obviously drop vector

.github/workflows/check-branch-name.yml

@@ -1,6 +1,9 @@
 name: Check pull request head branch name
 
 on:
+  # Normally risky but the workflow doesn't interpolate any user controlled content.
+  # i.e. no ${{ }} expressions anywhere, and none that reference anything that can be
+  # written by the pr author. Does not check out and execute user controlled code.
   pull_request_target:
     types:
       - opened
@@ -11,9 +14,8 @@ jobs:
     if: github.head_ref == 'master' && github.repository == 'CleverRaven/Cataclysm-DDA'
     steps:
       - name: Post warning
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             await github.rest.issues.createComment({
               owner: context.repo.owner,

.github/workflows/detect-translation-file-changes.yml

@@ -2,6 +2,8 @@ name: Detect translation file changes
 
 
 on:
+  # Does not interpolate i.e. ${{ }} user controlled text into script.
+  # Does not checkout and run user controlled code.
   pull_request_target:
     paths:
       - lang/po/*.po

.github/workflows/iwyu.yml

@@ -3,9 +3,11 @@ on:
   push:
     branches:
     - master
+    - main
   pull_request:
     branches:
     - master
+    - main
     types: [opened, reopened, synchronize, ready_for_review]
 
 # We only care about the latest revision of a PR, so cancel all previous instances.
@@ -21,7 +23,7 @@ jobs:
     - name: check for relevant file changes
       id: changed-files
       if: ${{ github.event_name == 'pull_request' }}
-      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
       with:
         script: |
           const response = await github.paginate(github.rest.pulls.listFiles,
@@ -43,6 +45,8 @@ jobs:
 
   iwyu:
     needs: check-changes
+    outputs:
+      has_errors: ${{ steps.run_iwyu.outputs.has_errors }}
     if: ${{ needs.check-changes.outputs.should_run == 'true' }}
     runs-on: ubuntu-24.04
     env:
@@ -83,7 +87,7 @@ jobs:
         echo "IWYU_BIN_DIR=${PWD}/iwyu-build/bin">> "$GITHUB_OUTPUT"
     - name: determine changed files
       if: ${{ github.event_name == 'pull_request' }}
-      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
       with:
         script: |
           var fs = require('fs');
@@ -118,25 +122,62 @@ jobs:
         make includes -j4 --silent TILES=${TILES:-0} SOUND=${SOUND:-0} LOCALIZE=${LOCALIZE:-0}
     - uses: ammaraskar/gcc-problem-matcher@0f9c86f9e693db67dacf53986e1674de5f2e5f28 # master
     - name: run IWYU
+      id: run_iwyu
       working-directory: Cataclysm-DDA
       env:
         IWYU_SRC_DIR: ${{ steps.build-iwyu.outputs.IWYU_SRC_DIR }}
         IWYU_BIN_DIR: ${{ steps.build-iwyu.outputs.IWYU_BIN_DIR }}
       run: |
+        set +e
         PATH="${PATH}:${IWYU_BIN_DIR}:${IWYU_SRC_DIR}"
         python build-scripts/ci-iwyu-run.py
+        exit_code=$?
+        echo "has_errors=$exit_code" >> $GITHUB_OUTPUT
+        exit $exit_code
+    - name: Create pr comment artifacts
+      if: ${{ failure() && github.event_name == 'pull_request' && steps.run_iwyu.outputs.has_errors != 0 }}
+      working-directory: Cataclysm-DDA
+      run: |
+        set +e
+        cat files_changed | while read f; do
+          git add $f
+        done
+        git checkout .
+        git reset
+        git diff --exit-code
+        if [ $? -ne 0 ]; then
+          mkdir -p ../suggestions
+          git diff > ../suggestions/diff.txt
+          echo ${{ github.event.pull_request.number }} > ../suggestions/pr_number
+          echo ${{ github.event.pull_request.head.sha }} > ../suggestions/commit_sha
+          echo '[Include What You Use](https://github.com/akrieger/Cataclysm-DDA/blob/main/doc/c%2B%2B/DEVELOPER_TOOLING.md#include-what-you-use)' > ../suggestions/comment.txt
+        fi
+        exit 0 # Always 'succeed' this step to reduce job noise.
+    - name: Upload pr comment artifacts
+      if: ${{ failure() && github.event_name == 'pull_request' && steps.run_iwyu.outputs.has_errors != 0 }}
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      with:
+        name: suggestions
+        path: suggestions/
+
 
   iwyu-result:
-    if: ${{ always() }}
-    needs: [iwyu]
+    if: ${{ !cancelled() }}
+    needs: iwyu
     runs-on: ubuntu-latest
     steps:
     - name: require successful IWYU
+      env:
+        JOB_RESULT: ${{ needs.iwyu.result }}
+        JOB_ERRORS: ${{ needs.iwyu.outputs.has_errors }}
       run: |
-        result="${{ needs.iwyu.result }}"
-        if [ "$result" = "success" ] || [ "$result" = "skipped" ]; then
-          echo "IWYU result: $result"
+        if [[ "$JOB_RESULT" == "skipped" ]]; then
+          echo "IWYU result: skipped"
+          exit 0
+        fi
+        if [[ "$JOB_RESULT" == "success" && "$JOB_ERRORS" == "0" ]]; then
+          echo "IWYU result: success"
           exit 0
         fi
-        echo "IWYU failed with result: $result"
+        echo "IWYU failed with result: $JOB_RESULT"
         exit 1

.github/workflows/label-first-time-contributor.yml

@@ -1,34 +1,45 @@
 name: Sort new contributors for test approval
 
 on:
+  # Does not interpolate i.e. ${{ }} user controlled fields into the script.
+  # Does not check out and run user controlled code.
   pull_request_target:
     types:
       - opened
 
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  PR_NUMBER: ${{ github.event.pull_request.number }}
-
 jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Label contributors with no merged PRs
+        if: steps.pr-check.outputs.pr_count == 0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
-          persist-credentials: false
+          script: |
+            script: |
+              // Get a list of all issues created by the PR opener
+              // See: https://octokit.github.io/rest.js/#pagination
+              const creator = context.payload.sender.login
+              const opts = github.rest.pulls.list.endpoint.merge({
+                context.repo.owner,
+                context.repo.repo,
+                state: 'closed'
+              })
 
-      - name: Check if user has any merged PRs in this reposiory
-        id: pr-check
-        run: |
-          author="${GITHUB_EVENT_PULL_REQUEST_USER_LOGIN}"
-          pr_count=$(gh pr list --state merged --author $author --json number | jq 'length')
+              const this_pr = context.pull_request.number;
+              let is_new_contributor = true;
+              for await (const pr of github.paginate.iterator(opts)) {
+                if (pr.number !== this_pr && pr.merged_at !== null) {
+                  is_new_contributor = false;
+                  break;
+                }
+              }
 
-          echo "Debug: $author with $pr_count merged PRs."
-          echo "pr_count=$pr_count" >> $GITHUB_OUTPUT
-        env:
-          GITHUB_EVENT_PULL_REQUEST_USER_LOGIN: ${{ github.event.pull_request.user.login }}
-
-      - name: Label contributors with no merged PRs
-        if: steps.pr-check.outputs.pr_count == 0
-        run: |
-          gh pr edit "$PR_NUMBER" --add-label "new contributor"
+              if (is_new_contributor) {
+                await github.rest.issues.addLabels({
+                  issue_number: context.issue.number,
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  labels: ['new contributor']
+                })
+              }