v2.3.4

.github/pull_request_template.md

@@ -12,7 +12,7 @@
 
 - [ ] My pull request is programmed entirely or mostly with AI.
 - [ ] My pull request only partially uses AI. <!-- How was it used? --> \
-       **If the above is applicable, I have used AI for:**
+      **If the above is applicable, I have used AI for:**
 - [ ] I have only used AI for documentation of Firefox APIs or similar. **No code was written with it.**
 - [ ] My pull request does not use any AI.
 

.github/workflows/build.yml

@@ -30,14 +30,12 @@ jobs:
           - os: windows
             arch: x64
             runner: windows-latest
-            generator: "Visual Studio 17 2022"
             vs_arch: x64
             triplet: x64-windows-static
 
           - os: windows
             arch: arm64
             runner: windows-11-arm
-            generator: "Visual Studio 17 2022"
             vs_arch: ARM64
             triplet: arm64-windows-static
 
@@ -69,26 +67,55 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Clone external repository
         run: |
           git clone --recurse-submodules https://github.com/sineorg/installer.git external
 
-      # ---------- Linux OpenGL / X11 ----------
-      - name: Install OpenGL dependencies (Linux)
+      # ---------- Linux OpenGL / Wayland / X11 ----------
+      - name: Install GUI dependencies (Linux)
         if: matrix.os == 'linux'
         run: |
           sudo apt-get update
           sudo apt-get install -y \
+            pkg-config \
             libgl1-mesa-dev \
+            libegl1-mesa-dev \
             libx11-dev \
             libxrandr-dev \
             libxinerama-dev \
             libxcursor-dev \
-            libxi-dev
+            libxi-dev \
+            libxext-dev \
+            libxfixes-dev \
+            libwayland-dev \
+            libwayland-bin \
+            wayland-protocols \
+            libxkbcommon-dev \
+            libxkbcommon-x11-dev \
+            extra-cmake-modules
+
+      - name: Enable Wayland feature for GLFW (Linux)
+        if: matrix.os == 'linux'
+        run: |
+          python3 -c "
+          import json
+          with open('external/vcpkg.json', 'r') as f:
+              data = json.load(f)
+          for i, dep in enumerate(data.get('dependencies', [])):
+              if dep == 'glfw3':
+                  data['dependencies'][i] = {'name': 'glfw3', 'features': ['wayland']}
+              elif isinstance(dep, dict) and dep.get('name') == 'glfw3':
+                  features = dep.get('features', [])
+                  if 'wayland' not in features:
+                      features.append('wayland')
+                  dep['features'] = features
+          with open('external/vcpkg.json', 'w') as f:
+              json.dump(data, f, indent=2)
+          "
 
       # ---------- Ninja ----------
       - name: Install Ninja (Linux)
@@ -98,6 +125,13 @@ jobs:
           sudo apt-get install -y ninja-build
 
       # ---------- vcpkg ----------
+      - name: Adjust config for macOS
+        if: matrix.os == 'macos'
+        run: |
+          git config --global http.lowSpeedLimit 1000
+          git config --global http.lowSpeedTime 300
+          git config --global http.postBuffer 524288000
+
       - name: Setup vcpkg
         uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11.6
         with:
@@ -110,15 +144,13 @@ jobs:
         if: matrix.os == 'windows'
         run: |
           cmake -S external -B build `
-            -G "$env:GENERATOR" `
             -A "$env:ARCH" `
             -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT\scripts\buildsystems\vcpkg.cmake" `
             -DVCPKG_TARGET_TRIPLET="$env:TRIPLET" `
             -DSINE_VERSION="$env:SINE_VERSION" `
             -DBOOT_VERSION="$env:BOOT_VERSION"
         env:
           VCPKG_ROOT: ${{ github.workspace }}\vcpkg
-          GENERATOR: ${{ matrix.generator }}
           ARCH: ${{ matrix.vs_arch }}
           TRIPLET: ${{ matrix.triplet }}
           SINE_VERSION: ${{ inputs.sine_version }}
@@ -129,8 +161,12 @@ jobs:
         run: |
           cmake -S external -B build \
             -G "${GENERATOR}" \
+            -DCMAKE_TOOLCHAIN_FILE="${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake" \
+            -DVCPKG_TARGET_TRIPLET="${VCPKG_DEFAULT_TRIPLET}" \
             -DSINE_VERSION=${SINE_VERSION} \
-            -DBOOT_VERSION=${BOOT_VERSION}
+            -DBOOT_VERSION=${BOOT_VERSION} \
+            -DGLFW_BUILD_WAYLAND=ON \
+            -DGLFW_BUILD_X11=ON
         env:
           VCPKG_ROOT: ${{ github.workspace }}/vcpkg
           VCPKG_DEFAULT_TRIPLET: ${{ matrix.triplet }}
@@ -224,3 +260,75 @@ jobs:
         with:
           name: sine-osx-${{ matrix.arch }}
           path: artifacts/sine-osx-${{ matrix.arch }}
+
+  post-build:
+    runs-on: ubuntu-latest
+    needs: build
+    name: Handle post-build steps
+    steps:
+      - name: Check signing requirements
+        id: status
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          if [[ "$REF_NAME" == "main" ]]; then
+            echo "should-sign=yes" >> $GITHUB_OUTPUT
+          else
+            echo "should-sign=no" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: ./artifacts
+
+      - name: Attest artifacts
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: |
+            ./artifacts/sine-linux-*/*
+            ./artifacts/sine-osx-*/*
+            ./artifacts/sine-win-*-unsigned/*
+
+      - name: Prepare SignPath Workspace
+        if: steps.status.outputs.should-sign == 'yes'
+        run: |
+          mkdir -p ./unsigned
+          find ./artifacts/sine-win-*-unsigned/ -type f -exec cp {} ./unsigned/ \;
+
+      - name: Upload Windows artifacts (for code signing)
+        if: steps.status.outputs.should-sign == 'yes'
+        id: upload-unsigned-zip
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sine-package-for-signing
+          path: ./unsigned
+
+      - name: Submit signing request
+        if: steps.status.outputs.should-sign == 'yes'
+        id: signpath-code-signing
+        uses: signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2.3
+        with:
+          api-token: "${{ secrets.SIGNPATH_API_TOKEN }}"
+          organization-id: "1324b51a-cb3d-4d1e-aab7-27b1169bd402"
+          project-slug: "Sine"
+          signing-policy-slug: "release-signing"
+          github-artifact-id: "${{ steps.upload-unsigned-zip.outputs.artifact-id }}"
+          wait-for-completion: false
+
+      - name: Save code signing info
+        if: steps.status.outputs.should-sign == 'yes'
+        env:
+          SIGNING_REQUEST_ID: ${{ steps.signpath-code-signing.outputs.signing-request-id }}
+          SIGNING_REQUEST_WEB_URL: ${{ steps.signpath-code-signing.outputs.signing-request-web-url }}
+        run: |
+          mkdir -p artifacts/info
+          echo "$SIGNING_REQUEST_ID" | tee artifacts/info/signing-request-id.txt
+          echo "$SIGNING_REQUEST_WEB_URL" | tee artifacts/info/signing-request-web-url.txt
+
+      - name: Upload Artifact (signing info)
+        if: steps.status.outputs.should-sign == 'yes'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: info
+          path: ./artifacts/info

.github/workflows/codeql.yml

@@ -60,7 +60,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -72,7 +72,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -100,6 +100,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/pr-test.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -26,7 +26,7 @@ jobs:
           bun-version: latest
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       # Run ci script to install bun and uv deps
       - name: Install dependencies
@@ -45,19 +45,19 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
 
   test:
     name: Run tests
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -73,4 +73,7 @@ jobs:
         run: bunx browsercfg select --browser zen-twilight --download
 
       - name: Run tests
-        run: bun run test
+        run: |
+          # Disable mozilla sandbox to prevent hanging process
+          export MOZ_DISABLE_CONTENT_SANDBOX=1
+          bun run test

.github/workflows/release.yml

@@ -11,6 +11,15 @@ on:
         type: number
         description: "Version type (0: normal, 1: abnormal, 2: bootloader, see docs/updates.md)"
         required: true
+      run_id:
+        description: "GitHub Actions run_id when created the corresponding release"
+        required: false
+        type: string
+      publish_draft:
+        description: "If true, will publish draft release"
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   id-token: write
@@ -25,7 +34,7 @@ jobs:
       version: ${{ steps.format_inputs.outputs.sine_version }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -101,15 +110,15 @@ jobs:
           VERSION_TYPE: ${{ inputs.version_type }}
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Generate packages
         run: |
           uv run python scripts/package.py
           mv engine.zip artifacts/engine.zip
 
       - name: Attest artifacts
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: artifacts/*
 
@@ -121,10 +130,20 @@ jobs:
           inputs: '{ "sine_version": "${{ steps.format_inputs.outputs.sine_version }}", "boot_version": "${{ steps.format_inputs.outputs.boot_version }}" }'
           wait-for-completion: true
 
+      - name: Trigger upload workflow
+        if: steps.extract_branch.outputs.suffix != 'c'
+        id: sign_job
+        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
+        with:
+          workflow: upload-signed-files.yml
+          inputs: '{ "run_id": "${{ inputs.run_id }}" }'
+          wait-for-completion: true
+
       - name: Download artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RUN_ID: ${{ steps.build_job.outputs.runId }}
+          RUN_ID: ${{ steps.build_job.outputs.runId || steps.sign_job.outputs.runId }}
+          INPUT_RUN_ID: ${{ inputs.run_id }}
         run: |
           gh run download $RUN_ID -D build/
 
@@ -138,12 +157,22 @@ jobs:
             filename=$(basename "$file")
             foldername=$(basename "$folder")
 
-            if [ "$filename" = "$foldername" ]; then
-              extension="${filename##*.}"
-              tempname="${foldername}_file.$extension"
-              mv "$file" "artifacts/$tempname"
-              rmdir "$folder"
-              mv "artifacts/$tempname" "artifacts/$filename"
+            if [[ "$filename" == *"-unsigned.exe" ]]; then
+              new_name="${file/-unsigned/}"
+              mv "$file" "$new_name"
+              file="$new_name"
+              filename=$(basename "$file")
+            fi
+
+            if [[ "$filename" == "engine.zip" || "$filename" == "updater.bat" || "$filename" == "updater.sh" ]]; then
+              echo "Preserving core asset: artifacts/$filename"
+              continue
+            fi
+
+            if [[ "$filename" =~ ^sine-(linux|osx|win)- ]]; then
+              echo "Verifying attestation for $filename..."
+              gh attestation verify "$file" --repo CosmoCreeper/Sine || echo "Warning: Attestation verification failed for $filename"
+              echo "Processed 'artifacts/$filename'"
             else
               mv "$file" artifacts/
               rmdir "$folder"
@@ -178,12 +207,12 @@ jobs:
 
   deploy:
     needs: build-and-upload
-    if: success()
+    if: success() && inputs.publish_draft == true
     runs-on: ubuntu-latest
     environment: production
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false