Make ci scripts more robust (#4608)

* Remove syntax error in release script

* Make ci scripts more robust

* Remove lib copying

* Add bin directory to RPATH

4 files changed, 26 insertions, 25 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 88ce31828..cdf315d8e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -90,8 +90,8 @@ jobs:
             # Configure, pointing to our just-generated slang-llvm archive
             cmake --preset default --fresh \
               -DSLANG_SLANG_LLVM_FLAVOR=FETCH_BINARY \
-              -DSLANG_SLANG_LLVM_BINARY_URL=$(pwd)/build/dist-release/slang-llvm.zip \
-              -DCMAKE_COMPILE_WARNING_AS_ERROR=${{matrix.warnings-as-errors}}
+              "-DSLANG_SLANG_LLVM_BINARY_URL=$(pwd)/build/dist-release/slang-llvm.zip" \
+              "-DCMAKE_COMPILE_WARNING_AS_ERROR=${{matrix.warnings-as-errors}}"
             cmake --workflow --preset "${{matrix.config}}"
           else
             # Otherwise, use the system llvm we have just build or got from the
@@ -107,13 +107,13 @@ jobs:
           export SLANG_USE_SPV_SOURCE_LANGUAGE_UNKNOWN=1
           failed=0
           if [[ "${{matrix.full-gpu-tests}}" == "true" ]]; then
-            $bin_dir/slang-test \
+            "$bin_dir/slang-test" \
               -use-test-server \
               -server-count 8 \
               -category ${{ matrix.test-category }} \
               -api all-cpu ||
               failed=1
-            $bin_dir/slang-test \
+            "$bin_dir/slang-test" \
               -use-test-server \
               -server-count 8 \
               -emit-spirv-via-glsl \
@@ -122,7 +122,7 @@ jobs:
               -expected-failure-list tests/expected-failure.txt ||
               failed=1
           else
-            $bin_dir/slang-test \
+            "$bin_dir/slang-test" \
               -use-test-server \
               -api all-dx12 \
               -category ${{ matrix.test-category }} \
diff --git a/.github/workflows/release-linux-glibc-2-17.yml b/.github/workflows/release-linux-glibc-2-17.yml
index 59f50ffd2..beb81d8db 100644
--- a/.github/workflows/release-linux-glibc-2-17.yml
+++ b/.github/workflows/release-linux-glibc-2-17.yml
@@ -39,14 +39,14 @@ jobs:
           base=$(pwd)/slang-${version}-linux-x86_64-glibc-2.17
 
           sudo mv "$(pwd)/build/dist-release/slang.zip" "${base}.zip"
-          echo "SLANG_BINARY_ARCHIVE_ZIP=${base}.zip" >> $GITHUB_OUTPUT
+          echo "SLANG_BINARY_ARCHIVE_ZIP=${base}.zip" >> "$GITHUB_OUTPUT"
 
           sudo mv "$(pwd)/build/dist-release/slang.tar.gz" "${base}.tar.gz"
-          echo "SLANG_BINARY_ARCHIVE_TAR=${base}.tar.gz" >> $GITHUB_OUTPUT
+          echo "SLANG_BINARY_ARCHIVE_TAR=${base}.tar.gz" >> "$GITHUB_OUTPUT"
 
       - name: File check
         run: |
-          find "build/dist-release" ! -iname '*.md' ! -iname '*.h' -type f | xargs file
+          find "build/dist-release" -print0 ! -iname '*.md' ! -iname '*.h' -type f | xargs -0 file
 
       - name: UploadBinary
         uses: softprops/action-gh-release@v1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5fab3f471..f0a738138 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -62,7 +62,7 @@ jobs:
 
       - name: Change dev tools to host arch (linux and macos)
         run: |
-          if [[ "${{inputs.os}}" == linux* && "${{inputs.platform}}" == "aarch64" && "$(uname -m)" != "aarch64" ]]; then
+          if [[ "${{matrix.os}}" == linux* && "${{matrix.platform}}" == "aarch64" && "$(uname -m)" != "aarch64" ]]; then
             export CC=aarch64-linux-gnu-gcc
             export CXX=aarch64-linux-gnu-g++
           fi
@@ -84,8 +84,8 @@ jobs:
             -DSLANG_GENERATORS_PATH=build-platform-generators/bin \
             -DSLANG_ENABLE_EXAMPLES=OFF \
             -DSLANG_EMBED_STDLIB=ON \
-            -DSLANG_SLANG_LLVM_FLAVOR=$(
-              [[ "${{matrix.build-slang-llvm}}" = "true" ]] && echo "USE_SYSTEM_LLVM" || echo "DISABLE")
+            "-DSLANG_SLANG_LLVM_FLAVOR=$(
+              [[ "${{matrix.build-slang-llvm}}" = "true" ]] && echo "USE_SYSTEM_LLVM" || echo "DISABLE")"
 
           cmake --build --preset "${{matrix.config}}"
 
@@ -110,18 +110,18 @@ jobs:
           KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
 
           # import certificate and provisioning profile from secrets
-          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode --output $CERTIFICATE_PATH
+          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode --output "$CERTIFICATE_PATH"
 
           # create temporary keychain
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
 
           # import certificate to keychain
-          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
+          security import "$CERTIFICATE_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security list-keychain -d user -s "$KEYCHAIN_PATH"
 
-          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k ${KEYCHAIN_PASSWORD} $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${KEYCHAIN_PASSWORD}" "$KEYCHAIN_PATH"
 
           binaries=(
             "${lib_dir}/libslang.dylib"
@@ -134,14 +134,14 @@ jobs:
           )
           for b in "${binaries[@]}"; do
             if [[ -f "$b" ]]; then
-              /usr/bin/codesign --force --options runtime -s ${IDENTITY_ID} "$b" -v
+              /usr/bin/codesign --force --options runtime -s "${IDENTITY_ID}" "$b" -v
               7z a "slang-macos-dist.zip" "$b"
             fi
           done
 
           timeout 1000 gon ./extras/macos-notarize.json
           cp slang-macos-dist.zip "slang-macos-dist-${{matrix.platform}}.zip"
-          echo "SLANG_NOTARIZED_DIST=slang-macos-dist-${{matrix.platform}}.zip" >> $GITHUB_OUTPUT
+          echo "SLANG_NOTARIZED_DIST=slang-macos-dist-${{matrix.platform}}.zip" >> "$GITHUB_OUTPUT"
 
       - name: Package Slang
         id: package
@@ -152,16 +152,16 @@ jobs:
           triggering_ref=${{ github.ref_name }}
           base=slang-${triggering_ref#v}-${{matrix.os}}-${{matrix.platform}}
           mv "$(pwd)/build/dist-${config}/slang.zip" "${base}.zip"
-          echo "SLANG_BINARY_ARCHIVE_ZIP=${base}.zip" >> $GITHUB_OUTPUT
+          echo "SLANG_BINARY_ARCHIVE_ZIP=${base}.zip" >> "$GITHUB_OUTPUT"
           mv "$(pwd)/build/dist-${config}/slang.tar.gz" "${base}.tar.gz"
-          echo "SLANG_BINARY_ARCHIVE_TAR=${base}.tar.gz" >> $GITHUB_OUTPUT
+          echo "SLANG_BINARY_ARCHIVE_TAR=${base}.tar.gz" >> "$GITHUB_OUTPUT"
 
       - name: File check
         run: |
-          find "build/dist-$config" ! -iname '*.md' ! -iname '*.h' -type f | xargs file
+          find "build/dist-$config" -print0 ! -iname '*.md' ! -iname '*.h' -type f | xargs -0 file
           if [ "${{matrix.os}}" = "macos" ]; then
-            find "build/dist-$config" ! -iname '*.md' ! -iname '*.h' -type f |
-              xargs codesign --verify --verbose=2 ||
+            find "build/dist-$config" -print0 ! -iname '*.md' ! -iname '*.h' -type f |
+              xargs -0 codesign --verify --verbose=2 ||
               echo "code signing failed"
           fi
 
diff --git a/.github/workflows/vk-gl-cts-nightly.yml b/.github/workflows/vk-gl-cts-nightly.yml
index 587e7db30..5817257e1 100644
--- a/.github/workflows/vk-gl-cts-nightly.yml
+++ b/.github/workflows/vk-gl-cts-nightly.yml
@@ -22,6 +22,7 @@ jobs:
             test-category: full
             full-gpu-tests: false
             runs-on: [Windows, self-hosted]
+    runs-on: ${{ matrix.runs-on }}
     timeout-minutes: 180
     defaults:
       run: