mux: MKV read-back, FMKV header metadata, live-stream stop handling

MKV read-back carries display shape, colour, frame rate, content
encodings and BCP47 language, and drops malformed blocks with a count.
The FMKV header carries display aspect, CICP, labels, chapters and
format. Live reads refuse a zero read batch (E9085) and treat a stopped
read as a stop. freemkv-unlock becomes a version dep with a git-tag
override; dependency bumps (#27, #28); LPCM keeps its source bit depth; 1.8.0
changelog.

.github/dependabot.yml

@@ -1,14 +1,12 @@
 version: 2
 
-# NOTE: the cargo updater cannot resolve the out-of-repo `freemkv-unlock` path
-# dep on dev, so it opens no PRs; advisory coverage there is cargo-deny (ci.yml).
-#
 # Dependency updates land on `dev`, never on `main`.
 #
-# `main` here is a RELEASE POINTER that moves to each tag. A bot
-# commit on it would put work there that no tag contains, which is exactly the
-# state that aborted the 1.6.2 cascade at the last step -- so pointing
-# Dependabot at main would recreate that failure on a schedule.
+# `main` here is a RELEASE POINTER that freemkv's release-orchestrate.yml
+# moves to each tag. A bot commit on it would put work there that no tag
+# contains, which is exactly the state that aborted the 1.6.2 cascade at the
+# last step -- so pointing Dependabot at main would recreate that failure on a
+# schedule.
 updates:
   - package-ecosystem: cargo
     directory: /
@@ -16,9 +14,7 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
-    # One PR per week for the routine bumps instead of one per crate. Eight
-    # repos times a handful of crates is a volume nobody reads, and an
-    # unread PR queue is indistinguishable from no updates at all.
+    # One PR per week for the routine bumps instead of one per crate.
     groups:
       minor-and-patch:
         update-types:
@@ -26,18 +22,14 @@ updates:
           - patch
     ignore:
       # The freemkv crates depend on each other by GIT TAG, re-pinned by
-      # release-orchestrate.yml as part of the release commit. Dependabot cannot see that
-      # cascade, so a PR bumping one of these would fight the release process
-      # and could pin a version whose tag does not exist yet.
+      # release-orchestrate.yml in the release commit. A bot bump would fight
+      # the release cascade and could pin a tag that does not exist yet.
       - dependency-name: freemkv-unlock
       - dependency-name: libfreemkv
       - dependency-name: freemkv-keysources
       - dependency-name: freemkv-i18n
       - dependency-name: freemkv-engine
 
-  # The workflows are now real infrastructure -- the release cascade, the
-  # cross-platform hash matrix, the disc gate -- so their actions need the same
-  # attention as the crates.
   - package-ecosystem: github-actions
     directory: /
     target-branch: dev
@@ -50,17 +42,11 @@ updates:
           - minor
           - patch
     ignore:
-      # NOT a dependency: `dtolnay/rust-toolchain` is versioned by the RUST
-      # release it installs, and CI selects the toolchain through the `toolchain:`
-      # input on the @master/@stable branch refs, so a lint that passes on a
-      # newer default cannot pass CI by accident.
-      #
-      # Dependabot reads its tags as semver and proposed 1.97.0 -> 1.100.0,
-      # a Rust version that does not exist. Every such PR 404s on toolchain
-      # download across all eight repos, and they regenerate weekly -- eight
-      # permanently-red PRs that promote.yml then has to special-case when it
-      # decides whether dev is green.
-      #
-      # Bumping the toolchain is a deliberate, all-eight-repos change, made by
-      # hand. There is nothing here for a bot.
+      # Versioned by the Rust release it installs; CI picks the toolchain via
+      # `toolchain:` on @master/@stable. Dependabot proposes Rust versions that
+      # do not exist. Toolchain bumps are a deliberate all-repo change.
       - dependency-name: dtolnay/rust-toolchain
+      # The org's own reusable workflows/actions. @v1 and @v2 are independent
+      # moving tags (v2 is only the comment guard), not semver releases: a
+      # "bump" from v1 to v2 would move a caller onto an OLDER guard.
+      - dependency-name: "freemkv/.github*"

.github/workflows/ci.yml

@@ -65,6 +65,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: stable
@@ -92,6 +94,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ needs.resolve-msrv.outputs.v }}
@@ -123,6 +127,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ needs.resolve-msrv.outputs.v }}
@@ -150,13 +156,15 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: stable
-      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
-        with:
-          command: check advisories bans licenses sources
-          manifest-path: libfreemkv/Cargo.toml
+      - uses: taiki-e/install-action@cargo-deny
+      # Run from the repo dir so the generated .cargo/config.toml path patches apply.
+      - run: cargo deny --all-features check advisories bans licenses sources
+        working-directory: libfreemkv
 
   # dev is the FAST lane: the platform jobs run on qa/main only (qa.yml also
   # covers macOS/Windows). `if` SKIPS (does not queue) so a never-scheduled job
@@ -173,6 +181,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ needs.resolve-msrv.outputs.v }}
@@ -194,6 +204,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ needs.resolve-msrv.outputs.v }}
@@ -230,6 +242,7 @@ jobs:
           freemkv-keysources = { path = "../freemkv-keysources" }
           freemkv-engine = { path = "../freemkv-engine" }
           freemkv-i18n = { path = "../freemkv-i18n" }
+          freemkv-unlock = { path = "../freemkv-unlock" }
           EOF
           done
       # freemkv's app build (`--features gui`) compiles a GTK4 + libadwaita
@@ -274,6 +287,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ needs.resolve-msrv.outputs.v }}

.github/workflows/doc-links.yml

@@ -1,9 +1,9 @@
 name: doc-links
 
 # Thin caller → the canonical reusable doc-links gate in freemkv/.github.
-# libfreemkv path-deps freemkv-unlock, so the reusable checks it out as a sibling
-# (no [patch] needed — the layout resolves the path dep) and resolves the
-# toolchain from rust-version.
+# libfreemkv deps freemkv-unlock by version (git-tag override), so the reusable
+# checks it out as a sibling and path-patches it, and resolves the toolchain
+# from rust-version.
 on: [push, pull_request]
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -15,3 +15,4 @@ jobs:
     with:
       self: libfreemkv
       checkout: freemkv-unlock
+      patch: freemkv-unlock

.github/workflows/ffmpeg-validation.yml

@@ -22,6 +22,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - name: Read the crate's MSRV
         id: msrv
         working-directory: libfreemkv

.github/workflows/qa.yml

@@ -106,6 +106,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ needs.resolve-msrv.outputs.v }}
@@ -137,6 +139,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       # clippy runs on stable (matches ci.yml's lint job); build/test stay on
       # the MSRV pin. See ci.yml for why the lint toolchain need not be the MSRV.
       - uses: dtolnay/rust-toolchain@stable
@@ -164,6 +168,8 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: freemkv-unlock
+          patch: freemkv-unlock
+          self: libfreemkv
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ needs.resolve-msrv.outputs.v }}