Github: Change release workflows to match upstream

.github/workflows/release-docs.yml

@@ -0,0 +1,85 @@
+name: Release (Docs)
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+
+jobs:
+  docs:
+    name: Docs
+
+    runs-on: ubuntu-20.04
+
+    steps:
+    - name: Download source
+      uses: actions/download-artifact@v3
+      with:
+        name: internal-source
+
+    - name: Unpack source
+      run: |
+        tar -xf source.tar.gz --strip-components=1
+
+    - name: Install dependencies
+      run: |
+        echo "::group::Update apt"
+        sudo apt-get update
+        echo "::endgroup::"
+
+        echo "::group::Install dependencies"
+        sudo apt-get install -y --no-install-recommends \
+          doxygen \
+          # EOF
+        echo "::endgroup::"
+      env:
+        DEBIAN_FRONTEND: noninteractive
+
+    - name: Build
+      run: |
+        mkdir -p ${GITHUB_WORKSPACE}/build
+        cd ${GITHUB_WORKSPACE}/build
+
+        echo "::group::CMake"
+        cmake ${GITHUB_WORKSPACE} \
+          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DOPTION_DOCS_ONLY=ON \
+          # EOF
+        echo "::endgroup::"
+
+        echo "::group::Build"
+        cmake --build . --target docs
+        echo "::endgroup::"
+
+    - name: Create bundles
+      run: |
+        BASENAME=openttd-${{ inputs.version }}
+
+        cd ${GITHUB_WORKSPACE}/build
+
+        mv docs/source ${BASENAME}-docs
+        mv docs/ai-api ${BASENAME}-docs-ai
+        mv docs/gs-api ${BASENAME}-docs-gs
+
+        mkdir -p bundles
+
+        echo "::group::Create docs bundle"
+        tar --xz -cf bundles/${BASENAME}-docs.tar.xz ${BASENAME}-docs
+        echo "::endgroup::"
+
+        echo "::group::Create AI API docs bundle"
+        tar --xz -cf bundles/${BASENAME}-docs-ai.tar.xz ${BASENAME}-docs-ai
+        echo "::endgroup::"
+
+        echo "::group::Create GameScript API docs bundle"
+        tar --xz -cf bundles/${BASENAME}-docs-gs.tar.xz ${BASENAME}-docs-gs
+        echo "::endgroup::"
+
+    - name: Store bundles
+      uses: actions/upload-artifact@v3
+      with:
+        name: openttd-docs
+        path: build/bundles/*.tar.xz
+        retention-days: 5

.github/workflows/release-linux.yml

@@ -0,0 +1,155 @@
+name: Release (Linux)
+
+on:
+  workflow_call:
+    inputs:
+      survey_key:
+        required: false
+        type: string
+        default: ""
+
+jobs:
+  linux:
+    name: Linux (Generic)
+
+    runs-on: ubuntu-20.04
+    container:
+      # manylinux2014 is based on CentOS 7, but already has a lot of things
+      # installed and preconfigured. It makes it easier to build OpenTTD.
+      image: quay.io/pypa/manylinux2014_x86_64
+
+    steps:
+    - name: Download source
+      uses: actions/download-artifact@v3
+      with:
+        name: internal-source
+
+    - name: Unpack source
+      run: |
+        tar -xf source.tar.gz --strip-components=1
+
+    - name: Enable vcpkg cache
+      uses: actions/cache@v3
+      with:
+        path: /vcpkg/installed
+        key: ubuntu-20.04-vcpkg-release-1 # Increase the number whenever dependencies are modified
+        restore-keys: |
+          ubuntu-20.04-vcpkg-release
+
+    - name: Install dependencies
+      run: |
+        echo "::group::Install system dependencies"
+        # perl-IPC-Cmd, wget, and zip are needed to run vcpkg.
+        # autoconf-archive is needed to build ICU.
+        yum install -y \
+          autoconf-archive \
+          perl-IPC-Cmd \
+          wget \
+          zip \
+          # EOF
+
+        # aclocal looks first in /usr/local/share/aclocal, and if that doesn't
+        # exist only looks in /usr/share/aclocal. We have files in both that
+        # are important. So copy the latter to the first, and we are good to
+        # go.
+        cp /usr/share/aclocal/* /usr/local/share/aclocal/
+        echo "::endgroup::"
+
+        # We use vcpkg for our dependencies, to get more up-to-date version.
+        echo "::group::Install vcpkg and dependencies"
+
+        # We do a little dance to make sure we copy the cached install folder
+        # into our new clone.
+        git clone --depth=1 https://github.com/microsoft/vcpkg /vcpkg-clone
+        if [ -e /vcpkg/installed ]; then
+          mv /vcpkg/installed /vcpkg-clone/
+          rm -rf /vcpkg
+        fi
+        mv /vcpkg-clone /vcpkg
+
+        (
+          cd /vcpkg
+          ./bootstrap-vcpkg.sh -disableMetrics
+
+          # Make Python3 available for other packages.
+          ./vcpkg install python3
+          ln -sf $(pwd)/installed/x64-linux/tools/python3/python3.[0-9][0-9] /usr/bin/python3
+
+          ./vcpkg install \
+            curl[http2] \
+            fontconfig \
+            freetype \
+            harfbuzz \
+            icu \
+            liblzma \
+            libpng \
+            lzo \
+            nlohmann-json \
+            sdl2 \
+            zlib \
+            # EOF
+        )
+        echo "::endgroup::"
+
+        # The yum variant of fluidsynth depends on all possible audio drivers,
+        # like jack, ALSA, pulseaudio, etc. This is not really useful for us,
+        # as we route the output of fluidsynth back via our sound driver, and
+        # as such do not use these audio driver outputs at all.
+        # The vcpkg variant of fluidsynth depends on ALSA. Similar issue here.
+        # So instead, we compile fluidsynth ourselves, with as few
+        # dependencies as possible. This currently means it picks up SDL2, but
+        # this is fine, as we need SDL2 anyway.
+        echo "::group::Install fluidsynth"
+        wget https://github.com/FluidSynth/fluidsynth/archive/v2.1.6.tar.gz
+        tar xf v2.1.6.tar.gz
+        (
+          cd fluidsynth-2.1.6
+          mkdir build
+          cd build
+          cmake .. -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_PREFIX=/usr
+          cmake --build . -j $(nproc)
+          cmake --install .
+        )
+        echo "::endgroup::"
+
+    - name: Install GCC problem matcher
+      uses: ammaraskar/gcc-problem-matcher@master
+
+    - name: Build
+      run: |
+        mkdir -p build
+        cd build
+
+        echo "::group::CMake"
+        cmake ${GITHUB_WORKSPACE} \
+          -DCMAKE_TOOLCHAIN_FILE=/vcpkg/scripts/buildsystems/vcpkg.cmake \
+          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DOPTION_SURVEY_KEY=${{ inputs.survey_key }} \
+          -DOPTION_PACKAGE_DEPENDENCIES=ON \
+          # EOF
+        echo "::endgroup::"
+
+        echo "::group::Build"
+        echo "Running on $(nproc) cores"
+        cmake --build . -j $(nproc) --target openttd
+        echo "::endgroup::"
+
+    - name: Create bundles
+      run: |
+        cd ${GITHUB_WORKSPACE}/build
+        echo "::group::Run CPack"
+        cpack
+        echo "::endgroup::"
+
+        echo "::group::Cleanup"
+        # Remove the sha256 files CPack generates; we will do this ourself at
+        # the end of this workflow.
+        rm -f bundles/*.sha256
+        echo "::endgroup::"
+
+    - name: Store bundles
+      uses: actions/upload-artifact@v3
+      with:
+        name: openttd-linux-generic
+        path: build/bundles
+        retention-days: 5

.github/workflows/release-macos.yml

@@ -0,0 +1,209 @@
+name: Release (MacOS)
+
+on:
+  workflow_call:
+    inputs:
+      survey_key:
+        required: false
+        type: string
+        default: ""
+
+jobs:
+  macos:
+    name: MacOS
+
+    runs-on: macos-11
+    env:
+      MACOSX_DEPLOYMENT_TARGET: 10.13
+
+    steps:
+    - name: Download source
+      uses: actions/download-artifact@v3
+      with:
+        name: internal-source
+
+    - name: Unpack source
+      run: |
+        tar -xf source.tar.gz --strip-components=1
+
+    - name: Install dependencies
+      env:
+        HOMEBREW_NO_AUTO_UPDATE: 1
+        HOMEBREW_NO_INSTALL_CLEANUP: 1
+      run: |
+        brew install \
+          pandoc \
+          pkg-config \
+          # EOF
+
+    - name: Prepare cache key
+      id: key
+      run: |
+        echo "image=$ImageOS-$ImageVersion" >> $GITHUB_OUTPUT
+
+    - name: Enable vcpkg cache
+      uses: actions/cache@v3
+      with:
+        path: /usr/local/share/vcpkg/installed
+        key: ${{ steps.key.outputs.image }}-vcpkg-release-1 # Increase the number whenever dependencies are modified
+        restore-keys: |
+          ${{ steps.key.outputs.image }}-vcpkg-release
+          ${{ steps.key.outputs.image }}-vcpkg-x64
+
+    - name: Prepare vcpkg
+      run: |
+        vcpkg install \
+          curl:x64-osx \
+          curl:arm64-osx \
+          liblzma:x64-osx \
+          liblzma:arm64-osx \
+          libpng:x64-osx \
+          libpng:arm64-osx \
+          lzo:x64-osx \
+          lzo:arm64-osx \
+          nlohmann-json:x64-osx \
+          nlohmann-json:arm64-osx \
+          zlib:x64-osx \
+          zlib:arm64-osx \
+          # EOF
+
+    - name: Install GCC problem matcher
+      uses: ammaraskar/gcc-problem-matcher@master
+
+    - name: Build tools
+      run: |
+        mkdir build-host
+        cd build-host
+
+        echo "::group::CMake"
+        cmake ${GITHUB_WORKSPACE} \
+          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DOPTION_TOOLS_ONLY=ON \
+          # EOF
+        echo "::endgroup::"
+
+        echo "::group::Build tools"
+        echo "Running on $(sysctl -n hw.logicalcpu) cores"
+        cmake --build . -j $(sysctl -n hw.logicalcpu) --target tools
+        echo "::endgroup::"
+
+    - name: Import code signing certificates
+      uses: Apple-Actions/import-codesign-certs@v2
+      with:
+        # The certificates in a PKCS12 file encoded as a base64 string
+        p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
+        # The password used to import the PKCS12 file.
+        p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
+      # If this is run on a fork, there may not be a certificate set up - continue in this case
+      continue-on-error: true
+
+    - name: Build arm64
+      run: |
+        mkdir build-arm64
+        cd build-arm64
+
+        echo "::group::CMake"
+        cmake ${GITHUB_WORKSPACE} \
+          -DCMAKE_OSX_ARCHITECTURES=arm64 \
+          -DVCPKG_TARGET_TRIPLET=arm64-osx \
+          -DCMAKE_TOOLCHAIN_FILE=/usr/local/share/vcpkg/scripts/buildsystems/vcpkg.cmake \
+          -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \
+          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DOPTION_SURVEY_KEY=${{ inputs.survey_key }} \
+          # EOF
+        echo "::endgroup::"
+
+        echo "::group::Build"
+        echo "Running on $(sysctl -n hw.logicalcpu) cores"
+        cmake --build . -j $(sysctl -n hw.logicalcpu) --target openttd
+        echo "::endgroup::"
+
+    - name: Build x64
+      run: |
+        mkdir build-x64
+        cd build-x64
+
+        echo "::group::CMake"
+        cmake ${GITHUB_WORKSPACE} \
+          -DCMAKE_OSX_ARCHITECTURES=x86_64 \
+          -DVCPKG_TARGET_TRIPLET=x64-osx \
+          -DCMAKE_TOOLCHAIN_FILE=/usr/local/share/vcpkg/scripts/buildsystems/vcpkg.cmake \
+          -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \
+          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DOPTION_SURVEY_KEY=${{ inputs.survey_key }} \
+          -DCPACK_BUNDLE_APPLE_CERT_APP=${{ secrets.APPLE_DEVELOPER_CERTIFICATE_ID }} \
+          "-DCPACK_BUNDLE_APPLE_CODESIGN_PARAMETER=--deep -f --options runtime" \
+          -DAPPLE_UNIVERSAL_PACKAGE=1 \
+          # EOF
+        echo "::endgroup::"
+
+        echo "::group::Build"
+        echo "Running on $(sysctl -n hw.logicalcpu) cores"
+        cmake --build . -j $(sysctl -n hw.logicalcpu) --target openttd
+        echo "::endgroup::"
+
+    - name: Create bundles
+      run: |
+        cd build-x64
+
+        echo "::group::Create universal binary"
+        # Combine the `openttd` binaries from each build into a single file
+        lipo -create -output openttd-universal ../build-*/openttd
+        mv openttd-universal openttd
+        echo "::endgroup::"
+
+        echo "::group::Run CPack"
+        cpack
+        echo "::endgroup::"
+
+        echo "::group::Cleanup"
+        # Remove the sha256 files CPack generates; we will do this ourself at
+        # the end of this workflow.
+        rm -f bundles/*.sha256
+        echo "::endgroup::"
+
+    - name: Notarize
+      env:
+        AC_USERNAME: ${{ secrets.APPLE_DEVELOPER_APP_USERNAME }}
+        AC_PASSWORD: ${{ secrets.APPLE_DEVELOPER_APP_PASSWORD }}
+        AC_TEAM_ID: ${{ secrets.APPLE_DEVELOPER_TEAM_ID }}
+      run: |
+        if [ -z "${AC_USERNAME}" ]; then
+            # We may be running on a fork that doesn't have notarization secrets set up; skip this step
+            echo No notarization secrets set up, skipping.
+            exit 0
+        fi
+
+        xcrun notarytool store-credentials --apple-id "${AC_USERNAME}" --password "${AC_PASSWORD}" --team-id "${AC_TEAM_ID}" openttd
+        cd build-x64
+        ../os/macosx/notarize.sh
+
+    - name: Build zip
+      run: |
+        cd build-x64
+
+        pushd _CPack_Packages/*/Bundle/openttd-*/
+
+        # Remove the Applications symlink from the staging folder
+        rm -f Applications
+
+        # Remove the original dmg built by CPack to avoid a conflict when resolving
+        # the zip_filename variable below
+        rm -f ../*.dmg
+
+        zip_filename=(../openttd-*)
+
+        # Package up the existing, notarised .app into a zip file
+        zip -r -9 ${zip_filename}.zip OpenTTD.app
+
+        popd
+
+        # Now move it into place to be uploaded
+        mv _CPack_Packages/*/Bundle/openttd-*.zip bundles/
+
+    - name: Store bundles
+      uses: actions/upload-artifact@v3
+      with:
+        name: openttd-macos-universal
+        path: build-x64/bundles
+        retention-days: 5

.github/workflows/release-source.yml

@@ -0,0 +1,202 @@
+name: Release (Source)
+
+on:
+  workflow_call:
+    outputs:
+      version:
+        value: ${{ jobs.source.outputs.version }}
+      is_tag:
+        value: ${{ jobs.source.outputs.is_tag }}
+      trigger_type:
+        value: ${{ jobs.source.outputs.trigger_type }}
+      folder:
+        value: ${{ jobs.source.outputs.folder }}
+      survey_key:
+        value: ${{ jobs.source.outputs.survey_key }}
+
+jobs:
+  source:
+    name: Source
+
+    runs-on: ubuntu-20.04
+
+    outputs:
+      version: ${{ steps.metadata.outputs.version }}
+      is_tag: ${{ steps.metadata.outputs.is_tag }}
+      trigger_type: ${{ steps.metadata.outputs.trigger_type }}
+      folder: ${{ steps.metadata.outputs.folder }}
+      survey_key: ${{ steps.survey_key.outputs.survey_key }}
+
+    steps:
+    - name: Checkout (Release)
+      if: github.event_name == 'release'
+      uses: actions/checkout@v3
+      with:
+        # We generate a changelog; for this we need the full git log.
+        fetch-depth: 0
+
+    - name: Checkout (Manual)
+      if: github.event_name == 'workflow_dispatch'
+      uses: actions/checkout@v3
+      with:
+        ref: ${{ github.event.inputs.ref }}
+        # We generate a changelog; for this we need the full git log.
+        fetch-depth: 0
+
+    - name: Checkout (Trigger)
+      if: github.event_name == 'repository_dispatch'
+      uses: actions/checkout@v3
+      with:
+        ref: ${{ github.event.client_payload.ref }}
+        # We generate a changelog; for this we need the full git log.
+        fetch-depth: 0
+
+    - name: Check valid branch name
+      run: |
+        if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+          REF="${{ github.event.inputs.ref }}"
+        elif [ "${{ github.event_name }}" = "repository_dispatch" ]; then
+          REF="${{ github.event.client_payload.ref }}"
+        else
+          REF="${{ github.ref }}"
+        fi
+
+        # Check if we are a tag.
+        if [ -n "$(git name-rev --name-only --tags --no-undefined HEAD 2>/dev/null || false)" ]; then
+          exit 0
+        fi
+
+        # Check if the checkout caused the branch to be named.
+        if [ "$(git rev-parse --abbrev-ref HEAD)" != "HEAD" ]; then
+          exit 0
+        fi
+
+        # Check if this was a pull request.
+        if [ -n "$(echo ${REF} | grep '^refs/pull/[0-9]*')" ]; then
+          PULL=$(echo ${REF} | cut -d/ -f3)
+          git checkout -b pr${PULL}
+        fi
+
+        # Are we still in a detached state? Error out.
+        if [ "$(git rev-parse --abbrev-ref HEAD)" == "HEAD" ]; then
+          echo "The 'ref' given resulted in a checkout of a detached HEAD."
+          echo "We cannot detect the version for these checkout accurate."
+          echo ""
+          echo "If you want to build a Pull Request, make sure you use 'refs/pull/NNN/head'."
+          echo ""
+          echo "Cancelling build, as without a version we cannot store the artifacts."
+          exit 1
+        fi
+
+    - name: Generate metadata
+      id: metadata
+      run: |
+        echo "::group::Prepare metadata files"
+        cmake -DGENERATE_OTTDREV=1 -P cmake/scripts/FindVersion.cmake
+        ./.github/changelog.sh > .changelog
+        TZ='UTC' date +"%Y-%m-%d %H:%M UTC" > .release_date
+        cat .ottdrev | cut -f 1 -d$'\t' > .version
+
+        if [ $(cat .ottdrev | cut -f 5 -d$'\t') = '1' ]; then
+          # Assume that all tags are always releases. Why else make a tag?
+          IS_TAG="true"
+
+          FOLDER="${{ env.FOLDER_RELEASES }}"
+          TRIGGER_TYPE="new-tag"
+        else
+          IS_TAG="false"
+
+          BRANCH=$(git symbolic-ref -q HEAD | sed 's@.*/@@')
+          if [ -z "${BRANCH}" ]; then
+            echo "Internal error: branch name is empty."
+            echo "An earlier step should have prevented this from happening."
+            echo "Cancelling build, as without a branch name we cannot store the artifacts"
+            exit 1
+          fi
+
+          if [ "${BRANCH}" = "${{ env.NIGHTLIES_BRANCH }}" ]; then
+            # The "master" branch is special, and we call a nightly.
+            FOLDER="${{ env.FOLDER_NIGHTLIES }}/$(date +%Y)"
+            TRIGGER_TYPE="new-master"
+          else
+            # All other branches, which can be builds of Pull Requests, are
+            # put in their own folder.
+            FOLDER="${{ env.FOLDER_BRANCHES }}/${BRANCH}"
+            TRIGGER_TYPE="new-branch"
+          fi
+        fi
+
+        mkdir -p build/bundles
+        cp .changelog build/bundles/changelog.txt
+        cp .release_date build/bundles/released.txt
+        cp README.md build/bundles/README.md
+        echo "::endgroup::"
+
+        echo "Release Date: $(cat .release_date)"
+        echo "Revision: $(cat .ottdrev)"
+        echo "Version: $(cat .version)"
+        echo "Is tag: ${IS_TAG}"
+        echo "Folder on CDN: ${FOLDER}"
+        echo "Workflow trigger: ${TRIGGER_TYPE}"
+
+        echo "version=$(cat .version)" >> $GITHUB_OUTPUT
+        echo "is_tag=${IS_TAG}" >> $GITHUB_OUTPUT
+        echo "folder=${FOLDER}" >> $GITHUB_OUTPUT
+        echo "trigger_type=${TRIGGER_TYPE}" >> $GITHUB_OUTPUT
+      env:
+        NIGHTLIES_BRANCH: master
+        FOLDER_RELEASES: openttd-releases
+        FOLDER_NIGHTLIES: openttd-nightlies
+        FOLDER_BRANCHES: openttd-branches
+
+    - name: Generate survey key
+      id: survey_key
+      run: |
+        PAYLOAD='{"version":"${{ steps.metadata.outputs.version }}","type":"${{ vars.SURVEY_TYPE }}"}'
+
+        echo "${{ secrets.SURVEY_SIGNING_KEY }}" > survey_signing_key.pem
+        SIGNATURE=$(echo -n "${PAYLOAD}" | openssl dgst -sha256 -sign survey_signing_key.pem | base64 -w0)
+        rm -f survey_signing_key.pem
+
+        SURVEY_KEY=$(curl -f -s -X POST -d "${PAYLOAD}" -H "Content-Type: application/json" -H "X-Signature: ${SIGNATURE}" https://survey-participate.openttd.org/create-survey-key/${{ vars.SURVEY_TYPE }})
+
+        echo "survey_key=${SURVEY_KEY}" >> $GITHUB_OUTPUT
+
+    - name: Remove VCS information
+      run: |
+        rm -rf .git
+
+    - name: Create bundles
+      run: |
+        FOLDER_NAME=openttd-${{ steps.metadata.outputs.version }}
+
+        # Rename the folder to openttd-NNN
+        mkdir ${FOLDER_NAME}
+        find . -maxdepth 1 -not -name . -not -name build -not -name ${FOLDER_NAME} -exec mv {} ${FOLDER_NAME}/ \;
+
+        echo "::group::Create tarball (xz) bundle"
+        tar --xz -cvf build/bundles/${FOLDER_NAME}-source.tar.xz ${FOLDER_NAME}
+        echo "::endgroup::"
+
+        # This tarball is only to be used within this workflow.
+        echo "::group::Create tarball (gz) bundle"
+        tar --gzip -cvf source.tar.gz ${FOLDER_NAME}
+        echo "::endgroup::"
+
+        echo "::group::Create zip bundle"
+        zip -9 -r build/bundles/${FOLDER_NAME}-source.zip ${FOLDER_NAME}
+        echo "::endgroup::"
+
+    - name: Store bundles
+      uses: actions/upload-artifact@v3
+      with:
+        name: openttd-source
+        path: build/bundles/*
+        retention-days: 5
+
+    - name: Store source (for other jobs)
+      uses: actions/upload-artifact@v3
+      with:
+        name: internal-source
+        path: source.tar.gz
+        retention-days: 1

.github/workflows/release-windows.yml

@@ -0,0 +1,208 @@
+name: Release (Windows)
+
+on:
+  workflow_call:
+    inputs:
+      survey_key:
+        required: false
+        type: string
+        default: ""
+      is_tag:
+        required: true
+        type: string
+
+jobs:
+  windows:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - arch: x86
+          host: x86
+        - arch: x64
+          host: x64
+        - arch: arm64
+          host: x64_arm64
+
+    name: Windows (${{ matrix.arch }})
+
+    runs-on: windows-latest
+
+    steps:
+    - name: Download source
+      uses: actions/download-artifact@v3
+      with:
+        name: internal-source
+
+    - name: Unpack source
+      shell: bash
+      run: |
+        tar -xf source.tar.gz --strip-components=1
+
+    - name: Install dependencies
+      shell: bash
+      run: |
+        choco install pandoc
+
+    - name: Prepare cache key
+      id: key
+      shell: powershell
+      run: |
+        # Work around caching failure with GNU tar
+        New-Item -Type Junction -Path vcpkg -Target c:\vcpkg
+
+        Write-Output "image=$env:ImageOS-$env:ImageVersion" >> $env:GITHUB_OUTPUT
+
+    - name: Enable vcpkg cache
+      uses: actions/cache@v3
+      with:
+        path: vcpkg/installed
+        key: ${{ steps.key.outputs.image }}-vcpkg-${{ matrix.arch }}-1 # Increase the number whenever dependencies are modified
+        restore-keys: |
+          ${{ steps.key.outputs.image }}-vcpkg-${{ matrix.arch }}
+
+    - name: Prepare vcpkg
+      shell: bash
+      run: |
+        vcpkg install --triplet=${{ matrix.arch }}-windows-static \
+          liblzma \
+          libpng \
+          lzo \
+          nlohmann-json \
+          zlib \
+          # EOF
+
+    - name: Install MSVC problem matcher
+      uses: ammaraskar/msvc-problem-matcher@master
+
+    - name: Configure developer command prompt for tools
+      uses: ilammy/msvc-dev-cmd@v1
+      with:
+        arch: x64
+
+    - name: Build tools
+      shell: bash
+      run: |
+        mkdir build-host
+        cd build-host
+
+        echo "::group::CMake"
+        cmake ${GITHUB_WORKSPACE} \
+          -GNinja \
+          -DOPTION_TOOLS_ONLY=ON \
+          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          # EOF
+        echo "::endgroup::"
+
+        echo "::group::Build"
+        cmake --build . --target tools
+        echo "::endgroup::"
+
+    - name: Configure developer command prompt for ${{ matrix.arch }}
+      uses: ilammy/msvc-dev-cmd@v1
+      with:
+        arch: ${{ matrix.host }}
+
+    - name: Import code signing certificate
+      shell: powershell
+      # If this is run on a fork, there may not be a certificate set up - continue in this case
+      continue-on-error: true
+      run: |
+        $tempFile = [System.IO.Path]::GetTempFileName()
