NOISSUE Add GitHub workflows for Project Tick project

- Create CodeQL analysis workflow for security checks on meshmc codebase.
- Add container build workflow for meshmc using Podman and Buildah.
- Implement scheduled flake update workflow for Nix dependencies.
- Introduce merge blocking PR automation to manage dependent PRs.
- Set up Nix build workflow for meshmc with multi-platform support.
- Add release workflow for publishing MeshMC artifacts on GitHub.
- Create CI workflow for tomlplusplus library with multi-compiler support.
- Implement CI workflow for uvim with various feature sets and architectures.
- Add .gitignore to exclude build artifacts and IDE files.
- Create .gitattributes files for various submodules to manage line endings and diff settings.
- Add post-receive hook for mirroring pushes to multiple forges.
- Include .gitignore files for images4docker and other submodules to manage temporary files.

Signed-off-by: Mehmet Samet Duman <yongdohyun@projecttick.org>

7 files changed, 755 insertions, 0 deletions

diff --git a/.github/actions/meshmc/package/linux/action.yml b/.github/actions/meshmc/package/linux/action.yml
new file mode 100644
index 0000000000..457ccb27ed
--- /dev/null
+++ b/.github/actions/meshmc/package/linux/action.yml
@@ -0,0 +1,153 @@
+name: Package for Linux
+description: Create Linux packages for MeshMC
+
+inputs:
+  version:
+    description: Launcher version
+    required: true
+  build-type:
+    description: Type for the build
+    required: true
+    default: Debug
+  artifact-name:
+    description: Name of the uploaded artifact
+    required: true
+    default: Linux
+  qt-version:
+    description: Version of Qt to use
+    required: true
+  gpg-private-key:
+    description: Private key for AppImage signing
+    required: false
+  gpg-private-key-id:
+    description: ID for the gpg-private-key, to select the signing key
+    required: false
+
+runs:
+  using: composite
+
+  steps:
+    - name: Cleanup Qt installation on Linux
+      shell: bash
+      run: |
+        rm -rf "$QT_PLUGIN_PATH"/printsupport
+        rm -rf "$QT_PLUGIN_PATH"/sqldrivers
+        rm -rf "$QT_PLUGIN_PATH"/help
+        rm -rf "$QT_PLUGIN_PATH"/designer
+        rm -rf "$QT_PLUGIN_PATH"/qmltooling
+        rm -rf "$QT_PLUGIN_PATH"/qmlls
+        rm -rf "$QT_PLUGIN_PATH"/qmllint
+        rm -rf "$QT_PLUGIN_PATH"/platformthemes/libqgtk3.so
+
+    - name: Setup build variables
+      shell: bash
+      run: |
+        # Fixup architecture naming for AppImages
+        dpkg_arch="$(dpkg-architecture -q DEB_HOST_ARCH_CPU)"
+        case "$dpkg_arch" in
+          "amd64")
+            APPIMAGE_ARCH="x86_64"
+            ;;
+          "arm64")
+            APPIMAGE_ARCH="aarch64"
+            ;;
+          *)
+            echo "# 🚨 The Debian architecture \"$deb_arch\" is not recognized!" >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+            ;;
+        esac
+        echo "APPIMAGE_ARCH=$APPIMAGE_ARCH" >> "$GITHUB_ENV"
+
+        # Used for the file paths of libraries
+        echo "DEB_HOST_MULTIARCH=$(dpkg-architecture -q DEB_HOST_MULTIARCH)" >> "$GITHUB_ENV"
+
+    - name: Package AppImage
+      shell: bash
+      env:
+        VERSION: ${{ github.ref_type == 'tag' && github.ref_name || inputs.version }}
+        BUILD_DIR: build
+        INSTALL_APPIMAGE_DIR: install-appdir
+
+        GPG_PRIVATE_KEY: ${{ inputs.gpg-private-key }}
+      run: |
+        cmake --install ${{ env.BUILD_DIR }} --config ${{ inputs.build-type }} --prefix ${{ env.INSTALL_APPIMAGE_DIR }}
+
+        if [ '${{ inputs.gpg-private-key-id }}' != '' ]; then
+          echo "$GPG_PRIVATE_KEY" > privkey.asc
+          gpg --import privkey.asc
+          gpg --export --armor ${{ inputs.gpg-private-key-id }} > pubkey.asc
+        else
+          echo ":warning: Skipped code signing for Linux AppImage, as gpg key was not present." >> $GITHUB_STEP_SUMMARY
+        fi
+
+        sharun lib4bin \
+          --hard-links \
+          --with-hooks \
+          --dst-dir "$INSTALL_APPIMAGE_DIR" \
+          "$INSTALL_APPIMAGE_DIR"/bin/* "$QT_PLUGIN_PATH"/*/*.so
+
+        cp ~/bin/AppImageUpdate.AppImage "$INSTALL_APPIMAGE_DIR"/bin/
+        # FIXME(@YongDo-Hyun): gamemode doesn't seem to be very portable with DBus. Find a way to make it work!
+        find "$INSTALL_APPIMAGE_DIR" -name '*gamemode*' -exec rm {} +
+
+        #disable OpenGL and Vulkan launcher features until https://github.com/VHSgunzo/sharun/issues/35
+        echo "LAUNCHER_DISABLE_GLVULKAN=1" > "$INSTALL_APPIMAGE_DIR"/.env
+        #makes the launcher use portals for file picking
+        echo "QT_QPA_PLATFORMTHEME=xdgdesktopportal" > "$INSTALL_APPIMAGE_DIR"/.env
+        ln -s org.projecttick.MeshMC.metainfo.xml "$INSTALL_APPIMAGE_DIR"/share/metainfo/org.projecttick.MeshMC.appdata.xml
+        ln -s share/applications/org.projecttick.MeshMC.desktop "$INSTALL_APPIMAGE_DIR"
+        ln -s share/icons/hicolor/256x256/apps/org.projecttick.MeshMC.png "$INSTALL_APPIMAGE_DIR"
+        mv "$INSTALL_APPIMAGE_DIR"/{sharun,AppRun}
+        ls -la "$INSTALL_APPIMAGE_DIR"
+
+        if [[ "${{ github.ref_type }}" == "tag" ]]; then
+          APPIMAGE_DEST="MeshMC-Linux-$APPIMAGE_ARCH.AppImage"
+        else
+          APPIMAGE_DEST="MeshMC-Linux-$VERSION-${{ inputs.build-type }}-$APPIMAGE_ARCH.AppImage"
+        fi
+
+        mkappimage \
+          --updateinformation "gh-releases-zsync|${{ github.repository_owner }}|${{ github.event.repository.name }}|latest|MeshMC-Linux-$APPIMAGE_ARCH.AppImage.zsync" \
+          "$INSTALL_APPIMAGE_DIR" \
+          "$APPIMAGE_DEST"
+
+    - name: Package portable tarball
+      shell: bash
+      env:
+        BUILD_DIR: build
+
+        INSTALL_PORTABLE_DIR: install-portable
+      run: |
+        cmake --install ${{ env.BUILD_DIR }} --config ${{ inputs.build-type }} --prefix ${{ env.INSTALL_PORTABLE_DIR }}
+        cmake --install ${{ env.BUILD_DIR }} --config ${{ inputs.build-type }} --prefix ${{ env.INSTALL_PORTABLE_DIR }} --component portable
+
+        sharun lib4bin \
+          --with-hooks \
+          --hard-links \
+          --dst-dir "$INSTALL_PORTABLE_DIR" \
+          "$INSTALL_PORTABLE_DIR"/bin/* "$QT_PLUGIN_PATH"/*/*.so
+
+        # FIXME(@YongDo-Hyun): gamemode doesn't seem to be very portable with DBus. Find a way to make it work!
+        find "$INSTALL_PORTABLE_DIR" -name '*gamemode*' -exec rm {} +
+
+        for l in $(find ${{ env.INSTALL_PORTABLE_DIR }} -type f -o -type l); do l=${l#$(pwd)/}; l=${l#${{ env.INSTALL_PORTABLE_DIR }}/}; l=${l#./}; echo $l; done > ${{ env.INSTALL_PORTABLE_DIR }}/manifest.txt
+        cd ${{ env.INSTALL_PORTABLE_DIR }}
+        tar -czf ../MeshMC-portable.tar.gz *
+
+    - name: Upload binary tarball
+      uses: actions/upload-artifact@v7
+      with:
+        name: MeshMC-${{ inputs.artifact-name }}-Qt6-Portable-${{ inputs.version }}-${{ inputs.build-type }}
+        path: MeshMC-portable.tar.gz
+
+    - name: Upload AppImage
+      uses: actions/upload-artifact@v7
+      with:
+        name: MeshMC-${{ runner.os }}-${{ inputs.version }}-${{ inputs.build-type }}-${{ env.APPIMAGE_ARCH }}.AppImage
+        path: MeshMC-${{ runner.os }}-*${{ env.APPIMAGE_ARCH }}.AppImage
+
+    - name: Upload AppImage Zsync
+      uses: actions/upload-artifact@v7
+      with:
+        name: MeshMC-${{ runner.os }}-${{ inputs.version }}-${{ inputs.build-type }}-${{ env.APPIMAGE_ARCH }}.AppImage.zsync
+        path: MeshMC-${{ runner.os }}-*${{ env.APPIMAGE_ARCH }}.AppImage.zsync
diff --git a/.github/actions/meshmc/package/macos/action.yml b/.github/actions/meshmc/package/macos/action.yml
new file mode 100644
index 0000000000..2a1c432a6d
--- /dev/null
+++ b/.github/actions/meshmc/package/macos/action.yml
@@ -0,0 +1,146 @@
+name: Package for macOS
+description: Create a macOS package for MeshMC
+
+inputs:
+  version:
+    description: Launcher version
+    required: true
+  build-type:
+    description: Type for the build
+    required: true
+    default: Debug
+  artifact-name:
+    description: Name of the uploaded artifact
+    required: true
+    default: macOS
+  apple-codesign-cert:
+    description: Certificate for signing macOS builds
+    required: false
+  apple-codesign-password:
+    description: Password for signing macOS builds
+    required: false
+  apple-codesign-id:
+    description: Certificate ID for signing macOS builds
+    required: false
+  apple-notarize-apple-id:
+    description: Apple ID used for notarizing macOS builds
+    required: false
+  apple-notarize-team-id:
+    description: Team ID used for notarizing macOS builds
+    required: false
+  apple-notarize-password:
+    description: Password used for notarizing macOS builds
+    required: false
+  sparkle-ed25519-key:
+    description: Private key for signing Sparkle updates
+    required: false
+
+runs:
+  using: composite
+
+  steps:
+    - name: Fetch codesign certificate
+      shell: bash
+      run: |
+        echo '${{ inputs.apple-codesign-cert }}' | base64 --decode > codesign.p12
+        if [ -n '${{ inputs.apple-codesign-id }}' ]; then
+          security create-keychain -p '${{ inputs.apple-codesign-password }}' build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p '${{ inputs.apple-codesign-password }}' build.keychain
+          security import codesign.p12 -k build.keychain -P '${{ inputs.apple-codesign-password }}' -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k '${{ inputs.apple-codesign-password }}' build.keychain
+        else
+          echo ":warning: Using ad-hoc code signing for macOS, as certificate was not present." >> $GITHUB_STEP_SUMMARY
+        fi
+
+    - name: Package
+      shell: bash
+      env:
+        BUILD_DIR: build
+        INSTALL_DIR: install
+      run: |
+        cmake --install ${{ env.BUILD_DIR }} --config ${{ inputs.build-type }}
+
+        cd ${{ env.INSTALL_DIR }}
+        chmod +x "MeshMC.app/Contents/MacOS/meshmc"
+
+        if [ -n '${{ inputs.apple-codesign-id }}' ]; then
+          APPLE_CODESIGN_ID='${{ inputs.apple-codesign-id }}'
+          ENTITLEMENTS_FILE='../branding/App.entitlements'
