Revived the Windows workflows, which had reached no runner since 2025

.github/dependabot.yml

@@ -0,0 +1,100 @@
+version: 2
+
+# Keeps the pinned action SHAs moving.
+#
+# Every action reference under .github/workflows is a 40-character commit SHA
+# with the version in a trailing comment. A SHA pin *without* this file is worse
+# than a floating tag: it freezes CI on whatever was current the day it was
+# written. This repository is the case study. Nothing had ever reported that an
+# action moved, so actions/upload-artifact sat on v3.1.3 in all four Windows
+# workflows -- four majors behind, and a version GitHub began auto-failing on
+# 2025-01-30. actions/checkout sat on an unpinned @v4, three majors behind.
+#
+# Dependabot understands the SHA form and rewrites the trailing version comment
+# together with the pin, so the comment cannot drift away from the SHA it
+# describes. That is what keeps "which exact code ran in our CI" answerable from
+# the repository, which the SBOM and certification work needs on its own.
+#
+# This follows the pattern set by eclipse-threadx/threadx, which added the same
+# configuration in August 2026 after the same drift was measured there.
+#
+# What this does not fix: it reports drift, not silence. A workflow that never
+# triggers rots unnoticed no matter what is pinned in it, and this repository had
+# that failure in its more severe form -- the four Windows workflows requested
+# runs-on: windows-2019 for more than a year after GitHub retired that image, so
+# every run queued for 24 hours and was cancelled without reaching a runner. No
+# amount of pinning would have said so. The runner image fix is a separate
+# change; this file is the drift half only.
+#
+# There is no entry for any other ecosystem, and that is a decision rather than
+# an oversight: the project forbids external dependencies and there are no
+# submodules. The one pinned toolchain input -- the Windows SDK version passed
+# to VsDevCmd in scripts/build_guix_studio.cmd -- lives in a batch file that no
+# Dependabot ecosystem can parse. That pin moves by hand.
+updates:
+  - package-ecosystem: "github-actions"
+    # "/" is the only accepted value for this ecosystem; it covers
+    # .github/workflows and .github/actions. The cross-repository reusable
+    # workflow in regression_test.yml
+    # (eclipse-threadx/threadx/.github/workflows/regression_template.yml@master)
+    # is correctly left alone: it references a branch, not a version, so there
+    # is nothing for Dependabot to move. Tracking that branch is deliberate --
+    # it is first-party, in the same organisation, and it means this repository
+    # picks up harness fixes without a bump here.
+    directory: "/"
+
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "Etc/UTC"
+
+    # Dependabot reads this file from the repository's DEFAULT branch, which is
+    # master. But master is deliberately kept behind dev, and pull requests
+    # belong on dev. target-branch sends the pull requests to dev and makes
+    # Dependabot read the workflows it is updating from dev as well.
+    #
+    # The consequence to plan for: landing this file on dev arms it, it does not
+    # fire it. Nothing happens until a release merge carries it to master.
+    #
+    # Setting target-branch also opts out of Dependabot *security* updates,
+    # which only ever run against the default branch. For this ecosystem the
+    # cost is small -- an action advisory arrives as an ordinary version bump on
+    # the weekly run -- but it is a real trade and not a detail to rediscover
+    # later.
+    target-branch: "dev"
+
+    groups:
+      # Patch and minor arrive together in one pull request: they are the
+      # routine traffic, and reviewing them one at a time is how an update queue
+      # starts being ignored, which is the failure mode this file exists to
+      # prevent. Majors stay ungrouped, one pull request each, because every
+      # breaking change met in an action here has been a major: upload-artifact
+      # v4 stopped allowing an artifact name to be uploaded twice in a run, and
+      # v6 requires a runner of 2.327.1 or newer.
+      actions-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+    # Only three distinct actions are in use today -- actions/checkout,
+    # actions/upload-artifact and EnricoMi/publish-unit-test-result-action -- so
+    # the default limit of five would be enough for now. Ten is set to match the
+    # sibling repositories and to leave room for a wave of majors after a long
+    # gap, which is exactly the situation this file is being added into.
+    open-pull-requests-limit: 10
+
+    # This repository has no "dependencies" label yet; Dependabot creates it on
+    # the first pull request.
+    labels:
+      - "dependencies"
+
+    # Reviewers are not listed. Unlike eclipse-threadx/threadx this repository
+    # has no .github/CODEOWNERS, so there is no path routing for Dependabot to
+    # honour. Adding one is worth doing, but it is not this file's job.
+    #
+    # Commit subjects are left at Dependabot's own "Bump x from a to b" wording.
+    # The project asks for a past-tense subject and still gets one: these pull
+    # requests are squash-merged, and the subject is set at that point.

.github/workflows/studio_demo_test.yml

@@ -6,19 +6,22 @@
 # https://opensource.org/licenses/MIT.
 #
 # SPDX-License-Identifier: MIT
+# Some portions generated by Claude Code (Opus 5).
 
 # This is a basic workflow that is manually triggered
 
 name: GUIX Studio Demo Test
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the master branch
+# Controls when the action will run. dev is included deliberately: it is the
+# integration branch, so a master-only trigger gated no pull request that
+# anybody opened. Verified green on a runner before being switched on --
+# 227 of 227 generation tests and 212 of 212 compile tests.
 on:
-  workflow_dispatch:  
+  workflow_dispatch:
   push:
-    branches: [ master ]
+    branches: [ master, dev ]
   pull_request:
-    branches: [ master ]
+    branches: [ master, dev ]
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
@@ -31,12 +34,21 @@ jobs:
       pull-requests: write
 
     # The type of runner that the job will run on
-    runs-on: windows-2019
+    # Pinned deliberately rather than windows-latest: the image this job
+    # needs has to be a reviewable commit, not something that changes
+    # underneath the build. windows-2019 sat here until 2026-08-26, more
+    # than a year after GitHub retired that image, so every run queued for
+    # 24 hours and was then cancelled without ever reaching a runner.
+    runs-on: windows-2022
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
     - name: Check out the repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         submodules: true
 
@@ -47,7 +59,7 @@ jobs:
       run: scripts\test_studio_demo.cmd
 
     - name: Publish Test Results
-      uses: EnricoMi/publish-unit-test-result-action/composite@v2
+      uses: EnricoMi/publish-unit-test-result-action/composite@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
       if: always()
       with:
         check_name: Test Results GUIX Studio Demo
@@ -56,7 +68,7 @@ jobs:
 
     - name: Upload Test Results
       if: success() || failure()
-      uses: actions/upload-artifact@v3.1.3
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: test_reports
         path: |

.github/workflows/studio_demo_test_compile.yml

@@ -6,19 +6,22 @@
 # https://opensource.org/licenses/MIT.
 #
 # SPDX-License-Identifier: MIT
+# Some portions generated by Claude Code (Opus 5).
 
 # This is a basic workflow that is manually triggered
 
 name: GUIX Studio Demo Compile Test
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the master branch
+# Controls when the action will run. dev is included deliberately: it is the
+# integration branch, so a master-only trigger gated no pull request that
+# anybody opened. Verified green on a runner before being switched on --
+# 227 of 227 generation tests and 212 of 212 compile tests.
 on:
-  workflow_dispatch:  
+  workflow_dispatch:
   push:
-    branches: [ master ]
+    branches: [ master, dev ]
   pull_request:
-    branches: [ master ]
+    branches: [ master, dev ]
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
@@ -31,12 +34,21 @@ jobs:
       pull-requests: write
 
     # The type of runner that the job will run on
-    runs-on: windows-2019
+    # Pinned deliberately rather than windows-latest: the image this job
+    # needs has to be a reviewable commit, not something that changes
+    # underneath the build. windows-2019 sat here until 2026-08-26, more
+    # than a year after GitHub retired that image, so every run queued for
+    # 24 hours and was then cancelled without ever reaching a runner.
+    runs-on: windows-2022
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
     - name: Check out the repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         submodules: true
 
@@ -47,7 +59,7 @@ jobs:
       run: scripts\test_studio_demo_compile.cmd
 
     - name: Publish Test Results
-      uses: EnricoMi/publish-unit-test-result-action/composite@v2
+      uses: EnricoMi/publish-unit-test-result-action/composite@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
       if: always()
       with:
         check_name: Test Results GUIX Studio Demo Compile
@@ -56,7 +68,7 @@ jobs:
 
     - name: Upload Test Results
       if: success() || failure()
-      uses: actions/upload-artifact@v3.1.3
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: test_reports
         path: |

.github/workflows/studio_msix_package.yml

@@ -6,6 +6,7 @@
 # https://opensource.org/licenses/MIT.
 #
 # SPDX-License-Identifier: MIT
+# Some portions generated by Claude Code (Opus 5).
 
 # This is a basic workflow that is manually triggered
 
@@ -26,22 +27,31 @@ jobs:
       pull-requests: write
 
     # The type of runner that the job will run on
-    runs-on: windows-2019
+    # Pinned deliberately rather than windows-latest: the image this job
+    # needs has to be a reviewable commit, not something that changes
+    # underneath the build. windows-2019 sat here until 2026-08-26, more
+    # than a year after GitHub retired that image, so every run queued for
+    # 24 hours and was then cancelled without ever reaching a runner.
+    runs-on: windows-2022
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
     - name: Check out the repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         submodules: true
 
     - name: Generate GUIX Studio package upload file
       run: scripts/build_guix_studio_msix_package.cmd
 
     - name: Upload GUIX Studio package upload file
-      uses: actions/upload-artifact@v3.1.3
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: GUIXStudioPackages
-        path: guix_studio/build/vs_2019/msix_package_project/AppPackages
+        path: guix_studio/build/vs_2022/msix_package_project/AppPackages
 
 

.github/workflows/studio_view_test.yml

@@ -6,6 +6,7 @@
 # https://opensource.org/licenses/MIT.
 #
 # SPDX-License-Identifier: MIT
+# Some portions generated by Claude Code (Opus 5).
 
 # This is a basic workflow that is manually triggered
 
@@ -31,12 +32,21 @@ jobs:
       pull-requests: write
 
     # The type of runner that the job will run on
-    runs-on: windows-2019
+    # Pinned deliberately rather than windows-latest: the image this job
+    # needs has to be a reviewable commit, not something that changes
+    # underneath the build. windows-2019 sat here until 2026-08-26, more
+    # than a year after GitHub retired that image, so every run queued for
+    # 24 hours and was then cancelled without ever reaching a runner.
+    runs-on: windows-2022
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
     - name: Check out the repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         submodules: true
 
@@ -47,7 +57,7 @@ jobs:
       run: scripts\test_studio_view.cmd
 
     - name: Publish Test Results
-      uses: EnricoMi/publish-unit-test-result-action/composite@v2
+      uses: EnricoMi/publish-unit-test-result-action/composite@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
       if: always()
       with:
         check_name: Test Results GUIX Studio View
@@ -56,7 +66,7 @@ jobs:
 
     - name: Upload Test Results
       if: success() || failure()
-      uses: actions/upload-artifact@v3.1.3
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: test_reports
         path: |

guix_studio/StudioXProject.cpp

@@ -9,6 +9,7 @@
  * SPDX-License-Identifier: MIT
  **************************************************************************/
 // Some portions generated by Codex (OpenAI GPT-5.5).
+// Some portions generated by Claude Code (Opus 5).
 
 
 #include "system_pngs.h"
@@ -254,10 +255,10 @@ FONT_RECORD DEFAULT_FONT_TABLE[] = {
     {NULL, -1, NULL}
 };
 
-extern IMAGE_INFO _system_png_radio_on;
-extern IMAGE_INFO _system_png_radio_off;
-extern IMAGE_INFO _system_png_checkbox_on;
-extern IMAGE_INFO _system_png_checkbox_off;
+extern STUDIO_IMAGE_INFO _system_png_radio_on;
+extern STUDIO_IMAGE_INFO _system_png_radio_off;
+extern STUDIO_IMAGE_INFO _system_png_checkbox_on;
+extern STUDIO_IMAGE_INFO _system_png_checkbox_off;
 
 // FIXME: do we want to use hardcoded path? 
 PIXELMAP_RECORD DEFAULT_PIXELMAP_TABLE[] = {
@@ -1521,7 +1522,7 @@ BOOL studiox_project::InitializeOnePixelmap(res_info *info, palette_info *theme_
 
     image_reader *pReader = NULL;
     CString abspath;
-    IMAGE_INFO *default_image_info = NULL;
+    STUDIO_IMAGE_INFO *default_image_info = NULL;
     int frame_count = 1;
     int frame_id = -1;
 

guix_studio/resource_gen.cpp

@@ -9,6 +9,7 @@
  * SPDX-License-Identifier: MIT
  **************************************************************************/
 // Some portions generated by Codex (OpenAI GPT-5.5).
+// Some portions generated by Claude Code (Opus 5).
 
 
 
@@ -4156,7 +4157,7 @@ GX_PIXELMAP* resource_gen::RotatePixelmap(res_info* info, int theme_id, GX_PIXEL
 
     image_reader *pReader = NULL;
     CString abspath;
-    IMAGE_INFO* default_image_info = NULL;
+    STUDIO_IMAGE_INFO* default_image_info = NULL;
     int frame_count = 1;
 
     if (info->is_default && info->pathinfo.pathname.IsEmpty())