ci: bust stale macOS OGRE cache (xcode263) — unblock 3.9.1 macOS deploy

[fernandotonon]

The 3.9.1 release deploy failed on build-macos (Windows + Linux .deb artifacts published OK; macOS artifact + Homebrew cask update did not):

make: No rule to make target '.../Xcode_26.5/.../usr/lib/libz.tbd', needed by QtMeshEditor

Cause: the Pin-Xcode step selects Xcode 26.3 consistently across all macOS jobs (verified), but the OGRE cache stored under key xcode26b was built earlier under Xcode 26.5 — its CMake export hardcodes 26.5's libz.tbd path. Restoring that into a 26.3 build breaks the link.

Fix: bump MACOS_CACHE_VERSION xcode26b → xcode263 so OGRE/Assimp rebuild under the pinned 26.3 and the stale 26.5 cache is discarded. One-line, CI-only.

After merge: move the 3.9.1 tag to the fixed commit and re-trigger the deploy so the macOS artifact + Homebrew cask complete.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Optimized macOS CI/CD deployment pipeline with improved toolchain pinning and updated cache key strategies to prevent stale cached artifacts from affecting builds.

• Tests

  • Improved test initialization procedures to ensure UI visibility state is properly established before running assertions on toolbar components.

[coderabbitai]

📝 Walkthrough

Walkthrough

The macOS CI workflow gains per-Xcode cache isolation by exporting SDKROOT and XCODE_TAG in every Xcode-pinning step and appending XCODE_TAG to the OGRE cache key; MACOS_CACHE_VERSION is bumped to sdkpin1 and an explicit cache-miss rebuild block is added. A test fix adds window->show() and app->processEvents() before visibility assertions.

Changes

macOS OGRE Cache Invalidation by Xcode Version

Layer / File(s)	Summary
Cache version bump and SDKROOT/XCODE_TAG export .github/workflows/deploy.yml	Bumps MACOS_CACHE_VERSION to sdkpin1, extends all three macOS Xcode-pinning steps to export SDKROOT (via xcrun) and XCODE_TAG (derived from the Xcode app path), and adds comments explaining assimp cache remains Xcode-agnostic.
OGRE cache key includes XCODE_TAG + cache-miss rebuild .github/workflows/deploy.yml	Appends ${{ env.XCODE_TAG }} to the OGRE cache key so incompatible Xcode images always miss, and adds a gated checkout + rebuild step that runs when cache-hit != 'true'.

MainWindow Test Visibility Fix

Layer / File(s)	Summary
Show window before visibility assertions src/mainwindow_test.cpp	Adds window->show() and app->processEvents() before isHidden() checks in ModeBarLoadsAndModeChangeUpdatesStatusIndicator to ensure the toolbar shell's effective visibility is realized before assertions run.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 A cache once stale from Xcode's old face,
Now tagged by version, locked into place.
SDKROOT pinned, no ghost paths remain,
And windows now show before tests complain!
Hop hop, the build bunnies cheer — no more pain! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the main change: bumping the macOS cache version to fix a stale OGRE cache issue blocking the 3.9.1 release deployment.
Description check	✅ Passed	The description provides a clear summary of the problem, root cause, and solution, though it does not follow the template structure with explicit sections like 'Summary' and 'Technical Details'.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/macos-deploy-cache-3.9.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy.yml:
- Around line 1824-1830: In the "Check out ogre repo (cache miss)" step where
the OGRECave/ogre repository is checked out, replace the mutable `@master`
reference in the uses field with a pinned version (use a specific commit SHA or
tagged release version instead). Additionally, add persist-credentials: false to
the with section to disable credential persistence for this external repository
checkout, reducing supply-chain risk.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: aae8390a-4f69-4d19-bd46-c41bac3343d5

📥 Commits

Reviewing files that changed from the base of the PR and between 0b370c9 and ca71059.

📒 Files selected for processing (2)

• .github/workflows/deploy.yml
• src/mainwindow_test.cpp

[coderabbitai]

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/deploy.yml"

echo "1) Find mutable checkout refs in workflow:"
rg -n 'uses:\s*actions/checkout@master' "$FILE" || true

echo
echo "2) Inspect new cache-miss checkout block context:"
sed -n '1822,1832p' "$FILE"

echo
echo "3) Verify whether credential persistence is explicitly disabled in that block:"
if sed -n '1824,1832p' "$FILE" | rg -q 'persist-credentials:\s*false'; then
  echo "persist-credentials: false is present"
else
  echo "persist-credentials: false is MISSING"
fi

Repository: fernandotonon/QtMeshEditor

Length of output: 1154

---

Pin the checkout action and disable credential persistence in the new cache-miss checkout.

Line 1826 uses actions/checkout@master (mutable reference), and this external-repository checkout does not set persist-credentials: false. This introduces a supply-chain risk in this path.

Suggested hardening fix

-    - if: steps.cache-ogre-macos.outputs.cache-hit != 'true'
-      name: Check out ogre repo (cache miss)
-      uses: actions/checkout@master
+    - if: steps.cache-ogre-macos.outputs.cache-hit != 'true'
+      name: Check out ogre repo (cache miss)
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
+          persist-credentials: false
           repository: OGRECave/ogre
           ref: v${{ env.OGRE_VERSION }}
           path: ${{github.workspace}}/ogre

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- if: steps.cache-ogre-macos.outputs.cache-hit != 'true'
	name: Check out ogre repo (cache miss)
	uses: actions/checkout@master
	with:
	repository: OGRECave/ogre
	ref: v${{ env.OGRE_VERSION }}
	path: ${{github.workspace}}/ogre
	- if: steps.cache-ogre-macos.outputs.cache-hit != 'true'
	name: Check out ogre repo (cache miss)
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	persist-credentials: false
	repository: OGRECave/ogre
	ref: v${{ env.OGRE_VERSION }}
	path: ${{github.workspace}}/ogre

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 1824-1830: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 1826-1826: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy.yml around lines 1824 - 1830, In the "Check out
ogre repo (cache miss)" step where the OGRECave/ogre repository is checked out,
replace the mutable `@master` reference in the uses field with a pinned version
(use a specific commit SHA or tagged release version instead). Additionally, add
persist-credentials: false to the with section to disable credential persistence
for this external repository checkout, reducing supply-chain risk.

Source: Linters/SAST tools

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud