Sync

.github/workflows/build-docker.yaml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
           submodules: recursive

.github/workflows/build-docs.yaml

@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: Install dependencies
         run: |
-          sudo apt install -y doxygen
+          sudo apt install -y doxygen graphviz
           python3 -m pip install \
               sphinx==7.1.2 \
               sphinxcontrib.plantuml \
@@ -40,7 +40,7 @@ jobs:
               breathe
 
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
 
@@ -66,12 +66,12 @@ jobs:
           chmod -R +rX gh-pages/
 
       - name: Upload docs artifacts
-        uses: actions/upload-pages-artifact@v2
+        uses: actions/upload-pages-artifact@v3
         with:
           path: gh-pages
 
       - name: Debug
-        uses: mxschmitt/action-tmate@v3.6
+        uses: mxschmitt/action-tmate@v3.17
         with:
           limit-access-to-actor: true
         if: failure() && inputs.debug

.github/workflows/build-matrix.json

@@ -9,12 +9,21 @@
       "generator": "Ninja"
     },
     {
-      "os": "macos-latest",
+      "comment": "Explicit macOS version 13 is required for explicit x64 CPU.",
+      "os": "macos-13",
       "os_name": "osx",
       "target_arch": "x64",
       "exe_ext": "",
       "generator": "Ninja"
     },
+    {
+      "comment": "Explicit macOS version 14 is required for explicit arm64 CPU.",
+      "os": "macos-14",
+      "os_name": "osx",
+      "target_arch": "arm64",
+      "exe_ext": "",
+      "generator": "Ninja"
+    },
     {
       "os": "windows-latest",
       "os_name": "win",

.github/workflows/build.yaml

@@ -44,7 +44,7 @@ jobs:
       INCLUDE: ${{ steps.configure.outputs.INCLUDE }}
       OS: ${{ steps.configure.outputs.OS }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
 
@@ -92,17 +92,33 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
           submodules: recursive
+          fetch-tags: true
 
       - name: Install Linux deps
         if: runner.os == 'Linux'
         # NOTE: CMake is already installed in GitHub Actions VMs, but not
-        # necessarily in a self-hosted runner.
+        # necessarily in a self-hosted runner.  We also need a minimum version
+        # that may be greater than what is available in Ubuntu, so we set up
+        # the official CMake PPA first.
         run: |
-          sudo apt update && sudo apt install -y \
+          kitware_key_url="https://apt.kitware.com/keys/kitware-archive-latest.asc"
+          kitware_key_path="/usr/share/keyrings/kitware-archive-keyring.gpg"
+          kitware_sources_path="/etc/apt/sources.list.d/kitware.list"
+
+          curl -sL "$kitware_key_url" | gpg --dearmor - \
+              | sudo tee "$kitware_key_path" >/dev/null
+
+          . /etc/lsb-release  # Defines $DISTRIB_CODENAME (jammy, focal, etc)
+
+          echo "deb [signed-by=$kitware_key_path] https://apt.kitware.com/ubuntu/ $DISTRIB_CODENAME main" \
+              | sudo tee "$kitware_sources_path" >/dev/null
+
+          sudo apt update
+          sudo apt install -y \
               cmake \
               ninja-build
 
@@ -112,6 +128,28 @@ jobs:
         run: |
           brew install ninja
 
+      - name: Check Mac CPU architecture
+        if: runner.os == 'macOS'
+        # In case we get confused about GitHub's mac VM image labels,
+        # explicitly check that the CPU type matches our expectations.
+        run: |
+          if [[ "${{matrix.target_arch}}" == "arm64" ]]; then
+            CORRECT_LABEL="arm64"
+          else
+            CORRECT_LABEL="x86_64"
+          fi
+
+          LABEL=$(uname -m)
+          echo "Hardware label: \"$LABEL\""
+
+          if [[ "$LABEL" != "$CORRECT_LABEL" ]]; then
+            echo "Wrong hardware label \"$LABEL\", expecting \"$CORRECT_LABEL\"."
+            echo "Full uname string: $(uname -a)"
+            echo "Full sysctl CPU info:"
+            sysctl machdep.cpu
+            exit 1
+          fi
+
       - name: Generate build files
         run: |
           mkdir -p build/
@@ -134,9 +172,32 @@ jobs:
             export PACKAGER_LOW_MEMORY_BUILD=yes
           fi
 
+          # Do fully static release builds on Linux.
+          BUILD_CONFIG="${{ matrix.build_type }}-${{ matrix.lib_type }}"
+          if [[ "${{ runner.os }}" == "Linux" && \
+                "$BUILD_CONFIG" == "Release-static" ]]; then
+            # Enable build settings for fully-static.
+            FULLY_STATIC="ON"
+
+            # Use a musl toolchain, since glibc static executables are not
+            # portable.
+            if [[ "${{matrix.target_arch}}" == "arm64" ]]; then
+              MUSL_ARCH="aarch64"
+            else
+              MUSL_ARCH="x86_64"
+            fi
+            curl -LO https://musl.cc/"$MUSL_ARCH"-linux-musl-native.tgz
+            tar xf "$MUSL_ARCH"-linux-musl-native.tgz
+            export CC=`pwd`/"$MUSL_ARCH"-linux-musl-native/bin/"$MUSL_ARCH"-linux-musl-gcc
+            export CXX=`pwd`/"$MUSL_ARCH"-linux-musl-native/bin/"$MUSL_ARCH"-linux-musl-g++
+          else
+            FULLY_STATIC="OFF"
+          fi
+
           cmake \
             -DCMAKE_BUILD_TYPE="${{ matrix.build_type }}" \
             -DBUILD_SHARED_LIBS="$BUILD_SHARED_LIBS" \
+            -DFULLY_STATIC="$FULLY_STATIC" \
             -S . \
             -B build/
 
@@ -151,7 +212,7 @@ jobs:
         run: ctest -C "${{ matrix.build_type }}" -V --test-dir build/
 
       - name: Publish Test Report
-        uses: mikepenz/action-junit-report@150e2f992e4fad1379da2056d1d1c279f520e058
+        uses: mikepenz/action-junit-report@v4
         if: ${{ always() }}
         with:
           report_paths: 'junit-reports/TEST-*.xml'
@@ -164,7 +225,21 @@ jobs:
             exit 0
           fi
 
-          # TODO: Check static executables?
+          # Check static executables
+          if [[ "${{ runner.os }}" == "Linux" ]]; then
+            echo "::group::Check static executables"
+            for exe in build/packager/{packager,mpd_generator}; do
+              # Capture information about the executables, but also let it be
+              # logged to stdout.
+              ldd "$exe" | tee static.log
+              # The phrase "statically linked" means we got it right.  Fail if
+              # we don't find it.
+              if ! cat static.log | grep -q statically; then
+                exit 1
+              fi
+            done
+            echo "::endgroup::"
+          fi
 
           echo "::group::Prepare artifacts folder"
           mkdir artifacts
@@ -202,7 +277,7 @@ jobs:
           fi
 
       - name: Upload static release build artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         if: matrix.build_type == 'Release' && matrix.lib_type == 'static'
         with:
           name: artifacts-${{ matrix.os_name }}-${{ matrix.target_arch }}
@@ -211,7 +286,7 @@ jobs:
           retention-days: 5
 
       - name: Debug
-        uses: mxschmitt/action-tmate@v3.6
+        uses: mxschmitt/action-tmate@v3.17
         with:
           limit-access-to-actor: true
         if: failure() && inputs.debug

.github/workflows/lint.yaml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
           # We must use 'fetch-depth: 2', or else the linter won't have another

