TheOneRing · Nov 9, 2026 · Nov 9, 2026
diff --git a/.craft.ini b/.craft.ini
@@ -1,105 +1,67 @@
 [General]
 ShallowClone = False
+CraftUrl = https://github.com/KDE/craft.git
 
 # Variables defined here override the default value
 # The variable names are case-sensitive
 [Variables]
-#Values need to be overwritten to create a cache
 UseCache = True
-CreateCache = True
-
-OpenCloudVersion = 1.0
-# this version must match the target in the blueprint
-
-# update MacDeploymentTarget when updating Qt
-#QtVersion = 6.8.0
-CachePatchLvl = 0
 
 # set WORKSPACE to cwd, override on ci
-# with legacy fallback APPVEYOR_BUILD_FOLDER
-WORKSPACE = ${Variables:APPVEYOR_BUILD_FOLDER}
-APPVEYOR_BUILD_FOLDER = ${Variables:Root}
+WORKSPACE = ${Variables:Root}
 CiBuild = True
 
 # Settings applicable for all Crafts matrices
 # Settings are Category/key=value
 # Category is case sensitive
 
 [GeneralSettings]
-Version/ConfigVersion = 6
+Packager/CacheVersion = 5.0
+Packager/RepositoryUrl = https://craft-cache.nbg1.your-objectstorage.com/
 
 Packager/Destination=${Variables:WORKSPACE}/binaries
-Paths/Python = C:/Python36
 Paths/DownloadDir = ${Variables:Root}/downloads
 Blueprints/BlueprintRoot = ${Variables:Root}/blueprints
 CraftDebug/LogDir = ${Variables:Root}/logs
 ShortPath/JunctionDir = /_/
 Packager/CacheDir = ${Variables:WORKSPACE}/cache
 Packager/UseCache = ${Variables:UseCache}
-Packager/CreateCache = ${Variables:CreateCache}
-#Packager/CacheVersion = ${Variables:OpenCloudVersion}/Qt_${Variables:QtVersion}_${Variables:CachePatchLvl}
+Packager/CreateCache = False
 Packager/PackageDebugSymbols = ${Env:CRAFT_PACKAGE_SYMBOLS}
 Packager/DownloadDebugSymbolsCache = ${Env:CRAFT_PACKAGE_SYMBOLS}
-Packager/AppxPublisherId = CN=44DA8A24-8237-46B0-B4A2-D297A6A22705
 Compile/BuildType = RelWithDebInfo
 ContinuousIntegration/Enabled = ${Variables:CiBuild}
 ContinuousIntegration/UpdateRepository = True
-CodeSigning/Enabled = ${Env:SIGN_PACKAGE}
-CodeSigning/Protected = True
-CodeSigning/Certificate = ${Env:CRAFT_CODESIGN_CERTIFICATE}
-CodeSigning/CommonName =
-CodeSigning/MacDeveloperId = OpenCloud GmbH (8P6LQ2M542)
-CodeSigning/MacAppleID = devops@opencloud.eu
-CodeSigning/MacKeychainPath = sign-${Env:DRONE_BUILD_NUMBER}.keychain
+Tools/DownloadConnecTimeout= 5
+Version/ConfigVersion = 6
 
 [BlueprintSettings]
 # skip msys in normal builds its only needed for the cache
 dev-utils/msys-base.ignored = True
 dev-utils/msys.ignored = True
 # in the current cache that pulls in the uncached lxml which takes ages to build
 dev-utils/gtk-doc.ignored = True
+# for some reason this fails in github actions
+dev-utils/perl.withRelocation = False
 
-#libs/qt6.version = ${Variables:QtVersion}
-
-[windows-cl-msvc2022-x86_64]
-General/ABI = windows-cl-msvc2022-x86_64
-
-[windows-cl-msvc2022-x86_64-debug]
-General/ABI = windows-cl-msvc2022-x86_64
-Compile/BuildType = Debug
-
-[macos-clang-x86_64]
-General/ABI = macos-clang-x86_64
-# Packager/PackageType = MacPkgPackager
-
-[macos-clang-x86_64-debug]
-General/ABI = macos-clang-x86_64
-Compile/BuildType = Debug
+libs/qt6.version = 6.11.3
+# only install qtbase, we require it for the install dir
+libs/qt6.ignored = 1
+libs/qt6/qtbase.ignored = 0
 
-[macos-clang-arm64]
-General/ABI = macos-clang-arm64
+[linux-gcc-arm64]
+General/ABI = linux-gcc-arm64
 
-[macos-clang-arm64-debug]
-General/ABI = macos-clang-arm64
+[linux-gcc-arm64-debug]
+General/ABI = linux-gcc-arm64
 Compile/BuildType = Debug
 
