[CI] Run the nightly legs from their own jobs

jobs.<id>.if cannot read matrix, so the previous filter never validated and
no leg of this workflow ran. matrix.exclude cannot express it either: GitHub
processes exclude before include, and these matrices are include-only.

Split the regular and nightly legs into two jobs per platform, sharing the
step list through a YAML anchor and gating the jobs on the event instead of
on matrix. The nightly run now covers only the legs a push leaves out, and
the event name is part of the concurrency group so a nightly and a master
push do not cancel each other.

.github/workflows/desktop-build.yml

@@ -41,7 +41,10 @@ on:
 
 # Cancel earlier, unfinished runs of this workflow on the same branch (unless on tag --> release)
 concurrency:
-  group: "${{ github.workflow }} @ ${{ github.ref_name }}"
+  # The event name is part of the group because a nightly run and a push run on master share
+  # refs/heads/master but must not cancel each other: the nightly would drop the push's vcpkg
+  # import, and a merge landing during the nightly would drop that night's coverage.
+  group: "${{ github.workflow }} @ ${{ github.ref_name }} (${{ github.event_name }})"
   cancel-in-progress: ${{ github.ref_type != 'tag' }}
 
 jobs:
@@ -155,25 +158,11 @@ jobs:
             server_only: yes
             test: skip
 
-          - distro: Debian
-            version: 12
-            nightly: yes    # previous stable, still covered by the nightly
-
-            package: DEB
-            test: skip    # Running tests on all distros is superfluous
-
           - distro: Debian
             version: 13
 
             package: DEB
 
-          - distro: Fedora
-            version: 43
-            nightly: yes    # previous release, still covered by the nightly
-
-            package: RPM
-            test: skip    # Running tests on all distros is superfluous
-
           - distro: Fedora
             version: 44
 
@@ -184,13 +173,6 @@ jobs:
             # new warning in either compiler still fails the build.
             debug_test: yes
 
-          - distro: Ubuntu
-            version: 24.04
-            nightly: yes    # previous LTS, still covered by the nightly
-
-            package: DEB
-            test: skip    # Running tests on all distros is superfluous
-
           - distro: Ubuntu
             version: 26.04
 
@@ -227,9 +209,9 @@ jobs:
 
     name: ${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}
     needs: configure
-    # A leg marked nightly runs in the nightly and on tags, never on a pull request or a
+    # The nightly legs live in build-linux-nightly below. A leg is in exactly one of the two
-    # merge, so nothing that reviews a change waits for a distro nobody is changing for.
+    # matrices, so nothing that reviews a change waits for a distro nobody is changing for.
-    if: matrix.nightly != 'yes' || github.event_name == 'schedule' || github.ref_type == 'tag'
+    if: github.event_name != 'schedule'
     runs-on: ubuntu-latest    # https://github.com/actions/runner-images
     continue-on-error: ${{ matrix.allow-failure == 'yes' }}
     timeout-minutes: 70
@@ -250,7 +232,8 @@ jobs:
       DEBUG_TEST: ${{ matrix.sanitize == 'yes' || matrix.coverage == 'yes' || matrix.debug_test == 'yes' }}
       RUN_TESTS: ${{ matrix.test != 'skip' && !(matrix.sanitize == 'yes' || matrix.coverage == 'yes' || matrix.debug_test == 'yes') }}
 
-    steps:
+    # Shared with build-linux-nightly so the two leg sets run the same steps.
+    steps: &linux-steps
       - name: "Checkout"
         uses: actions/checkout@v7
 
@@ -455,31 +438,50 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
 
+  build-linux-nightly:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: Debian
+            version: 12    # previous stable, still covered by the nightly
+
+            package: DEB
+            test: skip    # Running tests on all distros is superfluous
+
+          - distro: Fedora
+            version: 43    # previous release, still covered by the nightly
+
+            package: RPM
+            test: skip    # Running tests on all distros is superfluous
+
+          - distro: Ubuntu
+            version: 24.04    # previous LTS, still covered by the nightly
+
+            package: DEB
+            test: skip    # Running tests on all distros is superfluous
+
+    name: ${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}
+    needs: configure
+    # A nightly and a tag build cover the legs a pull request or a merge does not wait for.
+    if: github.event_name == 'schedule' || github.ref_type == 'tag'
+    runs-on: ubuntu-latest    # https://github.com/actions/runner-images
+    continue-on-error: ${{ matrix.allow-failure == 'yes' }}
+    timeout-minutes: 70
+    env:
+      CACHE: ${{ github.workspace }}/.cache/${{ matrix.distro }}${{ matrix.version }}${{ matrix.variant }}    # directory for caching docker image and ccache
+      CCACHE_EVICTION_AGE: 7d
+      CCACHE_SIZE: 600M    # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
+      CMAKE_GENERATOR: 'Ninja'
+      NAME: ${{ matrix.distro }}${{ matrix.version }}
+      IMAGE_SUFFIX: ${{ matrix.variant }}
+    steps: *linux-steps
+
   build-vcpkg:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: macOS
-            target: 13    # EOL 2025-09-15
-            runner: macos-15-intel    # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md
-                                      # macos-26-intel is very slow and fails in CPack during DMG config if not increasing Finder timeout
-            nightly: yes    # EOL target on the slowest runner: nightly and tags only
-
-            ccache_eviction_age: 7d
-            cmake_generator: Ninja
-            make_package: 1
-            override_target: 13
-            package_suffix: "-macOS13_Intel"
-            qt_version: 6.11.*
-            qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
-            soc: Intel
-            type: Release
-            use_ccache: 1
-            vcpkg_scope: 'vcpkg/macos13-x64-xcode26.3/'
-            vcpkg_upload: 1    # only one leg per vcpkg_scope hands its archives over
-            xcode: "26.3"
-
           - os: macOS
             target: 14    # EOL 2026-??
             runner: macos-26    # https://github.com/actions/runner-images/blob/main/images/macos/macos-26-arm64-Readme.md
@@ -555,14 +557,16 @@ jobs:
 
