Roadmap: complete remaining performance, architecture and ecosystem items

.github/actions/setup-conan/action.yml

@@ -1,17 +1,48 @@
 name: Set up Conan
-description: Install a pinned Conan version and create the default profile.
+description: Install a pinned Conan version, create the default profile and optionally manage the Conan cache.
 
 inputs:
   conan-version:
     description: Conan version to install.
     required: false
     default: "2.31.2"
+  cache-mode:
+    description: "restore, save, both or none (default: none)"
+    required: false
+    default: "none"
+  cache-suffix:
+    description: Extra cache-key segment to isolate build matrices.
+    required: false
+    default: "default"
+  install:
+    description: Install Conan and create the profile (false for cache-only saves).
+    required: false
+    default: "true"
 
 runs:
   using: composite
   steps:
+    - name: Restore Conan cache
+      if: inputs.cache-mode == 'restore' || inputs.cache-mode == 'both'
+      uses: actions/cache/restore@v4
+      with:
+        path: ~/.conan2
+        key: conan-${{ runner.os }}-${{ inputs.cache-suffix }}-conan-${{ inputs.conan-version }}-${{ hashFiles('conanfile.py') }}
+        restore-keys: |
+          conan-${{ runner.os }}-${{ inputs.cache-suffix }}-conan-${{ inputs.conan-version }}-
+          conan-${{ runner.os }}-${{ inputs.cache-suffix }}-
+          conan-${{ runner.os }}-
+
     - name: Install Conan
+      if: inputs.install == 'true'
       shell: bash
       run: |
         python -m pip install "conan==${{ inputs.conan-version }}"
         conan profile detect --force
+
+    - name: Save Conan cache
+      if: inputs.cache-mode == 'save' || inputs.cache-mode == 'both'
+      uses: actions/cache/save@v4
+      with:
+        path: ~/.conan2
+        key: conan-${{ runner.os }}-${{ inputs.cache-suffix }}-conan-${{ inputs.conan-version }}-${{ hashFiles('conanfile.py') }}

.github/workflows/cmake.yml

@@ -28,14 +28,13 @@ jobs:
         with:
           conan-version: ${{ env.CONAN_VERSION }}
 
-      - name: Cache Conan packages (restore)
-        uses: actions/cache/restore@v4
+      - name: Restore Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-${{ runner.os }}-${{ matrix.build-type }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
-          restore-keys: |
-            conan-${{ runner.os }}-${{ matrix.build-type }}-conan-${{ env.CONAN_VERSION }}-
-            conan-${{ runner.os }}-
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: restore
+          cache-suffix: "${{ matrix.build-type }}"
 
       - name: Install lcov
         if: matrix.build-type == 'Debug'
@@ -47,11 +46,13 @@ jobs:
       # Save the cache immediately after dependency provisioning but before
       # building the project, so that a later build failure does not lose the
       # fetched/built dependencies. The next run can then restore them.
-      - name: Cache Conan packages (save before build)
-        uses: actions/cache/save@v4
+      - name: Save Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-${{ runner.os }}-${{ matrix.build-type }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: save
+          cache-suffix: "${{ matrix.build-type }}"
 
       - name: Build
         run: cmake --build build --config ${{ matrix.build-type }} -j $(nproc)
@@ -126,26 +127,27 @@ jobs:
         with:
           conan-version: ${{ env.CONAN_VERSION }}
 
-      - name: Cache Conan packages (restore)
-        uses: actions/cache/restore@v4
+      - name: Restore Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-${{ runner.os }}-${{ matrix.build-type }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
-          restore-keys: |
-            conan-${{ runner.os }}-${{ matrix.build-type }}-conan-${{ env.CONAN_VERSION }}-
-            conan-${{ runner.os }}-
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: restore
+          cache-suffix: "${{ matrix.build-type }}"
 
       - name: Configure CMake
         run: cmake -B build -DCMAKE_BUILD_TYPE=${{ matrix.build-type }} -DCMAKE_CXX_STANDARD=17
 
       # Save the cache immediately after dependency provisioning but before
       # building the project, so that a later build failure does not lose the
       # fetched/built dependencies. The next run can then restore them.
-      - name: Cache Conan packages (save before build)
-        uses: actions/cache/save@v4
+      - name: Save Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-${{ runner.os }}-${{ matrix.build-type }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: save
+          cache-suffix: "${{ matrix.build-type }}"
 
       - name: Build
         run: cmake --build build --config ${{ matrix.build-type }} -j $(sysctl -n hw.ncpu)
@@ -175,14 +177,13 @@ jobs:
         with:
           conan-version: ${{ env.CONAN_VERSION }}
 
-      - name: Cache Conan packages (restore)
-        uses: actions/cache/restore@v4
+      - name: Restore Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-${{ runner.os }}-${{ matrix.build-type }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
-          restore-keys: |
-            conan-${{ runner.os }}-${{ matrix.build-type }}-conan-${{ env.CONAN_VERSION }}-
-            conan-${{ runner.os }}-
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: restore
+          cache-suffix: "${{ matrix.build-type }}"
 
       # Windows builds are otherwise surprisingly sequential: OpenSSL is built
       # with nmake (no -j) and project-level /m parallelism is disabled by
@@ -206,11 +207,13 @@ jobs:
       # Save the cache immediately after dependency provisioning but before
       # building the project, so that a later build failure does not lose the
       # fetched/built dependencies. The next run can then restore them.
-      - name: Cache Conan packages (save before build)
-        uses: actions/cache/save@v4
+      - name: Save Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-${{ runner.os }}-${{ matrix.build-type }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: save
+          cache-suffix: "${{ matrix.build-type }}"
 
       - name: Build
         run: cmake --build build --config ${{ matrix.build-type }}

.github/workflows/codeql.yml

@@ -37,15 +37,13 @@ jobs:
         with:
           conan-version: ${{ env.CONAN_VERSION }}
 
-      - name: Cache Conan packages (restore)
-        id: cache-restore
-        uses: actions/cache/restore@v5
+      - name: Restore Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-codeql-${{ runner.os }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
-          restore-keys: |
-            conan-${{ runner.os }}-conan-${{ env.CONAN_VERSION }}-
-            conan-${{ runner.os }}-
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: restore
+          cache-suffix: "default"
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
@@ -60,12 +58,13 @@ jobs:
       # building the project, so that a later build failure does not lose the
       # fetched/built dependencies. Skip saving when the restore hit the exact
       # key, otherwise GitHub refuses to reserve the already-existing cache.
-      - name: Cache Conan packages (save before build)
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
+      - name: Save Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-codeql-${{ runner.os }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: save
+          cache-suffix: "default"
 
       - name: Build
         run: cmake --build build -j $(nproc)

.github/workflows/fuzz.yml

@@ -35,13 +35,13 @@ jobs:
         with:
           conan-version: ${{ env.CONAN_VERSION }}
 
-      - name: Cache Conan packages (restore)
-        uses: actions/cache/restore@v4
+      - name: Restore Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-${{ runner.os }}-fuzz-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
-          restore-keys: |
-            conan-${{ runner.os }}-fuzz-conan-${{ env.CONAN_VERSION }}-
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: restore
+          cache-suffix: "fuzz"
 
       - name: Configure CMake (fuzzing)
         run: |
@@ -52,8 +52,17 @@ jobs:
             -DCMAKE_C_STANDARD=11 \
             -DCMAKE_BUILD_TYPE=Release \
             -DBUILD_TESTING=OFF \
+            -DLIBKEEPASS_BUILD_C_API=OFF \
             -DLIBKEEPASS_BUILD_FUZZING=ON
 