.github/workflows/publish-docker.yaml

@@ -43,10 +43,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.tag }}
           submodules: recursive
+          fetch-tags: true
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
@@ -57,12 +58,22 @@ jobs:
       - name: Push to Docker Hub
         uses: docker/build-push-action@v5
         with:
+          # Important: use actions/checkout source, which has the right tags!
+          # Without context: ., this action will try to fetch git source
+          # itself, and it will be unable to determine the correct version
+          # number.
+          context: .
           push: true
           tags: ${{ secrets.DOCKERHUB_PACKAGE_NAME }}:${{ inputs.tag }}
 
       - name: Push to Docker Hub as "latest"
         if: ${{ inputs.latest }}
         uses: docker/build-push-action@v5
         with:
+          # Important: use actions/checkout source, which has the right tags!
+          # Without context: ., this action will try to fetch git source
+          # itself, and it will be unable to determine the correct version
+          # number.
+          context: .
           push: true
           tags: ${{ secrets.DOCKERHUB_PACKAGE_NAME }}:latest

.github/workflows/publish-docs.yaml

@@ -48,4 +48,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v2
+        uses: actions/deploy-pages@v4

.github/workflows/publish-npm.yaml

@@ -41,10 +41,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.tag }}
-          submodules: recursive
 
       - uses: actions/setup-node@v4
         with:

.github/workflows/release-please.yaml

@@ -13,27 +13,28 @@ on:
       - v[0-9]*
 
 jobs:
+  settings:
+    name: Settings
+    uses: ./.github/workflows/settings.yaml
+
   release:
     runs-on: ubuntu-latest
+    needs: settings
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       # Create/update release PR
-      - uses: google-github-actions/release-please-action@v3
+      - uses: google-github-actions/release-please-action@v4
         id: release
         with:
-          # Required input to specify the release type.  This is not really a
-          # go project, but go projects in release-please only update
-          # CHANGELOG.md and nothing else.  This is what we want.
-          release-type: go
           # Make sure we create the PR against the correct branch.
-          default-branch: ${{ github.ref_name }}
+          target-branch: ${{ github.ref_name }}
           # Use a special shaka-bot access token for releases.
           token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
-          # Temporary settings to bootstrap v3.0.0.
-          last-release-sha: 634af6591ce8c701587a78042ae7f81761725710
-          bootstrap-sha: 634af6591ce8c701587a78042ae7f81761725710
+          # See also settings in these files:
+          manifest-file: .release-please-manifest.json
+          config-file: .release-please-config.json
 
   # The jobs below are all conditional on a release having been created by
   # someone merging the release PR.
@@ -51,10 +52,9 @@ jobs:
     outputs:
       latest: ${{ steps.compute.outputs.latest }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-tags: true
-          persist-credentials: false
 
       - name: Compute latest
         id: compute
@@ -101,11 +101,13 @@ jobs:
   # Do a complete build
   build:
     name: Build
-    needs: release
+    needs: [settings, release]
     if: needs.release.outputs.release_created
     uses: ./.github/workflows/build.yaml
     with:
       ref: ${{ github.ref }}
+      self_hosted: ${{ needs.settings.outputs.self_hosted != '' }}
+      debug: ${{ needs.settings.outputs.debug != '' }}
 
   # Attach build artifacts to the release
   artifacts:
@@ -114,22 +116,21 @@ jobs:
     needs: [release, build]
     if: needs.release.outputs.release_created
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: artifacts
+          merge-multiple: true
 
       - name: Debug
         run: find -ls
 
       - name: Attach packager to release
-        uses: svenstaro/upload-release-action@v2
-        with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          tag: ${{ needs.release.outputs.tag_name }}
-          make_latest: false  # Already set for the release
-          file_glob: true
-          file: artifacts/artifacts*/*
-          overwrite: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+        run: |
+          gh -R ${{ github.repository }} release upload \
+              ${{ needs.release.outputs.tag_name }} artifacts/* \
+              --clobber
 
   # Surprisingly, Shaka Packager binaries can be installed via npm.
   # Publish NPM package updates.

.github/workflows/sync-labels.yaml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: shaka-project/shaka-github-tools