Merge current upstream and make E2E cleanup ownership-safe

.github/workflows/codecov.yml

@@ -22,7 +22,7 @@ jobs:
           mkdir -p ~/.ssh/
           echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
           sudo apt-get update
-          sudo DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y apt-get install -y curl zip unzip tar libssl-dev libcurl4-openssl-dev libunwind-dev git cmake ninja-build gdb protobuf-compiler libsodium-dev libgflags-dev libprotobuf-dev libutempter-dev g++ lcov libtool libtool-bin autoconf
+          sudo DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y apt-get install -y curl zip unzip tar libssl-dev libcurl4-openssl-dev libunwind-dev git cmake ninja-build gdb protobuf-compiler libsodium-dev libgflags-dev libprotobuf-dev libutempter-dev g++ lcov libtool libtool-bin autoconf autoconf-archive automake
 
           echo -e "Host localhost 127.0.0.1\n  Port 2222\n\n" >> ~/.ssh/config
 
@@ -59,10 +59,14 @@ jobs:
 
       - name: Build
         run: |
+          parallel_level="${CI_PARALLEL_LEVEL:-2}"
+          if [[ -n "${ACT:-}" ]]; then
+            parallel_level="${CI_PARALLEL_LEVEL:-14}"
+          fi
           mkdir -p build
           pushd build
           cmake -DDISABLE_TELEMETRY=ON -DCODE_COVERAGE=ON ../
-          make -j`nproc`
+          make -j"${parallel_level}"
           popd
 
       - name: Build Test with code coverage

.github/workflows/deploy_debian_repo.yml

@@ -262,6 +262,9 @@ jobs:
             local qemu_target=""
 
             case "${arch}" in
+              amd64)
+                qemu_target="x86_64"
+                ;;
               arm64)
                 qemu_target="aarch64"
                 ;;
@@ -294,13 +297,11 @@ jobs:
               --output /tmp/qemu-binfmt-conf.sh
             chmod +x /tmp/qemu-binfmt-conf.sh
 
-            if ! /tmp/qemu-binfmt-conf.sh --path /usr/bin --suffix -static --persistent "${qemu_target}"; then
-              /tmp/qemu-binfmt-conf.sh \
-                --qemu-path /usr/bin \
-                --qemu-suffix -static \
-                --persistent yes \
-                "${qemu_target}"
-            fi
+            /tmp/qemu-binfmt-conf.sh \
+              --qemu-path /usr/bin \
+              --qemu-suffix=-static \
+              --persistent yes \
+              "${qemu_target}"
           }
 
           for distro in "${debian_suites[@]}"; do
@@ -426,7 +427,22 @@ jobs:
           install -d -m 700 "${HOME}/.ssh"
           printf '%s\n' "${DEBIAN_REPO_SSH_PRIVATE_KEY}" > "${HOME}/.ssh/id_ed25519"
           chmod 600 "${HOME}/.ssh/id_ed25519"
-          ssh-keyscan github.com >> "${HOME}/.ssh/known_hosts"
+          ssh-keyscan -t rsa,ecdsa,ed25519 github.com > "${HOME}/.ssh/known_hosts"
+          if [[ ! -s "${HOME}/.ssh/known_hosts" ]]; then
+            echo "Failed to populate SSH known_hosts for github.com" >&2
+            exit 1
+          fi
+          chmod 600 "${HOME}/.ssh/known_hosts"
+          cat > "${HOME}/.ssh/config" <<EOF
+          Host github.com
+            HostName github.com
+            IdentityFile ${HOME}/.ssh/id_ed25519
+            UserKnownHostsFile ${HOME}/.ssh/known_hosts
+            StrictHostKeyChecking yes
+          EOF
+          chmod 600 "${HOME}/.ssh/config"
+
+          echo "GIT_SSH_COMMAND=ssh -F ${HOME}/.ssh/config" >> "${GITHUB_ENV}"
 
           git config --global user.name "Jason Gauci"
           git config --global user.email "jgmath2000@gmail.com"