+        else
+          APPLE_CODESIGN_ID='-'
+          ENTITLEMENTS_FILE='../branding/AdhocSignedApp.entitlements'
+        fi
+
+        sudo codesign --sign "$APPLE_CODESIGN_ID" --deep --force --entitlements "$ENTITLEMENTS_FILE" --options runtime "MeshMC.app/Contents/MacOS/meshmc"
+
+    - name: Notarize
+      shell: bash
+      env:
+        INSTALL_DIR: install
+      run: |
+        cd ${{ env.INSTALL_DIR }}
+
+        if [ -n '${{ inputs.apple-notarize-password }}' ]; then
+          ditto -c -k --sequesterRsrc --keepParent "MeshMC.app" ../MeshMC.zip
+          xcrun notarytool submit ../MeshMC.zip \
+            --wait --progress \
+            --apple-id '${{ inputs.apple-notarize-apple-id }}' \
+            --team-id '${{ inputs.apple-notarize-team-id }}' \
+            --password '${{ inputs.apple-notarize-password }}'
+
+          xcrun stapler staple "MeshMC.app"
+        else
+          echo ":warning: Skipping notarization as credentials are not present." >> $GITHUB_STEP_SUMMARY
+        fi
+        ditto -c -k --sequesterRsrc --keepParent "MeshMC.app" ../MeshMC.zip
+
+    - name: Create DMG
+      shell: bash
+      env:
+        INSTALL_DIR: install
+      run: |
+        cd ${{ env.INSTALL_DIR }}
+
+        mkdir -p src
+        cp -R "MeshMC.app" src/
+
+        ln -s /Applications src/
+
+        hdiutil create \
+            -volname "MeshMC ${{ inputs.version }}" \
+            -srcfolder src \
+            -ov -format ULMO \
+            "../MeshMC.dmg"
+
+    - name: Make Sparkle signature
+      shell: bash
+      run: |
+        if [ '${{ inputs.sparkle-ed25519-key }}' != '' ]; then
+          echo '${{ inputs.sparkle-ed25519-key }}' > ed25519-priv.pem
+          signature_zip=$(/opt/homebrew/opt/openssl@3/bin/openssl pkeyutl -sign -rawin -in ${{ github.workspace }}/MeshMC.zip -inkey ed25519-priv.pem | openssl base64 | tr -d \\n)
+          signature_dmg=$(/opt/homebrew/opt/openssl@3/bin/openssl pkeyutl -sign -rawin -in ${{ github.workspace }}/MeshMC.dmg -inkey ed25519-priv.pem | openssl base64 | tr -d \\n) 
+          rm ed25519-priv.pem
+          cat >> $GITHUB_STEP_SUMMARY << EOF
+        ### Artifact Information :information_source:
+        - :memo: Sparkle Signature (ed25519): \`$signature_zip\` (ZIP)
+        - :memo: Sparkle Signature (ed25519): \`$signature_dmg\` (DMG)
+        EOF
+        else
+          cat >> $GITHUB_STEP_SUMMARY << EOF
+        ### Artifact Information :information_source:
+        - :warning: Sparkle Signature (ed25519): No private key available (likely a pull request or fork)
+        EOF
+        fi
+
+    - name: Upload binary tarball
+      uses: actions/upload-artifact@v7
+      with:
+        name: MeshMC-${{ inputs.artifact-name }}-${{ inputs.version }}-${{ inputs.build-type }}
+        path: MeshMC.zip
+
+    - name: Upload disk image
+      uses: actions/upload-artifact@v7
+      with:
+        name: MeshMC-${{ inputs.artifact-name }}-${{ inputs.version }}-${{ inputs.build-type }}.dmg
+        path: MeshMC.dmg
diff --git a/.github/actions/meshmc/package/windows/action.yml b/.github/actions/meshmc/package/windows/action.yml
new file mode 100644
index 0000000000..33e3d42718
--- /dev/null
+++ b/.github/actions/meshmc/package/windows/action.yml
@@ -0,0 +1,142 @@
+name: Package for Windows
+description: Create a Windows package for MeshMC
+
+inputs:
+  version:
+    description: Launcher version
+    required: true
+  build-type:
+    description: Type for the build
+    required: true
+    default: Debug
+  artifact-name:
+    description: Name of the uploaded artifact
+    required: true
+  msystem:
+    description: MSYS2 subsystem to use
+    required: false
+  windows-codesign-cert:
+    description: Certificate for signing Windows builds
+    required: false
+  windows-codesign-password:
+    description: Password for signing Windows builds
+    required: false
+
+runs:
+  using: composite
+
+  steps:
+    - name: Package (MinGW)
+      if: ${{ inputs.msystem != '' }}
+      shell: msys2 {0}
+      env:
+        BUILD_DIR: build
+        INSTALL_DIR: install
+      run: |
+        cmake --install ${{ env.BUILD_DIR }} --config ${{ inputs.build-type }}
+        touch ${{ env.INSTALL_DIR }}/manifest.txt
+        for l in $(find ${{ env.INSTALL_DIR }} -type f); do l=$(cygpath -u $l); l=${l#$(pwd)/}; l=${l#${{ env.INSTALL_DIR }}/}; l=${l#./}; echo $l; done >> ${{ env.INSTALL_DIR }}/manifest.txt
+
+    - name: Package (MSVC)
+      if: ${{ inputs.msystem == '' }}
+      shell: pwsh
+      env:
+        BUILD_DIR: build
+        INSTALL_DIR: install
+      run: |
+        cmake --install ${{ env.BUILD_DIR }} --config ${{ inputs.build-type }}
+
+        cd ${{ github.workspace }}
+
+        Get-ChildItem ${{ env.INSTALL_DIR }} -Recurse | ForEach FullName | Resolve-Path -Relative | %{ $_.TrimStart('.\') } | %{ $_.TrimStart('${{ env.INSTALL_DIR }}') } | %{ $_.TrimStart('\') } | Out-File -FilePath ${{ env.INSTALL_DIR }}/manifest.txt
+
+    - name: Fetch codesign certificate
+      shell: bash # yes, we are not using MSYS2 or PowerShell here
+      run: |
+        echo '${{ inputs.windows-codesign-cert }}' | base64 --decode > codesign.pfx
+
+    - name: Sign executable
+      shell: pwsh
+      env:
+        INSTALL_DIR: install
+      run: |
+        if (Get-Content ./codesign.pfx){
+          cd ${{ env.INSTALL_DIR }}
+            # We ship the exact same executable for portable and non-portable editions, so signing just once is fine
+            SignTool sign /fd sha256 /td sha256 /f ../codesign.pfx /p '${{ inputs.windows-codesign-password }}' /tr http://timestamp.digicert.com meshmc.exe
+        } else {
+          ":warning: Skipped code signing for Windows, as certificate was not present." >> $env:GITHUB_STEP_SUMMARY
+        }
+
+    - name: Package (MinGW, portable)
+      if: ${{ inputs.msystem != '' }}
+      shell: msys2 {0}
+      env:
+        BUILD_DIR: build
+        INSTALL_DIR: install
+        INSTALL_PORTABLE_DIR: install-portable
+      run: |
+        cp -r ${{ env.INSTALL_DIR }} ${{ env.INSTALL_PORTABLE_DIR }}  # cmake install on Windows is slow, let's just copy instead
+        cmake --install ${{ env.BUILD_DIR }} --config ${{ inputs.build-type }} --prefix ${{ env.INSTALL_PORTABLE_DIR }} --component portable
+        for l in $(find ${{ env.INSTALL_PORTABLE_DIR }} -type f); do l=$(cygpath -u $l); l=${l#$(pwd)/}; l=${l#${{ env.INSTALL_PORTABLE_DIR }}/}; l=${l#./}; echo $l; done >> ${{ env.INSTALL_PORTABLE_DIR }}/manifest.txt
+
+    - name: Package (MSVC, portable)
+      if: ${{ inputs.msystem == '' }}
+      shell: pwsh
+      env:
+        BUILD_DIR: build
+        INSTALL_DIR: install
+        INSTALL_PORTABLE_DIR: install-portable
+      run: |
+        cp -r ${{ env.INSTALL_DIR }} ${{ env.INSTALL_PORTABLE_DIR }}  # cmake install on Windows is slow, let's just copy instead
+        cmake --install ${{ env.BUILD_DIR }} --config ${{ inputs.build-type }} --prefix ${{ env.INSTALL_PORTABLE_DIR }} --component portable
+
+        Get-ChildItem ${{ env.INSTALL_PORTABLE_DIR }} -Recurse | ForEach FullName | Resolve-Path -Relative | %{ $_.TrimStart('.\') } | %{ $_.TrimStart('${{ env.INSTALL_PORTABLE_DIR }}') } | %{ $_.TrimStart('\') } | Out-File -FilePath ${{ env.INSTALL_DIR }}/manifest.txt
+
+    - name: Package (installer)
+      shell: pwsh
+      env:
+        BUILD_DIR: build
+        INSTALL_DIR: install
+
+        NSCURL_VERSION: "v24.9.26.122"
+        NSCURL_SHA256: "AEE6C4BE3CB6455858E9C1EE4B3AFE0DB9960FA03FE99CCDEDC28390D57CCBB0"
+      run: |
+        New-Item -Name NSISPlugins -ItemType Directory
