Update workflows to ubuntu-26.04 - #9
Merged
Merged
Conversation
The clang-format job runs with contents: write and can push directly to main, but handed control to third-party actions referenced by moving tags. DoozyX/clang-format-lint-action in particular is a Docker action that executes prebuilt clang-format binaries committed into its own repository, so a repointed tag there would mean arbitrary code execution alongside a token that can write to this repo. Pin every action to a full commit SHA with the version in a trailing comment, and add a Dependabot github-actions entry so the pins are kept current instead of silently going stale. Also: - Bump actions/checkout to v7.0.1 (was a mix of v4 and v6) and use one version across all six workflows. - Pin lukka/get-cmake@latest to v4.4.1, the commit that tag resolves to today, and lukka/run-cmake@v10 to v10.9. - Declare top-level permissions: contents: read on every workflow, so the default token scope no longer depends on the repository setting. The clang-format job keeps its explicit contents: write override. - Drop the windows-base-preview preset, orphaned when x64-preview was removed.
CMake gates `import std` behind an opt-in UUID that it rotates as the feature evolves, and CMakeLists.txt hardcoded the CMake 4.3 value. Pinning lukka/get-cmake moved CI from CMake 4.3.3 to 4.4.1, whose gate differs, so both Linux module jobs failed to configure: Experimental `import std` support not enabled when detecting toolchain Hardcoding one release's UUID means the project builds under exactly one CMake minor version; 2efaa42 already had to bump it once for 4.3. Replace the constant with a version-keyed table covering 3.31 through 4.4, looked up before project() where the variable has to be set. On a CMake release that isn't in the table, leave the variable unset rather than applying a known-wrong UUID, and have the UT_ENABLE_MODULES branch report what needs updating -- CMake's own diagnostic for a stale gate says only "set to incorrect value", which does not point at the fix. Verified with CMake 4.4.1 (the CI version) and 4.0.1: both configure clean, and the gate error is gone under 4.4.1 with modules enabled. Also gitignore tmp/, used here to hold a local CMake 4.4.1 for testing.
The guard skipping CMAKE_CXX_MODULE_STD for the Visual Studio generators was marked "Support should be added with 4.4, todo: check when available". Checked against CMake 4.4: support was not added, and the note misstates why it is missing. Per cmake-cxxmodules(7) in 4.4, `import std` is Ninja-only because the Visual Studio generators cannot build BMIs for IMPORTED targets, which is how the std module is modeled. That is a structural limitation, not a release that has yet to land, so the guard stays as-is. Record the actual reason and the condition that would justify removing it. No behavior change; comment only.
This was referenced Jul 31, 2026
stephenberry
added a commit
that referenced
this pull request
Jul 31, 2026
The version-keyed table added in #9 picks the right CMAKE_EXPERIMENTAL_CXX_IMPORT_STD value for known CMake releases, but it assigned it with a plain set(). That creates an ordinary variable which shadows the cache entry `-D` produces, so `-DCMAKE_EXPERIMENTAL_CXX_IMPORT_STD=...` was silently discarded for every release listed in the table, leaving no escape hatch when a row is wrong. Skip the assignment when the consumer has put a value in the cache, so the command line wins while the table stays authoritative by default. Guard on the cache entry rather than on DEFINED. Testing DEFINED would also defer to an ordinary variable, so consuming this project via add_subdirectory() or FetchContent from a parent that hardcodes a single UUID -- the pattern the table replaced -- would let the parent's value win on every release and pass its staleness on to us. Assigning to the cache here would also restore the override, but it would pin the UUID in CMakeCache.txt for everyone: upgrading CMake in an existing build tree would keep using the previous release's value and quietly ignore the table, which is the failure the table exists to prevent. Report the gate value actually in effect. The unlisted-release warning previously fired whenever no value was set, so supplying an empty or false one on a listed release claimed CMake was newer than every listed release and asked for a row that already exists; empty and unlisted are now separate messages naming their real cause. A supplied value differing from the table gets a STATUS line, since `-D` is cached and outlives the command line that introduced it, making a stale override otherwise indistinguishable from the table's own choice.
stephenberry
added a commit
that referenced
this pull request
Jul 31, 2026
The version-keyed table added in #9 picks the right CMAKE_EXPERIMENTAL_CXX_IMPORT_STD value for known CMake releases, but it assigned it with a plain set(). That creates an ordinary variable which shadows the cache entry `-D` produces, so `-DCMAKE_EXPERIMENTAL_CXX_IMPORT_STD=...` was silently discarded for every release listed in the table, leaving no escape hatch when a row is wrong. Skip the assignment when the consumer has put a value in the cache, so the command line wins while the table stays authoritative by default. Guard on the cache entry rather than on DEFINED. Testing DEFINED would also defer to an ordinary variable, so consuming this project via add_subdirectory() or FetchContent from a parent that hardcodes a single UUID -- the pattern the table replaced -- would let the parent's value win on every release and pass its staleness on to us. Assigning to the cache here would also restore the override, but it would pin the UUID in CMakeCache.txt for everyone: upgrading CMake in an existing build tree would keep using the previous release's value and quietly ignore the table, which is the failure the table exists to prevent. Report the gate value actually in effect. The unlisted-release warning previously fired whenever no value was set, so supplying an empty or false one on a listed release claimed CMake was newer than every listed release and asked for a row that already exists; empty and unlisted are now separate messages naming their real cause. A supplied value differing from the table gets a STATUS line, since `-D` is cached and outlives the command line that introduced it, making a stale override otherwise indistinguishable from the table's own choice.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The PR updates CI workflows to use the
ubuntu-26.04. The Linux compilers tested in CI are now GCC 14-15 and Clang 21-22. This also allows us to finally test modules build on Linux. Finally, this updates dependencies to the latest available versions.