Repository navigation
Qt 6.12, GitHub Actions fixes, more static analysis - #192
Merged
Merged
Conversation
Emscripten 5.0.5 is the version the Qt 6.12.0 WebAssembly binaries are built with, which Qt requires applications to match.
Qt 6.12 supports macOS 14.4 and newer. With a deployment target of 13.0 the app claimed to run on macOS 13, where it would fail to start against the Qt 6.12 frameworks.
The Android job used the newest NDK installed on the runner, while Qt recommends building apps with the same NDK as the Qt for Android libraries (r27c for Qt 6.12) to avoid missing symbol errors. That NDK version is now installed explicitly and used for the build.
Qt 6.12 for Android is tested with JDK 21 together with Gradle 9.5.1 and AGP 9.2.1, while the Ubuntu runners default to JDK 17.
Since Qt 6.7 the Android binaries are published under the all_os host, which install-qt-action selects by default for Android, the same as for the WebAssembly job. Forcing the linux host for the Android Qt was a leftover from older Qt versions.
Only the armeabi-v7a Qt was installed, so QT_ANDROID_BUILD_ALL_ABIS produced a 32-bit only APK, which doesn't run natively on 64-bit only devices and isn't accepted by Google Play. The arm64-v8a Qt is now installed next to it, so the APK contains both ABIs.
The WebAssembly job rewrote QT_ROOT_DIR to a sibling "wasm_multithread" directory to work around install-qt-action pointing it elsewhere. install-qt-action now sets QT_ROOT_DIR to the actual install prefix and exposes it as the qt-root-dir step output, which the build now uses directly.
The Android, WebAssembly and iOS build scripts guessed the host Qt location as a sibling of the target Qt. install-qt-action now sets QT_HOST_PATH from the installed Qt's own configuration, so an existing value is used and the guess only remains as a fallback for local builds.
QT_DEBUG_FIND_PACKAGE was left enabled from debugging the Android build, it only filled the CI log with find_package search details.
Both Windows jobs build with Ninja in a Visual Studio developer environment set up by the make-vs2022 scripts, so adding MSBuild to PATH had no effect.
The scripts setting up the MSVC environment hardcoded the Visual Studio 2022 Enterprise path, which breaks as soon as the runner image ships a different Visual Studio version or edition. vswhere now locates the newest installation with the required C++ toolset.
Killing XProtect worked around hdiutil failing with "Resource busy" on the macOS 13 runners (actions/runner-images#7522). The job runs on macos-26 now, where the workaround shouldn't be needed anymore; if hdiutil starts failing again, this commit can simply be reverted.
The Flatpak job has been disabled with "if: false" and never ran. The manifest in dist/linux/flatpak stays, so the job can be brought back from history once the Flatpak build works again.
Both Linux jobs ran ./dist/get-version-name.sh after changing into the build directory, where the script doesn't exist, so the version was always empty. It's now determined from the repository root like in the other jobs.
The Windows and Linux jobs passed the version as -DVERSION, which CMake never reads, so their builds always fell back to the version from git describe. They now use LITH_VERSION like the iOS and macOS builds.
configure-pages, upload-pages-artifact and deploy-pages were several major versions behind; they're updated together to configure-pages@v6, upload-pages-artifact@v5 and deploy-pages@v5. The deployed directory has no hidden files, which newer upload-pages-artifact versions exclude by default.
github/codeql-action v3 is being deprecated in favor of v4, which runs on Node 24.
The create event, used to publish releases, fires for new branches as well as tags and can't be filtered by ref type, so creating a branch started an extra run of the whole workflow on top of the push one. Releases are now triggered by pushing a v* tag, and the release-only steps check for a tag ref instead of the event name.
install-qt-action sets up the newest Python (now 3.15) to run aqtinstall, but py7zr's compiled dependencies (pyppmd, pybcj, inflate64, psutil, pycryptodomex) don't have Windows wheels for Python 3.15 yet, so installing them failed and with it the whole Windows build. Both Windows jobs now set up Python 3.14 themselves and tell install-qt-action to use it.
With QT_ANDROID_BUILD_ALL_ABIS, Qt configures every ABI except the main one in a separate CMake subproject that doesn't inherit the main project's cache. The arm64-v8a build therefore didn't get ANDROID_OPENSSL_PATH and fell back to the default location in the Android SDK, where OpenSSL isn't installed, and it would have also been built without the Imgur API key and version. These variables are now forwarded through QT_ANDROID_MULTI_ABI_FORWARD_VARS.
Since Qt 6.11 the online repository keeps each Windows x64 compiler in its own folder (e.g. qt6_6120/qt6_6120_msvc2022_64) instead of a single qt6_6120/qt6_6120 one. aqtinstall 3.3.0, the latest release and install-qt-action's default, still looks for the old folder and fails with "Failed to locate XML data for Qt version '6.12.0'". Support for the new layout (miurahr/aqtinstall#1000) is only on aqtinstall's master so far, so the Windows x64 job installs aqtinstall from a pinned master commit until a release contains it. Windows ARM64 keeps the old layout and the released aqtinstall.
Without an explicit query suite CodeQL only ran the default one, which is limited to high-precision security queries, so it practically never reported anything for Lith. The security-and-quality suite adds the medium-precision security queries and the code quality ones (dead code, suspicious comparisons, resource leaks and similar). The manually traced build is now also stated explicitly as build-mode: manual.
Enables the bugprone, clang-analyzer and performance checks plus a few targeted ones (slicing, missing virtual destructors, redundant expressions, override and nullptr), without checks that are mostly noise for this code base, like NewDeleteLeaks reporting QObjects owned by their parent. IDEs and clang-tidy pick the file up automatically.
A new workflow runs clang-tidy and clazy (level1 checks) on every push and pull request. Only the translation units touched by the change are analyzed, and only diagnostics on added or modified lines are reported, so existing warnings don't bury the new ones. New findings show up as annotations on the changed lines and in the job summary, and they fail the job. The work is done by dist/ci/static-analysis.py, which can also be run locally on a Clang build with a compilation database. The job runs on Ubuntu 26.04, where clazy is built against the same LLVM 21 as the clang and clang-tidy it uses.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Static analysis can miss affected code and pass despite analyzer failures, while secondary Android ABIs do not receive keychain and dependency-selection settings.
1 open issue
What changed in this PR
Updates Lith’s cross-platform build and CI configuration for Qt 6.12 and adds targeted static analysis for changed C++ code.
Changes:
- Refresh platform toolchains and deployment settings, including Android multi-ABI setup and Windows compiler discovery.
- Update GitHub Actions, version handling, and tag-based release publishing.
- Add clang-tidy/clazy checks and expand CodeQL analysis.
| File | Description |
|---|---|
dist/win/make-vs2022-env.bat |
Discover installed x64 Visual Studio tools dynamically. |
dist/win/make-vs2022-arm-env.bat |
Discover installed ARM64 Visual Studio tools dynamically. |
dist/wasm/build.sh |
Preserve an existing host Qt path. |
dist/macos/build.sh |
Raise the macOS deployment target to 14.4. |
dist/ios/build.sh |
Preserve an existing host Qt path. |
dist/ci/static-analysis.py |
Run clang-tidy/clazy and report changed-line diagnostics. |
dist/android/build.sh |
Preserve the host Qt path and remove verbose configuration output. |
CMakeLists.txt |
Forward OpenSSL, API-key, and version settings to Android ABI sub-builds. |
.github/workflows/static-analysis.yml |
Add pull-request static analysis with a Clang build. |
.github/workflows/main.yml |
Update toolchains, Android setup, version handling, and release triggers. |
.github/workflows/codeql.yml |
Upgrade Qt and CodeQL actions; enable manual builds and quality queries. |
.clang-tidy |
Configure analysis checks and project-header filtering. |
Review effort: Max
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #191