Ported to OpenTTD mainline

.github/codeql/codeql-config.yml

@@ -0,0 +1,10 @@
+name: openttd
+queries:
+- uses: security-and-quality
+query-filters:
+- exclude:
+    id:
+    # Only feasible way is to move away from fopen; fopen_s is optional C11 and not implemented on most platforms.
+    - cpp/world-writable-file-creation
+    # Basically OpenTTD's coding style for adding things like ..._INVALID to enumerations
+    - cpp/irregular-enum-init

.github/script-missing-mode-enforcement.py

@@ -0,0 +1,71 @@
+"""
+Script to scan the OpenTTD's script API for functions that miss checks for the
+function being called from the right mode (deity or company mode).
+
+When a function calls either ScriptObject::Command or ScriptObject::GetCompany
+then the function is considered dangerous. When one of the mode enforcement
+macros from script_error.hpp, i.e. EnforceDeityMode, EnforceCompanyModeValid or
+EnforceDeityOrCompanyModeValid, are called in the function, then we consider
+that the function has mode enforcement.
+
+Any dangerous function for which no enforcement is found are emitted as errors.
+"""
+
+import glob
+import re
+import sys
+
+
+def check_mode_enforcement(path):
+    errors = []
+    with open(path, "r") as reader:
+        mode_enforcement_found = False
+        dangerous_function = False
+        for line in reader:
+            # Line does not start with a tab and have <word>::<word>. That looks like the begin of a function, so reset the state.
+            if re.match(r"^[^\t].*\w::\w", line):
+                mode_enforcement_found = False
+                dangerous_function = False
+                currentFunction = line
+                continue
+
+            if re.match(
+                r"\t(EnforceDeityMode|EnforceCompanyModeValid|EnforceDeityOrCompanyModeValid|EnforceDeityOrCompanyModeValid_Void)\(",
+                line,
+            ):
+                # Mode enforcement macro found
+                mode_enforcement_found = True
+                continue
+
+            if re.match(r".*(ScriptObject::Command|ScriptObject::GetCompany).*", line):
+                # Dangerous function found
+                dangerous_function = True
+                continue
+
+            # Line with only a closing bracket. That looks like the end of a function, so check for the dangerous function without mode enforcement
+            if re.match(r"^}$", line) and dangerous_function and not mode_enforcement_found:
+                function_name = currentFunction.rstrip("\n").replace("/* static */ ", "")
+                errors.append(f"{path}: {function_name}")
+
+    return errors
+
+
+def main():
+    errors = []
+    for path in sorted(glob.glob("src/script/api/*.cpp")):
+        # Skip a number of files that yield only false positives
+        if path.endswith(("script_object.cpp", "script_companymode.cpp", "script_controller.cpp", "script_game.cpp")):
+            continue
+
+        errors.extend(check_mode_enforcement(path))
+
+    if errors:
+        print("Mode enforcement was expected in the following files/functions:")
+        print("\n".join(errors))
+        sys.exit(1)
+
+    print("OK")
+
+
+if __name__ == "__main__":
+    main()

.github/unused-strings.py

@@ -210,11 +210,10 @@ def main():
             errors.append(f"ERROR: {string} is (possibly) no longer needed.")
 
     if errors:
-        for error in errors:
-            print(error)
+        print("\n".join(errors))
         sys.exit(1)
-    else:
-        print("OK")
+
+    print("OK")
 
 
 if __name__ == "__main__":

.github/workflows/ci-build.yml

@@ -12,14 +12,18 @@ on:
 env:
   CTEST_OUTPUT_ON_FAILURE: 1
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
 jobs:
   emscripten:
     name: Emscripten
 
     runs-on: ubuntu-20.04
     container:
       # If you change this version, change the number in the cache step too.
-      image: emscripten/emsdk:2.0.31
+      image: emscripten/emsdk:3.1.28
 
     steps:
     - name: Checkout
@@ -29,7 +33,7 @@ jobs:
       uses: actions/cache@v3
       with:
         path: /emsdk/upstream/emscripten/cache
-        key: 2.0.31-${{ runner.os }}
+        key: 3.1.28-${{ runner.os }}
 
     - name: Patch Emscripten to support LZMA
       run: |
@@ -105,6 +109,7 @@ jobs:
         echo "::group::Install dependencies"
         sudo apt-get install -y --no-install-recommends \
           liballegro4-dev \
+          libcurl4-openssl-dev \
           libfontconfig-dev \
           libicu-dev \
           liblzma-dev \
@@ -165,16 +170,25 @@ jobs:
 
     runs-on: macos-latest
     env:
-      MACOSX_DEPLOYMENT_TARGET: 10.14
+      MACOSX_DEPLOYMENT_TARGET: 10.13
 
     steps:
     - name: Checkout
       uses: actions/checkout@v3
 
+    - name: Install dependencies
+      env:
+        HOMEBREW_NO_AUTO_UPDATE: 1
+        HOMEBREW_NO_INSTALL_CLEANUP: 1
+      run: |
+        brew install \
+          pkg-config \
+          # EOF
+
     - name: Prepare cache key
       id: key
       run: |
-        echo "::set-output name=image::$ImageOS-$ImageVersion"
+        echo "image=$ImageOS-$ImageVersion" >> $GITHUB_OUTPUT
 
     - name: Enable vcpkg cache
       uses: actions/cache@v3
@@ -187,6 +201,7 @@ jobs:
     - name: Prepare vcpkg
       run: |
         vcpkg install --triplet=${{ matrix.arch }}-osx \
+          curl \
           liblzma \
           libpng \
           lzo \
@@ -256,7 +271,7 @@ jobs:
         # Work around caching failure with GNU tar
         New-Item -Type Junction -Path vcpkg -Target c:\vcpkg
 
-        Write-Output "::set-output name=image::$env:ImageOS-$env:ImageVersion"
+        Write-Output "image=$env:ImageOS-$env:ImageVersion" >> $env:GITHUB_OUTPUT
 
     - name: Enable vcpkg cache
       uses: actions/cache@v3
@@ -411,4 +426,4 @@ jobs:
 
     steps:
     - name: Check annotations
-      uses: OpenTTD/actions/annotation-check@v2
+      uses: OpenTTD/actions/annotation-check@v3

.github/workflows/codeql.yml

@@ -0,0 +1,83 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+    - master
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches:
+    - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: Install dependencies
+      run: |
+        echo "::group::Update apt"
+        sudo apt-get update
+        echo "::endgroup::"
+
+        echo "::group::Install dependencies"
+        sudo apt-get install -y --no-install-recommends \
+          liballegro4-dev \
+          libcurl4-openssl-dev \
+          libfontconfig-dev \
+          libicu-dev \
+          liblzma-dev \
+          liblzo2-dev \
+          libsdl2-dev \
+          zlib1g-dev \
+          # EOF
+        echo "::endgroup::"
+      env:
+        DEBIAN_FRONTEND: noninteractive
+
+    - name: Set number of make jobs
+      run: |
+        echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: cpp
+        config-file: ./.github/codeql/codeql-config.yml
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: /language:cpp
+        upload: False
+        output: sarif-results
+
+    - name: Filter out table & generated code
+      uses: advanced-security/filter-sarif@v1
+      with:
+        patterns: |
+          +**/*.*
+          -**/table/*.*
+          -**/generated/**/*.*
+        input: sarif-results/cpp.sarif
+        output: sarif-results/cpp.sarif
+
+    - name: Upload results
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        sarif_file: sarif-results/cpp.sarif

.github/workflows/commit-checker.yml

@@ -3,6 +3,10 @@ name: Commit checker
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
 jobs:
   commit-checker:
     name: Commit checker

.github/workflows/preview_build.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-20.04
     container:
       # If you change this version, change the number in the cache step too.
-      image: emscripten/emsdk:2.0.31
+      image: emscripten/emsdk:3.1.28
 
     steps:
     - name: Update deployment status to in progress
@@ -37,14 +37,15 @@ jobs:
 
     - name: Name branch
       run: |
+        git config --global --add safe.directory ${GITHUB_WORKSPACE}
         name=$(echo "${{ github.event.client_payload.folder }}")
         git checkout -b ${name}
 
     - name: Setup cache
       uses: actions/cache@v3
       with:
         path: /emsdk/upstream/emscripten/cache
-        key: 2.0.31-${{ runner.os }}
+        key: 3.1.28-${{ runner.os }}
 
     - name: Patch Emscripten to support LZMA
       run: |