chore: Merge CI changes for neqo

Author: Not-Nik

.github/actionlint-matcher.json

@@ -1,33 +1,33 @@
-name: 'CI VM'
-description: 'Run main CI steps in VMs for VM-only platforms.'
+name: "Android checks"
+description: "Run Android build and test steps using the Android SDK/NDK and emulator."
 
 inputs:
   target:
-    description: 'Rust target to build for.'
+    description: "Rust target to build for."
     required: true
   working-directory:
-    description: 'Working directory.'
-    default: '.'
+    description: "Working directory."
+    default: "."
   ndk-version:
-    description: 'NDK version to install.'
+    description: "NDK version to install."
     # https://searchfox.org/mozilla-central/search?q=NDK_VERSION =&path=python/mozboot/mozboot/android.py
-    default: '27.2.12479018'
+    default: "27.2.12479018"
   api-level:
-    description: 'Android API level to use.'
+    description: "Android API level to use."
     # https://searchfox.org/mozilla-central/search?q=\bapi_level=&path=taskcluster/scripts/misc/build-llvm-common.sh&regexp=true
     # However, NSS requires an API >= 23 for a few symbols.
-    default: '23'
+    default: "23"
   minimum-nss-version:
-    description: 'If NSS is required, the minimum version required.'
-    default: ''
+    description: "If NSS is required, the minimum version required."
+    default: ""
   github-token:
-    description: 'A Github PAT'
+    description: "A Github PAT"
     required: true
 
 runs:
   using: composite
   steps:
-    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         distribution: zulu
         java-version: 23
@@ -43,18 +43,19 @@ runs:
         WD: ${{ inputs.working-directory }}
       run: cd "$WD" && sdkmanager --install "ndk;$NDK_VERSION"
 
-    - uses: ./.github/actions/rust
+    - uses: mozilla/actions/rust@b6b1031d2072eb8c2b181887cb5e194ebcc5caab # v1.0.4
       with:
         version: stable
         targets: ${{ inputs.target }}
         tools: cargo-ndk@^4
         token: ${{ inputs.github-token }}
 
-    - uses: ./.github/actions/nss
+    - uses: mozilla/actions/nss@b6b1031d2072eb8c2b181887cb5e194ebcc5caab # v1.0.4
       if: ${{ inputs.minimum-nss-version != '' }}
       with:
         minimum-version: ${{ inputs.minimum-nss-version }}
         target: ${{ inputs.target }}
+        token: ${{ inputs.github-token }}
 
     - shell: bash
       env:
@@ -63,7 +64,11 @@ runs:
         WD: ${{ inputs.working-directory }}
       run: cd "$WD" && cargo ndk --platform "$API_LEVEL" --target "$TARGET" test --no-run
 
+    # FIXME: Enable emulator testing for aarch64 once Google ships Android
+    # emulator binaries for ARM64 Linux hosts.
+    # See https://issuetracker.google.com/issues/242699119
     - shell: bash
+      if: ${{ !startsWith(inputs.target, 'aarch64') }}
       env:
         TARGET: ${{ inputs.target }}
         API_LEVEL: ${{ inputs.api-level }}
@@ -91,7 +96,8 @@ runs:
         EOF
         chmod a+x /tmp/rust-android-run-tests-on-emulator.sh
 
-    - uses: reactivecircus/android-emulator-runner@b530d96654c385303d652368551fb075bc2f0b6b # v2.35.0
+    - uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2.37.0
+      if: ${{ !startsWith(inputs.target, 'aarch64') }}
       with:
         api-level: ${{ inputs.api-level }}
         arch: ${{ startsWith(inputs.target, 'x86_64') && 'x86_64' || (startsWith(inputs.target, 'i686') && 'x86' || (startsWith(inputs.target, 'aarch64') && 'arm64-v8a')) }}

.github/actions/check-android/action.yml

@@ -1,16 +1,16 @@
-name: 'CI VM'
-description: 'Run main CI steps in VMs for VM-only platforms.'
+name: "CI VM"
+description: "Run main CI steps in VMs for VM-only platforms."
 
 inputs:
   working-directory:
-    description: 'Working directory.'
-    default: '.'
+    description: "Working directory."
+    default: "."
   platform:
-    description: 'Platform to run the checks on.'
-    default: ''
+    description: "Platform to run the checks on."
+    default: ""
   codecov-token:
-    description: 'Codecov token, if Codecov upload is desired.'
-    default: ''
+    description: "Codecov token, if Codecov upload is desired."
+    default: ""
 
