doxygen"
runs-on: ubuntu-latest runs-on: ubuntu-latest # https://github.com/actions/runner-images#available-images
steps: steps:
- name: "Checkout" - name: "Checkout"
uses: actions/checkout@v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
submodules: recursive submodules: recursive
@ -42,7 +42,7 @@ jobs:
- name: "Install Doxygen" - name: "Install Doxygen"
uses: ssciwr/doxygen-install@v2 uses: ssciwr/doxygen-install@v2
with: with:
version: "1.18.0" version: "1.18.0" # https://www.doxygen.nl/manual/changelog.html
- name: "Update Doxygen Configuration" - name: "Update Doxygen Configuration"
shell: bash shell: bash
@ -65,7 +65,7 @@ jobs:
- name: "Deploy to cockatrice.github.io/docs" - name: "Deploy to cockatrice.github.io/docs"
if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
uses: peaceiris/actions-gh-pages@v4 uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
with: with:
deploy_key: ${{ secrets.DOCS_DEPLOY_KEY }} deploy_key: ${{ secrets.DOCS_DEPLOY_KEY }}
destination_dir: docs # docs will be available at https://cockatrice.github.io/docs/ destination_dir: docs # docs will be available at https://cockatrice.github.io/docs/

9
.github/workflows/translations-pull.yml vendored
View file

@ -16,15 +16,14 @@ on:
jobs: jobs:
translations: translations:
name: "Pull languages"
# Do not run the scheduled workflow on forks # Do not run the scheduled workflow on forks
if: github.event_name != 'schedule' || github.repository_owner == 'Cockatrice' if: github.event_name != 'schedule' || github.repository_owner == 'Cockatrice'
runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
name: Pull languages
runs-on: ubuntu-slim
steps: steps:
- name: "Checkout repo" - name: "Checkout repo"
uses: actions/checkout@v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: "Pull translated strings from Transifex" - name: "Pull translated strings from Transifex"
# Do not run this step for PR's from forks, they don't have access to the secret # Do not run this step for PR's from forks, they don't have access to the secret
@ -39,7 +38,7 @@ jobs:
- name: "Create pull request" - name: "Create pull request"
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
id: create_pr id: create_pr
uses: peter-evans/create-pull-request@v8 uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with: with:
add-paths: | add-paths: |
cockatrice/translations/*.ts cockatrice/translations/*.ts

17
.github/workflows/translations-push.yml vendored
View file

@ -16,15 +16,14 @@ on:
jobs: jobs:
translations: translations:
name: "Push strings"
# Do not run the scheduled workflow on forks # Do not run the scheduled workflow on forks
if: github.event_name != 'schedule' || github.repository_owner == 'Cockatrice' if: github.event_name != 'schedule' || github.repository_owner == 'Cockatrice'
runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
name: Push strings
runs-on: ubuntu-slim
steps: steps:
- name: "Checkout repo" - name: "Checkout repo"
uses: actions/checkout@v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: "Install lupdate" - name: "Install lupdate"
shell: bash shell: bash
@ -37,7 +36,7 @@ jobs:
FILE: cockatrice/cockatrice_en@source.ts FILE: cockatrice/cockatrice_en@source.ts
id: cockatrice id: cockatrice
shell: bash shell: bash
run: > run: |
DIRS="cockatrice/src $(find . -maxdepth 1 -type d -name 'libcockatrice_*')" DIRS="cockatrice/src $(find . -maxdepth 1 -type d -name 'libcockatrice_*')"
.ci/update_translation_source_strings.sh .ci/update_translation_source_strings.sh
@ -45,13 +44,13 @@ jobs:
id: oracle id: oracle
shell: bash shell: bash
env: env:
DIRS: 'oracle/src' DIRS: oracle/src
FILE: 'oracle/oracle_en@source.ts' FILE: oracle/oracle_en@source.ts
run: .ci/update_translation_source_strings.sh run: .ci/update_translation_source_strings.sh
- name: "Render template" - name: "Render template"
id: template id: template
uses: chuhlomin/render-template/binary@v1 uses: chuhlomin/render-template/binary@a7c644e341797d050d1cb24332d83791b9a46dae # v1.12
with: with:
template: .ci/update_translation_source_strings_template.md template: .ci/update_translation_source_strings_template.md
vars: | vars: |
@ -62,7 +61,7 @@ jobs:
- name: "Create pull request" - name: "Create pull request"
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
id: create_pr id: create_pr
uses: peter-evans/create-pull-request@v8 uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with: with:
add-paths: | add-paths: |
cockatrice/cockatrice_en@source.ts cockatrice/cockatrice_en@source.ts