.github/workflows/deploy_windows_winget.yml

@@ -0,0 +1,157 @@
+name: Deploy Windows Release Asset
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Release tag to package. Leave blank to use the latest GitHub release."
+        required: false
+        default: ""
+      overwrite_asset:
+        description: "Overwrite an existing release asset with the same name."
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  deploy_windows:
+    name: deploy-windows-release-asset
+    runs-on: windows-latest
+    env:
+      CMAKE_BUILD_DIR: ${{ github.workspace }}/build
+      VCPKG_ROOT: ${{ github.workspace }}/external/vcpkg
+      INPUT_RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }}
+      OVERWRITE_ASSET: ${{ inputs.overwrite_asset || false }}
+    steps:
+      - name: Resolve release
+        id: resolve_release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [[ -n "${INPUT_RELEASE_TAG}" ]]; then
+            release_tag="${INPUT_RELEASE_TAG}"
+            if ! gh release view "${release_tag}" --repo "${GITHUB_REPOSITORY}" >/dev/null; then
+              echo "Release ${release_tag} does not exist in ${GITHUB_REPOSITORY}" >&2
+              exit 1
+            fi
+          else
+            release_tag="$(gh release view --repo "${GITHUB_REPOSITORY}" --json tagName --jq .tagName)"
+          fi
+
+          if [[ -z "${release_tag}" || "${release_tag}" == "null" ]]; then
+            echo "Could not resolve a release tag" >&2
+            exit 1
+          fi
+
+          version="${release_tag#et-v}"
+          if [[ "${version}" == "${release_tag}" ]]; then
+            echo "Expected release tag to start with et-v, got ${release_tag}" >&2
+            exit 1
+          fi
+
+          asset_name="EternalTerminal-${version}-windows-x64.zip"
+          {
+            echo "RELEASE_TAG=${release_tag}"
+            echo "RELEASE_VERSION=${version}"
+            echo "ASSET_NAME=${asset_name}"
+            echo "PACKAGE_DIR=${RUNNER_TEMP}/EternalTerminal-${version}-windows-x64"
+            echo "PACKAGE_PATH=${RUNNER_TEMP}/${asset_name}"
+          } >> "${GITHUB_ENV}"
+          echo "release_tag=${release_tag}" >> "${GITHUB_OUTPUT}"
+
+      - name: Check release asset
+        id: check_release_asset
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          existing_asset="$(
+            gh release view "${RELEASE_TAG}" \
+              --repo "${GITHUB_REPOSITORY}" \
+              --json assets \
+              --jq ".assets[].name" |
+              grep -Fx "${ASSET_NAME}" || true
+          )"
+
+          if [[ -n "${existing_asset}" && "${OVERWRITE_ASSET}" != "true" ]]; then
+            echo "Release asset ${ASSET_NAME} already exists and overwrite_asset is false; skipping Windows build."
+            echo "should_build=false" >> "${GITHUB_OUTPUT}"
+          else
+            echo "Release asset ${ASSET_NAME} will be built and uploaded."
+            echo "should_build=true" >> "${GITHUB_OUTPUT}"
+          fi
+
+      - uses: actions/checkout@v4
+        if: ${{ steps.check_release_asset.outputs.should_build == 'true' }}
+        with:
+          ref: ${{ steps.resolve_release.outputs.release_tag }}
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Install Dependencies (Windows)
+        if: ${{ steps.check_release_asset.outputs.should_build == 'true' }}
+        run: choco install -y ninja
+
+      # Restore both vcpkg and its artifacts from the GitHub cache service.
+      - name: Restore vcpkg and its artifacts.
+        if: ${{ steps.check_release_asset.outputs.should_build == 'true' }}
+        uses: actions/cache@v5
+        with:
+          path: |
+            ${{ env.VCPKG_ROOT }}
+            !${{ env.VCPKG_ROOT }}/buildtrees
+            !${{ env.VCPKG_ROOT }}/packages
+            !${{ env.VCPKG_ROOT }}/downloads
+          # The key is composed in a way that it gets properly invalidated: this must happen whenever vcpkg's Git commit id changes, or the list of packages changes. In this case a cache miss must happen and a new entry with a new key with be pushed to GitHub the cache service.
+          # The key includes: hash of the vcpkg.json file, the hash of the vcpkg Git commit id, and the used vcpkg's triplet. The vcpkg's commit id would suffice, but computing an hash out it does not harm.
+          # Note: given a key, the cache content is immutable. If a cache entry has been created improperly, in order the recreate the right content the key must be changed as well, and it must be brand new (i.e. not existing already).
+          key: |
+            et-vcpkg-${{ hashFiles( 'vcpkg.json' ) }}-${{ hashFiles( '.git/modules/external/vcpkg/HEAD' )}}-windows-latest-11-release-1
+
+      - name: Show content of workspace after cache has been restored
+        if: ${{ steps.check_release_asset.outputs.should_build == 'true' }}
+        run: find $RUNNER_WORKSPACE
+        shell: bash
+
+      # On Windows runners, let's ensure to have the Developer Command Prompt environment setup correctly. As used here the Developer Command Prompt created is targeting x64 and using the default the Windows SDK.
+      - uses: ilammy/msvc-dev-cmd@v1
+        if: ${{ steps.check_release_asset.outputs.should_build == 'true' }}
+
+      # Run CMake to generate Ninja project files, using the vcpkg's toolchain file to resolve and install the dependencies as specified in vcpkg.json.
+      - name: Install dependencies and generate project files (windows)
+        if: ${{ steps.check_release_asset.outputs.should_build == 'true' }}
+        run: |
+          cmake -DDISABLE_TELEMETRY=ON -S "${{ github.workspace }}" -B "${{ env.CMAKE_BUILD_DIR }}" -GNinja -DCMAKE_BUILD_TYPE=RelWithDebInfo
+
+      # Build the whole project with Ninja (which is spawn by CMake).
+      - name: Build
+        if: ${{ steps.check_release_asset.outputs.should_build == 'true' }}
+        run: |
+          cmake --build "${{ env.CMAKE_BUILD_DIR }}"
+          ctest --parallel
+
+      - name: Package
+        if: ${{ steps.check_release_asset.outputs.should_build == 'true' }}
+        run: |
+          mkdir -p "${PACKAGE_DIR}"
+          cp "${CMAKE_BUILD_DIR}/et.exe" "${PACKAGE_DIR}/et.exe"
+          cp "${GITHUB_WORKSPACE}/LICENSE" "${PACKAGE_DIR}/LICENSE"
+          pushd "${PACKAGE_DIR}"
+          7z a -tzip "${PACKAGE_PATH}" .
+          popd
+
+      - name: Upload release asset
+        if: ${{ steps.check_release_asset.outputs.should_build == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          upload_args=("${RELEASE_TAG}" "${PACKAGE_PATH}" --repo "${GITHUB_REPOSITORY}")
+          gh release upload "${upload_args[@]}"

.github/workflows/linux_ci.yml

@@ -27,7 +27,7 @@ jobs:
           mkdir -p ~/.ssh/
           echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
           sudo apt-get -o Acquire::ForceIPv4=true update
-          sudo DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y apt-get -o Acquire::ForceIPv4=true install -y curl zip unzip tar libssl-dev libcurl4-openssl-dev libunwind-dev git cmake ninja-build gdb protobuf-compiler libsodium-dev libgflags-dev libprotobuf-dev libutempter-dev g++ libtool libtool-bin autoconf
+          sudo DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y apt-get -o Acquire::ForceIPv4=true install -y curl zip unzip tar libssl-dev libcurl4-openssl-dev libunwind-dev git cmake ninja-build gdb protobuf-compiler libsodium-dev libgflags-dev libprotobuf-dev libutempter-dev g++ libtool libtool-bin autoconf autoconf-archive automake
 
           echo -e "Host localhost 127.0.0.1 ::1\n  Port ${SSH_PORT}\n\n" >> ~/.ssh/config
 
@@ -64,41 +64,57 @@ jobs:
 
       - name: Build with ubsan
         run: |
+          parallel_level="${CI_PARALLEL_LEVEL:-2}"
+          if [[ -n "${ACT:-}" ]]; then
+            parallel_level="${CI_PARALLEL_LEVEL:-14}"
+          fi
           mkdir -p build
           pushd build
           cmake -DDISABLE_TELEMETRY=ON -DSANITIZE_UNDEFINED=ON ../
-          make -j`nproc`
-          TSAN_OPTIONS="suppressions=../test/test_tsan.suppression" ctest --parallel
+          make -j"${parallel_level}"
+          TSAN_OPTIONS="suppressions=../test/test_tsan.suppression" ctest --parallel "${parallel_level}" --output-on-failure
           popd
         if: matrix.sanitize == 'ubsan'
 
       - name: Build with asan
         run: |
+          parallel_level="${CI_PARALLEL_LEVEL:-2}"
+          if [[ -n "${ACT:-}" ]]; then
+            parallel_level="${CI_PARALLEL_LEVEL:-14}"
+          fi
           mkdir -p build
           pushd build
           cmake -DDISABLE_TELEMETRY=ON -DSANITIZE_ADDRESS=ON ../
-          make -j`nproc`
-          TSAN_OPTIONS="suppressions=../test/test_tsan.suppression" ctest --parallel
+          make -j"${parallel_level}"
+          TSAN_OPTIONS="suppressions=../test/test_tsan.suppression" ctest --parallel "${parallel_level}" --output-on-failure
           popd
         if: matrix.sanitize == 'asan'
 
