Refactor/project structure

.dockerignore

@@ -1 +1,9 @@
-/build
+# Local build, docs and test output: large, stale and never read by the image build
+build/
+book/
+.venv/
+test/data/
+
+# .git is deliberately not ignored. The root CMakeLists runs git rev-parse to
+# stamp the commit into the version header, and without the repository the
+# released binary reports "unknown".

.github/workflows/build.yml

@@ -1,39 +1,34 @@
 name: Build
 
 on:
-  workflow_call
+  workflow_call:
+    inputs:
+      artifacts:
+        description: Build the full release artefact set, not just the cheap subset
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
 
 jobs:
   build_linux:
     strategy:
+      # Report both architectures independently; one failing says nothing about
+      # the other, and cancelling hides half the answer
+      fail-fast: false
       matrix:
         include:
           # AMD64 builds on ubuntu-24.04
           - arch: amd64
-            libc: glibc
-            runner: ubuntu-24.04
-            dockerfile: Dockerfile.glibc
-            platform: linux/amd64
-            binary_path: /usr/local/bin/mpqcli
-          - arch: amd64
-            libc: musl
+            asset: mpqcli-linux-x86_64
             runner: ubuntu-24.04
-            dockerfile: Dockerfile.musl
             platform: linux/amd64
-            binary_path: /mpqcli
           # ARM64 builds on ubuntu-24.04-arm
           - arch: arm64
-            libc: glibc
+            asset: mpqcli-linux-aarch64
             runner: ubuntu-24.04-arm
-            dockerfile: Dockerfile.glibc
             platform: linux/arm64
-            binary_path: /usr/local/bin/mpqcli
-          - arch: arm64
-            libc: musl
-            runner: ubuntu-24.04-arm
-            dockerfile: Dockerfile.musl
-            platform: linux/arm64
-            binary_path: /mpqcli
 
     runs-on: ${{ matrix.runner }}
     steps:
@@ -42,84 +37,76 @@ jobs:
         with:
           submodules: true
 
-      - name: Build Docker image (${{ matrix.arch }} ${{ matrix.libc }})
+      - name: Build Docker image (${{ matrix.arch }})
         run: |
-          docker build --platform ${{ matrix.platform }} -t mpqcli-${{ matrix.arch }}-${{ matrix.libc }} -f ${{ matrix.dockerfile }} .
+          docker build --platform ${{ matrix.platform }} -t mpqcli-${{ matrix.arch }} .
 
       - name: Extract binary from Docker image
         run: |
-          # Create a temporary container from the image
-          CONTAINER_ID=$(docker create mpqcli-${{ matrix.arch }}-${{ matrix.libc }})
-          # Copy the binary from the container
-          docker cp $CONTAINER_ID:${{ matrix.binary_path }} ./mpqcli-linux-${{ matrix.arch }}-${{ matrix.libc }}
-          # Clean up the container
+          CONTAINER_ID=$(docker create mpqcli-${{ matrix.arch }})
+          docker cp $CONTAINER_ID:/mpqcli ./${{ matrix.asset }}
           docker rm $CONTAINER_ID
 
-      - name: Verify binary
+      # Run the bytes that will ship: a static binary missing its loader builds
+      # without complaint and only fails here
+      - name: Smoke-run the artefact
         run: |
-          file ./mpqcli-linux-${{ matrix.arch }}-${{ matrix.libc }}
-          echo "Binary created: mpqcli-linux-${{ matrix.arch }}-${{ matrix.libc }}"
+          chmod +x ./${{ matrix.asset }}
+          ./${{ matrix.asset }} version
 
-      - name: Upload binary as artifact
+      - name: Upload binary as artefact
         uses: actions/upload-artifact@v7
         with:
-          name: mpqcli-linux-${{ matrix.arch }}-${{ matrix.libc }}
-          path: mpqcli-linux-${{ matrix.arch }}-${{ matrix.libc }}
+          name: ${{ matrix.asset }}
+          path: ${{ matrix.asset }}
           retention-days: 1
 
-  build_windows:
-    runs-on: windows-2022
-    steps:
-      - name: Check out repository code
-        uses: actions/checkout@v6
-        with:
-          submodules: true
-
-      - name: Run cmake
-        shell: bash
+      # The amd64 image is the one published. Saving it here rather than
+      # rebuilding it in a job of its own means release and prerelease push
+      # exactly the bytes this job smoke-ran. Only they consume it, so a pull
+      # request skips the save.
+      - name: Save Docker image as a tar file
+        if: matrix.arch == 'amd64' && inputs.artifacts
         run: |
-          cmake -B build \
-          -G "Visual Studio 17 2022" \
-          -A x64 \
-          -DBUILD_MPQCLI=ON
-
-      - name: Compile project
-        run: cmake --build build --config Release
-
-      - name: Check mpqcli version
-        run: build/bin/Release/mpqcli.exe version
-
-      - name: Copy mpqcli binary
-        run: cp build/bin/Release/mpqcli.exe build/bin/mpqcli-windows-amd64.exe
+          docker tag mpqcli-${{ matrix.arch }} mpqcli
+          docker save mpqcli -o mpqcli-docker.tar
 
-      - name: Upload Artifact
+      - name: Upload Docker image as artefact
+        if: matrix.arch == 'amd64' && inputs.artifacts
         uses: actions/upload-artifact@v7
         with:
-          name: mpqcli-windows-amd64.exe
-          path: build/bin/mpqcli-windows-amd64.exe
+          name: mpqcli-docker
+          path: mpqcli-docker.tar
           retention-days: 1
 
