Cherry picks: Godot sync 64bd2e3#1277
Merged
Arctis-Fireblight merged 12 commits intoJun 18, 2026
Merged
Conversation
While 4.5 is not yet EOL updating the codeowners for 4.5 was not a simple job and 4.5 is likely to be EOL soon enough and get limited enough contributions that we can handle ownership manually.
Co-authored-by: Pāvels Nadtočajevs <7645683+bruvzg@users.noreply.github.com>
…compiler warnings (cherry picked from commit f00df0ad1eae2f7d45228f3e0004335f1d2cb1a6)
(cherry picked from commit 1ade2b8e517f7f0e404afd5dd90962e34d92b4aa)
(cherry picked from commit e86050e745ec8b2a2035744cc6a14cbbe2e75e33)
(cherry picked from commit 419db23c85e4391697fe85afc79407638dae081e)
(cherry picked from commit 419db238a52a63f4fbf3490e77ecb5f926b336d8)
(cherry picked from commit 30cfb06941ec86d7b7da164ca67cb5094c82441a)
… warnings Re-implement the pre-commit action locally as the upstream one is unmaintained and won't bump the actions/checkout version. (cherry picked from commit eaa270cc1fbc1252a8e8d62aef9f02291946f6be)
Arctis-Fireblight
added
the
cherrypick:master
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
WalkthroughUpdates thirdparty zlib from 1.3.1 to 1.3.2 with new ChangesCI/CD and Infra Updates
Android Platform Version Bumps
Engine Source Code Fixes
Thirdparty zlib 1.3.2 and minizip Vendor Update
Estimated code review effort🎯 5 (Critical) | ⏱️ ~125 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🧹 Nitpick comments (1)
.github/workflows/android_builds.yml (1)
34-34: Consider pinning GitHub Actions to commit SHAs instead of version tags (Lines 34 and 39).Currently using mutable refs (
@v6,@v5). Pinning to specific commit SHAs reduces supply-chain risk, though this is a best practice recommendation rather than an enforced repository policy.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/android_builds.yml at line 34, The workflow is using mutable version tags (`@v6` and `@v5`) for GitHub Actions which presents a supply chain risk. Replace the version tags with specific commit SHAs for the actions/checkout action at line 34 and the other action at line 39. To do this, look up the commit SHA for each version tag from the respective GitHub action repositories and replace the version tag (e.g., `@v6`) with the full commit SHA (e.g., `@abc123def456`). This pins the actions to immutable commits, reducing the risk of malicious updates to those actions.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/download-artifact/action.yml:
- Line 17: Replace the mutable version tag `@v8` in the `uses:
actions/download-artifact@v8` line with a full-length commit SHA to prevent
supply chain attacks. Add a comment above or on the same line indicating the
version tag (e.g., `# v8.1.0`) for maintainability reference, and consider
configuring Dependabot to automate future SHA updates.
In @.github/actions/pre-commit/action.yml:
- Line 13: The `actions/cache@v5` reference on line 13 uses a mutable version
tag which presents a security risk as maintainers or attackers could force-push
malicious code to that tag. Replace the mutable tag `@v5` with a full
40-character commit SHA, and include the version number as a trailing comment
for readability in the format `uses: actions/cache@<full-commit-sha> # v5`. Look
up the correct commit SHA for version 5 of the actions/cache action and use that
immutable reference instead.
- Line 24: The pre-commit run command in the action.yml file has a hardcoded
--files flag that conflicts with the default --all-files argument typically
passed in extra_args. Remove the --files flag from the pre-commit run command
line and pass the inputs.extra_args directly instead, allowing the extra_args
input to control the file selection behavior without conflicts.
In @.github/actions/redot-cpp-build/action.yml:
- Line 25: The actions/checkout action is using the mutable `@v6` tag instead of a
pinned commit SHA, which creates supply chain risk since the tag can be
force-pushed without PR visibility. Replace the mutable `@v6` tag reference in the
uses field with the full 40-character commit SHA of the specific version (for
example, de0fac2e4500dabe0009e67214ff5f5447ce83dd for v6.0.2), optionally
including a comment with the version tag for clarity. This ensures the workflow
runs only the exact, reviewed code.
In @.github/workflows/ios_builds.yml:
- Line 21: Replace the mutable version reference in the `actions/checkout`
action usage from `@v6` to a pinned full 40-character commit SHA to prevent
supply chain attacks. Include a comment above or on the same line indicating the
original version tag (v6) for future reference and maintainability. This ensures
the action cannot be force-pushed with malicious code while making it clear
which version was pinned.
In @.github/workflows/linux_builds.yml:
- Line 84: The actions/checkout and actions/setup-dotnet uses statements are
referencing mutable version tags (v6 and v5) instead of immutable commit SHAs,
which creates a security vulnerability. Replace the version tags with their
corresponding commit SHAs for both the actions/checkout action on line 84 and
the actions/setup-dotnet action on line 127. This ensures the workflow will
always use the exact same versions and prevents unexpected behavior changes on
workflow reruns.
