Make ConflictSet non-copyable in C++98/C++03

`ConflictSet(const ConflictSet&)` and `operator=(const ConflictSet&)` were
only deleted for C++11 and later. In C++98/C++03 the compiler implicitly
generated public copy operations, so copying a ConflictSet shared the opaque
`Impl*` and caused a double-free on destruction.

Declare both operations private and leave them undefined when
`__cplusplus <= 199711L`, matching the standard pre-C++11 idiom for
move-only types. Guard the declarations with `defined(__cplusplus)` so
they are not exposed to C90 compilation units.

Closes #48

.gitea/workflows/ci.yml

@@ -2,38 +2,62 @@ name: CI
 
 on: [push, pull_request]
 
-env:
-  CC: clang
-  CXX: clang++
-
 jobs:
-  pre-commit:
+  build-image:
-    runs-on: ubuntu-latest-amd64
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest-amd64
+            arch: amd64
+          - runner: ubuntu-latest-arm64
+            arch: arm64
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/cache@v4
+      - name: Log in to registry
-        with:
+        env:
-          path: /var/cache/apt/archives
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          key: apt-amd64-${{ hashFiles('.gitea/workflows/ci.yml') }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Install dependencies
         run: |
-          sudo apt-get update -qq
+          echo "$REGISTRY_TOKEN" \
-          sudo apt-get install -y \
+            | docker login -u "$REGISTRY_USER" --password-stdin git.weaselab.dev
-            clang git nodejs pre-commit
 
-      - uses: actions/cache@v4
+      - name: Build and push image if changed
-        with:
+        run: |
-          path: ~/.cache/pre-commit
+          image=git.weaselab.dev/weaselab/conflict-set-ci
-          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+          hash="$(sha256sum Dockerfile .pre-commit-config.yaml | sha256sum | cut -c 1-16)"
+          latest="$image:latest-${{ matrix.arch }}"
+          current="$(docker buildx imagetools inspect "$latest" \
+            --format '{{index .Image.Config.Labels "dev.weaselab.ci-hash"}}' 2> /dev/null || true)"
+          if [ "$current" = "$hash" ]; then
+            echo "$latest is up to date"
+          else
+            docker build --push --label "dev.weaselab.ci-hash=$hash" -t "$latest" .
+          fi
+
+  pre-commit:
+    needs: build-image
+    runs-on: ubuntu-latest-amd64
+    container:
+      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-amd64
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
 
       - name: Run pre-commit
+        env:
+          # use the hooks pre-installed in the image
+          HOME: /tmp
         run: |
           git config --global --add safe.directory "$PWD"
           pre-commit run --all-files --show-diff-on-failure
 
   test:
+    needs: build-image
     strategy:
       fail-fast: false
       matrix:
@@ -47,23 +71,14 @@ jobs:
           - name: gcc
             cmake_args: -DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++
     runs-on: ubuntu-latest-amd64
+    container:
+      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-amd64
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/cache@v4
-        with:
-          path: /var/cache/apt/archives
-          key: apt-amd64-${{ hashFiles('.gitea/workflows/ci.yml') }}
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y \
-            build-essential ccache clang cmake gcc g++ \
-            libc6-dbg llvm mold ninja-build python3 valgrind zstd
-          sudo curl -Ls "https://dl.min.io/client/mc/release/linux-amd64/mc" \
-            -o /usr/local/bin/mc && sudo chmod +x /usr/local/bin/mc
-
       - uses: actions/cache@v4
         with:
           path: .ccache
@@ -105,6 +120,7 @@ jobs:
             | tee -a "$GITHUB_STEP_SUMMARY"
 
   release:
+    needs: build-image
     strategy:
       fail-fast: false
       matrix:
@@ -114,25 +130,14 @@ jobs:
           - runner: ubuntu-latest-arm64
             arch: arm64
     runs-on: ${{ matrix.runner }}
+    container:
+      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-${{ matrix.arch }}
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/cache@v4
-        with:
-          path: /var/cache/apt/archives
-          key: apt-${{ matrix.arch }}-${{ hashFiles('.gitea/workflows/ci.yml') }}
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y \
-            biber build-essential ccache clang cmake devscripts \
-            latexmk libc6-dbg llvm mold ninja-build rpm \
-            texlive-bibtex-extra texlive-fonts-recommended \
-            texlive-latex-extra texlive-pictures valgrind zstd
-          sudo curl -Ls "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/mc" \
-            -o /usr/local/bin/mc && sudo chmod +x /usr/local/bin/mc
-
       - uses: actions/cache@v4
         with:
           path: .ccache
@@ -183,6 +188,9 @@ jobs:
           dest="minio/jenkins/conflict-set/${{ gitea.run_number }}/release-${{ matrix.arch }}/"
           zstd build/Testing/*/Test.xml
           mc cp build/Testing/*/Test.xml.zst "$dest"
+          # This step runs even when a previous step failed, to upload test
+          # results. The packages may never have been built though, so skip
+          # them if they're missing.
           if compgen -G "build/*.deb" > /dev/null; then
             mc cp build/*.deb "$dest"
           fi
@@ -201,24 +209,16 @@ jobs:
             | tee -a "$GITHUB_STEP_SUMMARY"
 
   coverage:
+    needs: build-image
     runs-on: ubuntu-latest-amd64
+    container:
+      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-amd64
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/cache@v4
-        with:
-          path: /var/cache/apt/archives
-          key: apt-amd64-${{ hashFiles('.gitea/workflows/ci.yml') }}
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y \
-            build-essential ccache clang cmake gcovr \
-            libc6-dbg llvm mold ninja-build python3 valgrind zstd
-          sudo curl -Ls "https://dl.min.io/client/mc/release/linux-amd64/mc" \
-            -o /usr/local/bin/mc && sudo chmod +x /usr/local/bin/mc
-
       - uses: actions/cache@v4
         with:
           path: .ccache