Rearchitect vcpkg port for official submission

.gitattributes

@@ -87,6 +87,12 @@ GNUmakefile             text
 *.xml                   text
 *.cfg                   text
 
+## Exclude vcpkg port and test scaffolding from GitHub tarballs.
+## This avoids a chicken-and-egg problem: the portfile contains a SHA512
+## of the tarball, so changes to the portfile must not change the tarball.
+tools/ports/            export-ignore
+tests/vcpkg/            export-ignore
+
 ## Self-reference =)
 .gitignore              text
 .gitattributes          text

.github/workflows/build-android.yml

@@ -17,11 +17,18 @@ on:
     - main
     - dev
 
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
+
+# Least-privilege GITHUB_TOKEN scope: this workflow only checks out source
+# and builds + uploads artifacts (upload-artifact uses its own per-run SAS,
+# not GITHUB_TOKEN). Explicit block satisfies CodeQL rule
+# actions/missing-workflow-permissions if Actions analysis is enabled.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     runs-on: windows-latest

.github/workflows/build-ios-mac.yml

@@ -20,6 +20,12 @@ on:
   - cron: 0 2 * * 1-5
 
 
+# Least-privilege GITHUB_TOKEN scope: this workflow only checks out source
+# and runs the iOS/macOS build matrix. Explicit block satisfies CodeQL rule
+# actions/missing-workflow-permissions if Actions analysis is enabled.
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}

.github/workflows/build-posix-latest.yml

@@ -20,6 +20,12 @@ on:
   - cron: 0 2 * * 1-5
 
 
+# Least-privilege GITHUB_TOKEN scope: this workflow only checks out source
+# and runs the Linux/Mac build matrix. Explicit block satisfies CodeQL rule
+# actions/missing-workflow-permissions if Actions analysis is enabled.
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}

.github/workflows/build-ubuntu-2204.yml

@@ -20,6 +20,12 @@ on:
   - cron: 0 2 * * 1-5
 
 
+# Least-privilege GITHUB_TOKEN scope: this workflow only checks out source
+# and runs the Ubuntu 22.04 build. Explicit block satisfies CodeQL rule
+# actions/missing-workflow-permissions if Actions analysis is enabled.
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}

.github/workflows/build-windows-vs2022.yaml

@@ -13,6 +13,12 @@ on:
     - main
     - dev
 
+# Least-privilege GITHUB_TOKEN scope: this workflow only checks out source
+# and runs the Visual Studio 2022 build. Explicit block satisfies CodeQL
+# rule actions/missing-workflow-permissions if Actions analysis is enabled.
+permissions:
+  contents: read
+
 jobs:
   build:
 

.github/workflows/codeql-analysis.yml

@@ -56,14 +56,12 @@ jobs:
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Build C++
       env:
-        SKIP_ARM_BUILD: 1
-        SKIP_ARM64_BUILD: 1
         PlatformToolset: v143
         VSTOOLS_VERSION: vs2022
         WindowsSDKVersion: 10.0.22621.0
       shell: cmd
       if: matrix.language == 'cpp'
-      run: build-all.bat
+      run: build-codeql-cpp.bat
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl

.github/workflows/spellcheck.yml

@@ -6,6 +6,12 @@ on:
   pull_request:
     branches: [ master, main ]
 
+# Least-privilege GITHUB_TOKEN scope: misspell only reads .md/.txt files
+# (no PR comments, no status updates, no package writes). Explicit block
+# satisfies CodeQL "actions/missing-workflow-permissions" and keeps the
+# token narrowly scoped if Actions analysis is enabled here later.
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -22,9 +28,22 @@ jobs:
       continue-on-error: true
 
     - name: install misspell
+      env:
+        # misspell v0.3.4 linux 64-bit tarball SHA256 (from upstream
+        # release checksums.txt). Pinning version + verifying SHA
+        # avoids executing an unpinned bootstrap script from a floating
+        # ref (the prior 'curl https://git.io/misspell | sh' pattern is
+        # a supply-chain risk) and keeps CI reproducible. Bump
+        # deliberately when upstream releases.
+        MISSPELL_VERSION: "0.3.4"
+        MISSPELL_SHA256: "afd95caf1eecc72ff382791e00b3b11523a20b0579d95e2295c1c043688743d5"
       run: |
-        curl -L -o ./install-misspell.sh https://git.io/misspell
-        sh ./install-misspell.sh
+        curl -fsSL -o misspell.tar.gz \
+          "https://github.com/client9/misspell/releases/download/v${MISSPELL_VERSION}/misspell_${MISSPELL_VERSION}_linux_64bit.tar.gz"
+        echo "${MISSPELL_SHA256}  misspell.tar.gz" | sha256sum -c -
+        mkdir -p bin
+        tar -xzf misspell.tar.gz -C bin misspell
+        rm misspell.tar.gz
 
     - name: run misspell
       run: |

.github/workflows/test-vcpkg.yml

@@ -0,0 +1,111 @@
+name: Vcpkg port tests
+
+on:
+  push:
+    branches:
+    - master
+    - main
+    - dev
+    - dev/*
+    - release/*
+    - buildme/*
+
+  pull_request:
+    branches:
+    - master
+    - main
+    - dev
+
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  windows:
+    runs-on: windows-latest
+    name: Windows (x64-windows-static)
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Bootstrap vcpkg
+      run: |
+        git clone https://github.com/microsoft/vcpkg.git ${{ runner.temp }}\vcpkg
+        & "${{ runner.temp }}\vcpkg\bootstrap-vcpkg.bat" -disableMetrics
+      shell: pwsh
+
+    - name: Run vcpkg port test
+      run: .\tests\vcpkg\test-vcpkg-windows.ps1 -VcpkgRoot "${{ runner.temp }}\vcpkg"
+      shell: pwsh
+
+  linux:
+    runs-on: ubuntu-latest
+    name: Linux (x64-linux)
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Bootstrap vcpkg
+      run: |
+        git clone https://github.com/microsoft/vcpkg.git "${{ runner.temp }}/vcpkg"
+        "${{ runner.temp }}/vcpkg/bootstrap-vcpkg.sh" -disableMetrics
+
+    - name: Run vcpkg port test
+      env:
+        VCPKG_ROOT: ${{ runner.temp }}/vcpkg
+      run: |
+        chmod +x tests/vcpkg/test-vcpkg-linux.sh
+        ./tests/vcpkg/test-vcpkg-linux.sh
+
+  macos:
+    runs-on: macos-latest
+    name: macOS (native)
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Bootstrap vcpkg
+      run: |
+        git clone https://github.com/microsoft/vcpkg.git "${{ runner.temp }}/vcpkg"
+        "${{ runner.temp }}/vcpkg/bootstrap-vcpkg.sh" -disableMetrics
+
+    - name: Run vcpkg port test
+      env:
+        VCPKG_ROOT: ${{ runner.temp }}/vcpkg
+      run: |
+        chmod +x tests/vcpkg/test-vcpkg-macos.sh
+        ./tests/vcpkg/test-vcpkg-macos.sh
+
+  ios:
+    runs-on: macos-latest
+    name: iOS (arm64-ios cross-compile)
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Bootstrap vcpkg
+      run: |
+        git clone https://github.com/microsoft/vcpkg.git "${{ runner.temp }}/vcpkg"
+        "${{ runner.temp }}/vcpkg/bootstrap-vcpkg.sh" -disableMetrics
+
+    - name: Run vcpkg port test (device)
+      env:
+        VCPKG_ROOT: ${{ runner.temp }}/vcpkg
+      run: |
+        chmod +x tests/vcpkg/test-vcpkg-ios.sh
+        ./tests/vcpkg/test-vcpkg-ios.sh
+
+  android:
+    runs-on: ubuntu-latest
+    name: Android (arm64-v8a cross-compile)
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Bootstrap vcpkg
+      run: |
+        git clone https://github.com/microsoft/vcpkg.git "${{ runner.temp }}/vcpkg"
+        "${{ runner.temp }}/vcpkg/bootstrap-vcpkg.sh" -disableMetrics
+
+    - name: Run vcpkg port test
+      env:
+        VCPKG_ROOT: ${{ runner.temp }}/vcpkg
+      run: |
+        chmod +x tests/vcpkg/test-vcpkg-android.sh
+        ./tests/vcpkg/test-vcpkg-android.sh arm64-v8a

.github/workflows/test-win-latest.yml

@@ -20,6 +20,12 @@ on:
   - cron: 0 2 * * 1-5
 
 
+# Least-privilege GITHUB_TOKEN scope: this workflow only checks out source
+# and runs Windows unit/functional tests. Explicit block satisfies CodeQL
+# rule actions/missing-workflow-permissions if Actions analysis is enabled.
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}

.gitignore

@@ -405,3 +405,6 @@ build/.cmake/api/v1/query/client-vscode/query.json
 
 #Test files generated locally.
 *.ses
+
+# vcpkg test build directories
+tests/vcpkg/build-*/

Android.bp

@@ -81,6 +81,7 @@ cc_library_shared {
         "lib/http/HttpClient_Android.cpp"
     ],
     local_include_dirs: [
+        ".",
         "lib",
         "lib/include/public",
         "lib/include",