Merge pull request #41 from bstkhq/safeguard-shims #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build and attest ffshim for every distributed native platform. | |
| # | |
| # Each job verifies the generated C/Go contract, loads the exact copied | |
| # artifact through the consumer loader, exercises safe helpers, and emits a | |
| # checksum manifest. The package job rejects anything not attested by this | |
| # checkout before it can reach a release. | |
| name: Build Shim | |
| on: | |
| push: | |
| branches: [master, main] | |
| paths: | |
| - 'shim/**' | |
| - 'internal/shim/**' | |
| - 'cmd/ffshim-manifest/**' | |
| - '.github/workflows/build-shim.yml' | |
| - 'go.mod' | |
| - 'go.sum' | |
| pull_request: | |
| branches: [master, main] | |
| paths: | |
| - 'shim/**' | |
| - 'internal/shim/**' | |
| - 'cmd/ffshim-manifest/**' | |
| - '.github/workflows/build-shim.yml' | |
| - 'go.mod' | |
| - 'go.sum' | |
| release: | |
| types: [created] | |
| workflow_dispatch: | |
| inputs: | |
| upload_artifacts: | |
| description: 'Upload artifacts even on non-release builds' | |
| required: false | |
| default: 'false' | |
| type: boolean | |
| permissions: | |
| contents: read | |
| env: | |
| GO_VERSION: '1.23' | |
| jobs: | |
| build-linux-amd64: | |
| runs-on: ubuntu-latest | |
| name: Build and attest (linux/amd64) | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Verify generated shim contract | |
| run: make -C shim check-contract | |
| - name: Install FFmpeg development libraries | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libavcodec-dev libavformat-dev libavutil-dev libavdevice-dev | |
| - name: Build, verify, and attest shim | |
| run: | | |
| set -eu | |
| make -C shim native | |
| major="$(CGO_ENABLED=0 go run ./cmd/ffshim-manifest -shim-dir "$PWD/shim" -field ffmpeg-major)" | |
| destination="$PWD/dist/shim/prebuilt/linux-amd64/ffmpeg-$major" | |
| mkdir -p "$destination" | |
| cp shim/libffshim.so "$destination/" | |
| CGO_ENABLED=0 go run ./cmd/ffshim-manifest -shim-dir "$destination" -output "$destination/manifest.json" | |
| CGO_ENABLED=0 go run ./cmd/ffshim-manifest -verify "$destination/manifest.json" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: shim-linux-amd64 | |
| path: dist/shim/ | |
| build-linux-arm64: | |
| runs-on: ubuntu-24.04-arm | |
| name: Build and attest (linux/arm64) | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Verify generated shim contract | |
| run: make -C shim check-contract | |
| - name: Install FFmpeg development libraries | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libavcodec-dev libavformat-dev libavutil-dev libavdevice-dev | |
| - name: Build, verify, and attest shim | |
| run: | | |
| set -eu | |
| make -C shim native | |
| major="$(CGO_ENABLED=0 go run ./cmd/ffshim-manifest -shim-dir "$PWD/shim" -field ffmpeg-major)" | |
| destination="$PWD/dist/shim/prebuilt/linux-arm64/ffmpeg-$major" | |
| mkdir -p "$destination" | |
| cp shim/libffshim.so "$destination/" | |
| CGO_ENABLED=0 go run ./cmd/ffshim-manifest -shim-dir "$destination" -output "$destination/manifest.json" | |
| CGO_ENABLED=0 go run ./cmd/ffshim-manifest -verify "$destination/manifest.json" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: shim-linux-arm64 | |
| path: dist/shim/ | |
| build-macos-amd64: | |
| runs-on: macos-15-intel | |
| name: Build and attest (darwin/amd64) | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Verify generated shim contract | |
| run: make -C shim check-contract | |
| - name: Install FFmpeg | |
| run: brew install ffmpeg | |
| - name: Build, verify, and attest shim | |
| run: | | |
| set -eu | |
| make -C shim native | |
| major="$(CGO_ENABLED=0 go run ./cmd/ffshim-manifest -shim-dir "$PWD/shim" -field ffmpeg-major)" | |
| destination="$PWD/dist/shim/prebuilt/darwin-amd64/ffmpeg-$major" | |
| mkdir -p "$destination" | |
| cp shim/libffshim.dylib "$destination/" | |
| CGO_ENABLED=0 go run ./cmd/ffshim-manifest -shim-dir "$destination" -output "$destination/manifest.json" | |
| CGO_ENABLED=0 go run ./cmd/ffshim-manifest -verify "$destination/manifest.json" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: shim-darwin-amd64 | |
| path: dist/shim/ | |
| build-macos-arm64: | |
| runs-on: macos-15 | |