+        Invoke-Webrequest https://github.com/negrutiu/nsis-nscurl/releases/download/"${{ env.NSCURL_VERSION }}"/NScurl.zip -OutFile NSISPlugins\NScurl.zip
+        $nscurl_hash = Get-FileHash NSISPlugins\NScurl.zip -Algorithm Sha256 | Select-Object -ExpandProperty Hash
+        if ( $nscurl_hash -ne "${{ env.nscurl_sha256 }}") {
+          echo "::error:: NSCurl.zip sha256 mismatch"
+          exit 1
+        }
+        Expand-Archive -Path NSISPlugins\NScurl.zip -DestinationPath NSISPlugins\NScurl
+
+        cd ${{ env.INSTALL_DIR }}
+        makensis -NOCD "${{ github.workspace }}/${{ env.BUILD_DIR }}/win_install.nsi"
+
+    - name: Sign installer
+      shell: pwsh
+      run: |
+          if (Get-Content ./codesign.pfx){
+            SignTool sign /fd sha256 /td sha256 /f codesign.pfx /p '${{ inputs.windows-codesign-password }}' /tr http://timestamp.digicert.com MeshMC-Setup.exe
+          } else {
+            ":warning: Skipped code signing for Windows, as certificate was not present." >> $env:GITHUB_STEP_SUMMARY
+          }
+
+    - name: Upload binary zip
+      uses: actions/upload-artifact@v5
+      with:
+        name: MeshMC-${{ inputs.artifact-name }}-${{ inputs.version }}-${{ inputs.build-type }}
+        path: install/**
+
+    - name: Upload portable zip
+      uses: actions/upload-artifact@v5
+      with:
+        name: MeshMC-${{ inputs.artifact-name }}-Portable-${{ inputs.version }}-${{ inputs.build-type }}
+        path: install-portable/**
+
+    - name: Upload installer
+      uses: actions/upload-artifact@v5
+      with:
+        name: MeshMC-${{ inputs.artifact-name }}-Setup-${{ inputs.version }}-${{ inputs.build-type }}
+        path: MeshMC-Setup.exe
diff --git a/.github/actions/meshmc/setup-dependencies/action.yml b/.github/actions/meshmc/setup-dependencies/action.yml
new file mode 100644
index 0000000000..9ab7781441
--- /dev/null
+++ b/.github/actions/meshmc/setup-dependencies/action.yml
@@ -0,0 +1,89 @@
+name: Setup Dependencies
+description: Install and setup dependencies for building MeshMC
+
+inputs:
+  build-type:
+    description: Type for the build
+    required: true
+    default: Debug
+  artifact-name:
+    description: Name of the uploaded artifact
+    required: true
+  msystem:
+    description: MSYS2 subsystem to use
+    required: false
+  vcvars-arch:
+    description: Visual Studio architecture to use
+    required: false
+  qt-architecture:
+    description: Qt architecture
+    required: false
+  qt-version:
+    description: Version of Qt to use
+    required: true
+  github-token:
+    description: GitHub token for package feed authentication
+    required: false
+    default: ${{ github.token }}
+
+outputs:
+  build-type:
+    description: Type of build used
+    value: ${{ inputs.build-type }}
+  qt-version:
+    description: Version of Qt used
+    value: ${{ inputs.qt-version }}
+
+runs:
+  using: composite
+
+  steps:
+    - name: Setup Linux dependencies
+      if: ${{ runner.os == 'Linux' }}
+      uses: ./.github/actions/meshmc/setup-dependencies/linux
+      with:
+        github-token: ${{ inputs.github-token }}
+
+    - name: Setup macOS dependencies
+      if: ${{ runner.os == 'macOS' }}
+      uses: ./.github/actions/meshmc/setup-dependencies/macos
+      with:
+        build-type: ${{ inputs.build-type }}
+        github-token: ${{ inputs.github-token }}
+
+    - name: Setup Windows dependencies
+      if: ${{ runner.os == 'Windows' }}
+      uses: ./.github/actions/meshmc/setup-dependencies/windows
+      with:
+        build-type: ${{ inputs.build-type }}
+        msystem: ${{ inputs.msystem }}
+        vcvars-arch: ${{ inputs.vcvars-arch }}
+        github-token: ${{ inputs.github-token }}
+
+    # TODO(@YongDo-Hyun): Get this working on MSYS2!
+    - name: Setup ccache
+      if: ${{ (runner.os != 'Windows' || inputs.msystem == '') && inputs.build-type == 'Debug' }}
+      uses: hendrikmuhs/ccache-action@v1.2.22
+      with:
+        variant: sccache
+        create-symlink: ${{ runner.os != 'Windows' }}
+        key: ${{ runner.os }}-${{ runner.arch }}-${{ inputs.artifact-name }}-sccache
+
+    - name: Use ccache on debug builds
+      if: ${{ inputs.build-type == 'Debug' }}
+      shell: bash
+      env:
+        # Only use ccache on MSYS2
+        CCACHE_VARIANT: ${{ (runner.os == 'Windows' && inputs.msystem != '') && 'ccache' || 'sccache' }}
+      run: |
+        echo "CMAKE_C_COMPILER_LAUNCHER=$CCACHE_VARIANT" >> "$GITHUB_ENV"
+        echo "CMAKE_CXX_COMPILER_LAUNCHER=$CCACHE_VARIANT" >> "$GITHUB_ENV"
+
+    - name: Install Qt
+      if: ${{ inputs.msystem == '' }}
+      uses: jurplel/install-qt-action@v4
+      with:
+        aqtversion: "==3.1.*"
+        version: ${{ inputs.qt-version }}
+        modules: qtimageformats qtnetworkauth qt5compat
+        cache: ${{ inputs.build-type == 'Debug' }}
diff --git a/.github/actions/meshmc/setup-dependencies/linux/action.yml b/.github/actions/meshmc/setup-dependencies/linux/action.yml
new file mode 100644
index 0000000000..46cb40e8a5
--- /dev/null
+++ b/.github/actions/meshmc/setup-dependencies/linux/action.yml
@@ -0,0 +1,59 @@
+name: Setup Linux dependencies
+description: Install and setup dependencies for building MeshMC
+
+inputs:
+  github-token:
+    description: GitHub token for authentication
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+    - name: Install host dependencies
+      shell: bash
+      run: |
+        sudo apt-get -y update
+        sudo apt-get -y install \
+          dpkg-dev \
+          ninja-build extra-cmake-modules pkg-config scdoc \
+          cmark gamemode-dev libarchive-dev libcmark-dev libqrencode-dev zlib1g-dev \
+          libxcb-cursor-dev libtomlplusplus-dev libvulkan-dev
+
+    - name: Setup AppImage tooling
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+      run: |
+        # Determinate AppImage architecture to use
+        dpkg_arch="$(dpkg-architecture -q DEB_HOST_ARCH_CPU)"
+        case "$dpkg_arch" in
+          "amd64")
+            APPIMAGE_ARCH="x86_64"
+            ;;
+          "arm64")
+            APPIMAGE_ARCH="aarch64"
+            ;;
+          *)
+            echo "# 🚨 The Debian architecture \"$deb_arch\" is not recognized!" >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+            ;;
+        esac
+
+        gh release download \
+          --repo VHSgunzo/sharun \
+          --pattern "sharun-$APPIMAGE_ARCH-aio" \
+          --output ~/bin/sharun
+
+        # FIXME!: revert this to probonopd/go-appimage once https://github.com/probonopd/go-appimage/pull/377 is merged!
+        gh release download continuous \
+          --repo DioEgizio/go-appimage \
+          --pattern "mkappimage-*-$APPIMAGE_ARCH.AppImage" \
+          --output ~/bin/mkappimage
+
+        gh release download \
+          --repo AppImageCommunity/AppImageUpdate \
+          --pattern "AppImageUpdate-$APPIMAGE_ARCH.AppImage" \
+          --output ~/bin/AppImageUpdate.AppImage
+        chmod +x ~/bin/*
+        echo "$HOME/bin" >> "$GITHUB_PATH"
diff --git a/.github/actions/meshmc/setup-dependencies/macos/action.yml b/.github/actions/meshmc/setup-dependencies/macos/action.yml
new file mode 100644
index 0000000000..3eb5b37fa6
--- /dev/null
+++ b/.github/actions/meshmc/setup-dependencies/macos/action.yml
@@ -0,0 +1,52 @@
+name: Setup macOS dependencies
+
+inputs:
+  build-type:
+    description: Type for the build
+    required: true
+    default: Debug
+  github-token:
+    description: GitHub token for package feed authentication
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+    - name: Install dependencies
+      shell: bash
+      run: |
+        brew update
+        brew install ninja extra-cmake-modules temurin@17 mono autoconf libarchive
+
+    - name: Set JAVA_HOME
+      shell: bash
+      run: |
+        echo "JAVA_HOME=$(/usr/libexec/java_home -v 17)" >> "$GITHUB_ENV"
+
+    - name: Setup vcpkg cache
+      if: ${{ inputs.build-type == 'Debug' }}
+      shell: bash
+      env:
+        USERNAME: ${{ github.repository_owner }}
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        FEED_URL: https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json
+        NUGET_RW: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+      run: |
+        mono `vcpkg fetch nuget | tail -n 1` \
+          sources add \
+          -Source "$FEED_URL" \
+          -StorePasswordInClearText \
+          -Name GitHubPackages \
+          -UserName "$USERNAME" \
+          -Password "$GITHUB_TOKEN"
+        mono `vcpkg fetch nuget | tail -n 1` \
+          setapikey "$GITHUB_TOKEN" \
+          -Source "$FEED_URL"
+        MODE=$( [ "$NUGET_RW" = "true" ] && echo "readwrite" || echo "read" )
+        echo "VCPKG_BINARY_SOURCES=clear;nuget,$FEED_URL,$MODE" >> "$GITHUB_ENV"
+
+    - name: Setup vcpkg environment
+      shell: bash
+      run: |
+        echo "VCPKG_ROOT=$VCPKG_INSTALLATION_ROOT" >> "$GITHUB_ENV"
diff --git a/.github/actions/meshmc/setup-dependencies/windows/action.yml b/.github/actions/meshmc/setup-dependencies/windows/action.yml
new file mode 100644
index 0000000000..a06b38d389
--- /dev/null
+++ b/.github/actions/meshmc/setup-dependencies/windows/action.yml
@@ -0,0 +1,114 @@
+name: Setup Windows Dependencies
+description: Install and setup dependencies for building MeshMC
+
+inputs:
+  build-type:
+    description: Type for the build
+    required: true
+    default: Debug
+  msystem:
+    description: MSYS2 subsystem to use
+    required: false
+  vcvars-arch:
+    description: Visual Studio architecture to use
+    required: true
+    default: amd64
+  github-token:
+    description: GitHub token for package feed authentication
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+    # NOTE: Installed on MinGW as well for SignTool
+    - name: Enter VS Developer shell
+      if: ${{ runner.os == 'Windows' }}
+      uses: ilammy/msvc-dev-cmd@v1
+      with:
+        arch: ${{ inputs.vcvars-arch }}
+        vsversion: 2022
+
+    - name: Setup Java (MSVC)
+      uses: actions/setup-java@v5
+      with:
+        # NOTE(@YongDo-Hyun): We should probably stay on Zulu.
+        # Temurin doesn't have Java 17 builds for WoA
+        distribution: zulu
+        java-version: 17
+
+    - name: Setup vcpkg cache (MSVC)
+      if: ${{ inputs.msystem == '' && inputs.build-type == 'Debug' }}
+      shell: pwsh
+      env:
+        USERNAME: ${{ github.repository_owner }}
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        FEED_URL: https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json
+        NUGET_RW: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+      run: |
+        .$(vcpkg fetch nuget) `
+          sources add `
+          -Source "$env:FEED_URL" `
+          -StorePasswordInClearText `
+          -Name GitHubPackages `
+          -UserName "$env:USERNAME" `
+          -Password "$env:GITHUB_TOKEN"
+        .$(vcpkg fetch nuget) `
+          setapikey "$env:GITHUB_TOKEN" `
+          -Source "$env:FEED_URL"
+        $mode = if ($env:NUGET_RW -eq 'true') { 'readwrite' } else { 'read' }
+        "VCPKG_BINARY_SOURCES=clear;nuget,$env:FEED_URL,$mode" | Out-File -Append $env:GITHUB_ENV
+
+    - name: Setup vcpkg environment (MSVC)
+      if: ${{ inputs.msystem == '' }}
+      shell: bash
+      run: |
+        echo "VCPKG_ROOT=$VCPKG_INSTALLATION_ROOT" >> "$GITHUB_ENV"
+
+    - name: Setup MSYS2 (MinGW)
+      if: ${{ inputs.msystem != '' }}
+      uses: msys2/setup-msys2@v2
+      with:
+        msystem: ${{ inputs.msystem }}
+        update: true
+        install: >-
+          git
+        pacboy: >-
+          toolchain:p
+          ccache:p
+          cmake:p
+          extra-cmake-modules:p
+          ninja:p
+          qt6-base:p
+          qt6-svg:p
+          qt6-imageformats:p
+          qt6-networkauth:p
+          qt6-5compat:p
+          cmark:p
+          qrencode:p
+          tomlplusplus:p
+          libarchive:p
+
+    - name: List pacman packages (MinGW)
+      if: ${{ inputs.msystem != '' }}
+      shell: msys2 {0}
+      run: |
+        pacman -Qe
+
+    - name: Retrieve ccache cache (MinGW)
+      if: ${{ inputs.msystem != '' && inputs.build-type == 'Debug' }}
+      uses: actions/cache@v5.0.4
+      with:
+        path: '${{ github.workspace }}\.ccache'
+        key: ${{ runner.os }}-mingw-w64-ccache-${{ github.run_id }}
+        restore-keys: |
+          ${{ runner.os }}-mingw-w64-ccache
+
+    - name: Setup ccache (MinGW)
+      if: ${{ inputs.msystem != '' && inputs.build-type == 'Debug' }}
+      shell: msys2 {0}
+      run: |
+        ccache --set-config=cache_dir='${{ github.workspace }}\.ccache'
+        ccache --set-config=max_size='500M'
+        ccache --set-config=compression=true
+        ccache -p  # Show config