-  build_docker:
-    runs-on: ubuntu-24.04
+  # Gated on the full artefact set: test.yml already compiles this platform, so
+  # a pull request learns nothing from a second Windows build, and the runner
+  # bills at twice a Linux one
+  build_windows:
+    if: inputs.artifacts
+    runs-on: windows-2022
     steps:
       - name: Check out repository code
         uses: actions/checkout@v6
         with:
           submodules: true
 
-      # For the distributable Docker image we use musl
-      # This results in a smaller image size
-      - name: Build Docker image (AMD64)
+      # Raw cmake rather than make: the Makefile needs a POSIX shell, and the
+      # shipped build gets its own tree rather than the everyday build/dev
+      - name: Build
+        shell: bash
         run: |
-          docker build --platform linux/amd64 -t mpqcli -f Dockerfile.musl .
+          cmake -B build/release -G "Visual Studio 17 2022" -A x64 -DMPQCLI_BUILD_APP=ON
+          cmake --build build/release --config Release
+          mv build/release/bin/mpqcli.exe ./mpqcli-windows-x86_64.exe
 
-      - name: Save Docker image as a tar file
-        run: |
-          docker save mpqcli -o mpqcli-docker.tar
+      - name: Smoke-run the artefact
+        shell: bash
+        run: ./mpqcli-windows-x86_64.exe version
 
-      - name: Upload Docker image as artifact
+      - name: Upload binary as artefact
         uses: actions/upload-artifact@v7
         with:
-          name: mpqcli-docker
-          path: mpqcli-docker.tar
+          name: mpqcli-windows-x86_64.exe
+          path: mpqcli-windows-x86_64.exe
           retention-days: 1

.github/workflows/docs.yml

@@ -15,11 +15,8 @@ concurrency:
   group: "pages"
   cancel-in-progress: false
 
-# Required permissions for GitHub Pages deployment
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 env:
   MDBOOK_VERSION: 0.5.4
@@ -46,14 +43,18 @@ jobs:
       - name: Build docs
         run: make docs_build
 
-      - name: Upload Pages artifact
+      - name: Upload Pages artefact
         uses: actions/upload-pages-artifact@v5
         with:
           path: book/
 
   deploy:
     needs: build
     runs-on: ubuntu-24.04
+    # Only the deploy job publishes, so only it gets the Pages permissions
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/lint.yml

@@ -3,6 +3,9 @@ name: Lint
 on:
   workflow_call
 
+permissions:
+  contents: read
+
 jobs:
   lint_cpp:
     runs-on: ubuntu-24.04
@@ -12,10 +15,7 @@ jobs:
         with:
           submodules: true
 
-      - run: make install_clang_tools
-
-      - run: make configure
-
-      - run: make fmt_check
+      - name: Install clang tools
+        run: sudo apt-get install -y clang-18 clang-format-18 clang-tidy-18
 
-      - run: make lint_cpp
+      - run: make check_all

.github/workflows/main.yml

@@ -10,33 +10,39 @@ on:
       - ".clang-format"
       - ".clang-tidy"
       - "src/**"
+      - "app/**"
+      - "cmake/**"
+      - "completion/**"
       - "extern/**"
       - "test/**"
       - "CMakeLists.txt"
-      - "Dockerfile.glibc"
-      - "Dockerfile.musl"
+      - "Dockerfile"
+      - ".dockerignore"
+      - ".gpipe.yml"
 
+# Never cancel on main. The prerelease job deletes the dev release, recreates
+# its tag and pushes the image; a run cancelled part-way through leaves those
+# three disagreeing with each other, which costs more than the runner minutes
+# cancelling would save.
 concurrency:
-  group: prerelease
-  cancel-in-progress: true
+  group: main-${{ github.ref }}
+  cancel-in-progress: false
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
-  build:
-    uses: ./.github/workflows/build.yml
   lint:
     uses: ./.github/workflows/lint.yml
-    needs: build
   test:
     uses: ./.github/workflows/test.yml
-    needs: build
+  build:
+    uses: ./.github/workflows/build.yml
+    with:
+      artifacts: true
   prerelease:
     uses: ./.github/workflows/prerelease.yml
-    needs: 
-      - build
-      - lint
-      - test
-    secrets: inherit
+    needs: [build, lint, test]
+    permissions:
+      contents: write
+      packages: write

.github/workflows/pr.yml

@@ -4,24 +4,35 @@ on:
   pull_request:
     paths:
       - ".github/workflows/**"
+      - "Makefile"
       - ".clang-format"
       - ".clang-tidy"
       - "src/**"
+      - "app/**"
+      - "cmake/**"
+      - "completion/**"
       - "extern/**"
       - "test/**"
       - "CMakeLists.txt"
-      - "Dockerfile.glibc"
-      - "Dockerfile.musl"
+      - "Dockerfile"
+      - ".dockerignore"
+      - ".gpipe.yml"
+
+# Grouped by pull request number, so a push only ever supersedes an earlier run of
+# its own branch and never one somebody else is waiting on
+concurrency:
+  group: pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
 
+# No needs between the three: lint configures its own tree, test builds what it
+# runs, and nothing reads build's artefacts until a release
 jobs:
-  build:
-    uses: ./.github/workflows/build.yml
   lint:
     uses: ./.github/workflows/lint.yml
-    needs: build
   test:
     uses: ./.github/workflows/test.yml
-    needs: build
+  build:
+    uses: ./.github/workflows/build.yml