Use docker image for CI

.github/workflows/build.yml

@@ -1,5 +1,8 @@
 name: build
 
+permissions:
+  packages: read
+
 on:
   push:
     branches: [ master ]
@@ -20,56 +23,52 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - name: Update and Install Software
-        run: |
-          sudo add-apt-repository ppa:ubuntu-toolchain-r/test -y
-          sudo apt update
-          sudo apt -y --allow-downgrades install g++-10-multilib linux-libc-dev binutils-arm-none-eabi p7zip-full pkg-config libpugixml-dev ppa-purge
-          sudo ppa-purge -y ppa:ubuntu-toolchain-r/test || true
-          sudo dpkg --add-architecture i386
-          sudo mkdir -pm755 /etc/apt/keyrings
-          sudo wget -O /etc/apt/keyrings/winehq-archive.key https://dl.winehq.org/wine-builds/winehq.key
-          sudo add-apt-repository ppa:cybermax-dexter/sdl2-backport
-          sudo wget -NP /etc/apt/sources.list.d/ https://dl.winehq.org/wine-builds/ubuntu/dists/$(lsb_release -cs)/winehq-$(lsb_release -cs).sources
-          sudo apt update
-          sudo apt -y --allow-downgrades install --install-recommends winehq-stable
-
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Download assets
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: workflows/assets
+          path: tmp-download
+
+      - name: Install 7z
+        uses: milliewalky/setup-7-zip@ce4c26956d369e4cce6c1a7c114a4ed6c98f458f # v2.0.0
 
       - name: Setup Repo
+        working-directory: tmp-download
         run: |
-          mkdir -p ~/download
-          cd ~/download
-          wget https://github.com/pret/pokeheartgold/raw/workflows/assets/mwccarm.zip
-          wget https://github.com/pret/pokeheartgold/raw/workflows/assets/NitroSDK-3_2-060901.7z
           unzip mwccarm.zip
           mv mwccarm $GITHUB_WORKSPACE/tools
           7z x NitroSDK-3_2-060901.7z
           mv NitroSDK-3_2-060901/tools/bin $GITHUB_WORKSPACE/tools
           mv NitroSDK-3_2-060901/include/nitro/specfiles/ARM7-TS.lcf.template $GITHUB_WORKSPACE/sub/
           mv NitroSDK-3_2-060901/include/nitro/specfiles/ARM9-TS.lcf.template $GITHUB_WORKSPACE/
           mv NitroSDK-3_2-060901/include/nitro/specfiles/mwldarm.response.template $GITHUB_WORKSPACE/
-        working-directory: ~
+          cd .. && rm -rf tmp-download
 
-      - name: Set Swap Space
-        uses: pierotofy/set-swap-space@master
+      - name: Login to GHCR
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
-          swap-size-gb: 19
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build HeartGold
         env:
           GAME_VERSION: HEARTGOLD
           GAME_LANGUAGE: ENGLISH
           GAME_REVISION: 0
-        run: make -j4
+        run: |
+          docker run -v ${{ github.workspace }}:/repo -w /repo --platform linux/amd64 ghcr.io/pret/pokeheartgold:latest make -j4
 
       - name: Build SoulSilver
         env:
           GAME_VERSION: SOULSILVER
           GAME_LANGUAGE: ENGLISH
           GAME_REVISION: 0
-        run: make -j4
+        run: |
+          docker run -v ${{ github.workspace }}:/repo -w /repo --platform linux/amd64 ghcr.io/pret/pokeheartgold:latest make -j4
 
       - name: Webhook
         if: ${{ github.event_name == 'push' }}
@@ -79,24 +78,25 @@ jobs:
         continue-on-error: true
 
       - name: Post error archive
-        if: failure()
+        if: failure() && github.actor != 'nektos/act'
         continue-on-error: true
-        run: find . -maxdepth 2 -type d \( -name build -or -name files \) -exec tar -czvhf failure.tar.gz {} +
+        run: tar -czvhf failure.tar.gz $(git clean -ndx | sed 's/Would remove //' | grep
+          -v '^tools/')
 
       - name: Post error upload
-        if: failure()
-        uses: actions/upload-artifact@v4
+        if: failure() && github.actor != 'nektos/act'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pokeheartgold-failure-${{ github.run_id }}
           path: failure.tar.gz
           retention-days: 1
 
       - name: Checkout xMAP
         if: ${{ github.event_name == 'push' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          path: 'xmap'
-          ref: 'xmap'
+          path: "xmap"
+          ref: "xmap"
 
       - name: Move xMAP
         if: ${{ github.event_name == 'push' }}
@@ -108,7 +108,7 @@ jobs:
 
       - name: Update xMAP
         if: ${{ github.event_name == 'push' }}
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # v10.0.0
         with:
           cwd: "./xmap"
           add: "*.xMAP"

.github/workflows/docker.yml

@@ -0,0 +1,35 @@
+name: Build Docker container
+
+permissions:
+  packages: write
+
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-22.04
+    if: ${{ github.repository == 'pret/pokeheartgold' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Login to GHCR
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - name: Get short sha
+        id: short-sha
+        run: |
+          echo "short-sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          push: ${{ github.actor != 'nektos/act' }}
+          tags: "ghcr.io/pret/pokeheartgold:latest"

.github/workflows/stale.yml

@@ -1,15 +1,15 @@
 name: Close stale issues and PRs
 on:
   schedule:
-  - cron: "0 0 * * *"
+    - cron: "0 0 * * *"
 permissions:
   issues: write
   pull-requests: write
 jobs:
   stale-bot:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9.0.0
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           days-before-close: 30
           stale-issue-message: "This issue has had no activity for 60 days and will be marked stale. If there is no further activity, it will be closed in 30 days."

Dockerfile

@@ -1,5 +1,7 @@
+# check=skip=FromPlatformFlagConstDisallowed
 FROM --platform=linux/amd64 ubuntu:22.04
-LABEL com.docker.image.name=ghcr.io/pret/pokeheartgold
+LABEL com.docker.image.name=ghcr.io/pret/pokeheartgold \
+      org.opencontainers.image.source=https://github/pret/pokeheartgold
 
 RUN apt-get -y update \
  && apt-get -y install \
@@ -21,6 +23,8 @@ RUN apt-get -y update \
     build-essential \
     python3 \
     libpng-dev \
+    unzip \
+    sudo \
  && { ppa-purge -y ppa:ubuntu-toolchain-r/test || true; } \
  && dpkg --add-architecture i386 \
  && mkdir -pm755 /etc/apt/keyrings \