perf(windows): optimize Windows CI build and bump GitHub Actions versions

.github/actions/build-windows/action.yml

@@ -34,14 +34,20 @@ inputs:
     default: 'd3dcompiler_47 opengl32sw qt3d qtactiveqt qtbase qtconnectivity qtdeclarative qtgraphicaleffects qtimageformats qtlocation qtmultimedia qtquickcontrols qtquickcontrols2 qtremoteobjects qtscxml qtsensors qtsvg qttools qttranslations qtwebchannel qtwebsockets qtwebview qtwinextras qtxmlpatterns'
   windows_qt6_modules:
     required: false
-    default: 'debug_info qt3d qt5compat qtactiveqt qtcharts qtconnectivity qtdatavis3d qtgrpc qthttpserver qtimageformats qtlanguageserver qtlocation qtlottie qtmultimedia qtnetworkauth qtpdf qtpositioning qtquick3d qtquick3dphysics qtquickeffectmaker qtquicktimeline qtremoteobjects qtscxml qtsensors qtserialbus qtserialport qtshadertools qtspeech qtvirtualkeyboard qtwebchannel qtwebengine qtwebsockets qtwebview'
+    default: 'qtimageformats qtmultimedia qtpdf qtpositioning qtshadertools qtwebchannel qtwebengine'
   windows_qt6_archives:
     required: false
     default: 'd3dcompiler_47 opengl32sw qtbase qtdeclarative qtsvg qttools qttranslations'
 
 runs:
   using: "composite"
   steps:
+    - name: Disable Windows Defender Realtime Monitoring for Build Trees
+      shell: powershell
+      run: |
+        Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
+        Add-MpPreference -ExclusionPath "${{ github.workspace }}", "C:\.sccache", "C:\Program Files\OpenUTVDeps", "C:\VulkanSDK" -ErrorAction SilentlyContinue
+
     - name: Download and Install Prebuilt Dependencies
       shell: powershell
       env:
@@ -191,7 +197,7 @@ runs:
       shell: powershell
 
     - name: Cache CMake for Windows
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       id: windows-cmake-cache
       with:
         path: "C:/Program Files/CMake"
@@ -202,10 +208,20 @@ runs:
       run: choco install cmake --version=${{ inputs.cmake-version }} --allow-downgrade --yes --no-progress
       shell: powershell
 
-    - name: Install build tools (Ninja, JOM, flex, bison, nasm, patch, pkg-config, Vulkan)
+    - name: Cache Vulkan SDK for Windows
+      uses: actions/cache@v6
+      id: windows-vulkan-cache
+      with:
+        path: "C:/VulkanSDK"
+        key: ${{ runner.os }}-vulkan-sdk-1.4.350
+
+    - name: Install build tools (Ninja, flex, bison, nasm, patch, pkg-config, Vulkan)
       run: |
         choco feature enable -n allowEmptyChecksums
-        choco install ninja jom winflexbison3 nasm patch pkgconfiglite vulkan-sdk --yes --no-progress --allow-empty-checksums --ignore-checksums
+        choco install ninja winflexbison3 nasm patch pkgconfiglite --yes --no-progress --allow-empty-checksums --ignore-checksums
+        if ("${{ steps.windows-vulkan-cache.outputs.cache-hit }}" -ne "true") {
+            choco install vulkan-sdk --yes --no-progress --allow-empty-checksums --ignore-checksums
+        }
         "C:\ProgramData\chocolatey\bin" | Add-Content -Path $env:GITHUB_PATH
         $VulkanDir = Get-ChildItem -Path "C:\VulkanSDK" -ErrorAction SilentlyContinue | Sort-Object Name -Descending | Select-Object -First 1
         if ($VulkanDir) {
@@ -232,13 +248,12 @@ runs:
       shell: bash
 
     - name: Prepare Qt folder and 7-Zip
+      shell: powershell
       run: |
-        mkdir -p /c/qt
-        if [ -d "/c/Program Files/7-Zip" ]; then
-          echo "/c/Program Files/7-Zip" >> $GITHUB_PATH
-          echo "C:\Program Files\7-Zip" >> $GITHUB_PATH
-        fi
-      shell: bash
+        New-Item -ItemType Directory -Force -Path "C:\Qt" | Out-Null
+        if (Test-Path "C:\Program Files\7-Zip") {
+            "C:\Program Files\7-Zip" | Add-Content -Path $env:GITHUB_PATH
+        }
 
     - name: Install Qt ${{ inputs.qt-version }}
       uses: jurplel/install-qt-action@v4
@@ -294,22 +309,27 @@ runs:
       shell: powershell
 
     - name: Setup sccache
-      # Used for this run only (SCCACHE_GHA_ENABLED=false); not stored in Actions cache.
-      # For sccache to actually cache the Windows/MSVC build, CMake must use it as the compiler
-      # launcher, e.g. -DCMAKE_C_COMPILER_LAUNCHER=sccache -DCMAKE_CXX_COMPILER_LAUNCHER=sccache
-      # in the Configure UTV step (and sccache must be on PATH when the build runs).
-      uses: mozilla-actions/sccache-action@v0.0.10
+      uses: mozilla-actions/sccache-action@v0.0.11
       with:
         version: "v0.15.0"
 
