update ci/cd workflows and library configuration

.clang-format

@@ -3,34 +3,35 @@ Language: Cpp
 Standard: c++20
 BasedOnStyle: LLVM
 
-IndentWidth: 4
 TabWidth: 4
+IndentWidth: 4
 NamespaceIndentation: All
 AccessModifierOffset: -4
 
 ColumnLimit: 120
 
+SortIncludes: Never
+
+PointerAlignment: Left
+ReferenceAlignment: Left
+
+SpaceAfterTemplateKeyword: false
+AlwaysBreakTemplateDeclarations: No
+RequiresClausePosition: SingleLine
+
 PenaltyReturnTypeOnItsOwnLine: 1000
 
-BinPackParameters: false
+BinPackParameters: OnePerLine
 BinPackArguments: false
 AlignAfterOpenBracket: BlockIndent
 
 AllowShortFunctionsOnASingleLine: None
-InsertBraces: true
 AllowShortLambdasOnASingleLine: Empty
+InsertBraces: true
 
 BreakConstructorInitializers: AfterColon
 PackConstructorInitializers: CurrentLine
 
-PointerAlignment: Left
-ReferenceAlignment: Left
-
-SpaceAfterTemplateKeyword: false
-AlwaysBreakTemplateDeclarations: No
-
-SortIncludes: Never
-
 AlignTrailingComments:
   Kind: Always
   OverEmptyLines: 2

.clang-tidy

@@ -6,10 +6,25 @@ Checks: >
   -clang-diagnostic-gnu-string-literal-operator-template
 
 CheckOptions:
+  - key: readability-identifier-naming.NamespaceCase
+    value: lower_case
+
   - key: readability-identifier-naming.ClassCase
     value: lower_case
   - key: readability-identifier-naming.StructCase
     value: lower_case
+  - key: readability-identifier-naming.EnumCase
+    value: lower_case
+  - key: readability-identifier-naming.EnumConstantCase
+    value: lower_case
+
+  - key: readability-identifier-naming.TypeAliasCase
+    value: lower_case
+  - key: readability-identifier-naming.TypeAliasIgnoredRegexp
+    value: '^[A-Z]$'
+
+  - key: readability-identifier-naming.TemplateParameterCase
+    value: CamelCase
 
   - key: readability-identifier-naming.FunctionCase
     value: lower_case
@@ -36,21 +51,4 @@ CheckOptions:
   - key: readability-identifier-naming.ProtectedMemberSuffix
     value: '_'
   - key: readability-identifier-naming.ConstantMemberIgnoredRegexp
-    value: '^[A-Z][A-Z0-9_]*$'
-
-  - key: readability-identifier-naming.EnumConstantCase
-    value: lower_case
-
-  - key: readability-identifier-naming.EnumCase
-    value: lower_case
-
-  - key: readability-identifier-naming.TemplateParameterCase
-    value: CamelCase
-
-  - key: readability-identifier-naming.NamespaceCase
-    value: lower_case
-
-  - key: readability-identifier-naming.TypeAliasCase
-    value: lower_case
-  - key: readability-identifier-naming.TypeAliasIgnoredRegexp
-    value: '^[A-Z]$'
+    value: '^[A-Z][A-Z0-9_]*$'

.github/scripts/update-vcpkg.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+version=${TAG#v}
+history="$VCPKG_ROOT/versions/o-/obfuscxx.json"
+registered=$(jq --arg version "$version" 'any(.versions[]; .version == $version)' "$history")
+
+if [[ $registered == true ]]; then
+    echo "obfuscxx $version is already in the vcpkg registry"
+    echo "status=error" >> "$GITHUB_OUTPUT"
+    exit 1
+fi
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+tag=$(jq -rn --arg tag "$TAG" '$tag | @uri')
+
+curl --fail --location --output "$tmp/source.tar.gz" \
+    "https://github.com/$GITHUB_REPOSITORY/archive/$tag.tar.gz"
+
+hash=$(sha512sum "$tmp/source.tar.gz")
+hash=${hash%% *}
+
+portfile="$VCPKG_ROOT/ports/obfuscxx/portfile.cmake"
+pattern='^([[:blank:]]*SHA512[[:blank:]]+)[[:xdigit:]]{128}([[:space:]]*)$'
+
+sed -Ei "s/$pattern/\1${hash}\2/" "$portfile"
+
+manifest="$VCPKG_ROOT/ports/obfuscxx/vcpkg.json"
+
+jq --arg version "$version" '.version = $version | del(."port-version")' \
+    "$manifest" > "$tmp/vcpkg.json"
+mv "$tmp/vcpkg.json" "$manifest"
+
+echo "status=ok" >> "$GITHUB_OUTPUT"

.github/workflows/benchmark.yml

@@ -0,0 +1,86 @@
+name: Benchmark
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  benchmark:
+    name: Run Benchmarks
+    runs-on: windows-latest
+
+    permissions:
+      contents: read
+
+    env:
+      BENCHMARK_BIN_DIR: tests/benchmark/build/msvc-x64/Release
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Set VCPKG_ROOT
+        shell: bash
+        run: echo "VCPKG_ROOT=$VCPKG_INSTALLATION_ROOT" >> $GITHUB_ENV
+
+      - name: Install Google Benchmark
+        run: vcpkg install benchmark:x64-windows
+
+      - name: Configure
+        working-directory: tests/benchmark
+        run: cmake --preset msvc-x64
+
+      - name: Build
+        working-directory: tests/benchmark
+        run: cmake --build --preset msvc-x64 --config Release --parallel
+
+      - name: Run
+        working-directory: ${{ env.BENCHMARK_BIN_DIR }}
+        shell: bash
+        run: |
+          ./benchmark-obfuscxx.exe \
+            --benchmark_filter="BM_.*_(Low|Medium|High)" \
+            --benchmark_format=json \
+            --benchmark_out=result.json
+
+      - name: Upload benchmark result
+        uses: actions/upload-artifact@v6
+        with:
+          name: benchmark-result
+          path: ${{ env.BENCHMARK_BIN_DIR }}/result.json
+          if-no-files-found: error
+
+  store:
+    name: Store Benchmark Results
+    needs: benchmark
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Download benchmark result
+        uses: actions/download-artifact@v7
+        with:
+          name: benchmark-result
+          path: artifacts
+
+      - name: Store
+        uses: benchmark-action/github-action-benchmark@v1
+        with:
+          name: Benchmark
+          tool: googlecpp
+          output-file-path: artifacts/result.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          auto-push: true
+          comment-on-alert: false
+          alert-threshold: '200%'
+          fail-on-alert: true

.github/workflows/ci.yml

@@ -2,15 +2,18 @@ name: CI
 
 on:
   push:
-    branches: ["main"]
+    branches: [main]
+
   pull_request:
-    branches: ["main"]
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   unittests:
-    name: ${{ matrix.name }}
+    name: Run Unit Tests / ${{ matrix.name }}
     runs-on: ${{ matrix.os }}
-    if: github.event_name == 'pull_request'
 
     strategy:
       fail-fast: false
@@ -48,7 +51,9 @@ jobs:
             vcpkg_triplet: arm64-osx
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Set VCPKG_ROOT
         shell: bash
@@ -63,93 +68,60 @@ jobs:
 
       - name: Build
         working-directory: tests/unittest
-        run: cmake --build --preset ${{ matrix.preset }} --config Release
+        run: cmake --build --preset ${{ matrix.preset }} --config Release --parallel
 
       - name: Test
         working-directory: tests/unittest/build/${{ matrix.preset }}
         run: ctest --build-config Release --output-on-failure
 
-  benchmark:
-    name: Benchmark
-    runs-on: windows-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    env:
-      BENCHMARK_BIN_DIR: tests/benchmark/build/msvc-x64/Release
+  clang-format:
+    name: Run Clang Format
+    runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Set VCPKG_ROOT
-        shell: bash
-        run: echo "VCPKG_ROOT=$VCPKG_INSTALLATION_ROOT" >> $GITHUB_ENV
-
-      - name: Install Google Benchmark
-        run: vcpkg install benchmark:x64-windows
-
-      - name: Configure
-        working-directory: tests/benchmark
-        run: cmake --preset msvc-x64
-
-      - name: Build
-        working-directory: tests/benchmark
-        run: cmake --build --preset msvc-x64 --config Release
-
-      - name: Run
-        working-directory: ${{ env.BENCHMARK_BIN_DIR }}
-        run: ./benchmark-obfuscxx.exe --benchmark_filter="BM_.*_(Low|Medium|High)" --benchmark_format=json --benchmark_out=result.json
-
-      - name: Store
-        uses: benchmark-action/github-action-benchmark@v1
+      - uses: actions/checkout@v5
         with:
-          name: Benchmark
-          tool: googlecpp
-          output-file-path: ${{ env.BENCHMARK_BIN_DIR }}/result.json
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          auto-push: true
-          comment-on-alert: false
-          alert-threshold: '200%'
-          fail-on-alert: true
+          persist-credentials: false
 
-  clang-format:
-    name: Clang Format
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-    steps:
-      - uses: actions/checkout@v4
       - name: Install Clang-Format 22
         run: |
           wget https://apt.llvm.org/llvm.sh
           chmod +x llvm.sh
           sudo ./llvm.sh 22
           sudo apt-get update
           sudo apt-get install -y clang-format-22
+
       - name: Check formatting
         run: |
           find include \( -name "*.h" -o -name "*.cpp" \) | \
           xargs clang-format-22 --dry-run --Werror
 
   clang-tidy:
-    name: Clang Tidy
+    name: Run Clang Tidy
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
+
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
       - name: Install Clang-Tidy 19
         run: |
           wget https://apt.llvm.org/llvm.sh
           chmod +x llvm.sh
           sudo ./llvm.sh 19
           sudo apt-get update
           sudo apt-get install -y clang-tidy-19
+
       - name: Check tidy
         run: |
           find include \( -name "*.h" -o -name "*.cpp" \) | \
           xargs -I{} clang-tidy-19 {} --header-filter="include/.*" -- -x c++ -std=c++20 -I include
 
   all-checks:
-    name: All Checks
+    name: Check Results
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
     needs: [unittests, clang-format, clang-tidy]
+
     steps:
       - run: echo "All checks passed"