Merge branch 'development' into fix/list-item-query-fallback

Signed-off-by: DL6ER <dl6er@dl6er.de>

Author: DL6ER

.github/.codespellignore

@@ -13,3 +13,4 @@ iif
 prefered
 padd
 rabit
+clen

.github/.codespellignore_lines

@@ -1,3 +1,4 @@
 			self.errors.append("Exception when GETing from FTL: " + str(e))
 //    sitten -> sittin (substitution of "i" for "e"),
 //    sittin -> sitting (insertion of "g" at the end).
+		"upgrade", "te", "host", "http2-settings",

.github/Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/pi-hole/ftl-build:v2.19
+FROM ghcr.io/pi-hole/ftl-build:v2.25
 
 WORKDIR /app
 
@@ -16,16 +16,28 @@ ENV BUILD_OPTS=${BUILD_OPTS}
 # Setting TERM is needed for pretty output in BATS tests
 ENV TERM=xterm
 
-# Monkeypatch BATS to remove duplicate output of starting and finished test
-# BATS uses ANSI escape codes to overwrite the line after the test has finished
-# This is not supported by Github Actions as it does not provide a TTY to the docker build container
-RUN sed -i '/buffer_with_truncation /d' /bats/bats-core/libexec/bats-core/bats-format-pretty
+# CI starts from a fresh checkout every time, so cmake has no build tree to
+# compare against and recompiles all 207 translation units on every run - on
+# riscv64, sqlite3.c alone is over half of that under QEMU. ccache is keyed on
+# content rather than on mtimes in a build tree, so it survives the fresh clone
+# and only units that actually changed are compiled.
+ENV CCACHE_DIR=/app/.ccache
+ENV CCACHE_MAXSIZE=500M
+# Identify the compiler by hashing the binary rather than by its mtime and size,
+# which is what ccache would do by default. The compiler arrives in an image
+# here, so a rebuilt ftl-build must never be able to reuse entries made by the
+# gcc it replaced.
+ENV CCACHE_COMPILERCHECK=content
 
 # Build FTL
 # Remove possible old build files
 RUN rm -rf cmake && \
+# Start from clean counters so the statistics below describe this build alone
+    ccache --zero-stats && \
 # Build and test FTL
-    bash build.sh "-DSTATIC=${STATIC} -DBUILD_TAR_REGRESSION=ON -DBUILD_GZIP_REGRESSION=ON" ${BUILD_OPTS} && \
+    bash build.sh "-DSTATIC=${STATIC} -DBUILD_TAR_REGRESSION=ON -DBUILD_GZIP_REGRESSION=ON -DBUILD_DOTDOH_REGRESSION=ON -DCMAKE_C_COMPILER_LAUNCHER=ccache" ${BUILD_OPTS} && \
+# Report what the cache saved, so the CI log shows whether it is worth keeping
+    ccache --show-stats && \
 # Copy FTL binary to root directory
     cd / &&\
     cp /app/pihole-FTL . && \

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,37 @@
+<!--- Please base your code and PRs against the `development` branch.
+
+     Note that we do not accept changes to `src/dnsmasq/`: that tree is a
+     verbatim copy of upstream dnsmasq. Send fixes for it to the
+     `dnsmasq-discuss` mailing list instead, see item 6 below. -->
+
+# What does this implement/fix?
+
+<!--- Replace this with a detailed description of your change, screenshots (if necessary), as well as links to any relevant GitHub issues -->
+
+## How to test the change during review
+
+<!--- Replace this with concrete steps a reviewer can run: the manual checks to exercise the change, and which automated tests (bats/pytest/CI matrix) cover it -->
+
+## Additional information
+
+**Related issue or feature (if applicable):** N/A
+
+**Pull request in [docs](https://github.com/pi-hole/docs) with documentation (if applicable):** N/A
+
+---
+**By submitting this pull request, I confirm the following:**
+
+1. I have read and understood the [contributors guide](https://docs.pi-hole.net/guides/github/contributing/), as well as this entire template. I understand which branch to base my commits and Pull Requests against.
+2. I have commented my proposed changes within the code.
+3. I am willing to help maintain this change if there are issues with it later.
+4. It is compatible with the [EUPL 1.2 license](https://opensource.org/licenses/EUPL-1.2)
+5. I have squashed any insignificant commits. ([`git rebase`](https://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html))
+6. My change does not modify `src/dnsmasq/`. That tree is a verbatim copy of upstream dnsmasq and we do not carry anything in it that deviates from upstream. Fixes have to go through the [`dnsmasq-discuss` mailing list](https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss) first, we merge them once they are in dnsmasq master.
+
+## Checklist:
+
+- [ ] The code change is tested and works locally.
+- [ ] I based my code and PRs against the repository's `development` branch.
+- [ ] I [signed off](https://docs.pi-hole.net/guides/github/how-to-signoff/) all commits. Pi-hole enforces the [DCO](https://docs.pi-hole.net/guides/github/dco/) for all contributions
+- [ ] I [signed](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits) all my commits. Pi-hole requires signatures to verify authorship
+- [ ] I have read the above and my PR is ready for review.

.github/workflows/build.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
       -
         name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       -
         name: "Calculate required variables"
         id: variables
@@ -110,7 +110,7 @@ jobs:
     steps:
       -
         name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       # QEMU should come before Buildx
       -
         name: Set up QEMU
@@ -122,6 +122,19 @@ jobs:
         name: Print directory contents
         shell: bash
         run: ls -l
+      -
+        name: Restore ccache
+        # Restored into the build context, where .github/Dockerfile picks it up
+        # through its COPY. Keyed per matrix entry: the platforms compile for
+        # different architectures and the clang entry uses a different compiler,
+        # so none of them can share entries. The restore-keys prefix falls back
+        # to whatever the most recent run of this entry saved.
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0
+        with:
+          path: .ccache
+          key: ccache-${{ matrix.bin_name }}-${{ github.sha }}
+          restore-keys: |
+            ccache-${{ matrix.bin_name }}-
       -
         name: Build FTL in ftl-build container (QEMU)
         # Creates an image to build FTL and load it into the local Docker daemon
@@ -140,6 +153,28 @@ jobs:
               --build-arg "BUILD_OPTS=${{ matrix.build_opts }}" \
               --tag ftl-builder:local \
               --file .github/Dockerfile .
+      -
+        name: Export ccache from ftl-build container (QEMU)
+        # Exported here rather than alongside the other files further down, so a
+        # failing test run does not discard a cache the build just filled. The
+        # restored copy is removed first, as docker cp would otherwise nest the
+        # directory inside it.
+        run: |
+            docker create --platform ${{ matrix.platform }} --name ccache-container ftl-builder:local
+            rm -rf .ccache
+            docker cp ccache-container:/app/.ccache ./.ccache
+            docker rm ccache-container
+      -
+        name: Save ccache
+        # Cache entries are immutable, so the key carries the commit SHA and
+        # every run writes a new entry for GitHub to age out. Pull requests only
+        # run here when they come from a fork, and a fork's token cannot write
+        # caches, so there is nothing to save for them.
+        if: github.event_name == 'push'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0
+        with:
+          path: .ccache
+          key: ccache-${{ matrix.bin_name }}-${{ github.sha }}
       -
         name: Test FTL in ftl-build container (QEMU)
         # Uses the ftl-builder image to run tests
@@ -157,7 +192,7 @@ jobs:
               --env BUILD_OPTS=${{ matrix.build_opts }} \
               --env STATIC=${STATIC} \
               ftl-builder:local \
-              /bin/bash -c "test/arch_test.sh && test/run.sh"
+              /bin/bash -c "test/arch_test.sh && test/run.sh && test/http2_test.sh"
       -
         name: Export FTL files from ftl-build container (QEMU)
         # Create a temporary container to extract the built files
@@ -185,7 +220,7 @@ jobs:
           path: '${{ matrix.bin_name }}*'
       -
         name: Generate artifact attestation
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 #v4.1.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 #v4.2.2
         # Skip attestation if ACTIONS_ID_TOKEN_REQUEST_URL env variable is not
         # available (e.g., PR originating from a fork)
         if: env.DO_DEPLOY == 'true' && env.ACTIONS_ID_TOKEN_REQUEST_URL != ''
@@ -275,7 +310,7 @@ jobs:
       -
         name: Attach binaries to release
         if: github.event_name == 'release'
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b #v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 #v3.0.2
         with:
           tag_name: ${{ github.event.release.tag_name }}
           files: |

.github/workflows/codeql.yml

@@ -58,7 +58,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
 
     - name: Install dependencies
       run: |
@@ -87,7 +87,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a #v4.36.3
+      uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 #v4.37.6
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -110,7 +110,7 @@ jobs:
         ./build.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a #v4.36.3
+      uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 #v4.37.6
       with:
         category: "/language:${{matrix.language}}"
         upload: failure-only # upload only in case of failure, otherwise upload later after filtering
@@ -136,7 +136,7 @@ jobs:
         output: codeql-results/cpp.sarif
 
     - name: Upload SARIF
-      uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a #v4.36.3
+      uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 #v4.37.6
       with:
         sarif_file: codeql-results/cpp.sarif
 

.github/workflows/codespell.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
     -
       name: Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
     -
       name: Spell-Checking
       uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 #v2.2

.github/workflows/openapi-validator.yml

@@ -12,10 +12,10 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e #v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 #v7.0.0
         with:
           node-version: "20"
           cache: npm

.github/workflows/stale.yml

@@ -17,7 +17,7 @@ jobs:
       issues: write
 
     steps:
-    - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 #v10.3.0
+    - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 #v11.0.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         days-before-stale: 30
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       - name: Remove 'stale' label
         run: gh issue edit ${{ github.event.issue.number }} --remove-label ${{ env.stale_label }}
         env:

.github/workflows/stale_pr.yml

@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 #v10.3.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 #v11.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           # Do not automatically mark PR/issue as stale