Merge remote-tracking branch 'upstream/2.5' into numDeckSteamline

Author: daschuer

.github/labeler.yml

@@ -128,6 +128,11 @@ soundsource:
       - any-glob-to-any-file:
           - src/sources/soundsource*
 
+sync-branches:
+  - all:
+      - base-branch: ['\d+\.\d+']
+      - head-branch: ["main", '\d+\.\d+']
+
 ui:
   - changed-files:
       - any-glob-to-any-file:

.github/workflows/build.yml

@@ -3,8 +3,32 @@
 name: Build
 
 on:
-  push:
-  pull_request:
+  workflow_call:
+    inputs:
+      publish:
+        type: boolean
+        default: false
+    secrets:
+      AZURE_CLIENT_ID:
+        required: false
+      AZURE_CLIENT_SECRET:
+        required: false
+      AZURE_TENANT_ID:
+        required: false
+      DOWNLOADS_HOSTGATOR_DOT_MIXXX_DOT_ORG_KEY:
+        required: false
+      DOWNLOADS_HOSTGATOR_DOT_MIXXX_DOT_ORG_KEY_PASSWORD:
+        required: false
+      MACOS_CODESIGN_CERTIFICATE_P12_BASE64:
+        required: false
+      MACOS_CODESIGN_CERTIFICATE_PASSWORD:
+        required: false
+      MACOS_NOTARIZATION_APP_SPECIFIC_PASSWORD:
+        required: false
+      NETLIFY_BUILD_HOOK:
+        required: false
+      RRYAN_AT_MIXXX_DOT_ORG_GPG_PRIVATE_KEY:
+        required: false
 
 permissions:
   contents: read #  to fetch code (actions/checkout)
@@ -49,7 +73,6 @@ jobs:
               -DQT6=ON
               -DWAVPACK=ON
               -DVCPKG_TARGET_TRIPLET=x64-osx-min1100-release
-              -DVCPKG_DEFAULT_HOST_TRIPLET=x64-osx-min1100-release
             # TODO: Fix this broken test on macOS
             ctest_args: --exclude-regex DirectoryDAOTest.relocateDirectory
             cpack_generator: DragNDrop
@@ -73,7 +96,6 @@ jobs:
               -DQT6=ON
               -DWAVPACK=ON
               -DVCPKG_TARGET_TRIPLET=arm64-osx-min1100-release
-              -DVCPKG_DEFAULT_HOST_TRIPLET=x64-osx-min1100-release
             # TODO: Fix this broken test on macOS
             crosscompile: true
             cpack_generator: DragNDrop
@@ -86,8 +108,8 @@ jobs:
             artifacts_path: build/*.dmg
             artifacts_slug: macos-macosarm
             qt_qpa_platform: offscreen
-          - name: Windows 2019 (MSVC)
-            os: windows-2019
+          - name: Windows 2022 (MSVC)
+            os: windows-2022
             # TODO: Re-enable FFmpeg after licensing issues have been clarified
             # Attention: If you change the cmake_args for the Windows CI build,
             #            also adjust the for the local Windows build setup in
@@ -103,7 +125,6 @@ jobs:
               -DQT6=ON
               -DWAVPACK=ON
               -DVCPKG_TARGET_TRIPLET=x64-windows-release
-              -DVCPKG_DEFAULT_HOST_TRIPLET=x64-windows-release
             cc: cl
             cxx: cl
             # TODO: Fix these broken tests on Windows
@@ -130,7 +151,7 @@ jobs:
       artifact-windows-win64: ${{ steps.prepare_deploy.outputs.artifact-windows-win64 }}
     steps:
       - name: "Check out repository"
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v5
         with:
           # This is necessary for making `git describe` work.
           fetch-depth: 0
@@ -172,7 +193,7 @@ jobs:
       - name: "[macOS] install ccache and make"
         if: runner.os == 'macOS'
         run: |
-          brew install ccache ninja
+          brew install ccache
 
       - name: "[macOS/Windows] Get build environment name"
         if: runner.os != 'Linux'
@@ -281,7 +302,6 @@ jobs:
         env:
           CC: ${{ matrix.cc }}
           CXX: ${{ matrix.cxx }}
-          CMAKE_BUILD_PARALLEL_LEVEL: 2
           # GitHub Actions automatically zstd compresses caches
           CCACHE_NOCOMPRESS: true
 
@@ -315,7 +335,8 @@ jobs:
         env:
           AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
         if: runner.os == 'Windows' && env.AZURE_TENANT_ID
-        uses: azure/trusted-signing-action@v0.5.0
+        # Pinned to commit, to fix a caching issue https://github.com/Azure/trusted-signing-action/issues/62
+        uses: azure/trusted-signing-action@0d74250c661747df006298d0fb49944c10f16e03
         with:
           azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
@@ -356,7 +377,7 @@ jobs:
         run: |
           if [[ "${{ github.ref }}" == "refs/heads/main" ]] && [[ "${{ github.repository }}" == "mixxxdj/mixxx" ]]; then
             CPACK_ARGS="-D DEB_UPLOAD_PPA=ppa:mixxx/nightlies"
-          elif [[ "${{ github.ref }}" == "refs/heads/2.5" ]] && [[ "${{ github.repository }}" == "mixxxdj/mixxx" ]]; then
+          elif [[ "${{ github.ref }}" == "refs/heads/2.6" ]] && [[ "${{ github.repository }}" == "mixxxdj/mixxx" ]]; then
             CPACK_ARGS="-D DEB_UPLOAD_PPA=ppa:mixxx/mixxxbetas"
           elif [[ "${{ github.ref }}" =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+$ ]] && [[ "${{ github.repository }}" == "mixxxdj/mixxx" ]]; then
             CPACK_ARGS="-D DEB_UPLOAD_PPA=ppa:mixxx/mixxx"
@@ -379,7 +400,8 @@ jobs:
         env:
           AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
         if: runner.os == 'Windows' && env.AZURE_TENANT_ID
-        uses: azure/trusted-signing-action@v0.5.0
+        # Pinned to commit, to fix a caching issue https://github.com/Azure/trusted-signing-action/issues/62
+        uses: azure/trusted-signing-action@0d74250c661747df006298d0fb49944c10f16e03
         with:
           azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
@@ -399,7 +421,7 @@ jobs:
         # also generates metadata for file artifact and write it to the job
         # output using the artifacts_slug value.
         id: prepare_deploy
-        if: github.event_name == 'push' && matrix.artifacts_path != null
+        if: inputs.publish && matrix.artifacts_path != null
         shell: bash
         run: >
           if [[ "${GITHUB_REF}" =~ ^refs/tags/.* ]];
@@ -420,7 +442,7 @@ jobs:
       - name: "[Windows] Install rsync and openssh"
         env:
           SSH_PRIVATE_KEY: ${{ secrets.DOWNLOADS_HOSTGATOR_DOT_MIXXX_DOT_ORG_KEY }}
-        if: runner.os == 'Windows' && github.event_name == 'push' && env.SSH_PRIVATE_KEY != null
+        if: runner.os == 'Windows' && inputs.publish && env.SSH_PRIVATE_KEY != null
         run: |
           $Env:PATH="c:\msys64\usr\bin;$Env:PATH"
           pacman -S --noconfirm coreutils bash rsync openssh
@@ -449,7 +471,7 @@ jobs:
           Add-Content -Path "$Env:GITHUB_ENV" -Value "PATH=$Env:PATH"
 
       - name: "Set up SSH Agent"
-        if: github.event_name == 'push' && env.SSH_PRIVATE_KEY != null
+        if: inputs.publish && env.SSH_PRIVATE_KEY != null
         shell: bash
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
@@ -464,7 +486,7 @@ jobs:
 
       - name: "[macOS/Windows] Upload build to downloads.mixxx.org"
         # skip deploying Ubuntu builds to downloads.mixxx.org because these are deployed to the PPA
-        if: runner.os != 'Linux' && github.event_name == 'push' && env.SSH_AUTH_SOCK != null
+        if: runner.os != 'Linux' && inputs.publish && env.SSH_AUTH_SOCK != null
         shell: bash --login -eo pipefail "{0}"
         run: rsync --verbose --recursive --checksum --times --delay-updates "deploy/" "${SSH_USER}@${SSH_HOST}:${DESTDIR}/"
         env:
@@ -481,7 +503,7 @@ jobs:
 
       - name: "Upload GitHub Actions artifacts"
         if: matrix.artifacts_path != null
-        uses: actions/upload-artifact@v4.3.4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: ${{ matrix.artifacts_name }}
           path: ${{ matrix.artifacts_path }}
@@ -497,7 +519,7 @@ jobs:
     if: always() && github.repository == 'mixxxdj/mixxx'
     steps:
       - name: "Check out repository"
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -510,7 +532,7 @@ jobs:
       - name: "Collect Artifacts Metadata & Write Manifest"
         # Retrieve the metadata from the matrix job's outputs, merge them into a
         # single JSON document and then deploy to the server.
-        if: github.event_name == 'push' && env.SSH_PASSWORD != null
+        if: inputs.publish && env.SSH_PASSWORD != null
         run: >
           if [[ "${GITHUB_REF}" =~ ^refs/tags/.* ]];
           then
@@ -528,7 +550,7 @@ jobs:
           SSH_PASSWORD: ${{ secrets.DOWNLOADS_HOSTGATOR_DOT_MIXXX_DOT_ORG_KEY_PASSWORD }}
 
       - name: "Set up SSH Agent"
-        if: github.event_name == 'push' && env.SSH_PRIVATE_KEY != null  && env.MANIFEST_DIRTY != null && env.MANIFEST_DIRTY != '0'
+        if: inputs.publish && env.SSH_PRIVATE_KEY != null  && env.MANIFEST_DIRTY != null && env.MANIFEST_DIRTY != '0'
         shell: bash
         env:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
@@ -542,7 +564,7 @@ jobs:
           echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "${GITHUB_ENV}"
 
       - name: "Deploy Manifest"
-        if: github.event_name == 'push' && env.SSH_AUTH_SOCK != null
+        if: inputs.publish && env.SSH_AUTH_SOCK != null
         shell: bash
         run: rsync --verbose --recursive --checksum --times --delay-updates "deploy/" "${SSH_USER}@${SSH_HOST}:${DESTDIR}/"
         env:

.github/workflows/changelog.yml

@@ -3,12 +3,7 @@
 name: Changelog
 
 on:
-  push:
-    branches:
-      - "main"
-      - "[0-9].[0-9]"
-    paths:
-      - "CHANGELOG.md"
+  workflow_call:
 
 permissions: {}
 jobs:

.github/workflows/build-checks.yml .github/workflows/checks.yml.github/workflows/build-checks.yml renamed to .github/workflows/checks.yml

@@ -3,8 +3,7 @@
 name: build-checks
 
 on:
-  push:
-  pull_request:
+  workflow_call:
 
 permissions:
   contents: read #  to fetch code (actions/checkout)
@@ -25,7 +24,7 @@ jobs:
     name: ${{ matrix.name }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v5
       - name: Install build dependencies
         run: tools/debian_buildenv.sh setup
       - name: Create build directory
@@ -156,7 +155,7 @@ jobs:
       - name: "Upload Coverage Report to coveralls.io"
         if: matrix.name == 'coverage'
         continue-on-error: true
-        uses: coverallsapp/github-action@v2.3.4
+        uses: coverallsapp/github-action@v2.3.6
         with:
           flag-name: ubuntu-22.04
           path-to-lcov: build/lcov.info

.github/workflows/develop.yml

@@ -0,0 +1,88 @@
+name: Pull request or branch build
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+  push:
+    branches:
+      - "*"
+      - "!main"
+      - "![0-9].[0-9]"
+  workflow_dispatch:
+
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+  checks: write #  to create new checks (coverallsapp/github-action)
+
+jobs:
+  stop-build:
+    name: Check if build should be stopped
+    runs-on: ubuntu-latest
+    outputs:
+      result: ${{ github.event_name == 'push' && steps.stop-build.outputs.result || 'false' }}
+    steps:
+      - name: Check if there is an open PR for this branch
+        id: stop-build
+        if: ${{ github.event_name == 'push' }}
+        uses: actions/github-script@v7
+        env:
+          ORGANIZATION: mixxxdj
+          REPOSITORY: mixxx
+        with:
+          script: |
+            try {
+              const branch = context.ref.replace('refs/heads/', '');
+              const { data: pullRequests } = await github.rest.pulls.list({
+                owner: process.env.ORGANIZATION,
+                repo: process.env.REPOSITORY,
+                head: `${context.repo.owner}:${branch}`,
+                state: 'open'
+              });
+              console.log(`There is ${pullRequests.length} PR open upstream for branch '${context.repo.owner}:${branch}'`);
+              return pullRequests.length != 0;
+            } catch (error) {
+              console.log(`Didn't find a PR for branch '${context.repo.owner}:${branch}' on '${process.env.ORGANIZATION}/${process.env.REPOSITORY}'.`);
+              return false;
+            }
+
+  pre-commit:
+    if: needs.stop-build.outputs.result == 'false'
+    needs:
+      - stop-build
+    uses: ./.github/workflows/pre-commit.yml
+    with:
+      pull_request: ${{ github.event_name == 'pull_request' }}
+
+  checks:
+    if: needs.stop-build.outputs.result == 'false'
+    needs:
+      - stop-build
+    uses: ./.github/workflows/checks.yml
+
+  git:
+    if: github.event_name == 'pull_request'
+    uses: ./.github/workflows/git.yml
+
+  build:
+    if: needs.stop-build.outputs.result == 'false'
+    needs:
+      - stop-build
+    uses: ./.github/workflows/build.yml
+
+  # This task is used as a probe for auto merge
+  # In the future, it could also be used to perform a status update (e.g once the whole CI is passing + is ready for review, add a specific label such as `need review`)
+  ready:
+    name: Ready to merge
+    needs:
+      - pre-commit
+      - checks
+      - git
+      - build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Ready to go
+        run: "exit 0"

.github/workflows/git.yaml .github/workflows/git.yml.github/workflows/git.yaml renamed to .github/workflows/git.yml

@@ -1,12 +1,13 @@
 name: Git Checks
 
-on: [pull_request]
+on:
+  workflow_call:
 
 jobs:
   block-fixup:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v5
       - name: Block Fixup Commit Merge
         uses: 13rac1/block-fixup-merge-action@v2.0.0