Merge 'main' into 'next-gen-scenes'

.github/actions/install-linux-deps/action.yml

@@ -28,7 +28,7 @@ inputs:
   wayland:
     description: Install Wayland (libwayland-dev)
     required: false
-    default: "false"
+    default: "true"
   xkb:
     description: Install xkb (libxkbcommon-dev)
     required: false

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   merge_group:
   pull_request:
@@ -257,9 +260,12 @@ jobs:
         with:
           target: wasm32-unknown-unknown
       - name: Check wasm
+        env:
+          RUSTFLAGS: --cfg getrandom_backend="wasm_js"
         run: cargo check --target wasm32-unknown-unknown
 
   build-wasm-atomics:
+    if: ${{ false }} # Disabled temporarily due to https://github.com/rust-lang/rust/issues/145101
     runs-on: ubuntu-latest
     timeout-minutes: 30
     needs: build
@@ -287,7 +293,7 @@ jobs:
       - name: Check wasm
         run: cargo check --target wasm32-unknown-unknown -Z build-std=std,panic_abort
         env:
-          RUSTFLAGS: "-C target-feature=+atomics,+bulk-memory"
+          RUSTFLAGS: '-C target-feature=+atomics,+bulk-memory --cfg getrandom_backend="wasm_js"'
 
   markdownlint:
     runs-on: ubuntu-latest

.github/workflows/dependencies.yml

@@ -1,14 +1,17 @@
 name: Dependencies
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths:
-      - '**/Cargo.toml'
-      - 'deny.toml'
+      - "**/Cargo.toml"
+      - "deny.toml"
   push:
     paths:
-      - '**/Cargo.toml'
-      - 'deny.toml'
+      - "**/Cargo.toml"
+      - "deny.toml"
     branches:
       - main
 

.github/workflows/example-run-report.yml

@@ -6,6 +6,7 @@ name: Example Run - PR Comments
 # Also requesting write permissions on PR to be able to comment
 permissions:
   pull-requests: "write"
+  contents: "read"
 
 on:
   workflow_run:
@@ -59,8 +60,10 @@ jobs:
           path: screenshots
       - name: branch name
         id: branch-name
+        env:
+          BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
         run: |
-          echo "result=PR-$(cat PR)-${{ github.event.workflow_run.head_branch }}" >> $GITHUB_OUTPUT
+          echo "result=PR-$(cat PR)-$BRANCH_NAME" >> $GITHUB_OUTPUT
       - name: PR number
         id: pr-number
         run: |

.github/workflows/example-run.yml

@@ -1,5 +1,8 @@
 name: Example Run
 
+permissions:
+  contents: read
+
 on:
   merge_group:
   pull_request:

.github/workflows/send-screenshots-to-pixeleagle.yml

@@ -1,5 +1,8 @@
 name: Send Screenshots to Pixel Eagle
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
@@ -45,9 +48,10 @@ jobs:
         if: ${{ fromJSON(env.PIXELEAGLE_TOKEN_EXISTS) }}
         env:
           project: B04F67C0-C054-4A6F-92EC-F599FEC2FD1D
+          branch: ${{ inputs.branch }}
         run: |
           # Create a new run with its associated metadata
-          metadata='{"os":"${{ inputs.os }}", "commit": "${{ inputs.commit }}", "branch": "${{ inputs.branch }}"}'
+          metadata='{"os":"${{ inputs.os }}", "commit": "${{ inputs.commit }}", "branch": "$branch"}'
           run=`curl https://pixel-eagle.com/$project/runs --json "$metadata" --oauth2-bearer ${{ secrets.PIXELEAGLE_TOKEN }} | jq '.id'`
 
           SAVEIFS=$IFS

.github/workflows/update-caches.yml

@@ -1,5 +1,8 @@
 name: Update Actions Caches
 
+permissions:
+  contents: read
+
 on:
   # Manually
   workflow_dispatch:

.github/workflows/validation-jobs.yml

@@ -1,5 +1,8 @@
 name: validation jobs
 
+permissions:
+  contents: read
+
 on:
   merge_group:
   pull_request:
@@ -130,6 +133,8 @@ jobs:
           cd ../..
 
       - name: First Wasm build
+        env:
+          RUSTFLAGS: --cfg getrandom_backend="wasm_js"
         run: |
           cargo build --release --example testbed_ui --target wasm32-unknown-unknown
 

.github/workflows/weekly.yml

@@ -1,10 +1,13 @@
 name: Weekly beta compile test
 
+permissions:
+  contents: read
+
 on:
   schedule:
     # New versions of rust release on Thursdays. We test on Mondays to get at least 3 days of warning before all our CI breaks again.
     # https://forge.rust-lang.org/release/process.html#release-day-thursday
-    - cron:  '0 12 * * 1'
+    - cron: "0 12 * * 1"
   workflow_dispatch:
 
 env:
@@ -85,7 +88,7 @@ jobs:
 
   close-any-open-issues:
     runs-on: ubuntu-latest
-    needs: ['test', 'lint', 'check-compiles']
+    needs: ["test", "lint", "check-compiles"]
     permissions:
       issues: write
     steps:
@@ -106,14 +109,13 @@ jobs:
           COMMENT: |
             [Last pipeline run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) successfully completed. Closing issue.
 
-
   open-issue:
     name: Warn that weekly CI fails
     runs-on: ubuntu-latest
     needs: [test, lint, check-compiles]
     permissions:
       issues: write
-    # We disable this job on forks, because 
+    # We disable this job on forks, because
     # Use always() so the job doesn't get canceled if any other jobs fail
     if: ${{ github.repository == 'bevyengine/bevy' && always() && contains(needs.*.result, 'failure') }}
     steps: