test: prune redundant cases and reduce fixture cost

.gitattributes

@@ -0,0 +1,2 @@
+packaging/aur-git/PKGBUILD text eol=lf
+packaging/aur-git/legio-launcher text eol=lf

.github/workflows/aur-git.yml

@@ -0,0 +1,98 @@
+name: AUR development package
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - packaging/aur-git/PKGBUILD
+      - packaging/aur-git/legio-launcher
+      - .github/workflows/aur-git.yml
+  pull_request:
+    branches: [main]
+    paths:
+      - packaging/aur-git/PKGBUILD
+      - packaging/aur-git/legio-launcher
+      - .github/workflows/aur-git.yml
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+concurrency:
+  group: aur-git-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  package:
+    name: Build Arch source package
+    runs-on: ubuntu-latest
+    container: archlinux:base-devel
+    steps:
+      - name: Install packaging tools
+        run: |
+          printf '\n[multilib]\nInclude = /etc/pacman.d/mirrorlist\n' >> /etc/pacman.conf
+          pacman -Syu --noconfirm --needed git openssh sudo
+          useradd -m builder
+          printf 'builder ALL=(ALL:ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/builder
+
+      - name: Check out recipe
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Build and generate metadata
+        run: |
+          cp -r packaging/aur-git /tmp/aur-package
+          chown -R builder:builder /tmp/aur-package
+          bash -n /tmp/aur-package/PKGBUILD
+          su builder -c 'cd /tmp/aur-package && makepkg --syncdeps --noconfirm'
+          su builder -c 'cd /tmp/aur-package && makepkg --printsrcinfo > .SRCINFO'
+          mkdir aur-files
+          cp /tmp/aur-package/{PKGBUILD,.SRCINFO,legio-launcher} aur-files/
+
+      - name: Upload validated recipe
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: aur-git-recipe
+          path: aur-files/
+          include-hidden-files: true
+          retention-days: 7
+          if-no-files-found: error
+
+  publish:
+    name: Publish AUR recipe
+    needs: package
+    if: github.event_name == 'workflow_dispatch' || (github.ref == 'refs/heads/main' && github.event_name == 'push')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download validated recipe
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: aur-git-recipe
+          path: aur-files
+
+      - name: Create or update AUR package base
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          AUR_KNOWN_HOSTS: ${{ vars.AUR_KNOWN_HOSTS }}
+        run: |
+          test -n "$AUR_SSH_PRIVATE_KEY" || { echo "Missing AUR_SSH_PRIVATE_KEY"; exit 1; }
+          test -n "$AUR_KNOWN_HOSTS" || { echo "Missing verified AUR_KNOWN_HOSTS"; exit 1; }
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
+          chmod 600 ~/.ssh/aur
+          printf '%s\n' "$AUR_KNOWN_HOSTS" > ~/.ssh/known_hosts
+          chmod 600 ~/.ssh/known_hosts
+          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/aur -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
+          git clone ssh://aur@aur.archlinux.org/legio-launcher-git.git aur-repo
+          cp aur-files/{PKGBUILD,.SRCINFO,legio-launcher} aur-repo/
+          cd aur-repo
+          git config user.name 'Legio release bot'
+          git config user.email 'actions@users.noreply.github.com'
+          git add PKGBUILD .SRCINFO legio-launcher
+          if ! git diff --cached --quiet; then
+            git commit -m "Update development package recipe"
+            git push origin HEAD:master
+          fi

.github/workflows/ci.yml

@@ -1,7 +1,12 @@
 name: CI
 
 on:
-  workflow_call:
+  workflow_dispatch:
+    inputs:
+      test_packages:
+        description: Build downloadable Linux and Windows test packages
+        type: boolean
+        default: false
   pull_request:
     branches:
       - main
@@ -16,9 +21,51 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
+  plan:
+    name: Select checks and release
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.plan.outputs.code }}
+      release: ${{ steps.plan.outputs.release }}
+      version: ${{ steps.plan.outputs.version }}
+      tag: ${{ steps.plan.outputs.tag }}
+      prerelease: ${{ steps.plan.outputs.prerelease }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Select checks
+        id: plan
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: python scripts/ci_plan.py
+
+  docs:
+    name: Documentation
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+        with:
+          node-version: 22
+
+      - name: Check local links and images
+        run: node --test scripts/test_documentation.mjs
+
   frontend:
     name: Frontend
+    needs: plan
+    if: needs.plan.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
@@ -88,6 +135,8 @@ jobs:
 
   rust:
     name: Rust
+    needs: plan
+    if: needs.plan.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
@@ -128,7 +177,9 @@ jobs:
         run: cargo test --manifest-path src-tauri/Cargo.toml --all-features --locked
 
   tauri-smoke:
-    name: Tauri smoke (${{ matrix.name }})
+    name: Native checks (${{ matrix.name }})
+    needs: plan
+    if: needs.plan.outputs.code == 'true'
     runs-on: ${{ matrix.os }}
     env:
       VCPKGRS_TRIPLET: x64-windows-static-md
@@ -237,7 +288,6 @@ jobs:
           cargo test --manifest-path src-tauri/Cargo.toml --locked --lib overlay_update::tests
           cargo test --manifest-path src-tauri/Cargo.toml --locked --lib game_updates::tests
           cargo test --manifest-path src-tauri/Cargo.toml --locked --lib update_policy
-          cargo test --manifest-path src-tauri/Cargo.toml --locked --lib automatically_selects_and_installs_the_executable
 
       - name: Test Windows development data isolation
         if: runner.os == 'Windows'
@@ -290,7 +340,9 @@ jobs:
         shell: bash
         env:
           LEGIO_WINDOWS_TESTS: "1"
-        run: cargo test --manifest-path src-tauri/Cargo.toml --locked --lib steam_local::tests::windows_default_roots
+        run: |
+          cargo test --manifest-path src-tauri/Cargo.toml --locked --lib steam_local::tests::
+          cargo test --manifest-path src-tauri/Cargo.toml --locked --lib steam_import::tests::
 
       - name: Test Windows game process control
         if: runner.os == 'Windows'
@@ -306,46 +358,32 @@ jobs:
           LEGIO_WINDOWS_TESTS: "1"
         run: cargo test --manifest-path src-tauri/Cargo.toml --locked --lib game_lifecycle::tests::native_manager_lifecycle_tracks_a_controlled_process
 
-      - name: Test Windows staged executable finalization
-        if: runner.os == 'Windows'
-        shell: bash
-        env:
-          LEGIO_WINDOWS_TESTS: "1"
-        run: cargo test --manifest-path src-tauri/Cargo.toml --locked --lib finalize_install::tests::finalizes_and_commits_game_and_download
-
-      - name: Test Windows finalization recovery after database reopen
-        if: runner.os == 'Windows'
-        shell: bash
-        env:
-          LEGIO_WINDOWS_TESTS: "1"
-        run: cargo test --manifest-path src-tauri/Cargo.toml --locked --lib finalize_install::tests::recovers_after_database_commit_fails_and_database_reopens
-
       - name: Build Tauri application
-        if: github.event_name != 'pull_request'
+        if: needs.plan.outputs.release != 'true' && !(github.event_name == 'workflow_dispatch' && inputs.test_packages)
         shell: bash
         run: corepack pnpm tauri build --debug --no-bundle
 
       - name: Build Linux test AppImage
-        if: runner.os == 'Linux' && github.event_name == 'pull_request'
+        if: runner.os == 'Linux' && github.event_name == 'workflow_dispatch' && inputs.test_packages
         shell: bash
         run: 'corepack pnpm tauri build --bundles appimage --config ''{"bundle":{"createUpdaterArtifacts":false}}'''
 
       - name: Record Linux AppImage checksums and revision
-        if: runner.os == 'Linux' && github.event_name == 'pull_request'
+        if: runner.os == 'Linux' && github.event_name == 'workflow_dispatch' && inputs.test_packages
         shell: bash
         env:
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          SOURCE_SHA: ${{ github.sha }}
         run: |
           directory="src-tauri/target/release/bundle/appimage"
           (cd "$directory" && sha256sum -- *.AppImage) > "$directory/SHA256SUMS.txt"
-          printf 'Built revision: %s\nPR head: %s\nTest AppImage. Updater signing is disabled; this is not a published release.\n' \
-            "$(git rev-parse HEAD)" "$PR_HEAD_SHA" > "$directory/build-info.txt"
+          printf 'Built revision: %s\nSource revision: %s\nTest AppImage. Updater signing is disabled; this is not a published release.\n' \
+            "$(git rev-parse HEAD)" "$SOURCE_SHA" > "$directory/build-info.txt"
 
       - name: Upload Linux test AppImage
-        if: runner.os == 'Linux' && github.event_name == 'pull_request'
+        if: runner.os == 'Linux' && github.event_name == 'workflow_dispatch' && inputs.test_packages
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: legio-linux-pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
+          name: legio-linux-test-${{ github.run_id }}-${{ github.sha }}
           path: |
             src-tauri/target/release/bundle/appimage/*.AppImage
             src-tauri/target/release/bundle/appimage/SHA256SUMS.txt
@@ -354,17 +392,17 @@ jobs:
           retention-days: 14
 
       - name: Build Windows test installer
-        if: runner.os == 'Windows' && github.event_name == 'pull_request'
+        if: runner.os == 'Windows' && github.event_name == 'workflow_dispatch' && inputs.test_packages
         shell: bash
         env:
           CARGO_PROFILE_RELEASE_DEBUG: "1"
         run: 'corepack pnpm tauri build --bundles nsis --config ''{"bundle":{"createUpdaterArtifacts":false}}'''
 
       - name: Record Windows installer checksums and revision
-        if: runner.os == 'Windows' && github.event_name == 'pull_request'
+        if: runner.os == 'Windows' && github.event_name == 'workflow_dispatch' && inputs.test_packages
         shell: pwsh
         env:
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          SOURCE_SHA: ${{ github.sha }}
         run: |
           $directory = "src-tauri/target/release/bundle/nsis"
           $installers = @(Get-ChildItem "$directory/*.exe")
@@ -375,14 +413,14 @@ jobs:
           } | Set-Content "$directory/SHA256SUMS.txt" -Encoding utf8
           $builtRevision = git rev-parse HEAD
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-          @("Built revision: $builtRevision", "PR head: $env:PR_HEAD_SHA", "Test installer. Updater signing is disabled; this is not a published release.") |
+          @("Built revision: $builtRevision", "Source revision: $env:SOURCE_SHA", "Test installer. Updater signing is disabled; this is not a published release.") |
             Set-Content "$directory/build-info.txt" -Encoding utf8
 
       - name: Upload Windows test installer
-        if: runner.os == 'Windows' && github.event_name == 'pull_request'
+        if: runner.os == 'Windows' && github.event_name == 'workflow_dispatch' && inputs.test_packages
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: legio-windows-pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
+          name: legio-windows-test-${{ github.run_id }}-${{ github.sha }}
           path: |
             src-tauri/target/release/bundle/nsis/*.exe
             src-tauri/target/release/bundle/nsis/SHA256SUMS.txt
@@ -391,10 +429,23 @@ jobs:
           retention-days: 14
 
       - name: Upload matching Windows native symbols
-        if: runner.os == 'Windows' && github.event_name == 'pull_request'
+        if: runner.os == 'Windows' && github.event_name == 'workflow_dispatch' && inputs.test_packages
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: legio-windows-symbols-pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
+          name: legio-windows-symbols-test-${{ github.run_id }}-${{ github.sha }}
           path: src-tauri/target/release/legio.pdb
           if-no-files-found: error
           retention-days: 14
+
+  release:
+    name: Release
+    needs: [plan, docs, frontend, rust, tauri-smoke]
+    if: needs.plan.outputs.release == 'true'
+    permissions:
+      contents: write
+    uses: ./.github/workflows/release.yml
+    with:
+      version: ${{ needs.plan.outputs.version }}
+      tag: ${{ needs.plan.outputs.tag }}
+      prerelease: ${{ needs.plan.outputs.prerelease == 'true' }}
+    secrets: inherit