27
.github/workflows/vcpkg-cache-import.yml vendored
View file

@ -21,8 +21,10 @@ permissions:
on: on:
workflow_run: workflow_run:
workflows: ["Build Desktop"] workflows:
types: [completed] - 'Build Desktop'
types:
- completed
# Every import writes the same scopes, so let them queue instead of racing each other # Every import writes the same scopes, so let them queue instead of racing each other
concurrency: concurrency:
@ -31,12 +33,12 @@ concurrency:
jobs: jobs:
list: list:
name: List new vcpkg entries name: "List new vcpkg entries"
# Only a successful push to the default branch has archives worth importing. # Only a successful push to the default branch has archives worth importing.
# Only code that landed on master may populate the scope master runs restore. # Only code that landed on master may populate the scope master runs restore.
# Bot actors are excluded on top: their runs must never promote binaries into # Bot actors are excluded on top: their runs must never promote binaries into
# the shared scope even if they somehow target the default branch. # the shared scope even if they somehow target the default branch.
if: >- if: |
github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.conclusion == 'success' &&
github.event.workflow_run.event == 'push' && github.event.workflow_run.event == 'push' &&
github.event.workflow_run.head_branch == 'master' && github.event.workflow_run.head_branch == 'master' &&
@ -44,6 +46,7 @@ jobs:
!endsWith(github.event.workflow_run.actor.login, '[bot]') && !endsWith(github.event.workflow_run.actor.login, '[bot]') &&
!endsWith(github.event.workflow_run.triggering_actor.login, '[bot]') !endsWith(github.event.workflow_run.triggering_actor.login, '[bot]')
runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
# workflow_run is a low-trust trigger, so cache access is read-only by default even # workflow_run is a low-trust trigger, so cache access is read-only by default even
# though this run resolves to the default branch. Assert below that this took effect, # though this run resolves to the default branch. Assert below that this took effect,
# because a save under read-only access only warns and would import nothing silently. # because a save under read-only access only warns and would import nothing silently.
@ -53,7 +56,7 @@ jobs:
steps: steps:
- name: "Download new vcpkg entries" - name: "Download new vcpkg entries"
uses: actions/download-artifact@v8 uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with: with:
pattern: vcpkg-new-* pattern: vcpkg-new-*
path: incoming path: incoming
@ -64,7 +67,7 @@ jobs:
shell: bash shell: bash
run: | run: |
if [[ $ACTIONS_CACHE_MODE != *write* ]]; then if [[ $ACTIONS_CACHE_MODE != *write* ]]; then
echo "::error::expected a write-capable cache, got '$ACTIONS_CACHE_MODE'" echo "::error::Expected a write-capable cache, got '$ACTIONS_CACHE_MODE'"
exit 1 exit 1
fi fi
@ -86,14 +89,16 @@ jobs:
# Compact, because a multi line value cannot be written to GITHUB_OUTPUT # Compact, because a multi line value cannot be written to GITHUB_OUTPUT
entries="$(jq -cs '.' <<<"$entries")" entries="$(jq -cs '.' <<<"$entries")"
echo "entries=$entries" >>"$GITHUB_OUTPUT" echo "entries=$entries" >>"$GITHUB_OUTPUT"
echo "::notice::importing $(jq length <<<"$entries") vcpkg entries" echo "::notice::Importing $(jq length <<<"$entries") vcpkg entries"
save: save:
name: "Save ${{ matrix.entry.key }}" name: "Save ${{ matrix.entry.key }}"
needs: list
if: needs.list.outputs.entries if: needs.list.outputs.entries
runs-on: ubuntu-slim needs: list
runs-on: ubuntu-slim # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
cache-mode: write cache-mode: write
strategy: strategy:
# One job per archive, they run in parallel and each only uploads a single file # One job per archive, they run in parallel and each only uploads a single file
fail-fast: false fail-fast: false
@ -103,7 +108,7 @@ jobs:
steps: steps:
- name: "Download new vcpkg entries" - name: "Download new vcpkg entries"
uses: actions/download-artifact@v8 uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with: with:
pattern: ${{ matrix.entry.artifact }} pattern: ${{ matrix.entry.artifact }}
path: incoming path: incoming
@ -111,7 +116,7 @@ jobs:
github-token: ${{ secrets.GITHUB_TOKEN }} github-token: ${{ secrets.GITHUB_TOKEN }}
- name: "Save vcpkg entry" - name: "Save vcpkg entry"
uses: actions/cache/save@v6 uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with: with:
# The payload is a Windows or macOS archive while the upload runs on Linux, and # The payload is a Windows or macOS archive while the upload runs on Linux, and
# without this the entry would be stamped as a Linux cache that neither of them # without this the entry would be stamped as a Linux cache that neither of them