 [linux-gcc-x86_64]
 General/ABI = linux-gcc-x86_64
 
-[linux-gcc-x86_64-BlueprintSettings]
-libs/qt6/qtbase.withDBus = True
-
 [linux-gcc-x86_64-debug]
 General/ABI = linux-gcc-x86_64
 Compile/BuildType = Debug
 
-[linux-gcc-x86_64-debug-BlueprintSettings]
-libs/qt6/qtbase.withDBus = True
-
 [Env]
 CRAFT_PACKAGE_SYMBOLS = False
-CRAFT_CODESIGN_CERTIFICATE =
-SIGN_PACKAGE = False
-# double fallback
-DRONE_BUILD_NUMBER = ${Env:APPVEYOR_BUILD_NUMBER}
-APPVEYOR_BUILD_NUMBER = 0
diff --git a/.craft.shelf b/.craft.shelf
@@ -1,3 +1,3 @@
 [General]
 version = 2
-blueprintrepositories = https://invent.kde.org/packaging/craft-blueprints-kde.git|master|;https://github.com/opencloud-eu/craft-blueprints-opencloud.git|main|
+blueprintrepositories = https://github.com/opencloud-eu/craft-blueprints-opencloud.git|main|;https://github.com/KDE/craft-blueprints-kde.git|master|
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/.craft.ps1 b/.github/workflows/.craft.ps1
@@ -1,15 +1,52 @@
+# enable handling of exit codes in powershell
+$PSNativeCommandUseErrorActionPreference=$true
+
+# locate the latest python 3 installed on the system
+function Find-LatestPython {
+    $candidates = @()
+    if ($IsWindows) {
+        # the py launcher lists all registered installations with their paths
+        if (Get-Command py -ErrorAction SilentlyContinue) {
+            $candidates += (py -0p) | ForEach-Object {
+                if ($_ -match '([A-Za-z]:\\.*\.exe)\s*$') { $Matches[1] }
+            }
+        }
+    }
+    # python3, python3.12, python3.13, ... from PATH
+    $candidates += Get-Command -CommandType Application -Name "python3*" -ErrorAction SilentlyContinue |
+        Where-Object { $_.Name -match '^python3(\.\d+)?(\.exe)?$' } |
+        ForEach-Object { $_.Source }
+
+    $best = $null
+    $bestVersion = $null
+    foreach ($candidate in ($candidates | Select-Object -Unique)) {
+        try {
+            $info = & $candidate -c "import sys; print('.'.join(map(str, sys.version_info[:3]))); print(sys.executable)"
+            $version = [version]$info[0]
+            if (-not $bestVersion -or $version -gt $bestVersion) {
+                $bestVersion = $version
+                $best = $info[1]
+            }
+        } catch {
+            Write-Host "Ignoring broken python: ${candidate}"
+        }
+    }
+    if (-not $best) {
+        throw "Failed to locate a python 3 installation"
+    }
+    Write-Host "Using python ${bestVersion}: ${best}"
+    return $best
+}
+
+$python = Find-LatestPython
 if ($IsWindows) {
-    $python = (Get-Command py).Source
-    $python=(py -c "import sys; print(sys.executable)")
     $env:HOME = ${HOME}
-} else {
-    $python = (Get-Command python3).Source
 }
 
 # workaround, prevent CraftMaster detecting the platform as android
 $env:ANDROID_NDK = $null
 
-$RepoRoot = "{0}/../../" -f ([System.IO.Path]::GetDirectoryName($myInvocation.MyCommand.Definition))
+$RepoRoot = (Get-Item $PSScriptRoot).Parent.Parent
 $command = @("${HOME}/craft/CraftMaster/CraftMaster/CraftMaster.py",
              "--config", "${RepoRoot}/.craft.ini",
              "--config-override", "${RepoRoot}/.github/workflows/craft_override.ini",

diff --git a/.github/workflows/.run-clang-tidy.ps1 b/.github/workflows/.run-clang-tidy.ps1
@@ -1,25 +1,29 @@
-$clazyPlugin="ClazyClangTidy"
+# ensure sarif are in path
+$env:PATH+="$([IO.Path]::PathSeparator)${HOME}/.cargo/bin/"
 
