mirror of
https://github.com/freemkv/libfreemkv.git
synced 2026-10-07 18:13:10 +00:00
Matthew Jackson
4031513574
Lands the code-audit branches for aacs, css, keys, labels, udf, ifo and dvd, bdnav/mpls/clpi, disc/bluray, extract, io, scsi, the mkv, mp4, network and mpg muxers, the audio and video codecs, and CI. Fixes include MKB and FMTS validation, UDF bounds, IFO fallback to the BUP, DTS Express framing, MPEG-2 field pairing and mpg re-basing; the rest pins existing behaviour with tests.
75 lines
2.9 KiB
YAML
75 lines
2.9 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
# NOT the release-candidate tags. Every push to `qa` stamps a
|
|
# v<version>-rc<N> so a run can be named, and 'v*' matches those too —
|
|
# which would have this workflow build and PUBLISH a GitHub release for
|
|
# every candidate, including the red ones.
|
|
- '!v*-rc*'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- name: Verify Cargo.toml version matches tag
|
|
run: |
|
|
CARGO_VER="v$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')"
|
|
if [ "$CARGO_VER" != "${{ github.ref_name }}" ]; then
|
|
echo "::error::Cargo.toml says $CARGO_VER but tag is ${{ github.ref_name }}"
|
|
exit 1
|
|
fi
|
|
echo "Version match: $CARGO_VER"
|
|
|
|
# Tests run as a PARALLEL TRIPWIRE: they fail the run if they fail, but the
|
|
# release job does NOT `needs:` this job. The tag decision was already
|
|
# gated by CI (ci.yml on dev, then a green qa.yml on the same commit). Binary consumers
|
|
# (freemkv/autorip/bdemu) git-tag-pin libfreemkv and therefore start building
|
|
# the instant this tag exists — so this test job must NOT sit on their
|
|
# critical path.
|
|
test:
|
|
needs: verify
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- id: msrv
|
|
shell: bash
|
|
run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
|
|
- uses: dtolnay/rust-toolchain@master
|
|
with:
|
|
toolchain: ${{ steps.msrv.outputs.v }}
|
|
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
|
|
# Cargo.lock is now committed (issue #15), but --locked is still omitted:
|
|
# the sibling path-patch layout resolves the freemkv crates as path
|
|
# packages, which --locked can't satisfy.
|
|
- run: cargo test
|
|
|
|
# NOTE: there is no crates.io publish job. libfreemkv is git-tag-only
|
|
# (`package.publish = false` — it git-deps the firmware crate freemkv-unlock,
|
|
# which never ships to crates.io). Every consumer git-tag-pins libfreemkv via
|
|
# a committed [patch.crates-io]; the git tag itself IS the release artifact.
|
|
# A `cargo publish` here fails hard on `publish = false`, so it was removed.
|
|
|
|
release:
|
|
# Only needs `verify`; the GitHub Release can be cut as soon as the version
|
|
# check passes, in parallel with test.
|
|
needs: verify
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- name: Create GitHub Release
|
|
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
|
|
with:
|
|
generate_release_notes: true
|