CI v2: gridcraft PR 2227 @ f8cd0c3

.github/review-ci-v2.json

@@ -0,0 +1,15 @@
+{
+  "base": "67e39faeea1fa4b603cbab421a30737db2cef8d9",
+  "head": "f8cd0c3ae5162e31cf5686b4503ac89e48131240",
+  "platforms": [],
+  "policy": "review-ci-v2.2-no-sonar",
+  "pr": 2227,
+  "repository": "storytold/gridcraft",
+  "source_tree": "85e27ebf7fc5103018f0f893104fdd30acb1cfd4",
+  "workflows": {
+    ".github/workflows/ci.yml": "e426f5a572a5f14b354d2286c064b83c6fc53e372ba148674a2afab459f674ca",
+    ".github/workflows/freebsd.yml": "18759b8b8805db623545c1144b537b45ce1d9fa1a82f46e315a2e98052b55247",
+    ".github/workflows/nix.yml": "472141d86ba737061146d78206c3516e4762e453dad638e42850d45e79709192",
+    ".github/workflows/packaging-lint.yml": "733a955cf8c8e13f3b7fc3ca387b30052eb07bed8630de9a9d488ea60f6dffd6"
+  }
+}

.github/workflows/ci.yml

@@ -1,28 +1,20 @@
-name: CI
-
-# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
-# suite's shared gate workflow in craft-common-actions.
-on:
-  push:
-    branches: [main]
-  pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-# A newer push to a PR branch cancels its older run; every push to main runs to the end.
-concurrency:
-  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  gate:
-    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
-    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
-    with:
-      # The same craft-fonts commit as release.yml and freebsd.yml, so the gate tests the fonts that ship.
-      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
-      packages: >-
-        pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev
-        libgtk-3-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
+name: CI
+'on':
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - labeled
+  workflow_dispatch: null
+permissions:
+  contents: read
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  gate:
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@2b3fb9dc05036f73c77d18f753a3aa9da55fa386
+    with:
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+      packages: pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers

.github/workflows/freebsd.yml

@@ -1,32 +1,19 @@
-# Builds and tests the workspace on FreeBSD, inside a FreeBSD VM on a Linux runner
-# (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
-name: FreeBSD
-
-# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every pull
-# request: a drifted dependency still shows up within a day, and always before a release ships.
-# PRs that change the FreeBSD workflow or packaging itself still run it.
-on:
-  push:
-    branches: [release]
-  pull_request:
-    paths:
-      - .github/workflows/freebsd.yml
-      - packaging/freebsd/**
-      - packaging/env.sh
-  schedule:
-    - cron: "57 2 * * *"
-  workflow_dispatch:
-
-concurrency:
-  group: freebsd-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  freebsd:
-    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
-    uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
-    with:
-      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+name: FreeBSD
+'on':
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - labeled
+  workflow_dispatch: null
+concurrency:
+  group: freebsd-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  freebsd:
+    uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@2b3fb9dc05036f73c77d18f753a3aa9da55fa386
+    with:
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83

.github/workflows/nix.yml

@@ -1,23 +1,17 @@
-# Evaluates the Nix flake (no build, about a minute): `nix build` / `nix develop` stop at evaluation
-# when Cargo.lock gains something nix/package.nix can't vendor, and nothing else would notice.
-name: Nix
-
-on:
-  push:
-    branches: [main]
-    paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
-  pull_request:
-    paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: nix-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  nix:
-    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
-    uses: storytold/craft-common-actions/.github/workflows/nix.yml@main
+name: Nix
+'on':
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - labeled
+  workflow_dispatch: null
+permissions:
+  contents: read
+concurrency:
+  group: nix-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  nix:
+    uses: storytold/craft-common-actions/.github/workflows/nix.yml@2b3fb9dc05036f73c77d18f753a3aa9da55fa386

.github/workflows/packaging-lint.yml

@@ -1,47 +1,31 @@
-# Quick release-pipeline checks without a Rust build: workflow and packaging-script syntax,
-# Linux desktop metadata, and the Windows desktop-shortcut installer lifecycle.
-name: Packaging lint
-
-on:
-  push:
-    branches: [main, release]
-    paths: [".github/workflows/**", "packaging/**", "assets/app-icon/**"]
-  pull_request:
-    paths: [".github/workflows/**", "packaging/**", "assets/app-icon/**"]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: packaging-lint-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  lint:
-    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
-    uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
-
-  windows-install-policy:
-    timeout-minutes: 10
-    name: Windows installation policy (no app build)
-    runs-on: windows-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install the pinned packaging toolchain
-        shell: pwsh
-        run: |
-          $tools = Join-Path $env:RUNNER_TEMP 'craft-install-policy-wix'
-          dotnet tool install --tool-path $tools wix --version 5.0.2
-          if ($LASTEXITCODE -ne 0) { throw 'WiX installation failed.' }
-          $tools >> $env:GITHUB_PATH
-          $policy = Get-Content -Raw -LiteralPath packaging/windows/install-policy.json | ConvertFrom-Json
-          foreach ($extension in @($policy.extensions)) {
-            & (Join-Path $tools 'wix.exe') extension add -g "WixToolset.$extension.wixext/5.0.2"
-            if ($LASTEXITCODE -ne 0) { throw "WiX extension $extension installation failed." }
-          }
-      - name: Build and check non-executable installer fixtures
-        shell: pwsh
-        run: ./packaging/windows/test-install-policy.ps1 -OutputDirectory (Join-Path $env:RUNNER_TEMP 'craft-install-policy-tests')
+name: Packaging lint
+'on':
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - labeled
+  workflow_dispatch: null
+permissions:
+  contents: read
+concurrency:
+  group: packaging-lint-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  lint:
+    uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@2b3fb9dc05036f73c77d18f753a3aa9da55fa386
+  windows-install-policy:
+    timeout-minutes: 10
+    name: Windows installation policy (no app build)
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      with:
+        persist-credentials: false
+    - name: Install the pinned packaging toolchain
+      shell: pwsh
+      run: "$tools = Join-Path $env:RUNNER_TEMP 'craft-install-policy-wix'\ndotnet tool install --tool-path $tools wix --version 5.0.2\nif ($LASTEXITCODE -ne 0) { throw 'WiX installation failed.' }\n$tools >> $env:GITHUB_PATH\n$policy = Get-Content -Raw -LiteralPath packaging/windows/install-policy.json | ConvertFrom-Json\nforeach ($extension in @($policy.extensions)) {\n  & (Join-Path $tools 'wix.exe') extension add -g \"WixToolset.$extension.wixext/5.0.2\"\n  if ($LASTEXITCODE -ne 0) { throw \"WiX extension $extension installation failed.\" }\n}\n"
+    - name: Build and check non-executable installer fixtures
+      shell: pwsh
+      run: ./packaging/windows/test-install-policy.ps1 -OutputDirectory (Join-Path $env:RUNNER_TEMP 'craft-install-policy-tests')