Sweep three registries, cover the WebRTC and platform backends, and raise the floor to 81

.github/workflows/action-json-lint.yml

@@ -28,9 +28,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -41,8 +41,10 @@ jobs:
           python -m pip install --only-binary :all: --upgrade "pip==26.0.1"
           # The spec is a documented workflow input — pinned by default so a
           # lint run is reproducible, overridable so a caller can track their
-          # own release or a git ref.
-          python -m pip install "$AUTOCONTROL_REF"
+          # own release or a git ref. --only-binary still builds a git ref's
+          # own project (pip builds VCS requirements regardless) but runs no
+          # dependency's setup script.
+          python -m pip install --only-binary :all: "$AUTOCONTROL_REF"
 
       - name: Lint action JSON files
         shell: bash

.github/workflows/docker.yml

@@ -2,14 +2,14 @@ name: AutoControl Docker CI
 
 on:
   push:
-    branches: [ "dev", "main" ]
+    branches: [ "main" ]
     paths:
       - "docker/**"
       - "je_auto_control/**"
       - "pyproject.toml"
       - ".github/workflows/docker.yml"
   pull_request:
-    branches: [ "dev", "main" ]
+    branches: [ "main" ]
     paths:
       - "docker/**"
       - "je_auto_control/**"
@@ -25,15 +25,15 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/setup-buildx-action@v3  # NOSONAR githubactions:S7637
+        uses: docker/setup-buildx-action@v4  # NOSONAR githubactions:S7637
 
       - name: Build image (no push)
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/build-push-action@v5  # NOSONAR githubactions:S7637
+        uses: docker/build-push-action@v7  # NOSONAR githubactions:S7637
         with:
           context: .
           file: docker/Dockerfile
@@ -51,15 +51,15 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/setup-buildx-action@v3  # NOSONAR githubactions:S7637
+        uses: docker/setup-buildx-action@v4  # NOSONAR githubactions:S7637
 
       - name: Rebuild image (cached)
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/build-push-action@v5  # NOSONAR githubactions:S7637
+        uses: docker/build-push-action@v7  # NOSONAR githubactions:S7637
         with:
           context: .
           file: docker/Dockerfile
@@ -115,15 +115,15 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/setup-buildx-action@v3  # NOSONAR githubactions:S7637
+        uses: docker/setup-buildx-action@v4  # NOSONAR githubactions:S7637
 
       - name: Build the Wayland verification image
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/build-push-action@v5  # NOSONAR githubactions:S7637
+        uses: docker/build-push-action@v7  # NOSONAR githubactions:S7637
         with:
           context: .
           file: docker/Dockerfile.wayland
@@ -161,15 +161,15 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/setup-buildx-action@v3  # NOSONAR githubactions:S7637
+        uses: docker/setup-buildx-action@v4  # NOSONAR githubactions:S7637
 
       - name: Build the EIS verification image
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/build-push-action@v5  # NOSONAR githubactions:S7637
+        uses: docker/build-push-action@v7  # NOSONAR githubactions:S7637
         with:
           context: .
           file: docker/Dockerfile.eis
@@ -200,15 +200,15 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/setup-buildx-action@v3  # NOSONAR githubactions:S7637
+        uses: docker/setup-buildx-action@v4  # NOSONAR githubactions:S7637
 
       - name: Build the portal verification image
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/build-push-action@v5  # NOSONAR githubactions:S7637
+        uses: docker/build-push-action@v7  # NOSONAR githubactions:S7637
         with:
           context: .
           file: docker/Dockerfile.portal
@@ -247,15 +247,15 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/setup-buildx-action@v3  # NOSONAR githubactions:S7637
+        uses: docker/setup-buildx-action@v4  # NOSONAR githubactions:S7637
 
       - name: Build the X11 verification image
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/build-push-action@v5  # NOSONAR githubactions:S7637
+        uses: docker/build-push-action@v7  # NOSONAR githubactions:S7637
         with:
           context: .
           file: docker/Dockerfile.x11
@@ -295,15 +295,15 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/setup-buildx-action@v3  # NOSONAR githubactions:S7637
+        uses: docker/setup-buildx-action@v4  # NOSONAR githubactions:S7637
 
       - name: Build the seat verification image
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/build-push-action@v5  # NOSONAR githubactions:S7637
+        uses: docker/build-push-action@v7  # NOSONAR githubactions:S7637
         with:
           context: .
           file: docker/Dockerfile.seat
@@ -352,15 +352,15 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/setup-buildx-action@v3  # NOSONAR githubactions:S7637
+        uses: docker/setup-buildx-action@v4  # NOSONAR githubactions:S7637
 
       - name: Build the ydotool verification image
         # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
-        uses: docker/build-push-action@v5  # NOSONAR githubactions:S7637
+        uses: docker/build-push-action@v7  # NOSONAR githubactions:S7637
         with:
           context: .
           file: docker/Dockerfile.ydotool

.github/workflows/platform-smoke.yml

@@ -2,9 +2,9 @@ name: Platform smoke
 
 on:
   push:
-    branches: ["main", "dev"]
+    branches: ["main"]
   pull_request:
-    branches: ["main", "dev"]
+    branches: ["main"]
 
 permissions:
   contents: read
@@ -50,8 +50,8 @@ jobs:
             python-version: "3.10"
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
       - run: python -m pip install -e .  # NOSONAR githubactions:S8544  # reason: installs the checked-out project itself, there is no upstream version to lock
@@ -75,7 +75,7 @@ jobs:
           FailureBundleOptions, create_failure_bundle;
           create_failure_bundle('platform-smoke.zip',
           options=FailureBundleOptions(screenshot=False))"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         if: always()
         with:
           name: platform-smoke-${{ matrix.os }}-${{ matrix.python-version }}
@@ -88,7 +88,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       # The X11 backend was gated on sys.platform being linux/linux2, so it
       # refused to load on a FreeBSD desktop that runs the same X server, the
@@ -165,9 +165,9 @@ jobs:
     runs-on: macos-14
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"