-if($isWindows) {
-    $clazyPlugin = $null
-    #$clazy += ".dll" // don't use clazy on windows for now
-} elseif($isLinux) {
-    $clazyPlugin = "${env:KDEROOT}/lib/${clazyPlugin}.so"
-} else
-{
-    $clazyPlugin = "${env:KDEROOT}/lib/${clazyPlugin}.dylib"
-}
-$CLAZY_LEVEL0="clazy-overloaded-signal,clazy-connect-by-name,clazy-connect-non-signal,clazy-qstring-comparison-to-implicit-char,clazy-wrong-qevent-cast,clazy-lambda-in-connect,clazy-lambda-unique-connection,clazy-qdatetime-utc,clazy-qgetenv,clazy-qstring-insensitive-allocation,clazy-fully-qualified-moc-types,clazy-unused-non-trivial-variable,clazy-connect-not-normalized,clazy-mutable-container-key,clazy-qenums,clazy-qmap-with-pointer-key,clazy-qstring-ref,clazy-strict-iterators,clazy-writing-to-temporary,clazy-container-anti-pattern,clazy-qcolor-from-literal,clazy-qfileinfo-exists,clazy-qstring-arg,clazy-empty-qstringliteral,clazy-qt-macros,clazy-temporary-iterator,clazy-wrong-qglobalstatic,clazy-lowercase-qml-type-name,clazy-no-module-include,clazy-use-static-qregularexpression"
-$CLAZY_LEVEL1="clazy-auto-unexpected-qstringbuilder,clazy-connect-3arg-lambda,clazy-const-signal-or-slot,clazy-detaching-temporary,clazy-foreach,clazy-incorrect-emit,clazy-install-event-filter,clazy-non-pod-global-static,clazy-post-event,clazy-qdeleteall,clazy-qlatin1string-non-ascii,clazy-qproperty-without-notify,clazy-qstring-left,clazy-range-loop-detach,clazy-range-loop-reference,clazy-returning-data-from-temporary,clazy-rule-of-two-soft,clazy-child-event-qobject-cast,clazy-virtual-signal,clazy-overridden-signal,clazy-qhash-namespace,clazy-skipped-base-method,clazy-readlock-detaching"
-$CLAZY_LEVEL2="clazy-ctor-missing-parent-argument,clazy-base-class-event,clazy-copyable-polymorphic,clazy-function-args-by-ref,clazy-function-args-by-value,clazy-global-const-char-pointer,clazy-implicit-casts,clazy-missing-qobject-macro,clazy-missing-typeinfo,clazy-old-style-connect,clazy-qstring-allocations,clazy-returning-void-expression,clazy-rule-of-three,clazy-virtual-call-ctor,clazy-static-pmf"
+$extraArgs = @()
 
-if ($clazyPlugin)
-{
-    $clazyCommand = @("-load=${clazyPlugin}", "-checks=${CLAZY_LEVEL0},-overloaded-signal,qt-keywords")
-} else {
-    $clazyCommand = @()
+if($isLinux) {
+    # the project was built wit gcc ensure craft clang finds the toolchain
+    $extraArgs += @("-extra-arg=--gcc-toolchain=$($(Get-Item $(Get-command ${env:CXX}).Source).Directory.Parent)")
 }
 
-$clangCommand = $clazyCommand + @("-p",  "$env:BUILD_DIR")
+$clangCommand = $extraArgs + @("-p",  "$env:BUILD_DIR")
+
+Write-Host "Running run-clang-tidy ${clangCommand}"
+run-clang-tidy @clangCommand | clang-tidy-sarif  | Tee-Object -Path "${env:GITHUB_WORKSPACE}/clang-tidy.sarif" | sarif-fmt
 
-run-clang-tidy @clangCommand | Tee-Object -Path "$([System.IO.Path]::GetTempPath())/clang-tidy.log"
+$sarifFile = "${env:GITHUB_WORKSPACE}/clang-tidy.sarif"
+$workspacePrefix = ($env:GITHUB_WORKSPACE -replace '\\', '/') + '/'
+
+$sarif = Get-Content -Raw -Path $sarifFile | ConvertFrom-Json
+foreach ($run in $sarif.runs) {
+    foreach ($result in $run.results) {
+        foreach ($loc in $result.locations) {
+            if ($loc.physicalLocation.artifactLocation.uri) {
+                $loc.physicalLocation.artifactLocation.uri = $loc.physicalLocation.artifactLocation.uri -replace "^$([regex]::Escape($workspacePrefix))", ""
+            }
+        }
+    }
+}
+$sarif | ConvertTo-Json -Depth 100 | Set-Content -Path $sarifFile
diff --git a/.github/workflows/craft_override.ini b/.github/workflows/craft_override.ini
@@ -1,8 +1,6 @@
 [GeneralSettings]
-# creating cache files on github makes no sense
 Packager/CreateCache = False
 
-
 Paths/CCACHE_DIR = ${Env:HOME}/ccache
 Compile/UseCCache = True
 
@@ -11,3 +9,9 @@ Environment/SourceCommand = export PKG_CONFIG_PATH=(/usr/bin/pkg-config --variab
 
 [linux-gcc-x86_64-debug]
 Environment/SourceCommand = export PKG_CONFIG_PATH=(/usr/bin/pkg-config --variable pc_path pkg-config) && source /opt/rh/gcc-toolset-14/enable
+
+[linux-gcc-arm64]
+Environment/SourceCommand = export PKG_CONFIG_PATH=(/usr/bin/pkg-config --variable pc_path pkg-config) && source /opt/rh/gcc-toolset-14/enable
+
+[linux-gcc-arm64-debug]
+Environment/SourceCommand = export PKG_CONFIG_PATH=(/usr/bin/pkg-config --variable pc_path pkg-config) && source /opt/rh/gcc-toolset-14/enable
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -35,13 +35,20 @@ jobs:
     permissions:
       # actions/upload-artifact doesn't need contents: write
       contents: read
+      actions: read
+      security-events: write
     strategy:
       fail-fast: true
       matrix:
         include:
           - target: linux-gcc-x86_64
             os: ubuntu-latest
-            container: invent-registry.kde.org/sysadmin/ci-images/craft-appimage-alma9:latest
+            run_tools: false
+            container: ghcr.io/opencloud-eu/ci-docker-desktop/appimage:latest
+          - target: linux-gcc-arm64
+            os: ubuntu-24.04-arm
+            run_tools: true
+            container: ghcr.io/opencloud-eu/ci-docker-desktop/appimage:latest
 
     name: ${{ matrix.target }}
 
@@ -56,18 +63,18 @@ jobs:
 
     steps:
       - name: Check out full source code for tooling
-        if: ${{ matrix.target  == 'linux-gcc-x86_64' }}
-        uses: actions/checkout@v6
+        if: ${{ matrix.run_tools }}
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Check out latest commit
-        if: ${{ matrix.target  != 'linux-gcc-x86_64' }}
-        uses: actions/checkout@v6
+        if: ${{ !matrix.run_tools }}
+        uses: actions/checkout@v7
 
       - name: Restore and update cache
         if: github.event_name != 'pull_request'
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/ccache
@@ -76,7 +83,7 @@ jobs:
 
       - name: Restore cache
         if: github.event_name == 'pull_request'
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: |
             ~/ccache
@@ -85,13 +92,11 @@ jobs:
 
       - name: Clone CraftMaster
         run: |
-          git clone --depth=1 https://invent.kde.org/kde/craftmaster.git "${home}/craft/CraftMaster/CraftMaster"
+          git clone --depth=1 https://github.com/KDE/craftmaster.git "${home}/craft/CraftMaster/CraftMaster"
 
       - name: Craft setup
         run: |
           New-Item -Path ~/cache -ItemType Directory -ErrorAction SilentlyContinue
-          # disable git's safe.directory
-          git config --global --add safe.directory '*'
           & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" --setup
 
       - name: Craft unshelve
@@ -109,18 +114,14 @@ jobs:
       - name: Prepare
         run: |
           New-Item -ItemType Directory "${env:GITHUB_WORKSPACE}/binaries/"
-           & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --set "srcDir=${env:GITHUB_WORKSPACE}" opencloud/openvfs
-          if($IsLinux) {
-              # ensure we have fuse3-devel installed
-              dnf install -y fuse3-devel
-          }
+          & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --set "srcDir=${env:GITHUB_WORKSPACE}" opencloud/openvfs
 
       - name: Install dependencies
         run: |
           & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --install-deps opencloud/openvfs
 
       - name: clang-format format lint
-        if: matrix.target  == 'OFF_linux-gcc-x86_64'
+        if: ${{ matrix.run_tools && github.event_name == 'pull_request' }}
         run: |
           & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c libs/llvm
           & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --run git clang-format --force  ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}
@@ -141,4 +142,17 @@ jobs:
 
       - name: Run tests
         run: |
-          & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --no-cache opencloud/openvfs
+          & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --no-cache --test opencloud/openvfs
+
+      - name: Clang tidy
+        if: ${{ matrix.run_tools }}
+        run: |
+          & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c libs/llvm
+          $env:BUILD_DIR = $(& "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --get buildDir -q opencloud/openvfs)
+          & "${env:GITHUB_WORKSPACE}/.github/workflows/.craft.ps1" -c --run pwsh "${env:GITHUB_WORKSPACE}/.github/workflows/.run-clang-tidy.ps1"
+
+      - name: Upload SARIF file
+        if: ${{ matrix.run_tools }}
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: clang-tidy.sarif