From 14a1d5ef1b0aae27e3ce6026bd69c758c48b2d7f Mon Sep 17 00:00:00 2001 From: Nabil Freij Date: Tue, 15 Sep 2026 21:21:11 -0700 Subject: [PATCH 1/4] ci: add build and startup smoke checks Builds Windows and both Mac architectures, then launches the Linux binary under Xvfb to catch startup crashes a compile-only CI misses. Actions are pinned to SHAs. --- .github/workflows/ci.yml | 134 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 134 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..13bc3ce --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,134 @@ +name: CI + +# Both trigger lists below name the active development branch; that is the +# only thing to change if it is ever renamed or replaced by main. +on: + workflow_dispatch: + push: + branches: ["extremelywip"] + paths-ignore: + - "README.md" + - "ROADMAP.md" + - "CONTRIBUTING.md" + pull_request: + branches: ["extremelywip"] + paths-ignore: + - "README.md" + - "ROADMAP.md" + - "CONTRIBUTING.md" + +permissions: + contents: read + +jobs: + # Linux build coverage comes from smoke-linux, which runs `make linux` + # itself before launching the binary. + build-windows: + name: Build Windows x86_64 + runs-on: windows-latest + defaults: + run: + shell: msys2 {0} + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + submodules: recursive + + - name: Set up MSYS2 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 + with: + msystem: MINGW64 + update: true + install: >- + make + git + mingw-w64-x86_64-gcc + mingw-w64-x86_64-curl + mingw-w64-x86_64-ngtcp2 + mingw-w64-x86_64-nghttp3 + mingw-w64-x86_64-zstd + mingw-w64-x86_64-libssh2 + mingw-w64-x86_64-openssl + mingw-w64-x86_64-brotli + mingw-w64-x86_64-libpsl + mingw-w64-x86_64-libidn2 + mingw-w64-x86_64-libunistring + mingw-w64-x86_64-libiconv + mingw-w64-x86_64-pkgconf + + - name: Build + run: make windows MINGW_PREFIX=/mingw64 PKG_CONFIG_WIN=pkg-config + + build-macos: + name: Build macOS ${{ matrix.arch }} + runs-on: ${{ matrix.runner }} + strategy: + fail-fast: false + matrix: + include: + - runner: macos-15-intel + arch: Intel + expect: x86_64 + - runner: macos-15 + arch: Apple Silicon + expect: arm64 + env: + MACOSX_DEPLOYMENT_TARGET: "11.0" + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + submodules: recursive + + - name: Build + run: make macos + + - name: Verify binary architecture + run: | + file bin/TLEscope-macos + file bin/TLEscope-macos | grep -q "${{ matrix.expect }}" + + smoke-linux: + name: Linux startup smoke test + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + submodules: recursive + + - name: Install build and Xvfb dependencies + run: | + sudo apt-get update + sudo apt-get install -y \ + g++ make xvfb xauth \ + libasound2-dev libx11-dev libxrandr-dev libxi-dev \ + libgl1-mesa-dev libglu1-mesa-dev libxcursor-dev libxinerama-dev \ + libwayland-dev libxkbcommon-dev libcurl4-openssl-dev + + - name: Build Linux application + run: make linux + + - name: Verify application survives startup + working-directory: dist/TLEscope-Linux-Portable + env: + LIBGL_ALWAYS_SOFTWARE: "1" + run: | + mkdir -p "$RUNNER_TEMP/tlescope-home" + set +e + HOME="$RUNNER_TEMP/tlescope-home" \ + timeout 10s xvfb-run -a -s "-screen 0 1280x720x24" \ + ./TLEscope > "$RUNNER_TEMP/tlescope-smoke.log" 2>&1 + status=$? + set -e + + cat "$RUNNER_TEMP/tlescope-smoke.log" + + if [ "$status" -eq 124 ]; then + echo "TLEscope stayed running for the 10-second smoke-test window." + exit 0 + fi + + echo "TLEscope exited before the smoke-test window completed (status $status)." >&2 + exit 1 From ab6ed68b911c2b6e5761f5cfdadc7e7c56785ca4 Mon Sep 17 00:00:00 2001 From: Nabil Freij Date: Tue, 15 Sep 2026 21:21:11 -0700 Subject: [PATCH 2/4] ci: pin release workflow actions to SHAs Also moves off the Node 20 runtimes GitHub is deprecating. --- .github/workflows/build.yml | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4b69e78..9827653 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive @@ -34,7 +34,7 @@ jobs: run: make linux - name: Upload Linux Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: TLEscope-Linux-Portable path: dist/TLEscope-Linux-Portable/ @@ -45,12 +45,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive - name: Setup ARM64 Cross-Compile - uses: cyberjunk/gha-ubuntu-cross@v5 + uses: cyberjunk/gha-ubuntu-cross@e4dbbe43513699c9007d69f22dc429e8c1912b23 # v5 with: arch: arm64 @@ -71,7 +71,7 @@ jobs: DIST_LINUX=dist/TLEscope-Linux-arm64-Portable - name: Upload Linux ARM64 Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: TLEscope-Linux-arm64-Portable path: dist/TLEscope-Linux-arm64-Portable/ @@ -85,12 +85,12 @@ jobs: shell: msys2 {0} steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive - name: Setup MSYS2 (MinGW Environment) - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: msystem: MINGW64 update: true @@ -117,14 +117,14 @@ jobs: run: make win-installer MINGW_PREFIX=/mingw64 - name: Upload Windows Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: TLEscope-Win-Portable path: dist/TLEscope-Win-Portable/ retention-days: 14 - name: Upload Windows Installer Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: TLEscope-Installer path: dist/TLEscope-Installer.exe @@ -138,12 +138,12 @@ jobs: shell: msys2 {0} steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive - name: Setup MSYS2 (MinGW Environment) - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: msystem: CLANGARM64 update: true @@ -172,7 +172,7 @@ jobs: run: make windows-arm64 - name: Upload Windows ARM64 Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: TLEscope-Win-arm64-Portable path: dist/TLEscope-Win-arm64-Portable/ @@ -188,10 +188,10 @@ jobs: steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download Artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: artifacts @@ -232,7 +232,7 @@ jobs: - name: Update Nightly Release if: startsWith(github.ref, 'refs/heads/') - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: tag_name: nightly name: "Nightly Build" @@ -247,7 +247,7 @@ jobs: - name: Publish Release if: startsWith(github.ref, 'refs/tags/v') - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: generate_release_notes: true files: | From d293c82c1fbf55a79e3fdab05d4e52773cf1c749 Mon Sep 17 00:00:00 2001 From: Nabil Freij Date: Tue, 15 Sep 2026 21:21:11 -0700 Subject: [PATCH 3/4] ci: let Dependabot keep the pinned actions current SHA pins go stale silently, so weekly grouped PRs replace them. --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..b1e45fe --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,14 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + # extremelywip is the active development branch; main lags behind it. + target-branch: "extremelywip" + schedule: + interval: "weekly" + # one PR for all action bumps instead of one per action + groups: + actions: + patterns: ["*"] + commit-message: + prefix: "ci" From 98f6c7a2b2ca771de407d6eec347fdeba4a08ef5 Mon Sep 17 00:00:00 2001 From: Nabil Freij Date: Tue, 15 Sep 2026 21:34:26 -0700 Subject: [PATCH 4/4] Apply suggestion from @nabobalis --- .github/dependabot.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b1e45fe..5333ddf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,8 +2,7 @@ version: 2 updates: - package-ecosystem: "github-actions" directory: "/" - # extremelywip is the active development branch; main lags behind it. - target-branch: "extremelywip" + target-branch: "main" schedule: interval: "weekly" # one PR for all action bumps instead of one per action