build: use CPM for dependencies#373
Merged
Daan Timmer (daantimmer) merged 33 commits intoJul 24, 2026
Merged
Conversation
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 6 | 0 | 0 | 0.28s | |
| ✅ ACTION | zizmor | 6 | 0 | 0 | 0 | 3.19s |
| ✅ CPP | clang-format | 239 | 1 | 0 | 0 | 1.73s |
| ✅ DOCKERFILE | hadolint | 1 | 0 | 0 | 0.03s | |
| markdownlint | 7 | 4 | 20 | 0 | 1.03s | |
| ✅ MARKDOWN | markdown-table-formatter | 7 | 4 | 0 | 0 | 0.25s |
| ✅ REPOSITORY | betterleaks | yes | no | no | 1.28s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.03s | |
| ✅ REPOSITORY | grype | yes | no | no | 55.93s | |
| ✅ REPOSITORY | ls-lint | yes | no | no | 0.01s | |
| ✅ REPOSITORY | secretlint | yes | no | no | 4.08s | |
| ✅ REPOSITORY | syft | yes | no | no | 2.29s | |
| ✅ REPOSITORY | trivy | yes | no | no | 11.99s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.26s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 4.38s | |
| lychee | 72 | 1 | 0 | 30.2s | ||
| ✅ YAML | prettier | 13 | 1 | 0 | 0 | 0.65s |
| ✅ YAML | v8r | 13 | 0 | 0 | 7.72s | |
| ✅ YAML | yamllint | 13 | 0 | 0 | 0.5s |
Detailed Issues
⚠️ SPELL / lychee - 1 error
📝 Summary
---------------------
🔍 Total..........168
🔗 Unique.........162
✅ Successful.....167
⏳ Timeouts.........0
🔀 Redirected......74
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1
Errors in CONTRIBUTING.md
[404] https://github.com/yourname/amp-cucumber-cpp-runner.git (at 41:36) | Rejected status code: 404 Not Found | Followed 1 redirect. Redirects: https://github.com/yourname/amp-cucumber-cpp-runner.git --[301]--> https://github.com/yourname/amp-cucumber-cpp-runner
Hint: Followed 74 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 20 errors
CHANGELOG.md:31 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Features"]
CHANGELOG.md:38 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Bug Fixes"]
CHANGELOG.md:44 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Chores"]
CHANGELOG.md:51 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Features"]
CHANGELOG.md:58 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Chores"]
CHANGELOG.md:66 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "⚠ BREAKING CHANGES"]
CHANGELOG.md:70 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Features"]
CHANGELOG.md:79 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Features"]
CHANGELOG.md:85 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Chores"]
CHANGELOG.md:93 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "⚠ BREAKING CHANGES"]
CHANGELOG.md:97 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Features"]
CHANGELOG.md:102 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Bug Fixes"]
CHANGELOG.md:111 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Features"]
CHANGELOG.md:122 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Chores"]
CHANGELOG.md:130 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "⚠ BREAKING CHANGES"]
CHANGELOG.md:134 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Features"]
CHANGELOG.md:159 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Bug Fixes"]
CHANGELOG.md:166 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Chores"]
cmake/WindowsToolchainFilesProvidedBy.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "<https://github.com/MarkSchofi..."]
README.md:132 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,CPP_CLANG_FORMAT,DOCKERFILE_HADOLINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_LS_LINT,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates the project’s third-party dependency management from ad-hoc FetchContent in external/** to a centralized CPM-based flow with a committed lockfile, and updates the devcontainer to reuse a CPM source cache.
Changes:
- Removed per-dependency
FetchContent_Declare/MakeAvailableCMake snippets underexternal/**. - Added
cmake/dependencies.cpm.cmake+cmake/package-lock.cmakeand wired them into the top-levelCMakeLists.txt. - Added
CPM_SOURCE_CACHEto the devcontainer environment.
Reviewed changes
Copilot reviewed 22 out of 22 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
CMakeLists.txt |
Switches dependency setup to CPM script and simplifies module include usage. |
cmake/dependencies.cpm.cmake |
New centralized CPM dependency configuration and conditional find/fetch logic. |
cmake/package-lock.cmake |
New CPM lockfile pinning dependency versions/commits/options. |
.devcontainer/devcontainer.json |
Sets CPM cache location for faster devcontainer rebuilds. |
external/CMakeLists.txt |
Stops adding most third-party subdirectories; only keeps tobiaslocker. |
external/cliutils/CMakeLists.txt |
Removes subdir wiring for CLI11. |
external/cliutils/cli11/CMakeLists.txt |
Removes CLI11 FetchContent logic. |
external/cucumber/CMakeLists.txt |
Removes subdir wiring for messages/gherkin. |
external/cucumber/messages/CMakeLists.txt |
Removes cucumber/messages FetchContent and build wiring. |
external/cucumber/gherkin/CMakeLists.txt |
Removes cucumber/gherkin FetchContent and target property adjustments. |
external/fmtlib/CMakeLists.txt |
Removes subdir wiring for fmt. |
external/fmtlib/fmt/CMakeLists.txt |
Removes fmt FetchContent logic. |
external/google/CMakeLists.txt |
Removes wiring for abseil/re2/googletest. |
external/google/abseil/CMakeLists.txt |
Removes abseil FetchContent logic. |
external/google/re2/CMakeLists.txt |
Removes re2 FetchContent logic. |
external/google/googletest/CMakeLists.txt |
Removes googletest FetchContent logic and warning configuration. |
external/jbeder/CMakeLists.txt |
Removes subdir wiring for yaml-cpp. |
external/jbeder/yaml-cpp/CMakeLists.txt |
Removes yaml-cpp FetchContent logic. |
external/nlohmann/CMakeLists.txt |
Removes subdir wiring for nlohmann/json. |
external/nlohmann/json/CMakeLists.txt |
Removes nlohmann/json FetchContent logic. |
external/zeux/CMakeLists.txt |
Removes subdir wiring for pugixml. |
external/zeux/pugixml/CMakeLists.txt |
Removes pugixml FetchContent logic. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 22 out of 22 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (4)
cmake/dependencies.cpm.cmake:14
- cmake/dependencies.cpm.cmake uses (and should version-pin) nlohmann_json, but there is no NLOHMANN_JSON dependency definition alongside the other pinned deps. This makes it awkward to add a matching CPMAddPackage/find_package later and risks drifting from the package-lock pin.
ccr_dependency(CLI11 v2.6.2 37bb6edc5317e99af72ef48405e65d9ca5218861)
cmake/dependencies.cpm.cmake:85
- The build links against nlohmann_json::nlohmann_json (e.g. cucumber_cpp/library/formatter/CMakeLists.txt), but when CCR_FETCH_DEPS=ON this file never calls CPMAddPackage for nlohmann_json. This will fail at configure/generate time unless some other dependency happens to bring in the target.
CPMAddPackage(
URI "gh:CLIUtils/CLI11@${CLI11_VERSION}#${CLI11_DIGEST}"
NAME cli11
)
cmake/dependencies.cpm.cmake:141
- When CCR_FETCH_DEPS=OFF, this script doesn’t locate CLI11 or nlohmann_json, but the project links against CLI11::CLI11 and nlohmann_json::nlohmann_json. This will break non-fetch builds that rely on system-installed packages.
find_package(cucumber_gherkin ${CUCUMBER_GHERKIN_VERSION} REQUIRED)
find_package(GTest ${GOOGLE_TEST_VERSION} REQUIRED)
find_package(pugixml ${PUGIXML_VERSION} REQUIRED)
find_package(fmt ${LIBFMT_VERSION} REQUIRED)
.devcontainer/devcontainer.json:18
- "
" typically won’t be expanded in environment variables; CPM_SOURCE_CACHE may end up pointing to a literal "/cache/.cpm" path. Use $HOME via devcontainer variable substitution or an absolute path so caching works reliably.
"CPM_SOURCE_CACHE": "~/cache/.cpm"
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 24 out of 24 changed files in this pull request and generated 5 comments.
Comments suppressed due to low confidence (5)
cmake/dependencies.cpm.cmake:135
- In the yaml-cpp CPMAddPackage call, the keyword is
OPTIONbut CPM expectsOPTIONS(plural). As written, the YAML_ENABLE_PIC setting is likely ignored, changing the build compared to the previous FetchContent setup.
