refactor(tooling): modernize the v1.0.0 development workflow

[acgetchell]

• pin the official vcpkg baseline and add local and pkgx bootstrap paths
• unify supported platforms in GitHub Actions and retire legacy services
• replace tl-function-ref with Boost.Compat and remove unused dependencies
• document the main-based maintenance and regression-oracle workflow
• add the shared Just workflow interface over the existing scripts and presets
• add pinact-managed immutable Action pins with yamllint, actionlint, and zizmor validation
• stabilize the stochastic cdt smoke assertion around successful output generation

Local validation

• just check (verified non-mutating)
• just fix twice (verified idempotent)
• just build
• just run --help
• just ci
• just update-actions
• direct CMake build and reference-smoke CTest preset
• stochastic cdt smoke test repeated five times

Refs #89

Summary by CodeRabbit

• New Features
  • Added just-driven build/check/CI workflow and new reference / reference-smoke CMake presets for faster, consistent runs.
• Bug Fixes
  • Improved test coverage/guardrails: previously-skipped “no move” cases now fail, and runtime-dependent time assertions are now deterministic.
• Documentation
  • Refreshed README and contribution/testing guidance to match the streamlined v1.0.0-ready workflow.
• Chores
  • Modernized requirements and CI setup (main-focused workflows, pinned actions), updated dependency set, and switched callable support to Boost function_ref; removed legacy CI and deprecated tooling/configs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 48c6d4f0-ffbb-41aa-a592-05c917055489

📥 Commits

Reviewing files that changed from the base of the PR and between 378adf4 and 09e2661.

📒 Files selected for processing (8)

• .github/workflows/ci.yml
• CMakePresets.json
• Justfile
• README.md
• scripts/build.bat
• scripts/fast-build.bat
• scripts/fast-build.sh
• src/CMakeLists.txt

---

Walkthrough

The project adopts a pinned headless reference build, consolidates CI into a cross-platform GitHub Actions workflow, replaces Eigen and tl-function-ref, updates scripts and tests, removes legacy CI configuration, and revises documentation for the v1.0.0 maintenance state.

Changes

Build, dependencies, and validation

Layer / File(s)	Summary
Reference build and dependency contracts CMakeLists.txt, CMakePresets.json, vcpkg.json, src/CMakeLists.txt, include/*	Adds reference build/test presets, removes Eigen and tl-function-ref, and adopts boost::compat::function_ref.
Pinned dependency bootstrap and entrypoints scripts/*, .gitignore	Adds validated cached vcpkg bootstrapping and updates shell and Windows build scripts to use repository-relative CMake presets.
Focused test coverage tests/*, include/Utilities.hpp	Adds bounded CTest suites, updates function-reference tests, removes an unavailable-move skip, and makes date validation dynamic.

CI workflow consolidation

Layer / File(s)	Summary
Cross-platform CI matrix .github/workflows/ci.yml	Builds and smoke-tests Ubuntu, macOS, and Windows configurations through a matrix, then verifies the matrix result.
Workflow alignment .github/workflows/*, .codecov.yml	Moves workflow filters to main, pins selected actions, updates analysis workflows, and adjusts coverage reporting. Legacy CI files and obsolete workflows are removed.

Project status and documentation

Layer / File(s)	Summary
Headless v1.0.0 guidance README.md, .github/CONTRIBUTING.md, LICENSE.md, src/cdt.cpp	Documents the main-branch workflow, reference build paths, testing commands, maintenance status, visualization state, and updated copyright years.

Repository maintenance tooling

Layer / File(s)	Summary
Formatting, linting, and workflow maintenance Justfile, .pinact.yaml, .yamllint.yml, .clang-format, .cmake-format.yaml, .github/dependabot.yml	Adds Just recipes and validation helpers, configures workflow pinning and YAML linting, and updates formatting and Dependabot settings.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant vcpkg
  participant CMake
  participant CTest
  GitHubActions->>vcpkg: Restore pinned dependencies
  GitHubActions->>CMake: Configure and build platform matrix
  GitHubActions->>CTest: Run reference-smoke
  CTest-->>GitHubActions: Return test result

Loading

Possibly related issues

• Modernize CDT++ as a regression oracle for causal-triangulations #89 — Covers the vcpkg bootstrapping, CI consolidation, pkgx/Just integration, legacy CI removal, and README updates in this change.
• Audit and enforce the v1.0.0 build and CI release gates #95 — Covers the broader CMake, dependency, CI, test, and obsolete-tooling consolidation reflected here.

Possibly related PRs

• acgetchell/CDT-plusplus#76 — Overlaps the workflow branch-filter changes.
• acgetchell/CDT-plusplus#77 — Relates to workflow configuration changes, including clang-format checks.

Poem

Old pipelines fade,
Pinned tools build paths anew,
Main branches converge.
Smoke tests cross platforms,
Headless roads light the way.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the tooling/workflow refactor and matches the PR’s main changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/89-development-modernization

---

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!

[coderabbitai]

Actionable comments posted: 12

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/CONTRIBUTING.md:
- Around line 84-87: Remove the unused Markdown reference definitions from
.github/CONTRIBUTING.md lines 84-87: [LGTM], [releases], and [Tagged]. Also
remove the listed unused definitions from README.md lines 451-522:
CMakeLists.txt, scan.sh, CDT++, contrib, conduct, CLion, Docker, vcpkg manifest,
vcpkg.json, triplet, AppleClang-14, spack, modules, SLURM, CodeCov, and gcov;
leave all still-referenced definitions unchanged.

In @.github/workflows/ci.yml:
- Around line 3-12: Remove the legacy develop branch entries from the push and
pull_request triggers in the workflow’s on configuration, leaving CI enabled for
main and preserving workflow_dispatch.
- Around line 54-56: Update the actions/checkout configuration to set
persist-credentials to false alongside fetch-depth and submodules, preventing
the checkout token from being stored in local Git configuration before
third-party actions run.
- Line 53: Pin the third-party GitHub Actions to immutable commit SHAs instead
of mutable version refs: update actions/checkout at .github/workflows/ci.yml:53,
pkgxdev/setup at .github/workflows/ci.yml:70, ilammy/msvc-dev-cmd at
.github/workflows/ci.yml:84, and lukka/run-vcpkg at .github/workflows/ci.yml:94.
Preserve each action’s current version by using the corresponding full commit
SHA.

In @.github/workflows/codecov-upload.yml:
- Line 72: Update the Codecov action configuration by uncommenting the directory
input with build/gcov-reports as its value and removing the unsupported gcov
input. Keep the remaining codecov/codecov-action@v5 settings unchanged.

In @.github/workflows/codeql.yml:
- Around line 16-18: Update the branch filters in the workflow’s push and
pull_request triggers to use YAML inline arrays without spaces immediately
inside the brackets: `["main", "gh-pages"]` for both occurrences.

In @.github/workflows/cpp-linter.yml:
- Line 30: Uncomment the `run: exit 1` step in the C++ linter workflow so lint
failures propagate and the workflow fails after reporting the error.

In @.github/workflows/whitespace.yml:
- Line 18: Update the erictleung/find-file-whitespace action reference in the
workflow to use a full immutable commit SHA instead of the mutable main ref,
preserving the existing action and step behavior.

In `@README.md`:
- Line 314: Update the three command examples in README.md by replacing each
~~~bash opening fence and matching ~~~ closing fence with four-backtick bash
fences, preserving the example contents and formatting.

In `@scripts/build.bat`:
- Around line 12-19: Update the Windows build entrypoint in scripts/build.bat at
lines 12-19 to validate or bootstrap the official clean vcpkg checkout at the
vcpkg.json manifest baseline before the developer-mode configure step, replacing
the current existence-only VCPKG_ROOT check. Apply the same validation/bootstrap
path in scripts/fast-build.bat at lines 12-18 before its user-mode configure
step; both sites must enforce the pinned vcpkg trust contract.

In `@tests/Apply_move_test.cpp`:
- Line 159: Update the branch containing the “No valid (6,2) move exists”
MESSAGE in the relevant test so it cannot pass silently: call doctest::skip(...)
if absence of the (6,2) move is expected for this configuration, or fail the
test explicitly if it indicates an unexpected condition.

In `@tests/Utilities_test.cpp`:
- Around line 57-61: Update the current_date_time test to sample system_clock
only once and derive both the function result and expected year from that shared
timestamp, preserving the existing year-prefix assertion without a boundary-time
race.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2798c5b4-1e2d-4f81-b6e1-de48a4157d92

📥 Commits

Reviewing files that changed from the base of the PR and between f82fda2 and 0c22838.

📒 Files selected for processing (44)

• .appveyor.yml
• .github/CONTRIBUTING.md
• .github/workflows/asan.yml
• .github/workflows/ci.yml
• .github/workflows/clang-format-check.yml
• .github/workflows/codecov-upload.yml
• .github/workflows/codeql.yml
• .github/workflows/cpp-linter.yml
• .github/workflows/cppcheck.yml
• .github/workflows/doxygen.yml
• .github/workflows/linux-clang.yml
• .github/workflows/linux-gcc.yml
• .github/workflows/lsan.yml
• .github/workflows/macos.yml
• .github/workflows/msan.yml
• .github/workflows/sonarcloud.yml
• .github/workflows/tsan.yml
• .github/workflows/valgrind.yml
• .github/workflows/whitespace.yml
• .github/workflows/windows-msvc.yml
• .github/workflows/windows-pkgx.yml
• .gitignore
• .gitpod.yml
• .travis.yml
• CMakeLists.txt
• CMakePresets.json
• Dockerfile
• LICENSE.md
• README.md
• include/Apply_move.hpp
• include/Move_command.hpp
• scripts/bootstrap-vcpkg.sh
• scripts/build.bat
• scripts/build.sh
• scripts/fast-build.bat
• scripts/pkgx-build.sh
• sonar-project.properties
• src/CMakeLists.txt
• src/cdt.cpp
• tests/Apply_move_test.cpp
• tests/CMakeLists.txt
• tests/Function_ref_test.cpp
• tests/Utilities_test.cpp
• vcpkg.json

💤 Files with no reviewable changes (11)

• Dockerfile
• .github/workflows/windows-msvc.yml
• sonar-project.properties
• .github/workflows/sonarcloud.yml
• .appveyor.yml
• .gitpod.yml
• .github/workflows/macos.yml
• .github/workflows/windows-pkgx.yml
• .travis.yml
• .github/workflows/linux-clang.yml
• .github/workflows/linux-gcc.yml

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.codecov.yml:
- Line 3: Remove the committed token from the Codecov configuration, revoke and
rotate the exposed credential, and update the upload setup to use the repository
secret for private uploads or tokenless/OIDC authentication for public
repositories.

In @.github/workflows/asan.yml:
- Line 31: Remove the sudo apt upgrade command from the Setup steps in
.github/workflows/asan.yml lines 31-31 and .github/workflows/codecov-upload.yml
lines 31-31; no replacement upgrade command is needed.

In `@Justfile`:
- Around line 92-106: Pin both Justfile formatter recipes, _format-check at
Justfile lines 92-106 and _format-fix at Justfile lines 124-138, to clang-format
v18. Ensure PATH detection and the pkgx fallback resolve the v18 toolchain,
including clang-format-diff.py, so local formatting uses the same version as CI.

In `@scripts/bootstrap-vcpkg.bat`:
- Around line 53-57: Update the existing vcpkg reuse check around the git
baseline validation and vcpkg.exe existence test to also validate the executable
itself before returning success. Rebuild it or verify its hash against the
expected binary, and only execute the “Using vcpkg” success path when that
validation passes; otherwise continue to the existing setup path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: ac19a615-9ca3-4a0d-a391-7135d1296fbf

📥 Commits

Reviewing files that changed from the base of the PR and between 0c22838 and ac031ff.

📒 Files selected for processing (32)

• .clang-format
• .cmake-format.yaml
• .codecov.yml
• .coderabbit.yaml
• .github/CONTRIBUTING.md
• .github/dependabot.yml
• .github/workflows/asan.yml
• .github/workflows/ci.yml
• .github/workflows/clang-format-check.yml
• .github/workflows/codecov-upload.yml
• .github/workflows/codeql.yml
• .github/workflows/cpp-linter.yml
• .github/workflows/cppcheck.yml
• .github/workflows/doxygen.yml
• .github/workflows/lsan.yml
• .github/workflows/msan.yml
• .github/workflows/tsan.yml
• .github/workflows/valgrind.yml
• .github/workflows/whitespace.yml
• .pinact.yaml
• .yamllint.yml
• Justfile
• README.md
• include/Utilities.hpp
• scripts/bootstrap-vcpkg.bat
• scripts/build.bat
• scripts/fast-build.bat
• scripts/pkgx-build.sh
• scripts/scan.sh
• src/CMakeLists.txt
• tests/Apply_move_test.cpp
• tests/Utilities_test.cpp

💤 Files with no reviewable changes (1)

• scripts/scan.sh

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

scripts/bootstrap-vcpkg.bat (1)

55-59: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Validate the cached executable’s provenance, not only its launchability.

vcpkg.exe version returning success proves only that the ignored binary runs; it does not verify that it corresponds to %BASELINE%. A stale or replaced executable can therefore pass this check and be reused at line 57. Rebuild it when the baseline changes, or verify it against a trusted per-platform hash before reporting success.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/bootstrap-vcpkg.bat` around lines 55 - 59, Update the cached vcpkg
validation around the vcpkg.exe version check to verify that the executable
matches %BASELINE%, rather than treating successful launchability as sufficient.
Rebuild the cached executable when the baseline differs, or compare it with a
trusted platform-specific hash before printing the “Using vcpkg” message and
exiting successfully.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codecov-upload.yml:
- Line 12: Move id-token: write from the workflow-level permissions block into
the permissions block for jobs.codecov, while retaining contents: read globally.
Ensure only the Codecov job receives OIDC token permission.

---

Duplicate comments:
In `@scripts/bootstrap-vcpkg.bat`:
- Around line 55-59: Update the cached vcpkg validation around the vcpkg.exe
version check to verify that the executable matches %BASELINE%, rather than
treating successful launchability as sufficient. Rebuild the cached executable
when the baseline differs, or compare it with a trusted platform-specific hash
before printing the “Using vcpkg” message and exiting successfully.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 832801de-3084-4e81-ab61-8f88a8135c15

📥 Commits

Reviewing files that changed from the base of the PR and between ac031ff and f167bc0.

📒 Files selected for processing (5)

• .codecov.yml
• .github/workflows/ci.yml
• .github/workflows/codecov-upload.yml
• Justfile
• scripts/bootstrap-vcpkg.bat

[coderabbitai]

Actionable comments posted: 3

♻️ Duplicate comments (1)

scripts/bootstrap-vcpkg.bat (1)

53-59: 🔒 Security & Privacy | 🟠 Major

Do not treat the version string as binary provenance.

Because vcpkg.exe is ignored, a replaced executable can remain invisible to git status; the helper then executes that binary and accepts any self-reported version matching the metadata. Rebuild before reuse or verify a trusted SHA-256/signature before returning success. This repeats the previous review finding.

Also applies to: 118-120

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/bootstrap-vcpkg.bat` around lines 53 - 59, Update the cached-vcpkg
reuse path around VALIDATE_CACHED_VCPKG so the self-reported BASELINE version is
not treated as proof of executable provenance. Before echoing success and
exiting, rebuild the ignored vcpkg.exe or verify it against a trusted SHA-256
hash/signature, and return success only after that validation passes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codecov-upload.yml:
- Around line 21-23: Add an inline comment beside the job-scoped id-token: write
permission in the workflow permissions block, documenting that it is
intentionally required for Codecov’s OIDC upload. Leave the existing permission
values unchanged.

In `@include/Utilities.hpp`:
- Around line 77-78: Update the timestamp formatting used by make_filename() to
replace the colon-containing %T representation with a filename-safe time format
before constructing the filename, while preserving the existing UTC date and
timestamp semantics.

In `@tests/CMakeLists.txt`:
- Around line 42-44: Keep stochastic assertions in Utilities_test.cpp out of
deterministic smoke coverage by either separating deterministic scenarios from
random uniqueness checks or removing cdt-utilities-tests from smoke
registration. Update tests/CMakeLists.txt at lines 42-44 as needed, and exclude
cdt-utilities-tests from both reference-smoke and reference-windows-smoke in
CMakePresets.json lines 387-407.

---

Duplicate comments:
In `@scripts/bootstrap-vcpkg.bat`:
- Around line 53-59: Update the cached-vcpkg reuse path around
VALIDATE_CACHED_VCPKG so the self-reported BASELINE version is not treated as
proof of executable provenance. Before echoing success and exiting, rebuild the
ignored vcpkg.exe or verify it against a trusted SHA-256 hash/signature, and
return success only after that validation passes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4c12a1c1-8cf6-4966-9133-862f418a27ec

📥 Commits

Reviewing files that changed from the base of the PR and between f167bc0 and b8629a6.

📒 Files selected for processing (8)

• .github/workflows/ci.yml
• .github/workflows/codecov-upload.yml
• CMakePresets.json
• include/Utilities.hpp
• scripts/bootstrap-vcpkg.bat
• scripts/pkgx-build.sh
• tests/CMakeLists.txt
• tests/Utilities_test.cpp

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@include/Utilities.hpp`:
- Around line 119-124: In the timestamp filename construction, replace the
manual character loop in the visible timestamp-processing block with the
standard library’s std::replace algorithm to convert ':' to '-'. Preserve the
existing timestamp value and filename append behavior, and ensure the required
algorithm header is available.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9db827b0-aade-4684-9a26-6d1b6aa93cfa

📥 Commits

Reviewing files that changed from the base of the PR and between b8629a6 and 75e9bc7.

📒 Files selected for processing (6)

• .github/workflows/codecov-upload.yml
• CMakePresets.json
• include/Utilities.hpp
• scripts/bootstrap-vcpkg.bat
• scripts/pkgx-build.sh
• tests/Utilities_test.cpp

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Line 168: Update the non-pkgx prerequisites section in README.md to explicitly
include Git and Bash, ensuring the documented fallback dependencies match the
requirements of scripts/bootstrap-vcpkg.sh and scripts/build.sh.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d11238e0-52e3-449c-a87a-56697f847cec

📥 Commits

Reviewing files that changed from the base of the PR and between b8629a6 and 378adf4.

📒 Files selected for processing (7)

• .github/workflows/codecov-upload.yml
• CMakePresets.json
• README.md
• include/Utilities.hpp
• scripts/bootstrap-vcpkg.bat
• scripts/pkgx-build.sh
• tests/Utilities_test.cpp