In @.github/workflows/static_checks.yml:
- Line 15: The `actions/checkout@v6` action is pinned to a mutable version tag
which poses a security vulnerability as the tag can be retargeted by an
attacker. Replace the `uses: actions/checkout@v6` statement with the complete
40-character commit SHA instead of the version tag, and include an inline
comment with the semantic version (e.g., `actions/checkout@[40-char-sha] #
v6.x.x`) for maintainability and readability.
In @.github/workflows/web_builds.yml:
- Around line 37-42: Replace the floating action version tags with specific
commit SHAs to comply with the repo's pinning policy. For the
`actions/checkout@v6` action on line 37, replace `@v6` with the full commit SHA.
Similarly, for the `emscripten-core/setup-emsdk@v16` action on line 42, replace
`@v16` with the full commit SHA. This ensures the workflow uses fixed, immutable
versions of these external actions rather than floating tags that could change
unexpectedly.
In @.github/workflows/windows_builds.yml:
- Around line 51-52: The checkout action is currently pinned to a version tag
`actions/checkout@v6` which can float and pick up unexpected upstream changes.
Replace the `uses: actions/checkout@v6` line with a pinned full commit SHA
instead of the version tag to match the repository's action-pinning policy and
ensure deterministic builds.
In `@thirdparty/minizip/ioapi.h`:
- Line 24: The preprocessor condition on line 24 of ioapi.h uses OR operator in
the negated clause `!(defined(__ANDROID_API__) || __ANDROID_API__ >= 24)` which
incorrectly disables 64-bit support for all defined Android versions, but the
matching code in ioapi.c line 17 correctly enables 64-bit functions only for
Android < 24. Change the OR operator to AND in the negated Android API clause to
align with ioapi.c's intent, replacing the condition with
`!(defined(__ANDROID_API__) && __ANDROID_API__ < 24)` so that 64-bit file
operations are properly enabled on Android API 24 and above.
---
Nitpick comments:
In @.github/workflows/android_builds.yml:
- Line 34: The workflow is using mutable version tags (`@v6` and `@v5`) for GitHub
Actions which presents a supply chain risk. Replace the version tags with
specific commit SHAs for the actions/checkout action at line 34 and the other
action at line 39. To do this, look up the commit SHA for each version tag from
the respective GitHub action repositories and replace the version tag (e.g.,
`@v6`) with the full commit SHA (e.g., `@abc123def456`). This pins the actions to
immutable commits, reducing the risk of malicious updates to those actions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 0a7973da-b8cf-4a1f-8014-d41d889c35a8
⛔ Files ignored due to path filters (1)
servers/rendering/renderer_rd/shaders/effects/cubemap_roughness_inc.glslis excluded by!**/*.glsl
📒 Files selected for processing (52)
.github/CODEOWNERS.github/actions/download-artifact/action.yml.github/actions/pre-commit/action.yml.github/actions/redot-cpp-build/action.yml.github/workflows/android_builds.yml.github/workflows/ios_builds.yml.github/workflows/linux_builds.yml.github/workflows/macos_builds.yml.github/workflows/static_checks.yml.github/workflows/web_builds.yml.github/workflows/windows_builds.ymlCOPYRIGHT.txtSConstructdrivers/metal/metal_objects.mmdrivers/metal/pixel_formats.mmdrivers/metal/rendering_device_driver_metal.mmeditor/scene/2d/tiles/tile_data_editors.cppeditor/scene/2d/tiles/tile_map_layer_editor.cppeditor/themes/editor_theme_manager.cppmodules/text_server_adv/text_server_adv.hplatform/android/detect.pyplatform/android/export/export_plugin.cppplatform/android/java/app/config.gradlethirdparty/README.mdthirdparty/minizip/MiniZip64_info.txtthirdparty/minizip/crypt.hthirdparty/minizip/ints.hthirdparty/minizip/ioapi.cthirdparty/minizip/ioapi.hthirdparty/minizip/skipset.hthirdparty/minizip/unzip.cthirdparty/minizip/unzip.hthirdparty/minizip/zip.cthirdparty/minizip/zip.hthirdparty/zlib/LICENSEthirdparty/zlib/compress.cthirdparty/zlib/crc32.cthirdparty/zlib/deflate.cthirdparty/zlib/deflate.hthirdparty/zlib/gzguts.hthirdparty/zlib/inffast.cthirdparty/zlib/inffixed.hthirdparty/zlib/inflate.cthirdparty/zlib/inflate.hthirdparty/zlib/inftrees.cthirdparty/zlib/inftrees.hthirdparty/zlib/trees.cthirdparty/zlib/uncompr.cthirdparty/zlib/zconf.hthirdparty/zlib/zlib.hthirdparty/zlib/zutil.cthirdparty/zlib/zutil.h
…lve MSVC 2026+ warnings to fix CI failures
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pulled the latest changes from upstream's 4.5 branch.
Hopefully this will fix the GH Actions.
Summary by CodeRabbit
Release Notes
New Features
Bug Fixes
Chores