-    - name: Configure sccache for bash and powershell
+    - name: Configure sccache directory and cache
       run: |
-        # sccache is installed to cargo bin
         if (Test-Path "C:\Users\runneradmin\.cargo\bin") {
             "C:\Users\runneradmin\.cargo\bin" | Add-Content -Path $env:GITHUB_PATH
         }
+        "SCCACHE_DIR=C:\.sccache" | Add-Content -Path $env:GITHUB_ENV
+        "SCCACHE_CACHE_SIZE=5G" | Add-Content -Path $env:GITHUB_ENV
       shell: powershell
 
+    - name: Restore Sccache
+      uses: actions/cache/restore@v6
+      with:
+        path: "C:/.sccache"
+        key: ${{ runner.os }}-sccache-${{ github.sha }}
+        restore-keys: |
+          ${{ runner.os }}-sccache-
+
     - name: Configure UTV
       run: |
         $PrefixPaths = "C:/Qt/${{ inputs.qt-version }}/msvc2022_64"
@@ -447,6 +467,34 @@ runs:
         }
       shell: powershell
 
+    - name: Windows Defender Supply Chain Security Scan
+      shell: powershell
+      run: |
+        $installDir = Join-Path $env:GITHUB_WORKSPACE "_install"
+        if (Test-Path $installDir) {
+            Write-Host "Unexcluding staged application from Defender for security verification..."
+            Remove-MpPreference -ExclusionPath "${{ github.workspace }}" -ErrorAction SilentlyContinue
+
+            $mpCmd = "C:\Program Files\Windows Defender\MpCmdRun.exe"
+            if (Test-Path $mpCmd) {
+                Write-Host "Scanning staged application with Windows Defender: $installDir"
+                & $mpCmd -Scan -ScanType 3 -File "$installDir"
+                if ($LASTEXITCODE -eq 2) {
+                    Write-Error "Windows Defender detected malware or malicious threat in staged application!"
+                    exit 1
+                } elseif ($LASTEXITCODE -eq 0) {
+                    Write-Host "Windows Defender scan clean. 0 threats detected."
+                } else {
+                    Write-Warning "Windows Defender scan completed with exit code: $LASTEXITCODE"
+                }
+            } else {
+                Write-Host "Running PowerShell Start-MpScan on $installDir..."
+                Start-MpScan -ScanType CustomScan -ScanPath "$installDir"
+            }
+        } else {
+            Write-Warning "Directory _install not found for Defender scan."
+        }
+
     - name: Sccache Statistics
       if: always()
       run: |
@@ -455,3 +503,11 @@ runs:
         }
       shell: powershell
 
+    - name: Save Sccache
+      if: always()
+      uses: actions/cache/save@v6
+      with:
+        path: "C:/.sccache"
+        key: ${{ runner.os }}-sccache-${{ github.sha }}
+
+

.github/workflows/branch-build.yml

@@ -15,6 +15,7 @@ on:
 
 permissions:
   contents: read
+  actions: write
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
@@ -30,10 +31,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
@@ -49,14 +50,14 @@ jobs:
     runs-on: macos-26
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
           fetch-depth: 0
 
       - name: Check out proprietary vendor SDKs
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: OpenUTV/openutv-vendor-sdks
           token: ${{ secrets.GH_TOKEN_DEPS_READ }}
@@ -68,7 +69,7 @@ jobs:
         shell: bash
 
       - name: Restore Homebrew cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: |
             ~/Library/Caches/Homebrew/downloads
@@ -79,23 +80,27 @@ jobs:
             ${{ runner.os }}-brew-
 
       - name: Install Homebrew dependencies
+        env:
+          HOMEBREW_NO_AUTO_UPDATE: "0"
         run: |
+          brew update
           brew install --formula \
                ninja readline sqlite3 xz zlib tcl-tk@8 python-tk autoconf automake libtool python@3.14 yasm clang-format black meson nasm pkg-config glew ccache doctest qt pyside \
                ffmpeg openexr imath opencolorio libraw libtiff libpng libspng boost openimageio openjpeg webp yaml-cpp spdlog icu4c openjph jpeg-turbo
+          brew upgrade openexr imath opencolorio libraw libtiff boost openimageio spdlog openjph || true
         shell: bash
 
       - name: Save Homebrew cache
         if: always()
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: |
             ~/Library/Caches/Homebrew/downloads
             ~/Library/Caches/Homebrew/Casks
           key: ${{ runner.os }}-brew-${{ steps.date.outputs.date }}-${{ hashFiles('**/build.sh') }}
 
       - name: Restore CCache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: ~/.ccache
           key: ${{ runner.os }}-ccache-${{ github.sha }}
@@ -112,27 +117,22 @@ jobs:
 
       - name: Save CCache
         if: always()
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: ~/.ccache
           key: ${{ runner.os }}-ccache-${{ github.sha }}
 
-      - name: Package Ad-Hoc Signed App
+      - name: Sign Ad-Hoc App
         run: |
           python3 "${PWD}/src/build/sanitize_homebrew_links.py" "_build/stage/app/UTV.app" || true
           codesign --force --deep --sign - "_build/stage/app/UTV.app"
-          mkdir -p _dist
-          SHORT_SHA=$(git rev-parse --short=7 HEAD)
-          SAFE_BRANCH=$(echo "${{ github.ref_name }}" | tr '/' '-')
-          cd _build/stage/app
-          ditto -c -k --keepParent UTV.app "${GITHUB_WORKSPACE}/_dist/UTV-${SAFE_BRANCH}-${SHORT_SHA}-macOS-arm64.zip"
         shell: bash
 
       - name: Upload macOS Branch Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: UTV-macOS-arm64
-          path: _dist/*.zip
+          path: _build/stage/app/UTV.app
           retention-days: 5
 
   build-windows:
@@ -144,14 +144,14 @@ jobs:
       SCCACHE_GHA_ENABLED: "true"
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
           fetch-depth: 0
 
       - name: Check out proprietary vendor SDKs
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: OpenUTV/openutv-vendor-sdks
           token: ${{ secrets.GH_TOKEN_DEPS_READ }}
@@ -162,21 +162,16 @@ jobs:
         with:
           version: 'dev'
 
-      - name: Package Windows Branch Archive
+      - name: Stage Windows Branch Directory
         shell: powershell
         run: |
-          $ShortSha = git rev-parse --short=7 HEAD
-          $SafeBranch = "${{ github.ref_name }}".Replace("/", "-")
-          $ZipName = "UTV-$SafeBranch-$ShortSha-windows-x64.zip"
-          New-Item -ItemType Directory -Force -Path "_dist" | Out-Null
           Rename-Item -Path "_install" -NewName "utv-windows-x64"
-          Compress-Archive -Path "utv-windows-x64" -DestinationPath "_dist\$ZipName" -CompressionLevel Optimal
 
       - name: Upload Windows Branch Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: UTV-windows-x64
-          path: _dist/*.zip
+          path: utv-windows-x64
           retention-days: 5
 
   build-linux:
@@ -187,14 +182,14 @@ jobs:
     continue-on-error: true
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
           fetch-depth: 0
 
       - name: Check out proprietary vendor SDKs
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: OpenUTV/openutv-vendor-sdks
           token: ${{ secrets.GH_TOKEN_DEPS_READ }}
@@ -206,7 +201,7 @@ jobs:
         shell: bash
 
       - name: Restore Homebrew cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: |
             ~/.cache/Homebrew/downloads
@@ -216,25 +211,29 @@ jobs:
             ${{ runner.os }}-brew-
 
       - name: Install Homebrew dependencies
+        env:
+          HOMEBREW_NO_AUTO_UPDATE: "0"
         run: |
           eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
           sudo apt-get update && sudo apt-get install -y build-essential patchelf mold tcsh libgl1-mesa-dev libglu1-mesa-dev libegl1-mesa-dev libosmesa6-dev libudev-dev libaio-dev libreadline-dev libx11-dev libxcursor-dev libxext-dev libxi-dev libxinerama-dev libxrandr-dev libxrender-dev libxcomposite-dev libxdamage-dev libxtst-dev libxxf86vm-dev libxkbcommon-dev libxkbcommon-x11-dev libffi-dev libasound2-dev libpulse-dev
+          brew update
           brew install --formula \
                ninja pkg-config ccache glew doctest qt pyside \
                ffmpeg openexr imath opencolorio libraw libtiff libpng libspng boost \
                openimageio openjpeg webp yaml-cpp spdlog openjph jpeg-turbo
+          brew upgrade openexr imath opencolorio libraw libtiff boost openimageio spdlog openjph || true
         shell: bash
 
       - name: Save Homebrew cache
         if: always()
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: |
             ~/.cache/Homebrew/downloads
           key: ${{ runner.os }}-brew-${{ steps.date.outputs.date }}-${{ hashFiles('**/build.sh') }}
 
       - name: Restore CCache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: ~/.ccache
           key: ${{ runner.os }}-ccache-${{ github.sha }}
@@ -251,27 +250,16 @@ jobs:
 
       - name: Save CCache
         if: always()
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: ~/.ccache
           key: ${{ runner.os }}-ccache-${{ github.sha }}
 
-      - name: Package Linux Branch Archive
-        if: success()
-        run: |
-          mkdir -p _dist
-          SHORT_SHA=$(git rev-parse --short=7 HEAD)
-          SAFE_BRANCH=$(echo "${{ github.ref_name }}" | tr '/' '-')
-          if [ -d "_build/stage/app" ]; then
-            tar -czf "_dist/UTV-${SAFE_BRANCH}-${SHORT_SHA}-linux-x64.tar.gz" -C _build/stage/app .
-          fi
-        shell: bash
-
       - name: Upload Linux Branch Artifact
         if: success()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: UTV-linux-x64
-          path: _dist/*.tar.gz
+          path: _build/stage/app
           retention-days: 5