| name: Build and attest (darwin/arm64) | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Verify generated shim contract | |
| run: make -C shim check-contract | |
| - name: Install FFmpeg | |
| run: brew install ffmpeg | |
| - name: Build, verify, and attest shim | |
| run: | | |
| set -eu | |
| make -C shim native | |
| major="$(CGO_ENABLED=0 go run ./cmd/ffshim-manifest -shim-dir "$PWD/shim" -field ffmpeg-major)" | |
| destination="$PWD/dist/shim/prebuilt/darwin-arm64/ffmpeg-$major" | |
| mkdir -p "$destination" | |
| cp shim/libffshim.dylib "$destination/" | |
| CGO_ENABLED=0 go run ./cmd/ffshim-manifest -shim-dir "$destination" -output "$destination/manifest.json" | |
| CGO_ENABLED=0 go run ./cmd/ffshim-manifest -verify "$destination/manifest.json" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: shim-darwin-arm64 | |
| path: dist/shim/ | |
| build-windows-amd64: | |
| runs-on: windows-latest | |
| name: Build and attest (windows/amd64) | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Verify generated shim contract | |
| shell: pwsh | |
| run: go run ./internal/shim/cmd/gencontract -check | |
| - name: Setup MSYS2 | |
| uses: msys2/setup-msys2@v2 | |
| with: | |
| msystem: MINGW64 | |
| update: true | |
| path-type: inherit | |
| install: >- | |
| make | |
| mingw-w64-x86_64-gcc | |
| mingw-w64-x86_64-ffmpeg | |
| pkg-config | |
| - name: Build shim | |
| shell: msys2 {0} | |
| working-directory: shim | |
| run: make native | |
| - name: Verify and attest shim | |
| shell: msys2 {0} | |
| run: | | |
| set -eu | |
| command -v go | |
| avutil="$(find /mingw64/bin -maxdepth 1 -type f -name 'avutil-*.dll' -print -quit)" | |
| test -n "$avutil" | |
| echo "Using FFmpeg runtime: $avutil" | |
| major="$(go run ./cmd/ffshim-manifest -shim-dir "$PWD/shim" -field ffmpeg-major)" | |
| destination="$PWD/dist/shim/prebuilt/windows-amd64/ffmpeg-$major" | |
| mkdir -p "$destination" | |
| cp shim/ffshim.dll "$destination/ffshim.dll" | |
| go run ./cmd/ffshim-manifest -shim-dir "$destination" -output "$destination/manifest.json" | |
| go run ./cmd/ffshim-manifest -verify "$destination/manifest.json" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: shim-windows-amd64 | |
| path: dist/shim/ | |
| package: | |
| needs: [build-linux-amd64, build-linux-arm64, build-macos-amd64, build-macos-arm64, build-windows-amd64] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Verify generated shim contract | |
| run: make -C shim check-contract | |
| - name: Download all attested artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts | |
| - name: Verify manifests and package versioned shims | |
| run: | | |
| set -eu | |
| mkdir -p release/shim/prebuilt | |
| for platform in linux-amd64 linux-arm64 darwin-amd64 darwin-arm64 windows-amd64; do | |
| source="artifacts/shim-$platform/prebuilt/$platform" | |
| test -d "$source" | |
| manifests="$(find "$source" -mindepth 2 -maxdepth 2 -name manifest.json -print | sort)" | |
| test "$(printf '%s\n' "$manifests" | sed '/^$/d' | wc -l)" -eq 1 | |
| manifest="$(printf '%s\n' "$manifests" | sed '/^$/d')" | |
| case "$manifest" in | |
| "$source"/ffmpeg-[6-9]/manifest.json) ;; | |
| *) echo "unexpected versioned shim manifest: $manifest" >&2; exit 1 ;; | |
| esac | |
| CGO_ENABLED=0 go run ./cmd/ffshim-manifest -verify "$manifest" | |
| mkdir -p "release/shim/prebuilt/$platform" | |
| cp -a "$source/." "release/shim/prebuilt/$platform/" | |
| done | |
| find release/shim/prebuilt -name manifest.json -print | sort > release/shim/MANIFESTS | |
| test "$(wc -l < release/shim/MANIFESTS)" -eq 5 | |
| tar -C release -czvf ffshim-prebuilt.tar.gz shim/ | |
| sha256sum ffshim-prebuilt.tar.gz > ffshim-prebuilt.tar.gz.sha256 | |
| - name: Upload release asset | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| if [ "${GITHUB_EVENT_NAME}" != "release" ]; then | |
| echo "Not a release event (${GITHUB_EVENT_NAME}); skipping release upload." | |
| exit 0 | |
| fi | |
| tag="${GITHUB_REF_NAME}" | |
| gh release upload "${tag}" ffshim-prebuilt.tar.gz ffshim-prebuilt.tar.gz.sha256 --clobber | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: ffshim-prebuilt | |
| path: | | |
| ffshim-prebuilt.tar.gz | |
| ffshim-prebuilt.tar.gz.sha256 |