ci(embedded-mpv): keep Windows runtime pin available (#1495)

2026-10-08 17:06:15 -08:00 · 2026-08-29 21:24:06 +02:00
1 parent 29ca94aa43
commit f04f67728e
@@ -448,6 +448,12 @@ jobs:
            - name: Build frontend
              run: pnpm nx build web --skip-nx-cache

+            - name: Resolve pinned Windows Embedded MPV runtime
+              if: matrix.os == 'windows'
+              id: windows-embedded-mpv-runtime-pin
+              shell: bash
+              run: node tools/embedded-mpv/windows-runtime-pin.mjs --github-output
+
            - name: Resolve embedded MPV runtime cache key
              # TEMPORARY ARTIFACT TEST: remove `|| github.event_name == 'pull_request' || github.ref == 'refs/heads/master'`
              # after the macOS Embedded MPV artifacts are built and manually tested.
@@ -455,8 +461,7 @@ jobs:
              id: embedded-mpv-runtime-cache-key
              shell: bash
              env:
-                  IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256: ${{ vars.IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256 || secrets.IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256 || '' }}
-                  IPTVNATOR_DEFAULT_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256: 6014aa0e6d8e98cdba90f5288295a7105d7d14ab0ca906f51465eeb478d5fea0
+                  IPTVNATOR_PINNED_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256: ${{ steps.windows-embedded-mpv-runtime-pin.outputs.sha256 || '' }}
              run: |
                  set -euo pipefail

@@ -500,11 +505,13 @@ jobs:
                      `xcode${hash(xcodeVersion)}`
                    );
                  } else if (targetPlatform === 'win32') {
-                    sourceHashFiles.push('tools/embedded-mpv/stage-windows-runtime-archive.mjs');
+                    sourceHashFiles.push(
+                      'tools/embedded-mpv/stage-windows-runtime-archive.mjs',
+                      'tools/embedded-mpv/windows-runtime-pin.json',
+                      'tools/embedded-mpv/windows-runtime-pin.mjs'
+                    );
                    const windowsRuntimeSha256 =
-                      process.env.IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256 ||
-                      process.env.IPTVNATOR_DEFAULT_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256 ||
-                      'missing';
+                      process.env.IPTVNATOR_PINNED_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256 || 'missing';
                    cacheKeyParts.push(
                      `runtime${hash(windowsRuntimeSha256)}`
                    );
@@ -566,28 +573,13 @@ jobs:
              if: matrix.os == 'windows' && steps.embedded-mpv-runtime-cache.outputs.cache-hit != 'true'
              shell: bash
              env:
-                  IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_URL: ${{ vars.IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_URL || secrets.IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_URL || '' }}
-                  IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256: ${{ vars.IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256 || secrets.IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256 || '' }}
-                  IPTVNATOR_DEFAULT_WINDOWS_EMBEDDED_MPV_RUNTIME_URL: https://github.com/zhongfly/mpv-winbuild/releases/download/2026-07-17-94335ab87a/mpv-dev-lgpl-x86_64-20260717-git-94335ab87a.7z
-                  IPTVNATOR_DEFAULT_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256: 6014aa0e6d8e98cdba90f5288295a7105d7d14ab0ca906f51465eeb478d5fea0
+                  WINDOWS_RUNTIME_URL: ${{ steps.windows-embedded-mpv-runtime-pin.outputs.url }}
+                  WINDOWS_RUNTIME_SHA256: ${{ steps.windows-embedded-mpv-runtime-pin.outputs.sha256 }}
              run: |
                  set -euo pipefail

-                  WINDOWS_RUNTIME_URL="${IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_URL}"
-                  WINDOWS_RUNTIME_SHA256="${IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256}"
-                  if [ -z "${WINDOWS_RUNTIME_URL}" ] && [ -z "${WINDOWS_RUNTIME_SHA256}" ]; then
-                      case "${GITHUB_REF}" in
-                          refs/tags/v*)
-                              ;;
-                          *)
-                              WINDOWS_RUNTIME_URL="${IPTVNATOR_DEFAULT_WINDOWS_EMBEDDED_MPV_RUNTIME_URL}"
-                              WINDOWS_RUNTIME_SHA256="${IPTVNATOR_DEFAULT_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256}"
-                              ;;
-                      esac
-                  fi
-
                  if [ -z "${WINDOWS_RUNTIME_URL}" ] || [ -z "${WINDOWS_RUNTIME_SHA256}" ]; then
-                      echo "::error::Windows Embedded MPV CI requires IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_URL and IPTVNATOR_WINDOWS_EMBEDDED_MPV_RUNTIME_SHA256 repository variables or secrets."
+                      echo "::error::The checked-in Windows Embedded MPV runtime pin did not resolve a URL and SHA-256 digest."
                      exit 1
                  fi

@@ -0,0 +1,108 @@
+name: Refresh Windows Embedded MPV Runtime Pin
+
+on:
+    schedule:
+        - cron: '17 6 * * 1'
+    workflow_dispatch:
+        inputs:
+            force:
+                description: Refresh even when the current pin is still young
+                required: false
+                default: false
+                type: boolean
+
+permissions:
+    contents: read
+
+concurrency:
+    group: refresh-windows-embedded-mpv-runtime-pin
+    cancel-in-progress: false
+
+jobs:
+    refresh:
+        name: Refresh checked-in runtime pin
+        if: github.repository == '4gray/iptvnator'
+        runs-on: ubuntu-latest
+        timeout-minutes: 10
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+              with:
+                  fetch-depth: 0
+                  persist-credentials: false
+
+            - name: Setup Node.js
+              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+              with:
+                  node-version: '22'
+
+            - name: Refresh pin when it approaches upstream retention
+              id: refresh
+              env:
+                  FORCE_REFRESH: ${{ inputs.force && 'true' || 'false' }}
+                  GITHUB_TOKEN: ${{ github.token }}
+              shell: bash
+              run: |
+                  set -euo pipefail
+
+                  if [ "${FORCE_REFRESH}" = "true" ]; then
+                      node tools/embedded-mpv/update-windows-runtime-pin.mjs --force
+                  else
+                      node tools/embedded-mpv/update-windows-runtime-pin.mjs
+                  fi
+
+            - name: Validate updated pin
+              if: steps.refresh.outputs.changed == 'true'
+              run: >-
+                  node --test
+                  tools/embedded-mpv/windows-runtime-pin.test.mjs
+
+            - name: Create or update refresh pull request
+              if: steps.refresh.outputs.changed == 'true'
+              env:
+                  GH_TOKEN: ${{ secrets.PAT }}
+                  BRANCH_NAME: automation/windows-embedded-mpv-runtime-pin
+                  RELEASE_TAG: ${{ steps.refresh.outputs.release-tag }}
+              shell: bash
+              run: |
+                  set -euo pipefail
+
+                  if [ -z "${GH_TOKEN}" ]; then
+                      echo "::error::The PAT secret is required so the bot-created PR triggers normal CI."
+                      exit 1
+                  fi
+
+                  gh auth setup-git
+                  git config user.name "github-actions[bot]"
+                  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+                  git switch -C "${BRANCH_NAME}"
+                  git add -- tools/embedded-mpv/windows-runtime-pin.json
+                  git commit -m "ci(embedded-mpv): refresh Windows runtime pin"
+                  git fetch origin "${BRANCH_NAME}:refs/remotes/origin/${BRANCH_NAME}" || true
+                  git push --force-with-lease origin "HEAD:refs/heads/${BRANCH_NAME}"
+
+                  PR_BODY="$(printf '%s\n\n%s\n%s\n%s' \
+                      'Automated refresh of the checksum-pinned Windows Embedded MPV CI input.' \
+                      "- Pins upstream release \`${RELEASE_TAG}\` in repository history." \
+                      '- Keeps the binary on its upstream host; IPTVnator does not mirror it.' \
+                      '- Preserves the explicit checksum/layout-only license-verification statement.')"
+                  PR_NUMBER="$(gh pr list \
+                      --base master \
+                      --head "${BRANCH_NAME}" \
+                      --state open \
+                      --json number \
+                      --jq '.[0].number // empty')"
+
+                  if [ -n "${PR_NUMBER}" ]; then
+                      gh pr edit "${PR_NUMBER}" \
+                          --title "ci(embedded-mpv): refresh Windows runtime pin" \
+                          --body "${PR_BODY}"
+                      gh pr view "${PR_NUMBER}" --json url --jq '.url'
+                  else
+                      gh pr create \
+                          --base master \
+                          --head "${BRANCH_NAME}" \
+                          --title "ci(embedded-mpv): refresh Windows runtime pin" \
+                          --body "${PR_BODY}"
+                  fi