Repository navigation
Security: pin all build inputs, --disable-network, harden CI #813
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled] | |
| schedule: | |
| - cron: "0 6 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| build-core: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Source Code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Update pkg-config database | |
| run: sudo ldconfig | |
| - name: Setup Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | |
| - name: Cache build | |
| id: cache-build | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: build-cache-st | |
| key: build-cache-st-v1-${{ hashFiles('Dockerfile', 'Makefile', 'build/*') }} | |
| restore-keys: | | |
| build-cache-st-v1- | |
| - name: Build ffmpeg-core | |
| run: make prd EXTRA_ARGS="--cache-from=type=local,src=build-cache-st --cache-to=type=local,dest=build-cache-st,mode=max" | |
| - name: Upload core | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ffmpeg-core | |
| path: packages/core/dist/* | |
| build-core-mt: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Source Code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | |
| - name: Cache build | |
| id: cache-build | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: build-cache-mt | |
| key: build-cache-mt-v1-${{ hashFiles('Dockerfile', 'Makefile', 'build/*') }} | |
| restore-keys: | | |
| build-cache-v1- | |
| - name: Build ffmpet-core-mt | |
| run: make prd-mt EXTRA_ARGS="--cache-from=type=local,src=build-cache-mt --cache-to=type=local,dest=build-cache-mt,mode=max" | |
| - name: Upload core-mt | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ffmpeg-core-mt | |
| path: packages/core-mt/dist/* | |
| tests: | |
| # Node 22 (the oldest LTS release), 24 and 26. | |
| runs-on: ubuntu-latest | |
| needs: [build-core, build-core-mt] | |
| strategy: | |
| matrix: | |
| node: [22, 24, 26] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: true | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ffmpeg-core | |
| path: packages/core/dist | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ffmpeg-core-mt | |
| path: packages/core-mt/dist | |
| - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm test:unit --project core-st --project core-mt --project node | |
| browser: | |
| # @ffmpeg/ffmpeg and @ffmpeg/util in Chromium. | |
| runs-on: ubuntu-latest | |
| needs: [build-core, build-core-mt] | |
| strategy: | |
| matrix: | |
| node: [22, 24, 26] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: true | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ffmpeg-core | |
| path: packages/core/dist | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ffmpeg-core-mt | |
| path: packages/core-mt/dist | |
| - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm test:install | |
| - run: pnpm test:unit --project browser-st --project browser-mt | |
| - run: pnpm test:e2e | |
| heavy: | |
| # FATE samples + benchmarks: nightly, on demand, or with the "heavy" PR label. | |
| if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'heavy') | |
| runs-on: ubuntu-latest | |
| needs: [build-core, build-core-mt] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ffmpeg-core | |
| path: packages/core/dist | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ffmpeg-core-mt | |
| path: packages/core-mt/dist | |
| - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: .cache/fate-suite | |
| key: fate-suite-v1 | |
| - run: pnpm install --frozen-lockfile | |
| - name: FATE samples | |
| run: pnpm test:heavy --reporter=default --reporter=json --outputFile.json=tests/heavy/results/fate.json | |
| - name: FATE baseline from this run, to commit if the changes are expected | |
| if: failure() | |
| run: pnpm test:heavy -u | |
| - name: Benchmarks | |
| if: always() | |
| run: pnpm bench --reporter=default --reporter=json --outputFile.json=tests/heavy/results/bench.json | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: always() | |
| with: | |
| name: heavy-results | |
| path: | | |
| tests/heavy/results | |
| tests/heavy/baseline |