From bcdf004b8a7c338ef67b6679beeec69343c4074e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:22:44 +0100
Subject: [PATCH 01/25] Update CI to Qt 6.12.0 and Emscripten 5.0.5

Emscripten 5.0.5 is the version the Qt 6.12.0 WebAssembly binaries are built with, which Qt requires applications to match.
---
 .github/workflows/codeql.yml | 2 +-
 .github/workflows/main.yml   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d5216c1..c96b245 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,7 +18,7 @@ on:
     branches: [ "master" ]
 
 env:
-    QT_VERSION: '6.10.2'
+    QT_VERSION: '6.12.0'
     QT_MODULES: 'qtmultimedia qtwebsockets qtimageformats'
 
 jobs:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 766955a..3afbacd 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,9 +10,9 @@ on:
   create:
 
 env:
-    QT_VERSION: '6.10.2'
+    QT_VERSION: '6.12.0'
     QT_MODULES: 'qtmultimedia qtwebsockets qtimageformats'
-    EM_VERSION: '4.0.7'
+    EM_VERSION: '5.0.5'
 
 permissions:
   contents: write

From 8f74ec7c82db386f881207594b603fad37142dfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:22:53 +0100
Subject: [PATCH 02/25] Raise the macOS deployment target to 14.4

Qt 6.12 supports macOS 14.4 and newer. With a deployment target of 13.0 the app claimed to run on macOS 13, where it would fail to start against the Qt 6.12 frameworks.
---
 dist/macos/build.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dist/macos/build.sh b/dist/macos/build.sh
index adfd7d3..d3ca601 100755
--- a/dist/macos/build.sh
+++ b/dist/macos/build.sh
@@ -5,5 +5,5 @@ set -e
 mkdir build_macos
 cd build_macos
 export CMAKE_PREFIX_PATH=$QT_ROOT_DIR/lib/cmake
-cmake .. -DCMAKE_OSX_DEPLOYMENT_TARGET="13.0" -DCMAKE_OSX_ARCHITECTURES="x86_64;arm64" -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DLITH_VERSION=$VERSION_NAME -DCMAKE_INSTALL_PREFIX=installed
+cmake .. -DCMAKE_OSX_DEPLOYMENT_TARGET="14.4" -DCMAKE_OSX_ARCHITECTURES="x86_64;arm64" -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DLITH_VERSION=$VERSION_NAME -DCMAKE_INSTALL_PREFIX=installed
 cmake --build . --parallel

From 73b1454838909dd1828b83990e4d7347d92d8e44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:23:12 +0100
Subject: [PATCH 03/25] Build Android with the NDK Qt 6.12 is built with

The Android job used the newest NDK installed on the runner, while Qt recommends building apps with the same NDK as the Qt for Android libraries (r27c for Qt 6.12) to avoid missing symbol errors. That NDK version is now installed explicitly and used for the build.
---
 .github/workflows/main.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 3afbacd..5fe8e34 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,6 +13,8 @@ env:
     QT_VERSION: '6.12.0'
     QT_MODULES: 'qtmultimedia qtwebsockets qtimageformats'
     EM_VERSION: '5.0.5'
+    # Has to match the NDK the Qt for Android binaries are built with
+    ANDROID_NDK_VERSION: '27.2.12479018'
 
 permissions:
   contents: write
@@ -150,14 +152,17 @@ jobs:
     - name: Get OpenSSL
       run: |
         git clone https://github.com/KDAB/android_openssl.git --depth=1
+    - name: Install the Android NDK
+      run: |
+        yes | "${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager" --install "ndk;${ANDROID_NDK_VERSION}" > /dev/null
     - name: Build the Android binary
       run: |
         export ANDROID_SDK=${ANDROID_SDK_ROOT}
         export CPM_SOURCE_CACHE=~/cpm-cache
         export ANDROID_OPENSSL_PATH="$PWD/android_openssl/ssl_3"
-        export ANDROID_NDK="${ANDROID_NDK_LATEST_HOME}"
-        export ANDROID_NDK_HOME="${ANDROID_NDK_LATEST_HOME}"
-        export ANDROID_NDK_ROOT="${ANDROID_NDK_LATEST_HOME}"
+        export ANDROID_NDK="${ANDROID_SDK_ROOT}/ndk/${ANDROID_NDK_VERSION}"
+        export ANDROID_NDK_HOME="${ANDROID_NDK}"
+        export ANDROID_NDK_ROOT="${ANDROID_NDK}"
         IMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} bash ./dist/android/build.sh
     - name: Upload artifacts to GitHub
       if: github.event_name != 'create'

From d9a9370bf88480d5bff85958f33b4e53ad8b89d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:23:25 +0100
Subject: [PATCH 04/25] Build Android with JDK 21

Qt 6.12 for Android is tested with JDK 21 together with Gradle 9.5.1 and AGP 9.2.1, while the Ubuntu runners default to JDK 17.
---
 .github/workflows/main.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5fe8e34..46d912d 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -155,6 +155,11 @@ jobs:
     - name: Install the Android NDK
       run: |
         yes | "${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager" --install "ndk;${ANDROID_NDK_VERSION}" > /dev/null
+    - name: Set up JDK
+      uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: '21'
     - name: Build the Android binary
       run: |
         export ANDROID_SDK=${ANDROID_SDK_ROOT}

From 9f575627dd83d74dc8b325aac9e739dd6d96152e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:23:33 +0100
Subject: [PATCH 05/25] Install Qt for Android from the all_os packages

Since Qt 6.7 the Android binaries are published under the all_os host, which install-qt-action selects by default for Android, the same as for the WebAssembly job. Forcing the linux host for the Android Qt was a leftover from older Qt versions.
---
 .github/workflows/main.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 46d912d..f83c81f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -142,7 +142,6 @@ jobs:
       uses: jurplel/install-qt-action@v4
       with:
         version: ${{env.QT_VERSION}}
-        host: linux
         target: android
         arch: android_armv7
         modules: ${{env.QT_MODULES}}

From 0074b7a0cf4b43505320c11068d9880be6ccf97b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:23:46 +0100
Subject: [PATCH 06/25] Build the Android APK for arm64-v8a too

Only the armeabi-v7a Qt was installed, so QT_ANDROID_BUILD_ALL_ABIS produced a 32-bit only APK, which doesn't run natively on 64-bit only devices and isn't accepted by Google Play. The arm64-v8a Qt is now installed next to it, so the APK contains both ABIs.
---
 .github/workflows/main.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index f83c81f..06c911a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -138,6 +138,16 @@ jobs:
         modules: ${{env.QT_MODULES}}
         cache: true
         cache-key-prefix: ${{ github.job }}-qt-${{ env.QT_VERSION }}
+    - name: Install Qt for arm64-v8a
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{env.QT_VERSION}}
+        target: android
+        arch: android_arm64_v8a
+        set-env: false
+        modules: ${{env.QT_MODULES}}
+        cache: true
+        cache-key-prefix: ${{ github.job }}-qt-cross-arm64-${{ env.QT_VERSION }}
     - name: Install Qt
       uses: jurplel/install-qt-action@v4
       with:

From eb8d8f1b7738c9a90084e065456ff303021b4940 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:24:22 +0100
Subject: [PATCH 07/25] Use the installed WebAssembly Qt path instead of
 guessing it

The WebAssembly job rewrote QT_ROOT_DIR to a sibling "wasm_multithread" directory to work around install-qt-action pointing it elsewhere. install-qt-action now sets QT_ROOT_DIR to the actual install prefix and exposes it as the qt-root-dir step output, which the build now uses directly.
---
 .github/workflows/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 06c911a..d678d6b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -217,6 +217,7 @@ jobs:
         cache-key-prefix: ${{ github.job }}-qt-${{ env.QT_VERSION }}
 
     - name: Install Qt
+      id: install-qt-wasm
       uses: jurplel/install-qt-action@v4
       with:
         version: ${{env.QT_VERSION}}
@@ -234,8 +235,7 @@ jobs:
 
     - name: Build the Emscripten binary
       run: |
-        #hack
-        export QT_ROOT_DIR=${QT_ROOT_DIR}/../wasm_multithread
+        export QT_ROOT_DIR="${{ steps.install-qt-wasm.outputs.qt-root-dir }}"
         IMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} bash ./dist/wasm/build.sh
         # inject CORS handling into the main page
         sed s'/\(<\/title>\)/\0\n<script src="enable-threads.js"><\/script>/' -i'' build_wasm/app/Lith.html

From d491ec7c92b99955fb340cbd77b8eb4a063e67ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:24:34 +0100
Subject: [PATCH 08/25] Prefer the provided QT_HOST_PATH in the cross-build
 scripts

The Android, WebAssembly and iOS build scripts guessed the host Qt location as a sibling of the target Qt. install-qt-action now sets QT_HOST_PATH from the installed Qt's own configuration, so an existing value is used and the guess only remains as a fallback for local builds.
---
 dist/android/build.sh | 2 +-
 dist/ios/build.sh     | 2 +-
 dist/wasm/build.sh    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/dist/android/build.sh b/dist/android/build.sh
index 82d4fc1..13e5e3c 100644
--- a/dist/android/build.sh
+++ b/dist/android/build.sh
@@ -10,7 +10,7 @@ if [ -z "${ANDROID_OPENSSL_PATH}" ]; then
     ANDROID_OPENSSL_PATH="${ANDROID_SDK_ROOT}/android_openssl/ssl_3"
 fi
 
-export QT_HOST_PATH="${QT_ROOT_DIR}/../gcc_64"
+export QT_HOST_PATH="${QT_HOST_PATH:-${QT_ROOT_DIR}/../gcc_64}"
 export CMAKE_PREFIX_PATH=${QT_ROOT_DIR}/lib/cmake
 cmake .. -DQT_DEBUG_FIND_PACKAGE=ON -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_TOOLCHAIN_FILE=$QT_ROOT_DIR/lib/cmake/Qt6/qt.toolchain.cmake -DANDROID_OPENSSL_PATH="${ANDROID_OPENSSL_PATH}" -DQT_ANDROID_BUILD_ALL_ABIS=ON
 
diff --git a/dist/ios/build.sh b/dist/ios/build.sh
index 6088a2f..5d29233 100644
--- a/dist/ios/build.sh
+++ b/dist/ios/build.sh
@@ -6,7 +6,7 @@ set -x
 mkdir -p build_ios
 cd build_ios
 
-export QT_HOST_PATH="${QT_ROOT_DIR}/../macos"
+export QT_HOST_PATH="${QT_HOST_PATH:-${QT_ROOT_DIR}/../macos}"
 cmake .. -GXcode -DCMAKE_PREFIX_PATH=$QT_ROOT_DIR -DCMAKE_OSX_SYSROOT=iphoneos -DCMAKE_OSX_ARCHITECTURES=arm64 -DCMAKE_TOOLCHAIN_FILE=$QT_ROOT_DIR/lib/cmake/Qt6/qt.toolchain.cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo -DLITH_VERSION=$VERSION_NAME -DIMGUR_API_KEY=$IMGUR_API_KEY -DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_STYLE="Manual"
 
 xcodebuild -project Lith.xcodeproj -scheme Lith -configuration RelWithDebInfo archive -archivePath Lith.xcarchive DEVELOPMENT_TEAM=Z52EFCPL6D
diff --git a/dist/wasm/build.sh b/dist/wasm/build.sh
index 66e76d3..6f99db6 100644
--- a/dist/wasm/build.sh
+++ b/dist/wasm/build.sh
@@ -6,7 +6,7 @@ set -x
 mkdir -p build_wasm
 pushd build_wasm
 
-export QT_HOST_PATH="${QT_ROOT_DIR}/../gcc_64"
+export QT_HOST_PATH="${QT_HOST_PATH:-${QT_ROOT_DIR}/../gcc_64}"
 export CMAKE_PREFIX_PATH=$QT_ROOT_DIR/lib/cmake
 cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_TOOLCHAIN_FILE=$QT_ROOT_DIR/lib/cmake/Qt6/qt.toolchain.cmake
 cmake --build . --parallel