CPMAddPackage(
URI "gh:jbeder/yaml-cpp@${YAML_CPP_VERSION}#${YAML_CPP_DIGEST}"
NAME yaml-cpp
OPTION
"YAML_ENABLE_PIC OFF"
)
cmake/dependencies.cpm.cmake:141
- When
CCR_FETCH_DEPSis OFF, this file no longer finds CLI11 or nlohmann_json, but project targets link toCLI11::CLI11(cucumber_cpp/library/CMakeLists.txt:28) andnlohmann_json::nlohmann_json(cucumber_cpp/library/formatter/CMakeLists.txt:33). CMake configuration will fail unless those targets are provided implicitly by another package.
find_package(cucumber_gherkin ${CUCUMBER_GHERKIN_VERSION} REQUIRED)
find_package(GTest ${GOOGLE_TEST_VERSION} REQUIRED)
find_package(pugixml ${PUGIXML_VERSION} REQUIRED)
find_package(fmt ${LIBFMT_VERSION} REQUIRED)
cmake/dependencies.cpm.cmake:85
- The build links against
nlohmann_json::nlohmann_json, butCCR_FETCH_DEPS=ONdoes not explicitly add nlohmann_json via CPM here. Relying on transitive dependency setup from another package is fragile and can break if upstream changes.
CPMAddPackage(
URI "gh:CLIUtils/CLI11@${CLI11_VERSION}#${CLI11_DIGEST}"
NAME cli11
)
cmake/package-lock.cmake:110
- In the yaml-cpp lock entry,
OPTION YAML_ENABLE_PIC OFFis not valid CPMDeclarePackage syntax (CPM uses anOPTIONSlist). This likely means YAML_ENABLE_PIC is not applied when using the lock file.
SYSTEM YES
EXCLUDE_FROM_ALL YES
OPTION YAML_ENABLE_PIC OFF
)
CMakeLists.txt:26
CUCUMBER_CPP_FETCH_DEPSis set here but is not referenced anywhere else in the repository, so it currently has no effect and can confuse readers about the dependency flow.
set(CUCUMBER_CPP_FETCH_DEPS ${CCR_FETCH_DEPS})
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 24 out of 24 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (8)
cmake/dependencies.cpm.cmake:57
- When CCR_FETCH_DEPS is enabled, this script never adds nlohmann_json or cucumber_messages, but the project links against nlohmann_json::nlohmann_json and includes cucumber/messages headers. This will break fresh configures where those targets aren’t already provided transitively.
# ---------------------------------------------------------------------------
# cucumber_gherkin
# ---------------------------------------------------------------------------
CPMAddPackage(
URI "gh:cucumber/gherkin@${CUCUMBER_GHERKIN_VERSION}#${CUCUMBER_GHERKIN_DIGEST}"
cmake/dependencies.cpm.cmake:142
- When CCR_FETCH_DEPS is OFF, required dependencies aren’t located: CLI11 (used by cucumber_cpp.library), nlohmann_json (used by formatter), and cucumber_messages (headers used throughout) are never found, so consumers relying on system packages will fail to configure/build.
find_package(cucumber_gherkin ${CUCUMBER_GHERKIN_VERSION} REQUIRED)
find_package(GTest ${GOOGLE_TEST_VERSION} REQUIRED)
find_package(pugixml ${PUGIXML_VERSION} REQUIRED)
find_package(fmt ${LIBFMT_VERSION} REQUIRED)
cmake/dependencies.cpm.cmake:23
- This file references NLOHMANN_JSON_* and CUCUMBER_MESSAGES_* variables (needed to add those deps), but they aren’t declared alongside the other pinned dependency versions/digests.
# renovate: datasource=github-tags packageName=abseil/abseil-cpp
ccr_dependency(ABSEIL_CPP 20250814.2 0cf0a5c9d12cc3783363ab20f11613e69fd04c9a)
# renovate: datasource=github-tags packageName=google/re2
ccr_dependency(RE2 2025-08-12 0f6c07eae69151e606acb3d9232750c3442dff23)
# renovate: datasource=github-tags packageName=jbeder/yaml-cpp versioning=semver
cmake/dependencies.cpm.cmake:135
- CPMAddPackage uses the keyword OPTIONS (plural). Using OPTION here won’t apply YAML_ENABLE_PIC and may even be treated as an unknown argument depending on CPM version.
URI "gh:jbeder/yaml-cpp@${YAML_CPP_VERSION}#${YAML_CPP_DIGEST}"
NAME yaml-cpp
OPTION
"YAML_ENABLE_PIC OFF"
)
cmake/package-lock.cmake:110
- CPMDeclarePackage expects dependency options under OPTIONS (plural), typically as quoted "VAR value" strings. As written, YAML_ENABLE_PIC won’t be applied from the lock file.
