Merge remote-tracking branch 'origin/master' into claude/dash-clearkey-shaka

# Conflicts: # CLAUDE.md # libs/ui/playback/src/lib/web-player-view/web-player-view.component.ts
2026-10-11 02:46:16 -08:00 · 2026-07-24 18:44:22 +02:00
commit 5b2dd3b8b0
@@ -0,0 +1,92 @@
+name: Cleanup PR Draft Release
+
+on:
+    pull_request:
+        types: [closed]
+
+# contents: write — delete the draft release; actions: write — cancel the
+# closed PR's still-running build workflow before deleting.
+permissions:
+    actions: write
+    contents: write
+
+jobs:
+    delete-draft:
+        name: Delete PR draft release
+        # Fork PRs never get a draft (the release job skips them) and their
+        # GITHUB_TOKEN is read-only regardless of the permissions block, so
+        # there is nothing to cancel or delete.
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        runs-on: ubuntu-latest
+        steps:
+            # A closed PR can be reopened while this job is still queued or
+            # waiting; a reopened PR's fresh build must not be cancelled and
+            # its draft must not be deleted. Check the live state up front
+            # (and again right before deleting below).
+            - name: Check PR is still closed
+              id: pr-state
+              env:
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  PR_NUMBER: ${{ github.event.pull_request.number }}
+              run: |
+                  set -euo pipefail
+                  echo "state=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq '.state')" >> "${GITHUB_OUTPUT}"
+
+            # A build for this PR may still be running and would recreate the
+            # rolling draft after we delete it. Cancel those runs (dead work
+            # for a closed PR anyway) and wait for them to wind down. The
+            # release job additionally re-checks the live PR state, so this
+            # wait is defense in depth, not the only guard.
+            - name: Cancel in-progress builds for the closed PR
+              if: steps.pr-state.outputs.state == 'closed'
+              env:
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
+              run: |
+                  set -euo pipefail
+
+                  # --event pull_request: a manually dispatched build on the
+                  # same branch is not this PR's work and must not be cancelled.
+                  list_active_runs() {
+                      gh run list --repo "${GITHUB_REPOSITORY}" \
+                          --workflow 'Build and Make Electron App' \
+                          --branch "${HEAD_BRANCH}" \
+                          --event pull_request \
+                          --json databaseId,status \
+                          --jq '.[] | select(.status == "queued" or .status == "in_progress" or .status == "waiting" or .status == "requested" or .status == "pending") | .databaseId'
+                  }
+
+                  for run_id in $(list_active_runs); do
+                      echo "Cancelling run ${run_id}"
+                      gh run cancel "${run_id}" --repo "${GITHUB_REPOSITORY}" || true
+                  done
+
+                  # Cancellation is asynchronous; poll until the runs settle.
+                  for _ in $(seq 1 18); do
+                      if [ -z "$(list_active_runs)" ]; then
+                          break
+                      fi
+                      sleep 10
+                  done
+
+            # Draft releases have no real git tag, so a lookup via
+            # releases/tags/<tag> returns 404. List releases and match the
+            # draft by its stored tag_name (test-pr-<n>) instead. The PR state
+            # is re-checked one last time right before deleting, in case the
+            # PR was reopened during the cancellation wait above.
+            - name: Delete draft release for closed PR
+              if: steps.pr-state.outputs.state == 'closed'
+              env:
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  PR_NUMBER: ${{ github.event.pull_request.number }}
+              run: |
+                  set -euo pipefail
+
+                  if [ "$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq '.state')" != "closed" ]; then
+                      echo "PR #${PR_NUMBER} was reopened; keeping its draft."
+                      exit 0
+                  fi
+
+                  gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" --paginate \
+                      --jq ".[] | select(.draft and .tag_name == \"test-pr-${PR_NUMBER}\") | .id" |
+                      xargs -r -n1 -I{} gh api -X DELETE "repos/${GITHUB_REPOSITORY}/releases/{}"
@@ -109,5 +109,7 @@ jobs:
                  push: ${{ steps.docker-meta.outputs.publish == 'true' }}
                  tags: ${{ steps.docker-meta.outputs.tags }}
                  platforms: ${{ steps.docker-meta.outputs.platforms }}
+                  build-args: |
+                      BUILD_COMMIT=${{ github.event.pull_request.head.sha || github.sha }}
                  cache-from: type=gha
                  cache-to: type=gha,mode=max,ignore-error=true
@@ -0,0 +1,269 @@
+name: Publish Snap after public release
+
+on:
+    release:
+        types:
+            - published
+
+permissions:
+    contents: read
+
+jobs:
+    verify-snap:
+        name: Verify public-release Snap assets
+        if: ${{ startsWith(github.event.release.tag_name, 'v') && github.event.release.draft == false }}
+        runs-on: ubuntu-latest
+        timeout-minutes: 45
+        env:
+            SOURCE_ARCHIVE_NAME: linux-frame-copy-runtime-sources.tar.xz
+        outputs:
+            receipt-sha256: ${{ steps.bind-transfer.outputs.receipt-sha256 }}
+
+        steps:
+            - name: Checkout released tooling
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+              with:
+                  ref: ${{ github.event.release.tag_name }}
+                  persist-credentials: false
+
+            - name: Install release source verifier
+              shell: bash
+              run: |
+                  set -euo pipefail
+
+                  sudo apt-get update
+                  sudo apt-get install --no-install-recommends -y \
+                      binutils \
+                      squashfs-tools \
+                      xz-utils
+
+            - name: Select exact public release assets
+              shell: bash
+              env:
+                  GH_TOKEN: ${{ github.token }}
+              run: |
+                  set -euo pipefail
+
+                  gh api \
+                      --paginate \
+                      --slurp \
+                      "repos/${GITHUB_REPOSITORY}/releases/${{ github.event.release.id }}/assets?per_page=100" \
+                      > "${RUNNER_TEMP}/snap-release-assets.json"
+                  node tools/packaging/release-snap-assets.cjs select \
+                      --assets-json "${RUNNER_TEMP}/snap-release-assets.json" \
+                      --output-json "${RUNNER_TEMP}/selected-snap-release-assets.json"
+
+            - name: Download exact public release assets
+              shell: bash
+              env:
+                  GH_TOKEN: ${{ github.token }}
+              run: |
+                  set -euo pipefail
+
+                  ASSET_DIRECTORY="${RUNNER_TEMP}/snap-release-downloads"
+                  rm -rf "${ASSET_DIRECTORY}"
+                  mkdir -p "${ASSET_DIRECTORY}"
+                  node -e \
+                      "const fs=require('node:fs'); const selected=JSON.parse(fs.readFileSync(process.argv[1],'utf8')); for (const asset of [...selected.snapAssets, selected.sourceAsset]) console.log([asset.id, asset.name].join('\\t'));" \
+                      "${RUNNER_TEMP}/selected-snap-release-assets.json" |
+                      while IFS=$'\t' read -r ASSET_ID ASSET_NAME; do
+                          gh api \
+                              --header "Accept: application/octet-stream" \
+                              "repos/${GITHUB_REPOSITORY}/releases/assets/${ASSET_ID}" \
+                              > "${ASSET_DIRECTORY}/${ASSET_NAME}"
+                      done
+
+            - name: Verify downloaded public release assets
+              shell: bash
+              run: |
+                  set -euo pipefail
+
+                  VERIFIED_ASSET_STAGING="${RUNNER_TEMP}/verified-snap-release-assets"
+                  SEALED_ASSET_PARENT="/var/lib/iptvnator-snap-release"
+                  SEALED_ASSET_DIRECTORY="${SEALED_ASSET_PARENT}/assets"
+                  test -s "${RUNNER_TEMP}/snap-release-downloads/${SOURCE_ARCHIVE_NAME}"
+                  test ! -e "${VERIFIED_ASSET_STAGING}"
+                  sudo test ! -e "${SEALED_ASSET_PARENT}"
+                  node tools/packaging/release-snap-assets.cjs verify \
+                      --manifest "${RUNNER_TEMP}/selected-snap-release-assets.json" \
+                      --directory "${RUNNER_TEMP}/snap-release-downloads" \
+                      --repository-revision "$(git rev-parse HEAD)" \
+                      --verified-directory "${VERIFIED_ASSET_STAGING}"
+                  sudo install -d -m 0700 -o root -g root "${SEALED_ASSET_PARENT}"
+                  sudo mv "${VERIFIED_ASSET_STAGING}" "${SEALED_ASSET_DIRECTORY}"
+                  sudo chown -R root:root "${SEALED_ASSET_DIRECTORY}"
+                  sudo find "${SEALED_ASSET_DIRECTORY}" -type d -exec chmod 0555 {} +
+                  sudo find "${SEALED_ASSET_DIRECTORY}" -type f -exec chmod 0444 {} +
+                  sudo chmod 0555 "${SEALED_ASSET_PARENT}"
+
+            - name: Reverify sealed public release assets
+              shell: bash
+              run: |
+                  set -euo pipefail
+
+                  VERIFIED_ASSET_DIRECTORY="/var/lib/iptvnator-snap-release/assets"
+                  node tools/packaging/release-snap-assets.cjs verify-sealed \
+                      --manifest "${RUNNER_TEMP}/selected-snap-release-assets.json" \
+                      --directory "${VERIFIED_ASSET_DIRECTORY}" \
+                      --receipt "${VERIFIED_ASSET_DIRECTORY}/verified-release-assets.json" \
+                      --repository-revision "$(git rev-parse HEAD)"
+
+            - name: Bind verified release transfer
+              id: bind-transfer
+              shell: bash
+              run: |
+                  set -euo pipefail
+
+                  RECEIPT_PATH="/var/lib/iptvnator-snap-release/assets/verified-release-assets.json"
+                  RECEIPT_RECORD="$(/usr/bin/sha256sum --binary "${RECEIPT_PATH}")"
+                  RECEIPT_SHA256="${RECEIPT_RECORD%% *}"
+                  [[ "${RECEIPT_SHA256}" =~ ^[a-f0-9]{64}$ ]]
+                  printf 'receipt-sha256=%s\n' "${RECEIPT_SHA256}" >> "${GITHUB_OUTPUT}"
+
+            - name: Transfer verified release assets
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+              with:
+                  name: verified-snap-release-assets
+                  path: /var/lib/iptvnator-snap-release/assets
+                  if-no-files-found: error
+                  retention-days: 1
+                  compression-level: 0
+                  include-hidden-files: true
+
+    publish-snap:
+        name: Publish verified public-release Snap to edge
+        needs: verify-snap
+        if: ${{ needs.verify-snap.result == 'success' && startsWith(github.event.release.tag_name, 'v') && github.event.release.draft == false }}
+        runs-on: ubuntu-latest
+        timeout-minutes: 20
+
+        steps:
+            - name: Download verified release assets
+              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+              with:
+                  name: verified-snap-release-assets
+                  path: ${{ runner.temp }}/verified-snap-release-assets
+
+            - name: Seal transferred public release assets
+              shell: bash
+              env:
+                  EXPECTED_RECEIPT_SHA256: ${{ needs.verify-snap.outputs.receipt-sha256 }}
+              run: |
+                  set -euo pipefail
+
+                  TRANSFERRED_ASSET_DIRECTORY="${RUNNER_TEMP}/verified-snap-release-assets"
+                  SEALED_ASSET_PARENT="/var/lib/iptvnator-snap-release"
+                  SEALED_ASSET_DIRECTORY="${SEALED_ASSET_PARENT}/assets"
+                  test -d "${TRANSFERRED_ASSET_DIRECTORY}"
+                  test ! -L "${TRANSFERRED_ASSET_DIRECTORY}"
+                  shopt -s nullglob dotglob
+                  TRANSFERRED_FILES=("${TRANSFERRED_ASSET_DIRECTORY}"/*)
+                  TRANSFERRED_SNAPS=("${TRANSFERRED_ASSET_DIRECTORY}"/*.snap)
+                  test "${#TRANSFERRED_SNAPS[@]}" -gt 0
+                  test "${#TRANSFERRED_FILES[@]}" -eq "$(( ${#TRANSFERRED_SNAPS[@]} + 2 ))"
+                  test -f "${TRANSFERRED_ASSET_DIRECTORY}/linux-frame-copy-runtime-sources.tar.xz"
+                  test ! -L "${TRANSFERRED_ASSET_DIRECTORY}/linux-frame-copy-runtime-sources.tar.xz"
+                  test -f "${TRANSFERRED_ASSET_DIRECTORY}/verified-release-assets.json"
+                  test ! -L "${TRANSFERRED_ASSET_DIRECTORY}/verified-release-assets.json"
+                  for ASSET_FILE in "${TRANSFERRED_FILES[@]}"; do
+                      test -f "${ASSET_FILE}"
+                      test ! -L "${ASSET_FILE}"
+                  done
+                  RECEIPT_PATH="${TRANSFERRED_ASSET_DIRECTORY}/verified-release-assets.json"
+                  RECEIPT_RECORD="$(/usr/bin/sha256sum --binary "${RECEIPT_PATH}")"
+                  ACTUAL_RECEIPT_SHA256="${RECEIPT_RECORD%% *}"
+                  [[ "${EXPECTED_RECEIPT_SHA256}" =~ ^[a-f0-9]{64}$ ]]
+                  test "${ACTUAL_RECEIPT_SHA256}" = "${EXPECTED_RECEIPT_SHA256}"
+                  /usr/bin/jq --exit-status '
+                      type == "object" and
+                      (keys == ["assets", "repositoryRevision", "schemaVersion"]) and
+                      (.schemaVersion == 1) and
+                      (.repositoryRevision |
+                          type == "string" and test("^[a-f0-9]{40,64}$")) and
+                      (.assets | type == "array" and length >= 2) and
+                      (.assets | all(.[];