From 080d1e0bf89da9bf0bc3e9b417faf0dc084692dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:24:44 +0100
Subject: [PATCH 09/25] Stop debugging find_package in the Android build

QT_DEBUG_FIND_PACKAGE was left enabled from debugging the Android build, it only filled the CI log with find_package search details.
---
 dist/android/build.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dist/android/build.sh b/dist/android/build.sh
index 13e5e3c..1e68ce4 100644
--- a/dist/android/build.sh
+++ b/dist/android/build.sh
@@ -12,7 +12,7 @@ fi
 
 export QT_HOST_PATH="${QT_HOST_PATH:-${QT_ROOT_DIR}/../gcc_64}"
 export CMAKE_PREFIX_PATH=${QT_ROOT_DIR}/lib/cmake
-cmake .. -DQT_DEBUG_FIND_PACKAGE=ON -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_TOOLCHAIN_FILE=$QT_ROOT_DIR/lib/cmake/Qt6/qt.toolchain.cmake -DANDROID_OPENSSL_PATH="${ANDROID_OPENSSL_PATH}" -DQT_ANDROID_BUILD_ALL_ABIS=ON
+cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=$IMGUR_API_KEY -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_TOOLCHAIN_FILE=$QT_ROOT_DIR/lib/cmake/Qt6/qt.toolchain.cmake -DANDROID_OPENSSL_PATH="${ANDROID_OPENSSL_PATH}" -DQT_ANDROID_BUILD_ALL_ABIS=ON
 
 cmake --build . --target Lith -- -j2
 cmake --build . --target apk -- -j2

From 21fe3e7bf697d72477043bc79ae0200f70351c20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:25:06 +0100
Subject: [PATCH 10/25] Remove the unused MSBuild setup from the Windows jobs

Both Windows jobs build with Ninja in a Visual Studio developer environment set up by the make-vs2022 scripts, so adding MSBuild to PATH had no effect.
---
 .github/workflows/main.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d678d6b..08338f3 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -282,8 +282,6 @@ jobs:
         cache: true
         cache-key-prefix: ${{ github.job }}-qt
 
-    - name: Add msbuild to PATH
-      uses: microsoft/setup-msbuild@v2
     - name: Build the application
       shell: bash
       run: |
@@ -346,8 +344,6 @@ jobs:
         cache: true
         cache-key-prefix: ${{ github.job }}-qt
 
-    - name: Add msbuild to PATH
-      uses: microsoft/setup-msbuild@v2
     - name: Build the application
       shell: bash
       run: |

From cd35317ca8b6d32bd309506c3085feed241fcceb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:25:30 +0100
Subject: [PATCH 11/25] Find Visual Studio with vswhere in the Windows build
 scripts

The scripts setting up the MSVC environment hardcoded the Visual Studio 2022 Enterprise path, which breaks as soon as the runner image ships a different Visual Studio version or edition. vswhere now locates the newest installation with the required C++ toolset.
---
 dist/win/make-vs2022-arm-env.bat | 3 ++-
 dist/win/make-vs2022-env.bat     | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/dist/win/make-vs2022-arm-env.bat b/dist/win/make-vs2022-arm-env.bat
index 42f1f73..95ced79 100644
--- a/dist/win/make-vs2022-arm-env.bat
+++ b/dist/win/make-vs2022-arm-env.bat
@@ -2,7 +2,8 @@
 
 set OLDPATH=%PATH%
 
-call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" arm64 > NUL:
+for /f "usebackq tokens=*" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.ARM64 -property installationPath`) do set VS_PATH=%%i
+call "%VS_PATH%\VC\Auxiliary\Build\vcvarsall.bat" arm64 > NUL:
 
 echo export INCLUDE='%INCLUDE%'
 echo export LIB='%LIB%'
diff --git a/dist/win/make-vs2022-env.bat b/dist/win/make-vs2022-env.bat
index c1048be..1e3bdf2 100644
--- a/dist/win/make-vs2022-env.bat
+++ b/dist/win/make-vs2022-env.bat
@@ -2,7 +2,8 @@
 
 set OLDPATH=%PATH%
 
-call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x64 > NUL:
+for /f "usebackq tokens=*" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath`) do set VS_PATH=%%i
+call "%VS_PATH%\VC\Auxiliary\Build\vcvarsall.bat" x64 > NUL:
 
 echo export INCLUDE='%INCLUDE%'
 echo export LIB='%LIB%'

From 446b333980209728e88673c5c0f612e489232b6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:25:38 +0100
Subject: [PATCH 12/25] Remove the XProtect workaround from the macOS DMG
 generation

Killing XProtect worked around hdiutil failing with "Resource busy" on the macOS 13 runners (actions/runner-images#7522). The job runs on macos-26 now, where the workaround shouldn't be needed anymore; if hdiutil starts failing again, this commit can simply be reverted.
---
 .github/workflows/main.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 08338f3..4f50f08 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -566,9 +566,6 @@ jobs:
         IMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} ./dist/macos/build.sh
     - name: Generate .dmg
       run: |
-        # A workaround mentioned here https://github.com/actions/runner-images/issues/7522
-        echo killing...; sudo pkill -9 XProtect >/dev/null || true;
-        echo waiting...; while pgrep XProtect; do sleep 3; done;
         "$QT_ROOT_DIR"/bin/macdeployqt build_macos/app/Lith.app -hardened-runtime -qmldir=modules -appstore-compliant -codesign="Developer ID Application: Martin Briza (Z52EFCPL6D)"
         # No idea why but macdeployqt deploys debug libs too, just remove them, maybe fix this sometimes
         for i in `find build_macos/app/Lith.app/ -name '*.dSYM'`; do rm -fr "$i"; done

From e93a74f7fcdb09f2e393c20f340e17f354de4d3b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:25:58 +0100
Subject: [PATCH 13/25] Remove the disabled Flatpak CI job

The Flatpak job has been disabled with "if: false" and never ran. The manifest in dist/linux/flatpak stays, so the job can be brought back from history once the Flatpak build works again.
---
 .github/workflows/main.yml | 31 -------------------------------
 1 file changed, 31 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4f50f08..4f06fe6 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -460,37 +460,6 @@ jobs:
         cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
         make -j5
 
-
-
-  Flatpak:
-    runs-on: ubuntu-latest
-    if: false
-    container:
-      image: docker.io/bilelmoussaoui/flatpak-github-actions
-      options: --privileged
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 1
-    - uses: bilelmoussaoui/flatpak-github-actions@v2
-      with:
-        bundle: "app.Lith.Lith.flatpak"
-        manifest-path: "dist/linux/flatpak/app.Lith.Lith.json"
-    - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
-      uses: actions/upload-artifact@v4
-      with:
-        name: app.Lith.Lith.flatpak
-        path: app.Lith.Lith.flatpak
-    - name: Upload to GitHub
-      if: github.event_name == 'create'
-      run: |
-        VERSION_NAME=$(./dist/get-version-name.sh)
-        if [[ "$VERSION_NAME" != "" ]]; then
-            ./dist/upload-github-release-asset.sh github_api_token=${{ secrets.GITHUB_TOKEN }} tag="v${VERSION_NAME}" filename="app.Lith.Lith.flatpak" renameto="Lith-linux-${VERSION_NAME}.flatpak"
-        fi
-
-
   macOS:
     runs-on: macos-26
     steps:

From 8622d9b9c7365d71f8822d7a1193a27e4b168202 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:26:44 +0100
Subject: [PATCH 14/25] Compute the version before entering the build directory
 on Linux

Both Linux jobs ran ./dist/get-version-name.sh after changing into the build directory, where the script doesn't exist, so the version was always empty. It's now determined from the repository root like in the other jobs.
---
 .github/workflows/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4f06fe6..5037704 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -411,10 +411,10 @@ jobs:
 
     - name: Build the application
       run: |
+        export VERSION_NAME=$(./dist/get-version-name.sh)
         mkdir build
         cd build
         export CPM_SOURCE_CACHE=~/cpm-cache
-        export VERSION_NAME=$(./dist/get-version-name.sh)
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
         cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
         make -j5
@@ -452,10 +452,10 @@ jobs:
 
     - name: Build the application
       run: |
+        export VERSION_NAME=$(./dist/get-version-name.sh)
         mkdir build
         cd build
         export CPM_SOURCE_CACHE=~/cpm-cache
-        export VERSION_NAME=$(./dist/get-version-name.sh)
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
         cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
         make -j5

From fb8cbaea0d42c6f3bace50f599e49d8c9bdf7807 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:27:18 +0100
Subject: [PATCH 15/25] Pass the version to CMake as LITH_VERSION on Windows
 and Linux

The Windows and Linux jobs passed the version as -DVERSION, which CMake never reads, so their builds always fell back to the version from git describe. They now use LITH_VERSION like the iOS and macOS builds.
---
 .github/workflows/main.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5037704..62af698 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -291,7 +291,7 @@ jobs:
         cd build_win
         export CPM_SOURCE_CACHE=~/cpm-cache
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
-        "/c/Program Files/CMake/bin/cmake.exe" .. -GNinja -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME
+        "/c/Program Files/CMake/bin/cmake.exe" .. -GNinja -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DLITH_VERSION=$VERSION_NAME
         "/c/Program Files/CMake/bin/cmake.exe" --build . --config Release
         "/c/Program Files/CMake/bin/cmake.exe" --install . --config Release
     - name: Windeployqt + zip
@@ -353,7 +353,7 @@ jobs:
         cd build_win
         export CPM_SOURCE_CACHE=~/cpm-cache
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
-        "/c/Program Files/CMake/bin/cmake.exe" .. -GNinja -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME
+        "/c/Program Files/CMake/bin/cmake.exe" .. -GNinja -DCMAKE_INSTALL_PREFIX=installed -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DLITH_VERSION=$VERSION_NAME
         "/c/Program Files/CMake/bin/cmake.exe" --build . --config Release
         "/c/Program Files/CMake/bin/cmake.exe" --install . --config Release
     - name: Windeployqt + zip
@@ -416,7 +416,7 @@ jobs:
         cd build
         export CPM_SOURCE_CACHE=~/cpm-cache
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
-        cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
+        cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DLITH_VERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
         make -j5
 
   Linux-ARM:
@@ -457,7 +457,7 @@ jobs:
         cd build
         export CPM_SOURCE_CACHE=~/cpm-cache
         export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
-        cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DVERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
+        cmake .. -DCMAKE_BUILD_TYPE=Release -DIMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} -DLITH_VERSION=$VERSION_NAME -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
         make -j5
 
   macOS:

From a90c1f06cf4795605629c580c84c489d1d12c4d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:28:07 +0100
Subject: [PATCH 16/25] Update the GitHub Pages actions

configure-pages, upload-pages-artifact and deploy-pages were several major versions behind; they're updated together to configure-pages@v6, upload-pages-artifact@v5 and deploy-pages@v5. The deployed directory has no hidden files, which newer upload-pages-artifact versions exclude by default.
---
 .github/workflows/main.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 62af698..1c61213 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -247,16 +247,16 @@ jobs:
 
     - name: Setup Pages
       if: github.event_name == 'create'
-      uses: actions/configure-pages@v3
+      uses: actions/configure-pages@v6
     - name: Upload artifact
       if: github.event_name == 'create'
-      uses: actions/upload-pages-artifact@v3
+      uses: actions/upload-pages-artifact@v5
       with:
         path: 'installed/'
     - name: Deploy to GitHub Pages
       id: deployment
       if: github.event_name == 'create'
-      uses: actions/deploy-pages@v4
+      uses: actions/deploy-pages@v5
 
   Windows-MSVC:
     runs-on: windows-latest

From 6af19d0eb9d9c136995c9743c3182f45874594fc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:28:15 +0100
Subject: [PATCH 17/25] Update the CodeQL action to v4

github/codeql-action v3 is being deprecated in favor of v4, which runs on Node 24.
---
 .github/workflows/codeql.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c96b245..7e113d0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -73,7 +73,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -86,7 +86,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
     # If this step fails, then you should remove it and run the build manually (see below)
     # - name: Autobuild
-    #   uses: github/codeql-action/autobuild@v2
+    #   uses: github/codeql-action/autobuild@v4
 
     - name: Build the application
       run: |
@@ -108,6 +108,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
       with:
         category: "/language:${{matrix.language}}"

From 71d8b04152b58d06e7d7df940bd065864b81ef05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:31:09 +0100
Subject: [PATCH 18/25] Run release builds on tag pushes instead of the create
 event

The create event, used to publish releases, fires for new branches as well as tags and can't be filtered by ref type, so creating a branch started an extra run of the whole workflow on top of the push one. Releases are now triggered by pushing a v* tag, and the release-only steps check for a tag ref instead of the event name.
---
 .github/workflows/main.yml | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 1c61213..67ac951 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -4,10 +4,11 @@ on:
   push:
     branches:
       - '**'
+    tags:
+      - 'v*'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ "master" ]
-  create:
 
 env:
     QT_VERSION: '6.12.0'
@@ -92,20 +93,20 @@ jobs:
         export CPM_SOURCE_CACHE=~/cpm-cache
         IMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} bash ./dist/ios/build.sh
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: Lith.ipa
         path: build_ios/Lith.ipa
     - name: Upload to GitHub
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         export VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
             ./dist/upload-github-release-asset.sh github_api_token="${{ secrets.GITHUB_TOKEN }}" tag="v${VERSION_NAME}" filename="build_ios/Lith.ipa" renameto="Lith-iOS-${VERSION_NAME}.ipa"
         fi
     - name: Upload to Testflight
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         export VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
@@ -179,13 +180,13 @@ jobs:
         export ANDROID_NDK_ROOT="${ANDROID_NDK}"
         IMGUR_API_KEY=${{ secrets.IMGUR_API_KEY }} bash ./dist/android/build.sh
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: android-build-debug.apk
         path: build_android/app/android-build/Lith.apk
     - name: Upload to GitHub
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
@@ -246,16 +247,16 @@ jobs:
         cp dist/wasm/enable-threads.js installed/enable-threads.js
 
     - name: Setup Pages
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       uses: actions/configure-pages@v6
     - name: Upload artifact
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       uses: actions/upload-pages-artifact@v5
       with:
         path: 'installed/'
     - name: Deploy to GitHub Pages
       id: deployment
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       uses: actions/deploy-pages@v5
 
   Windows-MSVC:
@@ -304,14 +305,14 @@ jobs:
         "$QT_ROOT_DIR"/bin/windeployqt.exe Lith.exe LithCore.dll LithStyle.dll LithUI.dll --verbose 2 --release --compiler-runtime --qmldir ../..
         7z a ../../Lith.zip *
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: Lith.zip
         path: Lith.zip
     - name: Upload to GitHub
       shell: bash
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
@@ -366,14 +367,14 @@ jobs:
         "$QT_ROOT_DIR"/bin/windeployqt.exe Lith.exe LithCore.dll LithStyle.dll LithUI.dll --verbose 2 --release --compiler-runtime --qmldir ../..
         7z a ../../Lith-ARM.zip *
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: Lith-ARM.zip
         path: Lith-ARM.zip
     - name: Upload to GitHub
       shell: bash
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then
@@ -547,13 +548,13 @@ jobs:
             xcrun stapler staple build_macos/app/Lith.dmg
         fi
     - name: Upload artifacts to GitHub
-      if: github.event_name != 'create'
+      if: github.ref_type != 'tag'
       uses: actions/upload-artifact@v4
       with:
         name: Lith.dmg
         path: build_macos/app/Lith.dmg
     - name: Upload to GitHub
-      if: github.event_name == 'create'
+      if: github.ref_type == 'tag'
       run: |
         VERSION_NAME=$(./dist/get-version-name.sh)
         if [[ "$VERSION_NAME" != "" ]]; then

From 1c580e13c3f7d0810f1dab84325749e49a865915 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:35:59 +0100
Subject: [PATCH 19/25] Install Qt with Python 3.14 on Windows

install-qt-action sets up the newest Python (now 3.15) to run aqtinstall, but py7zr's compiled dependencies (pyppmd, pybcj, inflate64, psutil, pycryptodomex) don't have Windows wheels for Python 3.15 yet, so installing them failed and with it the whole Windows build. Both Windows jobs now set up Python 3.14 themselves and tell install-qt-action to use it.
---
 .github/workflows/main.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 67ac951..929868d 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -274,12 +274,18 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-cpm-
 
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        # py7zr's compiled dependencies don't have Windows wheels for Python 3.15 yet
+        python-version: '3.14'
     - name: Install Qt
       uses: jurplel/install-qt-action@v4
       with:
         version: ${{env.QT_VERSION}}
         modules: ${{env.QT_MODULES}}
         arch: win64_msvc2022_64
+        setup-python: false
         cache: true
         cache-key-prefix: ${{ github.job }}-qt
 
@@ -334,6 +340,11 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-cpm-
 
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        # py7zr's compiled dependencies don't have Windows wheels for Python 3.15 yet
+        python-version: '3.14'
     - name: Install Qt
       uses: jurplel/install-qt-action@v4
       with:
@@ -342,6 +353,7 @@ jobs:
         host: windows_arm64
         target: desktop
         arch: win64_msvc2022_arm64
+        setup-python: false
         cache: true
         cache-key-prefix: ${{ github.job }}-qt
 

From 8537aed2d96b99e3a76c6adc7f90a74ccb23415d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:50:19 +0100
Subject: [PATCH 20/25] Forward the build configuration to the other Android
 ABI builds

With QT_ANDROID_BUILD_ALL_ABIS, Qt configures every ABI except the main one in a separate CMake subproject that doesn't inherit the main project's cache. The arm64-v8a build therefore didn't get ANDROID_OPENSSL_PATH and fell back to the default location in the Android SDK, where OpenSSL isn't installed, and it would have also been built without the Imgur API key and version. These variables are now forwarded through QT_ANDROID_MULTI_ABI_FORWARD_VARS.
---
 CMakeLists.txt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index c6aa2d9..241ace3 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -44,6 +44,8 @@ endif()
 
 if(CMAKE_SYSTEM_NAME STREQUAL "Android")
     set(ANDROID_OPENSSL_PATH "${ANDROID_SDK_ROOT}/android_openssl/ssl_3" CACHE STRING "Path to the folder with https://github.com/KDAB/android_openssl.git")
+    # The subprojects building the other ABIs with QT_ANDROID_BUILD_ALL_ABIS don't inherit the cache
+    set(QT_ANDROID_MULTI_ABI_FORWARD_VARS "ANDROID_OPENSSL_PATH;IMGUR_API_KEY;LITH_VERSION;LITH_VERSION_RELEASEDATE")
 endif()
 
 set(LITH_VERSION "0.0.0" CACHE STRING "This is where we start working with the version string as passed from the build script")

From a3118363c338c6235f0ad39da0c97770e65a3540 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 15:58:13 +0100
Subject: [PATCH 21/25] Install Qt for Windows x64 with an unreleased
 aqtinstall

Since Qt 6.11 the online repository keeps each Windows x64 compiler in its own folder (e.g. qt6_6120/qt6_6120_msvc2022_64) instead of a single qt6_6120/qt6_6120 one. aqtinstall 3.3.0, the latest release and install-qt-action's default, still looks for the old folder and fails with "Failed to locate XML data for Qt version '6.12.0'". Support for the new layout (miurahr/aqtinstall#1000) is only on aqtinstall's master so far, so the Windows x64 job installs aqtinstall from a pinned master commit until a release contains it. Windows ARM64 keeps the old layout and the released aqtinstall.
---
 .github/workflows/main.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 929868d..df4017a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -286,6 +286,8 @@ jobs:
         modules: ${{env.QT_MODULES}}
         arch: win64_msvc2022_64
         setup-python: false
+        # Qt 6.11+ for Windows x64 needs aqtinstall newer than the latest release (3.3.0)
+        aqtsource: 'git+https://github.com/miurahr/aqtinstall.git@076e1659807d0b362a3ed684d54c2e9c775eb9c7'
         cache: true
         cache-key-prefix: ${{ github.job }}-qt
 

From d4df343f571e4c9e18b2c3f87a82aa2afa7174db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 16:01:33 +0100
Subject: [PATCH 22/25] Run the security-and-quality CodeQL suite

Without an explicit query suite CodeQL only ran the default one, which is limited to high-precision security queries, so it practically never reported anything for Lith. The security-and-quality suite adds the medium-precision security queries and the code quality ones (dead code, suspicious comparisons, resource leaks and similar). The manually traced build is now also stated explicitly as build-mode: manual.
---
 .github/workflows/codeql.yml | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7e113d0..c2e2a01 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -76,12 +76,9 @@ jobs:
       uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
+        build-mode: manual
+        # The default suite only runs high-precision security queries
+        queries: security-and-quality
 
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
     # If this step fails, then you should remove it and run the build manually (see below)

From cc1ffa5e8836e3b552e7cdb903d0756150e23cc5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 16:21:32 +0100
Subject: [PATCH 23/25] Add a clang-tidy configuration

Enables the bugprone, clang-analyzer and performance checks plus a few targeted ones (slicing, missing virtual destructors, redundant expressions, override and nullptr), without checks that are mostly noise for this code base, like NewDeleteLeaks reporting QObjects owned by their parent. IDEs and clang-tidy pick the file up automatically.
---
 .clang-tidy | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .clang-tidy

diff --git a/.clang-tidy b/.clang-tidy
new file mode 100644
index 0000000..31bccee
--- /dev/null
+++ b/.clang-tidy
@@ -0,0 +1,24 @@
+---
+# clang-analyzer-cplusplus.NewDeleteLeaks reports QObjects owned by their parent as leaks
+Checks: >
+  -*,
+  bugprone-*,
+  -bugprone-easily-swappable-parameters,
+  -bugprone-narrowing-conversions,
+  -bugprone-exception-escape,
+  clang-analyzer-*,
+  -clang-analyzer-cplusplus.NewDeleteLeaks,
+  cppcoreguidelines-slicing,
+  cppcoreguidelines-virtual-class-destructor,
+  misc-redundant-expression,
+  misc-unused-using-decls,
+  modernize-use-nullptr,
+  modernize-use-override,
+  performance-*,
+  -performance-enum-size,
+  readability-misleading-indentation,
+  readability-redundant-smartptr-get
+WarningsAsErrors: ''
+HeaderFilterRegex: '/(app|modules)/'
+FormatStyle: file
+...

From ff84d875bd2d092e69b896b086fa91bb46d4bcea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 16:21:32 +0100
Subject: [PATCH 24/25] Check changed code with clang-tidy and clazy in CI

A new workflow runs clang-tidy and clazy (level1 checks) on every push and pull request. Only the translation units touched by the change are analyzed, and only diagnostics on added or modified lines are reported, so existing warnings don't bury the new ones. New findings show up as annotations on the changed lines and in the job summary, and they fail the job. The work is done by dist/ci/static-analysis.py, which can also be run locally on a Clang build with a compilation database. The job runs on Ubuntu 26.04, where clazy is built against the same LLVM 21 as the clang and clang-tidy it uses.
---
 .github/workflows/static-analysis.yml |  87 ++++++++++++++
 dist/ci/static-analysis.py            | 165 ++++++++++++++++++++++++++
 2 files changed, 252 insertions(+)
 create mode 100644 .github/workflows/static-analysis.yml
 create mode 100755 dist/ci/static-analysis.py

diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
new file mode 100644
index 0000000..4894293
--- /dev/null
+++ b/.github/workflows/static-analysis.yml
@@ -0,0 +1,87 @@
+name: Static analysis
+
+on:
+  pull_request:
+    branches: [ "master" ]
+
+env:
+    QT_VERSION: '6.12.0'
+    QT_MODULES: 'qtmultimedia qtwebsockets qtimageformats'
+    # clazy is built against this LLVM version in the runner's Ubuntu release
+    LLVM_VERSION: '21'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  clang-tidy-clazy:
+    name: clang-tidy and clazy on changed code
+    runs-on: ubuntu-26.04
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Find the base commit
+      id: base
+      env:
+        PR_BASE: ${{ github.event.pull_request.base.sha }}
+        PUSH_BEFORE: ${{ github.event.before }}
+        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      run: |
+        if [[ -n "$PR_BASE" ]]; then
+            BASE="$PR_BASE"
+        elif [[ -n "$PUSH_BEFORE" && ! "$PUSH_BEFORE" =~ ^0+$ ]] && git cat-file -e "$PUSH_BEFORE^{commit}" 2>/dev/null; then
+            BASE="$PUSH_BEFORE"
+        else
+            # New branches and force pushes are compared to where they forked off
+            BASE="$(git merge-base HEAD "origin/$DEFAULT_BRANCH")"
+        fi
+        echo "Comparing to $BASE"
+        echo "sha=$BASE" >> "$GITHUB_OUTPUT"
+        if git diff --quiet "$BASE" -- '*.cpp' '*.cc' '*.cxx' '*.mm' '*.h' '*.hpp'; then
+            echo "No C++ changes, nothing to analyze"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Install dependencies
+      if: steps.base.outputs.skip != 'true'
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y clang-${LLVM_VERSION} clang-tidy-${LLVM_VERSION} clazy ninja-build libxkbcommon-dev libsecret-1-dev
+
+    - name: Set up CPM cache
+      if: steps.base.outputs.skip != 'true'
+      uses: actions/cache@v4
+      with:
+        path: ~/cpm-cache
+        key: ${{ runner.os }}-cpm-${{ hashFiles('CMakeLists.txt') }}
+        restore-keys: |
+          ${{ runner.os }}-cpm-
+
+    - name: Install Qt
+      if: steps.base.outputs.skip != 'true'
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{env.QT_VERSION}}
+        modules: ${{env.QT_MODULES}}
+        cache: true
+        cache-key-prefix: ${{ github.job }}-qt
+
+    # The analysis needs the compilation database and the sources generated during the build
+    - name: Build with Clang
+      if: steps.base.outputs.skip != 'true'
+      run: |
+        export CPM_SOURCE_CACHE=~/cpm-cache
+        export CMAKE_PREFIX_PATH="$QT_ROOT_DIR"/lib/cmake
+        cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang-${LLVM_VERSION} -DCMAKE_CXX_COMPILER=clang++-${LLVM_VERSION} -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DLITH_BUILD_TESTS=ON -DLITH_FORCE_DOWNLOAD_DEPENDENCIES=ON
+        cmake --build build
+
+    - name: Run clang-tidy and clazy
+      if: steps.base.outputs.skip != 'true'
+      run: |
+        ./dist/ci/static-analysis.py --build-dir build --base "${{ steps.base.outputs.sha }}" --clang-tidy clang-tidy-${LLVM_VERSION} --clazy clazy-standalone
diff --git a/dist/ci/static-analysis.py b/dist/ci/static-analysis.py
new file mode 100755
index 0000000..b785e96
--- /dev/null
+++ b/dist/ci/static-analysis.py
@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+"""Runs clang-tidy and clazy on the C++ code changed since a base commit.
+
+Only diagnostics on lines added or modified since the base commit are reported, so
+warnings already present in the code base don't hide the ones a change introduces.
+Requires a compilation database (CMAKE_EXPORT_COMPILE_COMMANDS) of a build in which the
+generated sources already exist. In GitHub Actions, findings are emitted as annotations.
+
+Example: dist/ci/static-analysis.py --build-dir build --base origin/master
+"""
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass
+from pathlib import Path
+
+SOURCE_SUFFIXES = (".cpp", ".cc", ".cxx", ".mm")
+HEADER_SUFFIXES = (".h", ".hpp")
+DIAGNOSTIC = re.compile(
+    r"^(?P<file>[^\n:]+):(?P<line>\d+):(?P<col>\d+): (?P<level>warning|error): (?P<message>.*?)(?: \[(?P<check>[^\]\s]+)\])?$"
+)
+
+
+@dataclass(frozen=True)
+class Finding:
+    tool: str
+    file: str
+    line: int
+    col: int
+    check: str
+    message: str
+
+
+def git(*args: str) -> str:
+    return subprocess.run(["git", *args], check=True, capture_output=True, text=True).stdout
+
+
+def changed_lines(base: str) -> dict[str, set[int]]:
+    """Lines added or modified in the working tree since base, keyed by repository-relative path."""
+    pathspecs = [f"*{suffix}" for suffix in SOURCE_SUFFIXES + HEADER_SUFFIXES]
+    diff = git("diff", "--unified=0", "--no-color", "--no-ext-diff", "--diff-filter=AM", base, "--", *pathspecs)
+    result: dict[str, set[int]] = {}
+    current = None
+    for line in diff.splitlines():
+        if line.startswith("+++ "):
+            current = line[len("+++ b/") :] if line.startswith("+++ b/") else None
+        elif line.startswith("@@") and current:
+            match = re.match(r"@@ -\S+ \+(\d+)(?:,(\d+))? @@", line)
+            start, count = int(match[1]), int(match[2] if match[2] is not None else 1)
+            if count:
+                result.setdefault(current, set()).update(range(start, start + count))
+    return result
+
+
+def translation_units(build_dir: Path, root: Path, changed: dict[str, set[int]]) -> list[Path]:
+    """Sources to analyze: the changed ones, and for changed headers the sources including them."""
+    database = json.loads((build_dir / "compile_commands.json").read_text())
+    sources = set()
+    for entry in database:
+        path = Path(entry["directory"], entry["file"]).resolve()
+        if path.is_relative_to(root) and not path.is_relative_to(build_dir) and "_deps" not in path.parts:
+            sources.add(path)
+
+    units = set()
+    for relative in changed:
+        path = root / relative
+        if path.suffix in SOURCE_SUFFIXES:
+            if path in sources:
+                units.add(path)
+            continue
+        siblings = {source for source in sources if source.parent == path.parent and source.stem == path.stem}
+        if siblings:
+            units |= siblings
+            continue
+        include = re.compile(rf'#\s*include\s*["<](?:[^">]*/)?{re.escape(path.name)}[">]')
+        units |= {source for source in sources if include.search(source.read_text(errors="replace"))}
+    return sorted(units)
+
+
+def run_tool(tool: str, command: list[str], root: Path) -> tuple[set[Finding], str]:
+    process = subprocess.run(command, capture_output=True, text=True, cwd=root)
+    findings = set()
+    for line in (process.stdout + process.stderr).splitlines():
+        match = DIAGNOSTIC.match(line)
+        if not match:
+            continue
+        check = match["check"] or ""
+        # Plain compiler diagnostics aren't the job of either tool here
+        if tool == "clazy" and not check.startswith("-Wclazy-"):
+            continue
+        if tool == "clang-tidy" and (not check or check.startswith("clang-diagnostic-")):
+            continue
+        path = Path(root, match["file"]).resolve()
+        if not path.is_relative_to(root):
+            continue
+        findings.add(
+            Finding(tool, str(path.relative_to(root)), int(match["line"]), int(match["col"]), check.removeprefix("-W"), match["message"])
+        )
+    failed = process.returncode != 0 and not findings
+    return findings, (process.stderr.strip() if failed else "")
+
+
+def escape(value: str, is_property: bool = False) -> str:
+    value = value.replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
+    return value.replace(":", "%3A").replace(",", "%2C") if is_property else value
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--build-dir", required=True, type=Path, help="build directory with compile_commands.json")
+    parser.add_argument("--base", required=True, help="commit to compare the working tree to")
+    parser.add_argument("--clang-tidy", default="clang-tidy")
+    parser.add_argument("--clazy", default="clazy-standalone")
+    parser.add_argument("--clazy-checks", default="level1")
+    parser.add_argument("--jobs", type=int, default=os.cpu_count())
+    args = parser.parse_args()
+
+    root = Path(git("rev-parse", "--show-toplevel").strip()).resolve()
+    build_dir = args.build_dir.resolve()
+    changed = changed_lines(args.base)
+    units = translation_units(build_dir, root, changed)
+    print(f"{len(changed)} changed C++ files, analyzing {len(units)} translation units", flush=True)
+
+    commands = []
+    for unit in units:
+        commands.append(("clang-tidy", [args.clang_tidy, "-p", str(build_dir), "--quiet", str(unit)]))
+        commands.append(("clazy", [args.clazy, "-p", str(build_dir), f"-checks={args.clazy_checks}", str(unit)]))
+
+    findings: set[Finding] = set()
+    with ThreadPoolExecutor(max_workers=args.jobs) as pool:
+        for (tool, command), (result, error) in zip(commands, pool.map(lambda c: run_tool(c[0], c[1], root), commands)):
+            findings |= result
+            if error:
+                print(f"{tool} failed on {command[-1]}:\n{error}", file=sys.stderr)
+
+    new = sorted((f for f in findings if f.line in changed.get(f.file, ())), key=lambda f: (f.file, f.line, f.col, f.tool))
+    in_actions = os.environ.get("GITHUB_ACTIONS") == "true"
+    for f in new:
+        if in_actions:
+            title = escape(f"{f.tool}: {f.check}", True)
+            print(f"::warning file={escape(f.file, True)},line={f.line},col={f.col},title={title}::{escape(f.message)}")
+        else:
+            print(f"{f.file}:{f.line}:{f.col}: {f.message} [{f.tool}: {f.check}]")
+
+    summary = os.environ.get("GITHUB_STEP_SUMMARY")
+    if summary:
+        with open(summary, "a") as out:
+            out.write(f"### Static analysis of changed code\n\n{len(new)} new findings in {len(units)} analyzed translation units.\n")
+            if new:
+                out.write("\n| Location | Tool | Check | Message |\n|---|---|---|---|\n")
+                for f in new:
+                    message = f.message.replace("|", "\\|")
+                    out.write(f"| `{f.file}:{f.line}` | {f.tool} | `{f.check}` | {message} |\n")
+
+    print(f"{len(new)} new findings ({len(findings) - len(new)} more in unchanged lines of the analyzed files)")
+    return 1 if new else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

From 0767660c48231c6175443608da73c184d566cda2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20B=C5=99=C3=ADza?= <m@rtinbriza.cz>
Date: Sat, 31 Oct 2026 16:52:34 +0100
Subject: [PATCH 25/25] Update multi ABI forward variables in CMakeLists

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 CMakeLists.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 241ace3..20a5197 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -45,7 +45,7 @@ endif()
 if(CMAKE_SYSTEM_NAME STREQUAL "Android")
     set(ANDROID_OPENSSL_PATH "${ANDROID_SDK_ROOT}/android_openssl/ssl_3" CACHE STRING "Path to the folder with https://github.com/KDAB/android_openssl.git")
     # The subprojects building the other ABIs with QT_ANDROID_BUILD_ALL_ABIS don't inherit the cache
-    set(QT_ANDROID_MULTI_ABI_FORWARD_VARS "ANDROID_OPENSSL_PATH;IMGUR_API_KEY;LITH_VERSION;LITH_VERSION_RELEASEDATE")
+    list(APPEND QT_ANDROID_MULTI_ABI_FORWARD_VARS ANDROID_OPENSSL_PATH IMGUR_API_KEY LITH_VERSION LITH_VERSION_RELEASEDATE LITH_FEATURE_KEYCHAIN LITH_FORCE_DOWNLOAD_DEPENDENCIES LITH_FORCE_LOCAL_PACKAGES_ONLY)
 endif()
 
 set(LITH_VERSION "0.0.0" CACHE STRING "This is where we start working with the version string as passed from the build script")