Update main to AP v0.6.7

.github/pyright-config.json

@@ -3,6 +3,7 @@
     "../BizHawkClient.py",
     "../Patch.py",
     "../rule_builder/cached_world.py",
+    "../rule_builder/field_resolvers.py",
     "../rule_builder/options.py",
     "../rule_builder/rules.py",
     "../test/param.py",

.github/workflows/analyze-modified-files.yml

@@ -14,6 +14,8 @@ env:
   BEFORE: ${{ github.event.before }}
   AFTER: ${{ github.event.after }}
 
+permissions: {}
+
 jobs:
   flake8-or-mypy:
     strategy:
@@ -25,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
 
       - name: "Determine modified files (pull_request)"
         if: github.event_name == 'pull_request'
@@ -50,7 +52,7 @@ jobs:
         run: |
           echo "diff=." >> $GITHUB_ENV
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6.2.0
         if: env.diff != ''
         with:
           python-version: '3.11'

.github/workflows/build.yml

@@ -41,17 +41,17 @@ jobs:
     runs-on: windows-latest
     steps:
       # - copy code below to release.yml -
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - name: Install python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: '~3.12.7'
           check-latest: true
       - name: Download run-time dependencies
         run: |
           Invoke-WebRequest -Uri https://github.com/Ijwu/Enemizer/releases/download/${Env:ENEMIZER_VERSION}/win-x64.zip -OutFile enemizer.zip
           Expand-Archive -Path enemizer.zip -DestinationPath EnemizerCLI -Force
-          choco install innosetup --version=6.2.2 --allow-downgrade
+          choco install innosetup --version=6.7.0 --allow-downgrade
       - name: Build
         run: |
           python -m pip install --upgrade pip
@@ -82,7 +82,7 @@ jobs:
       # - copy code above to release.yml -
       - name: Attest Build
         if: ${{ github.event_name == 'workflow_dispatch' }}
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest@v4.1.0
         with:
           subject-path: |
             build/exe.*/ArchipelagoLauncher.exe
@@ -110,33 +110,32 @@ jobs:
           cp Players/Templates/VVVVVV.yaml Players/
           timeout 30 ./ArchipelagoGenerate
       - name: Store 7z
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.0
         with:
-          name: ${{ env.ZIP_NAME }}
           path: dist/${{ env.ZIP_NAME }}
-          compression-level: 0  # .7z is incompressible by zip
+          archive: false
           if-no-files-found: error
           retention-days: 7  # keep for 7 days, should be enough
       - name: Store Setup
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.0
         with:
-          name: ${{ env.SETUP_NAME }}
           path: setups/${{ env.SETUP_NAME }}
+          archive: false
           if-no-files-found: error
           retention-days: 7  # keep for 7 days, should be enough
 
   build-ubuntu2204:
     runs-on: ubuntu-22.04
     steps:
       # - copy code below to release.yml -
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - name: Install base dependencies
         run: |
           sudo apt update
           sudo apt -y install build-essential p7zip xz-utils wget libglib2.0-0
           sudo apt -y install python3-gi libgirepository1.0-dev  # should pull dependencies for gi installation below
       - name: Get a recent python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: '~3.12.7'
           check-latest: true
@@ -173,7 +172,7 @@ jobs:
       # - copy code above to release.yml -
       - name: Attest Build
         if: ${{ github.event_name == 'workflow_dispatch' }}
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest@v4.1.0
         with:
           subject-path: |
             build/exe.*/ArchipelagoLauncher
@@ -204,17 +203,17 @@ jobs:
           cp Players/Templates/VVVVVV.yaml Players/
           timeout 30 ./ArchipelagoGenerate
       - name: Store AppImage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.0
         with:
-          name: ${{ env.APPIMAGE_NAME }}
           path: dist/${{ env.APPIMAGE_NAME }}
+          archive: false
+          # TODO: decide if we want to also upload the zsync
           if-no-files-found: error
           retention-days: 7
       - name: Store .tar.gz
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.0
         with:
-          name: ${{ env.TAR_NAME }}
           path: dist/${{ env.TAR_NAME }}
-          compression-level: 0  # .gz is incompressible by zip
+          archive: false
           if-no-files-found: error
           retention-days: 7

.github/workflows/codeql-analysis.yml

@@ -17,17 +17,26 @@ on:
     paths:
       - '**.py'
       - '**.js'
-      - '.github/workflows/codeql-analysis.yml'
+      - '.github/workflows/*.yml'
+      - '.github/workflows/*.yaml'
+      - '**/action.yml'
+      - '**/action.yaml'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ main ]
     paths:
       - '**.py'
       - '**.js'
-      - '.github/workflows/codeql-analysis.yml'
+      - '.github/workflows/*.yml'
+      - '.github/workflows/*.yaml'
+      - '**/action.yml'
+      - '**/action.yaml'
   schedule:
     - cron: '44 8 * * 1'
 
+permissions:
+  security-events: write
+
 jobs:
   analyze:
     name: Analyze
@@ -36,18 +45,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'javascript', 'python' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
+        language: [ 'javascript', 'python', 'actions' ]
         # Learn more:
         # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6.0.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4.35.1
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +66,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4.35.1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -72,4 +80,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4.35.1

.github/workflows/ctest.yml

@@ -24,6 +24,8 @@ on:
       - '**/CMakeLists.txt'
       - '.github/workflows/ctest.yml'
 
+permissions: {}
+
 jobs:
   ctest:
     runs-on: ${{ matrix.os }}
@@ -35,7 +37,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6.0.2
     - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
       if: startsWith(matrix.os,'windows')
     - uses: Bacondish2023/setup-googletest@49065d1f7a6d21f6134864dd65980fe5dbe06c73

.github/workflows/docker.yml

@@ -19,6 +19,8 @@ on:
 env:
   REGISTRY: ghcr.io
 
+permissions: {}
+
 jobs:
   prepare:
     runs-on: ubuntu-latest
@@ -29,7 +31,7 @@ jobs:
       package-name: ${{ steps.package.outputs.name }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.2
 
       - name: Set lowercase image name
         id: image
@@ -43,7 +45,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6.0.0
         with:
           images: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}
           tags: |
@@ -92,13 +94,13 @@ jobs:
             cache-scope: arm64
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4.0.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -115,7 +117,7 @@ jobs:
           echo "tags=$(IFS=','; echo "${suffixed[*]}")" >> $GITHUB_OUTPUT
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7.0.0
         with:
           context: .
           file: ./Dockerfile
@@ -135,7 +137,7 @@ jobs:
       packages: write
     steps:
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4.0.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/label-pull-requests.yml

@@ -14,7 +14,7 @@ jobs:
     name: 'Apply content-based labels'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v6.0.1
         with:
           sync-labels: false
   peer_review:

.github/workflows/release.yml

@@ -48,9 +48,9 @@ jobs:
         shell: bash
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
       # - code below copied from build.yml -
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - name: Install python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: '~3.12.7'
           check-latest: true
@@ -88,7 +88,7 @@ jobs:
           echo "SETUP_NAME=$SETUP_NAME" >> $Env:GITHUB_ENV
       # - code above copied from build.yml -
       - name: Attest Build
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest@v4.1.0
         with:
           subject-path: |
             build/exe.*/ArchipelagoLauncher.exe
@@ -114,14 +114,14 @@ jobs:
       - name: Set env
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
       # - code below copied from build.yml -
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - name: Install base dependencies
         run: |
           sudo apt update
           sudo apt -y install build-essential p7zip xz-utils wget libglib2.0-0
           sudo apt -y install python3-gi libgirepository1.0-dev  # should pull dependencies for gi installation below
       - name: Get a recent python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: '~3.12.7'
           check-latest: true
@@ -157,7 +157,7 @@ jobs:
           echo "TAR_NAME=$TAR_NAME" >> $GITHUB_ENV
       # - code above copied from build.yml -
       - name: Attest Build
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest@v4.1.0
         with:
           subject-path: |
             build/exe.*/ArchipelagoLauncher

.github/workflows/scan-build.yml

@@ -28,12 +28,14 @@ on:
       - 'requirements.txt'
       - '.github/workflows/scan-build.yml'
 
+permissions: {}
+
 jobs:
   scan-build:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6.0.2
       with:
         submodules: recursive
     - name: Install newer Clang
@@ -45,7 +47,7 @@ jobs:
       run: |
         sudo apt install clang-tools-19
     - name: Get a recent python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6.2.0
       with:
         python-version: '3.11'
     - name: Install dependencies
@@ -59,7 +61,9 @@ jobs:
         scan-build-19 --status-bugs -o scan-build-reports -disable-checker deadcode.DeadStores python setup.py build -y
     - name: Store report
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7.0.0
       with:
         name: scan-build-reports
         path: scan-build-reports
+        compression-level: 9  # highly compressible
+        if-no-files-found: error

.github/workflows/strict-type-check.yml

@@ -14,13 +14,15 @@ on:
       - ".github/workflows/strict-type-check.yml"
       - "**.pyi"
 
+permissions: {}
+
 jobs:
   pyright:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: "3.11"