+      - name: Save Conan packages
+        uses: ./.github/actions/setup-conan
+        with:
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: save
+          cache-suffix: "fuzz"
+
       - name: Build ${{ matrix.target }}
         run: cmake --build build-fuzz --target ${{ matrix.target }} -- -j $(nproc)
 

.github/workflows/lint.yml

@@ -32,14 +32,13 @@ jobs:
           pip install "clang-format==${{ env.CLANG_FORMAT_VERSION }}" \
                       "clang-tidy==${{ env.CLANG_TIDY_VERSION }}"
 
-      - name: Cache Conan packages (restore)
-        uses: actions/cache/restore@v4
+      - name: Restore Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-lint-${{ runner.os }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
-          restore-keys: |
-            conan-lint-${{ runner.os }}-conan-${{ env.CONAN_VERSION }}-
-            conan-${{ runner.os }}-
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: restore
+          cache-suffix: "default"
 
       # Configure the Debug build only to generate compile_commands.json, which
       # run-clang-tidy needs to resolve the include paths and flags.
@@ -48,16 +47,73 @@ jobs:
 
       # Save the cache immediately after dependency provisioning but before
       # any linting, so that a later failure does not lose the dependencies.
-      - name: Cache Conan packages (save before lint)
-        uses: actions/cache/save@v4
+      - name: Save Conan packages
+        uses: ./.github/actions/setup-conan
         with:
-          path: ~/.conan2
-          key: conan-lint-${{ runner.os }}-conan-${{ env.CONAN_VERSION }}-${{ hashFiles('conanfile.py') }}
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: save
+          cache-suffix: "default"
 
       - name: Check formatting
         run: clang-format --dry-run --Werror $(git ls-files '*.cc' '*.hh')
 
       # -extra-arg silences "unknown warning option" hard errors for the
       # GCC-only -W* flags that CMake injects for the default GCC toolchain.
       - name: Run clang-tidy
-        run: run-clang-tidy.py -p build -j $(nproc) -extra-arg=-Wno-unknown-warning-option src cli test
+        run: run-clang-tidy.py -p build -j $(nproc) -extra-arg=-Wno-unknown-warning-option src cli test
+
+  windows-lint:
+    runs-on: windows-latest
+
+    env:
+      CONAN_VERSION: "2.31.2"
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+
+      - name: Set up Conan
+        uses: ./.github/actions/setup-conan
+        with:
+          conan-version: ${{ env.CONAN_VERSION }}
+
+      - name: Install LLVM (clang-tidy)
+        run: choco install llvm --yes --no-progress
+
+      - name: Restore Conan packages
+        uses: ./.github/actions/setup-conan
+        with:
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: restore
+          cache-suffix: "windows-lint"
+
+      - name: Configure CMake
+        run: >
+          cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug
+          -DCMAKE_CXX_STANDARD=17 -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
+
+      - name: Save Conan packages
+        uses: ./.github/actions/setup-conan
+        with:
+          conan-version: ${{ env.CONAN_VERSION }}
+          install: "false"
+          cache-mode: save
+          cache-suffix: "windows-lint"
+
+      # Advisory on Windows: MSVC's system headers and zlib's Unix fallbacks
+      # produce diagnostics that are unrelated to the project sources. Linux
+      # remains the gating clang-tidy job.
+      - name: Run clang-tidy (advisory)
+        continue-on-error: true
+        shell: pwsh
+        run: |
+          $env:Path = "C:\Program Files\LLVM\bin;$env:Path"
+          $script = Join-Path $env:RUNNER_TEMP "run-clang-tidy.py"
+          Invoke-WebRequest `
+            -Uri "https://raw.githubusercontent.com/llvm/llvm-project/llvmorg-22.1.8/clang-tools-extra/clang-tidy/tool/run-clang-tidy.py" `
+            -OutFile $script
+          python $script -p build -j $env:NUMBER_OF_PROCESSORS `
+            -extra-arg=-Wno-unknown-warning-option src cli test