From d973fde40b83815dd2b4327a8883a372c47ad98a Mon Sep 17 00:00:00 2001
From: 1e1 <1e1@users.noreply.github.com>
Date: Mon, 29 Jun 2026 21:22:57 +0200
Subject: [PATCH] CI: verify MoltenVK download, cancel superseded runs, fix
 deprecated set-output

- Verify the SHA-256 of the downloaded MoltenVK tarball before extracting it (macOS jobs).

- Add concurrency cancellation so superseded PR/push builds stop instead of running the full matrix to completion.

- Replace the removed ::set-output workflow command with $GITHUB_OUTPUT in the release version calculation.
---
 .github/workflows/build.yml                     | 1 +
 .github/workflows/build_check.yml               | 5 +++++
 .github/workflows/determine_release_version.yml | 3 +--
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3aaf9a93..c75abec7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -239,6 +239,7 @@ jobs:
     - name: "Install molten-vk"
       run: |
         curl -L -O https://github.com/KhronosGroup/MoltenVK/releases/download/v1.4.1/MoltenVK-macos-privateapi.tar
+        echo "5e662d77f7f280d9bd692ac5d626831198f404e28b0c8d4d11aac04bff8ff418  MoltenVK-macos-privateapi.tar" | shasum -a 256 -c -
         tar xf MoltenVK-macos-privateapi.tar
         sudo mkdir -p /usr/local/lib
         sudo cp MoltenVK/MoltenVK/dynamic/dylib/macOS/libMoltenVK.dylib /usr/local/lib
diff --git a/.github/workflows/build_check.yml b/.github/workflows/build_check.yml
index 5d24b0c6..35515652 100644
--- a/.github/workflows/build_check.yml
+++ b/.github/workflows/build_check.yml
@@ -13,6 +13,11 @@ on:
     branches:
       - main
 
+# Cancel superseded runs for the same ref to save CI minutes
+concurrency:
+  group: build-check-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     uses: ./.github/workflows/build.yml
diff --git a/.github/workflows/determine_release_version.yml b/.github/workflows/determine_release_version.yml
index a2efcd17..3222bd58 100644
--- a/.github/workflows/determine_release_version.yml
+++ b/.github/workflows/determine_release_version.yml
@@ -45,8 +45,7 @@ jobs:
             exit 1
           fi
 
-          echo "::set-output name=tag::$ALL_TAGS"
-          # echo "tag=$ALL_TAGS" >> $GITHUB_STATE
+          echo "tag=$ALL_TAGS" >> "$GITHUB_OUTPUT"
 
       - name: Calculate next semver minor
         id: calculate_next_version