       - name: Build with msan
         run: |
+          parallel_level="${CI_PARALLEL_LEVEL:-2}"
+          if [[ -n "${ACT:-}" ]]; then
+            parallel_level="${CI_PARALLEL_LEVEL:-14}"
+          fi
           mkdir -p build
           pushd build
           cmake -DDISABLE_TELEMETRY=ON -DSANITIZE_MEMORY=ON ../
-          make -j`nproc`
-          TSAN_OPTIONS="suppressions=../test/test_tsan.suppression" ctest --parallel
+          make -j"${parallel_level}"
+          TSAN_OPTIONS="suppressions=../test/test_tsan.suppression" ctest --parallel "${parallel_level}" --output-on-failure
           popd
         if: matrix.sanitize == 'msan'
 
       - name: Build with tsan
         run: |
+          parallel_level="${CI_PARALLEL_LEVEL:-2}"
+          if [[ -n "${ACT:-}" ]]; then
+            parallel_level="${CI_PARALLEL_LEVEL:-14}"
+          fi
           mkdir -p build
           pushd build
           cmake -DDISABLE_TELEMETRY=ON -DSANITIZE_THREAD=ON -DSANITIZE_LINK_STATIC=ON ../
-          make -j`nproc`
-          TSAN_OPTIONS="suppressions=../test/test_tsan.suppression" ctest --parallel
+          make -j"${parallel_level}"
+          TSAN_OPTIONS="suppressions=../test/test_tsan.suppression" ctest --parallel "${parallel_level}" --output-on-failure
           popd
         if: matrix.sanitize == 'tsan'
 
@@ -123,7 +139,7 @@ jobs:
           mkdir -p ~/.ssh/
           echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
           sudo apt-get -o Acquire::ForceIPv4=true update
-          sudo DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y apt-get -o Acquire::ForceIPv4=true install -y curl zip unzip tar libssl-dev libcurl4-openssl-dev libunwind-dev git cmake ninja-build gdb protobuf-compiler libsodium-dev libgflags-dev libprotobuf-dev libutempter-dev g++ libtool libtool-bin autoconf
+          sudo DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y apt-get -o Acquire::ForceIPv4=true install -y curl zip unzip tar libssl-dev libcurl4-openssl-dev libunwind-dev git cmake ninja-build gdb protobuf-compiler libsodium-dev libgflags-dev libprotobuf-dev libutempter-dev g++ libtool libtool-bin autoconf autoconf-archive automake
 
           echo -e "Host localhost 127.0.0.1 ::1\n  Port ${SSH_PORT}\n\n" >> ~/.ssh/config
 
@@ -153,10 +169,14 @@ jobs:
 
       - name: Build for jumphost system test
         run: |
+          parallel_level="${CI_PARALLEL_LEVEL:-2}"
+          if [[ -n "${ACT:-}" ]]; then
+            parallel_level="${CI_PARALLEL_LEVEL:-14}"
+          fi
           mkdir -p build
           pushd build
           cmake -DDISABLE_TELEMETRY=ON -DSANITIZE_UNDEFINED=ON ../
-          cmake --build . --target et etserver etterminal --parallel `nproc`
+          cmake --build . --target et etserver etterminal --parallel "${parallel_level}"
           popd
 
       - name: Connect with jumphost
@@ -183,7 +203,7 @@ jobs:
           mkdir -p ~/.ssh/
           echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
           sudo apt-get -o Acquire::ForceIPv4=true update
-          sudo DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y apt-get -o Acquire::ForceIPv4=true install -y curl zip unzip tar libssl-dev libcurl4-openssl-dev libunwind-dev git cmake ninja-build gdb protobuf-compiler libsodium-dev libgflags-dev libprotobuf-dev libutempter-dev g++ libtool libtool-bin autoconf
+          sudo DEBIAN_FRONTEND=noninteractive ACCEPT_EULA=Y apt-get -o Acquire::ForceIPv4=true install -y curl zip unzip tar libssl-dev libcurl4-openssl-dev libunwind-dev git cmake ninja-build gdb protobuf-compiler libsodium-dev libgflags-dev libprotobuf-dev libutempter-dev g++ libtool libtool-bin autoconf autoconf-archive automake
 
           echo -e "Host localhost 127.0.0.1 ::1\n  Port ${SSH_PORT}\n\n" >> ~/.ssh/config
 
@@ -213,10 +233,14 @@ jobs:
 
       - name: Build for backwards compatibility system test
         run: |
+          parallel_level="${CI_PARALLEL_LEVEL:-2}"
+          if [[ -n "${ACT:-}" ]]; then
+            parallel_level="${CI_PARALLEL_LEVEL:-14}"
+          fi
           mkdir -p build
           pushd build
           cmake -DDISABLE_TELEMETRY=ON -DSANITIZE_UNDEFINED=ON ../
-          cmake --build . --target et etserver etterminal --parallel `nproc`
+          cmake --build . --target et etserver etterminal --parallel "${parallel_level}"
           popd
 
       - name: Backwards compatibility with et-v7.0.0