     name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
     needs: [configure, vcpkg-baseline]
-    if: matrix.nightly != 'yes' || github.event_name == 'schedule' || github.ref_type == 'tag'
+    # The nightly leg lives in build-vcpkg-nightly below, next to the Linux nightly legs.
+    if: github.event_name != 'schedule'
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 100
     env:
       CCACHE_DIR: ${{ github.workspace }}/.cache/
       CCACHE_SIZE: 600M    # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
 
-    steps:
+    # Shared with build-vcpkg-nightly so the two leg sets run the same steps.
+    steps: &vcpkg-steps
       - name: "Checkout"
         uses: actions/checkout@v7
         with:
@@ -1037,6 +1041,42 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
 
+  build-vcpkg-nightly:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macOS
+            target: 13    # EOL 2025-09-15
+            runner: macos-15-intel    # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md
+                                      # macos-26-intel is very slow and fails in CPack during DMG config if not increasing Finder timeout
+
+            ccache_eviction_age: 7d
+            cmake_generator: Ninja
+            make_package: 1
+            override_target: 13
+            package_suffix: "-macOS13_Intel"
+            qt_version: 6.11.*
+            qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
+            soc: Intel
+            type: Release
+            use_ccache: 1
+            vcpkg_scope: 'vcpkg/macos13-x64-xcode26.3/'
+            vcpkg_upload: 1    # only one leg per vcpkg_scope hands its archives over
+            xcode: "26.3"
+
+    name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
+    needs: configure
+    # The EOL target on the slowest runner is too slow to gate a change, so it runs in the
+    # nightly and on tags only, where the vcpkg cache import also has to accept schedule runs.
+    if: github.event_name == 'schedule' || github.ref_type == 'tag'
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 100
+    env:
+      CCACHE_DIR: ${{ github.workspace }}/.cache/
+      CCACHE_SIZE: 600M    # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
+    steps: *vcpkg-steps
+
   prune-caches:
     name: Prune caches
     # Only master writes caches at all, so only master may clean them up too
@@ -1055,8 +1095,9 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-          # Must list every vcpkg_scope of the build-vcpkg matrix above, or the entries of
+          # Must list every vcpkg_scope of the build-vcpkg and build-vcpkg-nightly
-          # a scope that is still in use get deleted on the next run.
+          # matrices above, or the entries of a scope that is still in use get deleted
+          # on the next run.
           LIVE_VCPKG_SCOPES: 'vcpkg/macos13-x64-xcode26.3/ vcpkg/macos14-arm64-xcode26.6/ vcpkg/windows10-x64-vs2026/'
         run: |
           gh api --paginate "repos/$GITHUB_REPOSITORY/actions/caches?per_page=100" \

.github/workflows/vcpkg-cache-import.yml

@@ -4,12 +4,14 @@ name: Import vcpkg cache
 # rebuilds protobuf, openssl and abseil from source and saves them into the shared
 # cache, where every later run can restore them.
 #
-# Only master pushes are imported here: the collect step, keys.txt and the zip
+# Only master pushes and the nightly schedule run on master are imported here: the
-# contents all come from the workflow run being imported, so importing from an
+# collect step, keys.txt and the zip contents all come from the workflow run being
-# unmerged pull request would let anyone who can push a branch — or a bot actor
+# imported, so importing from an unmerged pull request would let anyone who can push
-# such as Dependabot, whose PRs are same-repo — promote arbitrary binaries into
+# a branch — or a bot actor such as Dependabot, whose PRs are same-repo — promote
-# the scope that master and tag builds restore and link into signed releases.
+# arbitrary binaries into the scope that master and tag builds restore and link into
-# Forks build untrusted code and must never reach that scope either.
+# signed releases. Forks build untrusted code and must never reach that scope either.
+# A scheduled run is the default branch at the commit a master push already built, so
+# it carries the same trust as a push.
 #
 # repository_dispatch is not used on purpose: it would also resolve to the default branch,
 # but it counts as a low-trust trigger and may only write there when it declares a
@@ -38,7 +40,7 @@ jobs:
     # the shared scope even if they somehow target the default branch.
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
+      (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule') &&
       github.event.workflow_run.head_branch == 'master' &&
       github.event.workflow_run.head_repository.full_name == github.repository &&
       !endsWith(github.event.workflow_run.actor.login, '[bot]') &&