 runs:
   using: composite
@@ -27,14 +27,14 @@ runs:
           set -ex
           pwd
           case "$PLATFORM" in
-            freebsd)    pkg install -y curl llvm nss pkgconf
+            freebsd)    pkg update -f && pkg install -y curl llvm nss pkgconf
                         ;;
             openbsd)    # TODO: Is there a way to not pin the version of llvm? -z to pkg_add does not work.
                         pkg_add rust rust-clippy rust-rustfmt llvm-21.1.2p0 nss # rustup does not support OpenBSD at all
                         ;;
-            netbsd)     /usr/sbin/pkg_add pkgin && pkgin -y install curl clang nss pkgconf
+            netbsd)     /usr/sbin/pkg_add pkgin && pkgin -y update && pkgin -y install curl clang nss pkgconf
                         ;;
-            solaris)    pkg install clang-libs nss pkg-config
+            solaris)    pkg refresh && pkg install clang-libs nss pkg-config
                         ;;
             *)          echo "Unsupported OS: $PLATFORM"
                         exit 1
@@ -53,30 +53,28 @@ runs:
           cd "$WD"
           pwd
           case "$PLATFORM" in
-            freebsd)    sh rustup.sh --default-toolchain stable --profile minimal --component clippy,llvm-tools,rustfmt -y
-                        . "\$HOME/.cargo/env"
-                        ;;
             openbsd)    export LIBCLANG_PATH=/usr/local/llvm21/lib
                         export LLVM_COV=/usr/local/llvm21/bin/llvm-cov
                         export LLVM_PROFDATA=/usr/local/llvm21/bin/llvm-profdata
-                        [ "$WORKSPACE" ] && EXCLUDE="--exclude fuzz" # Fuzzing not supported on OpenBSD
                         ;;
-            netbsd)     sh rustup.sh --default-toolchain stable --profile minimal --component clippy,llvm-tools,rustfmt -y
+            *)          sh rustup.sh --default-toolchain stable --profile minimal --component clippy,llvm-tools,rustfmt -y
                         . "\$HOME/.cargo/env"
-                        # FIXME: Why do we need to set this on NetBSD?
+                        ;;
+          esac
+          case "$PLATFORM" in
+            netbsd)     # FIXME: Why do we need to set this on NetBSD?
                         export LD_LIBRARY_PATH=/usr/pkg/lib/nss:/usr/pkg/lib/nspr
-                        [ "$WORKSPACE" ] && EXCLUDE="--exclude fuzz" # Fuzzing not supported on NetBSD
                         ;;
-            solaris)    curl --output rust.sh -s https://raw.githubusercontent.com/psumbera/solaris-rust/refs/heads/main/sh.rust-web-install
-                        chmod a+x rust.sh
-                        ls -lt
-                        source ./rust.sh || true # This does not exit with zero on success
-                        export LIBCLANG_PATH="/usr/lib/amd64"
-                        [ "$WORKSPACE" ] && EXCLUDE="--exclude fuzz" # Fuzzing not supported on Solaris
+            solaris)    export LIBCLANG_PATH="/usr/lib/amd64"
+                        ;;
+          esac
+          case "$PLATFORM" in
+            freebsd)    ;;
+            *)          [ "$WORKSPACE" ] && EXCLUDE="--exclude fuzz" # Fuzzing not supported on this platform
                         ;;
           esac
           cargo version
-          cargo check --locked --all-targets $WORKSPACE \$EXCLUDE
+          cargo check --locked --all-targets $WORKSPACE \${EXCLUDE:-}
           case "$PLATFORM" in
             openbsd)    # clippy fails on OpenBSD, because libfuzzer-sys is not supported.
                         ;;
@@ -105,7 +103,7 @@ runs:
         echo "envs=CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG RUST_TEST_TIME_UNIT RUST_TEST_TIME_INTEGRATION RUST_TEST_TIME_DOCTEST WD" >> "$GITHUB_OUTPUT"
 
     - if: ${{ inputs.platform == 'freebsd' }}
-      uses: vmactions/freebsd-vm@ba6bedee4a4884da2b782a41a64329a1c8e42ffb # v1.3.8
+      uses: vmactions/freebsd-vm@4807432c7cab1c3f97688665332c0b932062d31f # v1.4.3
       with:
         usesh: true
         disable-cache: true
@@ -114,7 +112,7 @@ runs:
         run: ${{ steps.prep.outputs.run }}
 
     - if: ${{ inputs.platform == 'openbsd' }}
-      uses: vmactions/openbsd-vm@f5b9bc1261c3d4eed9639fcae0cf5dcc5374ca0c # v1.3.2
+      uses: vmactions/openbsd-vm@3fafb45f2e2e696249c583835939323fe1c3448c # v1.3.7
       with:
         usesh: true
         disable-cache: true
@@ -123,7 +121,7 @@ runs:
         run: ${{ steps.prep.outputs.run }}
 
     - if: ${{ inputs.platform == 'netbsd' }}
-      uses: vmactions/netbsd-vm@37b614756f0b44b02f5dab4fd9ecb27545d1785e # v1.3.2
+      uses: vmactions/netbsd-vm@ca7ff0556959998c82761c34ea0c3c99fa084c48 # v1.3.7
       with:
         usesh: true
         disable-cache: true
@@ -132,7 +130,7 @@ runs:
         run: ${{ steps.prep.outputs.run }}
 
     - if: ${{ inputs.platform == 'solaris' }}
-      uses: vmactions/solaris-vm@37d40b6627e80434541454b42841caa4cc77d0cf # v1.2.7
+      uses: vmactions/solaris-vm@0a231b94365d1911cf62097ef342f6b30d95598f # v1.3.2
       with:
         release: "11.4-gcc"
         usesh: true
@@ -148,7 +146,7 @@ runs:
       run: test -f "$WORKING_DIR/codecov.json" && echo "exists=true" >> "$GITHUB_OUTPUT" || true
 
     - if: ${{ steps.check-coverage.outputs.exists == 'true' }}
-      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
       with:
         files: codecov.json
         working-directory: ${{ inputs.working-directory }}