Sucukdeluxe
9f1b052afd
Harden update, system-check, queue, cutter, streamer and shutdown state transitions. Add multi-user installer recovery, secret-safe config migration, provider fallback handling, managed-tool validation and real media export coverage. Refresh the English public documentation, release notes and 1.0.18 product screenshot.
269 lines
10 KiB
YAML
269 lines
10 KiB
YAML
name: Windows CI
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
live_gate:
|
|
description: Optional live gate to run after verification
|
|
required: true
|
|
default: none
|
|
type: choice
|
|
options:
|
|
- none
|
|
- twitch
|
|
- updater-postpublish
|
|
source_version:
|
|
description: Published source version for the updater gate
|
|
required: false
|
|
type: string
|
|
source_sha256:
|
|
description: SHA-256 of the published source installer
|
|
required: false
|
|
type: string
|
|
update_version:
|
|
description: Newly published target version for the updater gate
|
|
required: false
|
|
type: string
|
|
update_sha512:
|
|
description: SHA-512 from the newly published latest.yml
|
|
required: false
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: windows-latest
|
|
timeout-minutes: 120
|
|
env:
|
|
CI: 'true'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
timeout-minutes: 10
|
|
- uses: actions/setup-node@v4
|
|
timeout-minutes: 10
|
|
with:
|
|
node-version: '24.11.1'
|
|
cache: npm
|
|
- name: Clean install
|
|
run: npm ci
|
|
timeout-minutes: 10
|
|
- name: Provision Electron binary
|
|
run: |
|
|
npx install-electron --no
|
|
if ($LASTEXITCODE -ne 0) {
|
|
npx install-electron --no
|
|
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
|
}
|
|
timeout-minutes: 10
|
|
- name: Lint
|
|
run: npm run lint
|
|
timeout-minutes: 10
|
|
- name: Lint configuration contract
|
|
run: npm run test:lint-config
|
|
timeout-minutes: 10
|
|
- name: Security contracts
|
|
run: npm run security:check
|
|
timeout-minutes: 10
|
|
- name: Security regression tests
|
|
run: npm run test:security
|
|
timeout-minutes: 10
|
|
- name: CI contract
|
|
run: npm run test:ci-contract
|
|
timeout-minutes: 10
|
|
- name: Installer contract
|
|
run: npm run test:installer-contract
|
|
timeout-minutes: 10
|
|
- name: Managed tools contract
|
|
run: npm run test:managed-tools-contract
|
|
timeout-minutes: 10
|
|
- name: Cutter matrix provisioning contract
|
|
run: npm run test:cutter-matrix-contract
|
|
timeout-minutes: 10
|
|
- name: Build
|
|
run: npm run build
|
|
timeout-minutes: 10
|
|
- name: Live integration contract
|
|
run: npm run test:live-integration-contract
|
|
timeout-minutes: 10
|
|
- name: Unit tests
|
|
run: npm run test:unit
|
|
timeout-minutes: 10
|
|
- name: Focused Electron smoke
|
|
run: npm run test:e2e:focused
|
|
timeout-minutes: 10
|
|
- name: Cutter media matrix
|
|
run: node scripts/smoke-test-cutter-media-matrix.js
|
|
timeout-minutes: 10
|
|
- name: Clean managed tools provision and repair
|
|
run: npm run test:managed-tools-live
|
|
timeout-minutes: 10
|
|
- name: Package directory
|
|
run: |
|
|
npm run pack
|
|
if ($LASTEXITCODE -ne 0) {
|
|
npm run pack
|
|
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
|
}
|
|
timeout-minutes: 10
|
|
- name: Packaged launch smoke
|
|
run: npm run test:packaged-launch
|
|
timeout-minutes: 10
|
|
- name: Build installer
|
|
run: |
|
|
npm run dist:ci
|
|
if ($LASTEXITCODE -ne 0) {
|
|
npm run dist:ci
|
|
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
|
}
|
|
timeout-minutes: 10
|
|
- name: Installer smoke
|
|
run: npm run test:installer
|
|
timeout-minutes: 10
|
|
|
|
twitch-live:
|
|
if: github.event_name == 'workflow_dispatch' && github.event.inputs.live_gate == 'twitch'
|
|
needs: verify
|
|
runs-on: windows-latest
|
|
timeout-minutes: 60
|
|
env:
|
|
CI: 'true'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
timeout-minutes: 10
|
|
- uses: actions/setup-node@v4
|
|
timeout-minutes: 10
|
|
with:
|
|
node-version: '24.11.1'
|
|
cache: npm
|
|
- name: Clean install
|
|
run: npm ci
|
|
timeout-minutes: 10
|
|
- name: Build
|
|
run: npm run build
|
|
timeout-minutes: 10
|
|
- name: Verify live integration contract
|
|
run: npm run test:live-integration-contract
|
|
timeout-minutes: 10
|
|
- name: Provision pinned media tools
|
|
run: |
|
|
$env:TWITCH_VOD_MANAGER_LIVE_TOOL_ROOT = Join-Path $env:RUNNER_TEMP "tvm-live-tools-$env:GITHUB_RUN_ID-$env:GITHUB_RUN_ATTEMPT"
|
|
@'
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const tools = require('./dist/tools.js');
|
|
|
|
(async () => {
|
|
const root = process.env.TWITCH_VOD_MANAGER_LIVE_TOOL_ROOT;
|
|
const streamlinkDirectory = path.join(root, 'streamlink');
|
|
const ffmpegDirectory = path.join(root, 'ffmpeg');
|
|
const temporaryDirectory = path.join(root, 'temporary');
|
|
fs.mkdirSync(temporaryDirectory, { recursive: true });
|
|
tools.initToolDirs(streamlinkDirectory, ffmpegDirectory, () => temporaryDirectory);
|
|
const result = await tools.repairManagedTools();
|
|
if (!result.success) throw new Error(`Pinned media tool provisioning failed: ${JSON.stringify(result.statuses)}`);
|
|
if (!process.env.GITHUB_ENV) throw new Error('Actions environment export file is unavailable');
|
|
fs.appendFileSync(process.env.GITHUB_ENV, [
|
|
`TWITCH_VOD_MANAGER_LIVE_STREAMLINK_PATH=${tools.getStreamlinkPath()}`,
|
|
`TWITCH_VOD_MANAGER_LIVE_FFPROBE_PATH=${tools.getFFprobePath()}`,
|
|
''
|
|
].join('\n'));
|
|
})().catch((error) => {
|
|
console.error(error instanceof Error ? error.message : String(error));
|
|
process.exitCode = 1;
|
|
});
|
|
'@ | node
|
|
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
|
timeout-minutes: 10
|
|
- name: Twitch provider OAuth, Helix and bounded VOD gate
|
|
env:
|
|
TWITCH_VOD_MANAGER_LIVE_INTEGRATION: '1'
|
|
TWITCH_VOD_MANAGER_LIVE_TWITCH_CLIENT_ID: ${{ secrets.TWITCH_VOD_MANAGER_LIVE_TWITCH_CLIENT_ID }}
|
|
TWITCH_VOD_MANAGER_LIVE_TWITCH_CLIENT_SECRET: ${{ secrets.TWITCH_VOD_MANAGER_LIVE_TWITCH_CLIENT_SECRET }}
|
|
TWITCH_VOD_MANAGER_LIVE_TWITCH_LOGIN: ${{ secrets.TWITCH_VOD_MANAGER_LIVE_TWITCH_LOGIN }}
|
|
TWITCH_VOD_MANAGER_LIVE_TWITCH_VOD_ID: ${{ secrets.TWITCH_VOD_MANAGER_LIVE_TWITCH_VOD_ID }}
|
|
run: npm run test:live:twitch
|
|
timeout-minutes: 10
|
|
|
|
updater-live-postpublish:
|
|
if: github.event_name == 'workflow_dispatch' && github.event.inputs.live_gate == 'updater-postpublish'
|
|
needs: verify
|
|
runs-on: windows-latest
|
|
timeout-minutes: 60
|
|
env:
|
|
CI: 'true'
|
|
TWITCH_VOD_MANAGER_LIVE_INTEGRATION: '1'
|
|
TWITCH_VOD_MANAGER_LIVE_SOURCE_VERSION: ${{ github.event.inputs.source_version }}
|
|
TWITCH_VOD_MANAGER_LIVE_SOURCE_SHA256: ${{ github.event.inputs.source_sha256 }}
|
|
TWITCH_VOD_MANAGER_LIVE_UPDATE_VERSION: ${{ github.event.inputs.update_version }}
|
|
TWITCH_VOD_MANAGER_LIVE_UPDATE_SHA512: ${{ github.event.inputs.update_sha512 }}
|
|
TWITCH_VOD_MANAGER_LIVE_UPDATE_COMMIT_SHA: ${{ github.sha }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
timeout-minutes: 10
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
- uses: actions/setup-node@v4
|
|
timeout-minutes: 10
|
|
with:
|
|
node-version: '24.11.1'
|
|
cache: npm
|
|
- name: Clean install
|
|
run: npm ci
|
|
timeout-minutes: 10
|
|
- name: Require explicit post-publish updater inputs
|
|
run: |
|
|
$required = @(
|
|
'TWITCH_VOD_MANAGER_LIVE_SOURCE_VERSION',
|
|
'TWITCH_VOD_MANAGER_LIVE_SOURCE_SHA256',
|
|
'TWITCH_VOD_MANAGER_LIVE_UPDATE_VERSION',
|
|
'TWITCH_VOD_MANAGER_LIVE_UPDATE_SHA512',
|
|
'TWITCH_VOD_MANAGER_LIVE_UPDATE_COMMIT_SHA'
|
|
)
|
|
foreach ($name in $required) {
|
|
if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
|
|
throw "Missing required post-publish updater input: $name"
|
|
}
|
|
}
|
|
if ($env:TWITCH_VOD_MANAGER_LIVE_UPDATE_COMMIT_SHA -notmatch '^[0-9a-fA-F]{40}$') {
|
|
throw 'Pinned updater commit provenance must be a 40-character hexadecimal SHA'
|
|
}
|
|
if (-not [string]::Equals($env:TWITCH_VOD_MANAGER_LIVE_UPDATE_COMMIT_SHA, $env:GITHUB_SHA, [StringComparison]::OrdinalIgnoreCase)) {
|
|
throw 'Pinned updater commit provenance must match GITHUB_SHA'
|
|
}
|
|
$sourceVersionText = $env:TWITCH_VOD_MANAGER_LIVE_SOURCE_VERSION.Trim()
|
|
$updateVersionText = $env:TWITCH_VOD_MANAGER_LIVE_UPDATE_VERSION.Trim()
|
|
$versionPattern = '^(0|[1-9][0-9]{0,8})\.(0|[1-9][0-9]{0,8})\.(0|[1-9][0-9]{0,8})$'
|
|
if ($sourceVersionText -notmatch $versionPattern) {
|
|
throw 'Pinned source version must be an exact three-segment numeric release version'
|
|
}
|
|
if ($updateVersionText -notmatch $versionPattern) {
|
|
throw 'Pinned update version must be an exact three-segment numeric release version'
|
|
}
|
|
$sourceVersion = [version]$sourceVersionText
|
|
$updateVersion = [version]$updateVersionText
|
|
if ($sourceVersion -ge $updateVersion) {
|
|
throw 'Pinned source version must be older than the update version'
|
|
}
|
|
$packageVersion = (Get-Content -Raw -LiteralPath package.json | ConvertFrom-Json).version
|
|
if ($updateVersionText -ne $packageVersion) {
|
|
throw "Pinned update version must match package.json version $packageVersion"
|
|
}
|
|
$expectedRef = "refs/tags/v$updateVersionText"
|
|
if ($env:GITHUB_REF -ne $expectedRef) {
|
|
throw "Post-publish updater gate must run from release tag $expectedRef"
|
|
}
|
|
timeout-minutes: 10
|
|
- name: Build
|
|
run: npm run build
|
|
timeout-minutes: 10
|
|
- name: Verify live integration contract
|
|
run: npm run test:live-integration-contract
|
|
timeout-minutes: 10
|
|
- name: Verify published updater path
|
|
run: npm run test:live:updater-postpublish
|
|
timeout-minutes: 25
|