+                          type == "object" and
+                          (keys == ["id", "name", "sha256", "size"]) and
+                          (.id |
+                              type == "number" and . > 0 and
+                              . <= 9007199254740991 and . == floor) and
+                          (.name |
+                              type == "string" and length > 0 and
+                              . != "." and . != ".." and
+                              (contains("/") | not) and
+                              (contains("\\") | not) and
+                              (explode | all(.[]; . > 31 and . != 127))) and
+                          (.sha256 |
+                              type == "string" and test("^[a-f0-9]{64}$")) and
+                          (.size |
+                              type == "number" and . > 0 and
+                              . <= 9007199254740991 and . == floor))) and
+                      ([.assets[].name] | length == (unique | length)) and
+                      ([.assets[] |
+                          select(.name == "linux-frame-copy-runtime-sources.tar.xz")] |
+                          length == 1) and
+                      ([.assets[] | select(.name | endswith(".snap"))] |
+                          length >= 1) and
+                      (.assets | all(.[];
+                          .name == "linux-frame-copy-runtime-sources.tar.xz" or
+                          (.name | endswith(".snap"))))
+                  ' "${RECEIPT_PATH}" > /dev/null
+                  RECEIPT_ASSET_COUNT="$(/usr/bin/jq --raw-output '.assets | length' "${RECEIPT_PATH}")"
+                  test "${RECEIPT_ASSET_COUNT}" -eq "$(( ${#TRANSFERRED_SNAPS[@]} + 1 ))"
+                  SIZE_MANIFEST="${RUNNER_TEMP}/verified-release-asset-sizes.tsv"
+                  CHECKSUM_MANIFEST="${RUNNER_TEMP}/verified-release-asset-checksums.txt"
+                  umask 077
+                  /usr/bin/jq --raw-output \
+                      '.assets[] | [.name, (.size | tostring)] | @tsv' \
+                      "${RECEIPT_PATH}" > "${SIZE_MANIFEST}"
+                  while IFS=$'\t' read -r ASSET_NAME EXPECTED_SIZE; do
+                      ASSET_PATH="${TRANSFERRED_ASSET_DIRECTORY}/${ASSET_NAME}"
+                      ACTUAL_SIZE="$(/usr/bin/stat --format=%s -- "${ASSET_PATH}")"
+                      test "${ACTUAL_SIZE}" = "${EXPECTED_SIZE}"
+                  done < "${SIZE_MANIFEST}"
+                  /usr/bin/jq --raw-output \
+                      '.assets[] | "\(.sha256)  \(.name)"' \
+                      "${RECEIPT_PATH}" > "${CHECKSUM_MANIFEST}"
+                  (
+                      cd "${TRANSFERRED_ASSET_DIRECTORY}"
+                      /usr/bin/sha256sum --strict --check "${CHECKSUM_MANIFEST}"
+                  )
+                  rm -f "${SIZE_MANIFEST}" "${CHECKSUM_MANIFEST}"
+                  shopt -u nullglob dotglob
+                  sudo test ! -e "${SEALED_ASSET_PARENT}"
+                  sudo install -d -m 0700 -o root -g root "${SEALED_ASSET_PARENT}"
+                  sudo mv "${TRANSFERRED_ASSET_DIRECTORY}" "${SEALED_ASSET_DIRECTORY}"
+                  sudo chown -R root:root "${SEALED_ASSET_DIRECTORY}"
+                  sudo find "${SEALED_ASSET_DIRECTORY}" -type d -exec chmod 0555 {} +
+                  sudo find "${SEALED_ASSET_DIRECTORY}" -type f -exec chmod 0444 {} +
+                  sudo chmod 0555 "${SEALED_ASSET_PARENT}"
+
+            - name: Install Snapcraft
+              shell: bash
+              run: |
+                  set -euo pipefail
+
+                  sudo snap install snapcraft --classic --channel=stable
+
+            - name: Publish all public-release snaps to edge
+              shell: bash
+              env:
+                  SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.snapcraft_token }}
+              run: |
+                  set -euo pipefail
+
+                  VERIFIED_ASSET_DIRECTORY="/var/lib/iptvnator-snap-release/assets"
+                  STORE_CREDENTIALS="${SNAPCRAFT_STORE_CREDENTIALS}"
+                  unset SNAPCRAFT_STORE_CREDENTIALS
+                  shopt -s nullglob dotglob
+                  SNAP_FILES=("${VERIFIED_ASSET_DIRECTORY}"/*.snap)
+                  test "${#SNAP_FILES[@]}" -gt 0
+                  for SNAP_FILE in "${SNAP_FILES[@]}"; do
+                      SNAP_NAME="${SNAP_FILE##*/}"
+                      echo "Publishing public release asset: ${SNAP_NAME}"
+                      # Candidate/stable promotion is manual after installed-Snap frame-copy and missing-runtime fallback smoke.
+                      # GitHub Actions never promotes automatically.
+                      SNAPCRAFT_STORE_CREDENTIALS="${STORE_CREDENTIALS}" /snap/bin/snapcraft upload --release=edge "${SNAP_FILE}"
+                  done
+                  unset STORE_CREDENTIALS
+                  shopt -u nullglob dotglob