+        $bytes = [System.Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_P12)
+        [IO.File]::WriteAllBytes($tempFile, $bytes)
+        $pwd = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force
+        Import-PfxCertificate -FilePath $tempFile -CertStoreLocation Cert:\CurrentUser\My -Password $pwd
+        Remove-Item $tempFile
+      env:
+        WINDOWS_CERTIFICATE_P12: ${{ secrets.WINDOWS_CERTIFICATE_P12 }}
+        WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+
+    - name: Build (with installer)
+      if: inputs.is_tag == 'true'
+      shell: bash
+      run: |
+        mkdir build
+        cd build
+
+        echo "::group::CMake"
+        cmake ${GITHUB_WORKSPACE} \
+          -GNinja \
+          -DVCPKG_TARGET_TRIPLET=${{ matrix.arch }}-windows-static \
+          -DCMAKE_TOOLCHAIN_FILE="c:\vcpkg\scripts\buildsystems\vcpkg.cmake" \
+          -DOPTION_USE_NSIS=ON \
+          -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \
+          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DOPTION_SURVEY_KEY=${{ inputs.survey_key }} \
+          -DWINDOWS_CERTIFICATE_COMMON_NAME="${WINDOWS_CERTIFICATE_COMMON_NAME}" \
+          # EOF
+        echo "::endgroup::"
+
+        echo "::group::Build"
+        cmake --build . --target openttd
+        echo "::endgroup::"
+      env:
+        WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }}
+
+    - name: Build (without installer)
+      if: inputs.is_tag != 'true'
+      shell: bash
+      run: |
+        mkdir build
+        cd build
+
+        echo "::group::CMake"
+        cmake ${GITHUB_WORKSPACE} \
+          -GNinja \
+          -DVCPKG_TARGET_TRIPLET=${{ matrix.arch }}-windows-static \
+          -DCMAKE_TOOLCHAIN_FILE="c:\vcpkg\scripts\buildsystems\vcpkg.cmake" \
+          -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \
+          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DOPTION_SURVEY_KEY=${{ inputs.survey_key }} \
+          -DWINDOWS_CERTIFICATE_COMMON_NAME="${WINDOWS_CERTIFICATE_COMMON_NAME}" \
+          # EOF
+        echo "::endgroup::"
+
+        echo "::group::Build"
+        cmake --build . --target openttd
+        echo "::endgroup::"
+      env:
+        WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }}
+
+    - name: Create bundles
+      shell: bash
+      run: |
+        cd ${GITHUB_WORKSPACE}/build
+        echo "::group::Run CPack"
+        cpack
+        echo "::endgroup::"
+
+        echo "::group::Prepare PDB to be bundled"
+        PDB=$(ls bundles/*.zip | cut -d/ -f2 | sed 's/.zip$/.pdb/')
+        cp openttd.pdb bundles/${PDB}
+        xz -9 bundles/${PDB}
+        echo "::endgroup::"
+
+        echo "::group::Cleanup"
+        # Remove the sha256 files CPack generates; we will do this ourself at
+        # the end of this workflow.
+        rm -f bundles/*.sha256
+        echo "::endgroup::"
+
+    - name: Sign installer
+      if: inputs.is_tag == 'true'
+      shell: bash
+      # If this is run on a fork, there may not be a certificate set up - continue in this case
+      continue-on-error: true
+      run: |
+        cd ${GITHUB_WORKSPACE}/build/bundles
+        ../../os/windows/sign.bat *.exe "${WINDOWS_CERTIFICATE_COMMON_NAME}"
+      env:
+        WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }}
+
+    - name: Store bundles
+      uses: actions/upload-artifact@v3
+      with:
+        name: openttd-windows-${{ matrix.arch }}
+        path: build/bundles
+        retention-days: 5