Fix the Android emulator gate and update every workflow

.github/workflows/browser-docker.yml

@@ -4,26 +4,29 @@ name: Docker Image CI
 on:
    workflow_dispatch: {}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up timestamp
         run: echo "TIMESTAMP=$(date +%s)" >> $GITHUB_ENV
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
            username: ${{ secrets.DOCKERHUB_USERNAME }}
            password: ${{ secrets.DOCKERHUB_TOKEN }} 
 
       - name: Build and push multi-platform image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Avalonia.Browser.Dockerfile

.github/workflows/dotnet.yml

@@ -1,6 +1,3 @@
-# This workflow will build a .NET project
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-net
-
 name: .NET build
 
 on:
@@ -9,31 +6,41 @@ on:
   pull_request:
     branches: [ "master" ]
 
+# A newer push to the same branch makes the previous run's answer irrelevant.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: 10.0.x
 
+    # Without libfontconfig1 libSkiaSharp fails to load and the test host crashes
+    # rather than reporting failures.
     - name: Install native dependencies for SkiaSharp
       run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libfontconfig1
 
     - name: Set up JDK 17
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v6
       with:
         java-version: '17'
         distribution: 'temurin'
 
     - name: Setup Android SDK
-      uses: android-actions/setup-android@v3
+      uses: android-actions/setup-android@v4
 
     - name: Install workloads
-      run:  dotnet workload restore 
+      run: dotnet workload restore
 
     - name: Restore dependencies
       run: dotnet restore
@@ -47,60 +54,87 @@ jobs:
   android-smoke:
     name: Android startup smoke test
     runs-on: ubuntu-latest
-    timeout-minutes: 25
+    timeout-minutes: 45
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: 10.0.x
 
     - name: Set up JDK 17
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v6
       with:
         java-version: '17'
         distribution: 'temurin'
 
     - name: Setup Android SDK
-      uses: android-actions/setup-android@v3
+      uses: android-actions/setup-android@v4
 
     - name: Restore Android workload
       run: dotnet workload restore GameEngine.Runner.Avalonia/GameEngine.Runner.Avalonia.Android/GameEngine.Runner.Avalonia.Android.csproj
 
     - name: Publish Android APK
       run: dotnet publish GameEngine.Runner.Avalonia/GameEngine.Runner.Avalonia.Android/GameEngine.Runner.Avalonia.Android.csproj --configuration Release
 
-    - name: Stage APK and reclaim emulator space
+    - name: Stage APK
       run: |
         mkdir -p artifacts/android-apk
         find GameEngine.Runner.Avalonia/GameEngine.Runner.Avalonia.Android/bin/Release -type f -name '*-Signed.apk' -exec cp {} artifacts/android-apk/ \;
-        find . -type d \( -name bin -o -name obj \) -prune -exec rm -rf {} +
-        dotnet nuget locals all --clear
+        ls -la artifacts/android-apk
+
+    # The emulator needs room for its system image and userdata partition, and a runner
+    # that has just built .NET and Android has very little left. Reported either way, so a
+    # failure to boot can be told apart from a failure to run.
+    - name: Reclaim disk for the emulator
+      run: |
+        echo "::group::Before"
+        df -h /
+        echo "::endgroup::"
+        sudo rm -rf \
+          /usr/local/lib/android/sdk/ndk \
+          /usr/local/lib/android/sdk/cmake \
+          /opt/ghc /usr/local/.ghcup \
+          /usr/share/swift \
+          /opt/hostedtoolcache/CodeQL \
+          /usr/local/share/powershell \
+          /usr/local/share/boost || true
+        docker image prune -af || true
+        find . -type d \( -name bin -o -name obj \) -prune -exec rm -rf {} + || true
+        dotnet nuget locals all --clear || true
+        echo "::group::After"
+        df -h /
+        echo "::endgroup::"
 
     - name: Enable KVM
       run: |
         echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
         sudo udevadm control --reload-rules
         sudo udevadm trigger --name-match=kvm
+        ls -l /dev/kvm
 
+    # aosp_atd is the lightest image that can run the app — it needs no Google APIs — and the
+    # emulator is given the resources the runner actually has rather than a starved subset,
+    # which is what stopped it booting on the August 2026 runner images.
     - name: Launch app and wait for first rendered frame
-      uses: ReactiveCircus/android-emulator-runner@4c44018e59b437e86cdfc41da381398f93ed8808
+      uses: ReactiveCircus/android-emulator-runner@c9c93e6ba9c4194322e114c40970d5983d9a07cc # v2.38.0
       with:
         api-level: 35
-        target: google_atd
+        target: aosp_atd
         arch: x86_64
         profile: pixel_6
-        cores: 2
-        ram-size: 2048M
-        disk-size: 2048M
-        emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none -no-snapshot -no-metrics -partition-size 2048
+        cores: 4
+        ram-size: 4096M
+        disk-size: 8192M
+        emulator-boot-timeout: 900
+        emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none -camera-front none -no-snapshot -no-metrics
         script: bash .github/scripts/android-smoke-test.sh
 
     - name: Upload Android smoke diagnostics
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: android-smoke-diagnostics
         path: artifacts/android-smoke
@@ -111,10 +145,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: 10.0.x
 

.github/workflows/nuget.yml

@@ -16,12 +16,19 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+
+concurrency:
+  group: nuget-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   pack:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
 
@@ -61,7 +68,7 @@ jobs:
             dotnet pack "$project" -c Release -p:Version=${{ steps.version.outputs.version }} -o packages
           done
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: nuget-packages
           path: packages/*

.github/workflows/publish.yml

@@ -15,6 +15,12 @@ on:
 permissions:
   contents: write
 
+# A release in flight is never worth cancelling; a second one for the same tag is a mistake
+# worth blocking rather than racing.
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   version:
     runs-on: ubuntu-latest
@@ -48,8 +54,8 @@ jobs:
             rid: osx-arm64
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
 
@@ -68,7 +74,7 @@ jobs:
             tar -czf "../${dir%/}.tar.gz" "${dir%/}"
           done
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: desktop-${{ matrix.rid }}
           path: '*.tar.gz'
@@ -77,15 +83,15 @@ jobs:
     needs: version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: temurin
-      - uses: android-actions/setup-android@v3
+      - uses: android-actions/setup-android@v4
 
       - name: Install Android workload
         run: dotnet workload restore GameEngine.Runner.Avalonia/GameEngine.Runner.Avalonia.Android/GameEngine.Runner.Avalonia.Android.csproj
@@ -98,7 +104,7 @@ jobs:
           mkdir -p out
           find GameEngine.Runner.Avalonia/GameEngine.Runner.Avalonia.Android/bin/Release -name '*-Signed.apk' -exec cp {} out/ \;
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: android
           path: out/*.apk
@@ -107,8 +113,8 @@ jobs:
     needs: version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
 
@@ -124,7 +130,7 @@ jobs:
           cd artifacts/browser/wwwroot
           zip -r ../../../browser-wwwroot.zip .
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: browser
           path: browser-wwwroot.zip
@@ -133,13 +139,13 @@ jobs:
     needs: version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@v7
         with:
           context: .
           file: Avalonia.Browser.Dockerfile
@@ -154,11 +160,11 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: artifacts
           merge-multiple: true
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@e598afbe1493e6b1bafb1f389cabb956eab91231 # v3.0.3
         with:
           name: ${{ needs.version.outputs.version }}
           files: artifacts/**/*