SYSTEM YES
EXCLUDE_FROM_ALL YES
OPTION YAML_ENABLE_PIC OFF
)
CMakeLists.txt:26
- CUCUMBER_CPP_FETCH_DEPS is set but never read anywhere in the repo. Keeping it around suggests there’s a toggle that doesn’t actually do anything, which makes the build logic harder to reason about.
set(CUCUMBER_CPP_FETCH_DEPS ${CCR_FETCH_DEPS})
.github/workflows/ci.yml:60
- The CPM cache key doesn’t include cmake/package-lock.cmake, so updating the lock file won’t invalidate the cache. This can lead to stale sources being restored across dependency updates.
- name: Cache CPM packages
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ${{ env.CPM_SOURCE_CACHE }}
key: cpm-${{ hashFiles('cmake/dependencies.cpm.cmake') }}
.github/workflows/ci.yml:135
- Same as above: this CPM cache key ignores cmake/package-lock.cmake, so dependency lock updates won’t invalidate the restored CPM_SOURCE_CACHE.
- name: Cache CPM packages
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ${{ env.CPM_SOURCE_CACHE }}
key: cpm-${{ hashFiles('cmake/dependencies.cpm.cmake') }}
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 25 out of 25 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (4)
cmake/dependencies.cpm.cmake:56
- When CCR_FETCH_DEPS is ON, this file never adds/locks
nlohmann_jsonorcucumber_messages, but the build linksnlohmann_json::nlohmann_json(cucumber_cpp/library/formatter/CMakeLists.txt:33) and includescucumber/messages/*headers (e.g. compatibility/BaseCompatibility.cpp:2). This will fail at configure/build time because the targets/headers are unavailable.
# ---------------------------------------------------------------------------
# cucumber_gherkin
# ---------------------------------------------------------------------------
CPMAddPackage(
cmake/dependencies.cpm.cmake:141
- When CCR_FETCH_DEPS is OFF, the configure path no longer calls
find_package()forCLI11,nlohmann_json, orcucumber_messages, but the project linksCLI11::CLI11(cucumber_cpp/library/CMakeLists.txt:28) andnlohmann_json::nlohmann_json(cucumber_cpp/library/formatter/CMakeLists.txt:33) and includes cucumber messages headers. Add the missing packages to the non-fetch path so the build works without CPM.
else()
find_package(cucumber_gherkin ${CUCUMBER_GHERKIN_VERSION} REQUIRED)
find_package(GTest ${GOOGLE_TEST_VERSION} REQUIRED)
find_package(pugixml ${PUGIXML_VERSION} REQUIRED)
find_package(fmt ${LIBFMT_VERSION} REQUIRED)
.github/workflows/ci.yml:60
- The CPM cache key only hashes
cmake/dependencies.cpm.cmake, but the actual pinned versions live incmake/package-lock.cmake. If the lock file changes, this cache will be incorrectly reused, potentially hiding dependency updates or causing hard-to-reproduce CI behavior.
- name: Cache CPM packages
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ${{ env.CPM_SOURCE_CACHE }}
key: cpm-${{ hashFiles('cmake/dependencies.cpm.cmake') }}
.github/workflows/ci.yml:135
- Same issue as the devcontainer job: the CPM cache key doesn’t include
cmake/package-lock.cmake, so dependency version bumps in the lock file won’t invalidate the cache.
- name: Cache CPM packages
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ${{ env.CPM_SOURCE_CACHE }}
key: cpm-${{ hashFiles('cmake/dependencies.cpm.cmake') }}
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 34 out of 34 changed files in this pull request and generated 6 comments.
Comments suppressed due to low confidence (2)
cmake/dependencies.cpm.cmake:36
- With
CCR_FETCH_DEPSenabled,CPM_USE_LOCAL_PACKAGESis set toON, which allows CPM to satisfy dependencies from locally installed packages instead of the pinned CPM lock/URI; this reduces build reproducibility (especially between CI and developer machines).
set(CPM_USE_LOCAL_PACKAGES ON)
.github/actions/workflow/action.yml:40
- This action restores/saves the CPM cache based on the
cpm-source-cacheinput, but it doesn't exportCPM_SOURCE_CACHEfor thelukka/run-cmakestep. CPM relies on this env var to use the restored source cache, so callers currently have to set it separately.
- uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9
with:
workflowPreset: "${{ inputs.workflow-preset }}"
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 34 out of 34 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (2)
cmake/dependencies.cpm.cmake:37
CPM_DOWNLOAD_LOCATIONpoints into acmake/subdirectory under the build tree, but that directory is never created beforefile(DOWNLOAD ...)writes to it. On a clean build directory this can make configuration fail becausefile(DOWNLOAD)does not create parent directories.
set(CPM_USE_LOCAL_PACKAGES ON)
set(CPM_DOWNLOAD_LOCATION "${CMAKE_CURRENT_BINARY_DIR}/cmake/CPM_${CPM_DOWNLOAD_VERSION}.cmake")
.github/actions/build/action.yml:46
- This action restores/saves a CPM cache directory based on the
cpm-source-cacheinput, but the CMake configure/build step does not receiveCPM_SOURCE_CACHE. If the caller doesn’t also set this env var externally, CPM will ignore the restored cache and re-download dependencies.
- uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9
with:
configurePreset: "${{ inputs.configure-preset }}"
buildPreset: "${{ inputs.build-preset }}"
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 34 out of 34 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
.github/actions/build/action.yml:46
CPM_SOURCE_CACHEis not exported to thelukka/run-cmakestep. Theenv:set on theccache-actionstep does not carry over to subsequent steps, so CPM won’t use the restored cache during configure/build (cache restore/save becomes mostly ineffective).
- uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9
with:
configurePreset: "${{ inputs.configure-preset }}"
buildPreset: "${{ inputs.build-preset }}"
compatibility/CMakeLists.txt:18
CCR_BINARY_DIRis injected as a C++ string literal. On Windows,${CMAKE_BINARY_DIR}commonly contains backslashes (e.g.C:\Users\...), which can produce invalid/ill-formed escape sequences in the compiled C++ code. Convert the path to forward slashes before defining it.
target_compile_definitions(compatibility.base PRIVATE
CCR_BINARY_DIR="${CMAKE_BINARY_DIR}"
)
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 34 out of 34 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
cmake/dependencies.cpm.cmake:38
file(DOWNLOAD ...)will fail on a clean build directory if the destination folder${CMAKE_CURRENT_BINARY_DIR}/cmakedoesn’t exist; CMake doesn’t create parent directories automatically for downloads. Create the directory before setting/usingCPM_DOWNLOAD_LOCATIONto make first-configure reliable.
set(CPM_USE_LOCAL_PACKAGES ON)
set(CPM_DOWNLOAD_LOCATION "${CMAKE_CURRENT_BINARY_DIR}/cmake/CPM_${CPM_DOWNLOAD_VERSION}.cmake")
.github/actions/build/action.yml:45
- The action restores/saves the CPM cache at
inputs.cpm-source-cache, butlukka/run-cmakeisn’t givenCPM_SOURCE_CACHE, so CPM may ignore the restored cache unless the caller also sets a matching job-level env var. Pass the env var to the run-cmake step so the action’s input reliably takes effect.
- uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9
with:
configurePreset: "${{ inputs.configure-preset }}"
buildPreset: "${{ inputs.build-preset }}"
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 34 out of 34 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
.github/actions/build/action.yml:45
- The Build composite action restores/saves the CPM cache based on
inputs.cpm-source-cache, but it never setsCPM_SOURCE_CACHEfor thelukka/run-cmakestep. Unless the caller also sets that env var externally, CPM will ignore the provided cache directory and re-download sources, defeating the purpose of thecpm-source-cacheinput.
- uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9
with:
configurePreset: "${{ inputs.configure-preset }}"
buildPreset: "${{ inputs.build-preset }}"
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 34 out of 34 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
cmake/dependencies.cpm.cmake:37
file(DOWNLOAD ...)writes into${CMAKE_CURRENT_BINARY_DIR}/cmake/..., but this file doesn’t ensure that${CMAKE_CURRENT_BINARY_DIR}/cmakeexists first. On a clean build directory, the download can fail because the destination directory is missing. Create the directory before setting/usingCPM_DOWNLOAD_LOCATION.
set(CPM_USE_LOCAL_PACKAGES ON)
set(CPM_DOWNLOAD_LOCATION "${CMAKE_CURRENT_BINARY_DIR}/cmake/CPM_${CPM_DOWNLOAD_VERSION}.cmake")
.github/actions/build/action.yml:45
- The restored CPM cache path is provided as an input, but
CPM_SOURCE_CACHEis only set for theccache-actionstep. If this composite action is used without a caller-providedCPM_SOURCE_CACHEenv var, CPM will ignore the restored cache and re-download dependencies. PassCPM_SOURCE_CACHEto thelukka/run-cmakestep as well so the cache is reliably used.
- uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9
with:
configurePreset: "${{ inputs.configure-preset }}"
buildPreset: "${{ inputs.build-preset }}"
Daan Timmer (daantimmer)
enabled auto-merge (squash)
July 24, 2026 10:05
André Jordan (andjordan)
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.