From a5bcd8c3f29ef451128c973aa9897874d7a2f3b2 Mon Sep 17 00:00:00 2001 From: Gunwoo Kim Date: Sun, 8 Nov 2026 18:28:02 +0900 Subject: [PATCH 1/8] fix(ci): cache verified oracle downloads Signed-off-by: Gunwoo Kim --- .github/actions/oracle-cache/action.yml | 15 ++ .github/workflows/aac-encode.yml | 14 +- .github/workflows/audio-conformance.yml | 61 ++----- .github/workflows/avi-output.yml | 6 +- .github/workflows/ci-full.yml | 12 +- .github/workflows/ci.yml | 75 ++++---- .github/workflows/codec-coverage.yml | 36 +--- .github/workflows/deny.yml | 12 +- .github/workflows/flac-output.yml | 6 +- .github/workflows/github-shapes.yml | 12 +- .github/workflows/h264-encoder.yml | 9 +- .github/workflows/hevc-conformance.yml | 13 +- .github/workflows/input-summary.yml | 9 +- .github/workflows/mediainfo-oracle.yml | 9 +- .github/workflows/npm.yml | 9 +- .github/workflows/opus-encode.yml | 14 +- .github/workflows/png-bmp-yuv.yml | 5 +- .github/workflows/python.yml | 13 +- .github/workflows/release.yml | 6 +- .github/workflows/vp9-corpus.yml | 14 +- .github/workflows/vp9-filter.yml | 13 +- .github/workflows/wasm.yml | 17 +- docs/agents/ffmpeg-cli.md | 4 + scripts/install-ci-oracle-ffmpeg.sh | 52 ++++++ scripts/tests/test_hevc_workflow.py | 2 +- scripts/tests/test_oracle_install.py | 211 ++++++++++++++++++++++ scripts/tests/test_vp9_filter_coverage.py | 3 +- scripts/workflow_check.py | 5 +- scripts/workflow_check_selftest.py | 19 +- 29 files changed, 461 insertions(+), 215 deletions(-) create mode 100644 .github/actions/oracle-cache/action.yml create mode 100755 scripts/install-ci-oracle-ffmpeg.sh create mode 100644 scripts/tests/test_oracle_install.py diff --git a/.github/actions/oracle-cache/action.yml b/.github/actions/oracle-cache/action.yml new file mode 100644 index 000000000..1463841fd --- /dev/null +++ b/.github/actions/oracle-cache/action.yml @@ -0,0 +1,15 @@ +name: Cache the pinned oracle archive +description: Share only the archive identified by the oracle SHA256 +runs: + using: composite + steps: + - id: pin + shell: bash + run: | + source "$GITHUB_ACTION_PATH/../../../scripts/oracle-ffmpeg.env" + echo "sha256=$SHA256" >> "$GITHUB_OUTPUT" + echo "COREAV_ORACLE_ARCHIVE=$RUNNER_TEMP/coreav-oracle-archive/$SHA256.tar.xz" >> "$GITHUB_ENV" + - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + with: + path: ${{ runner.temp }}/coreav-oracle-archive/${{ steps.pin.outputs.sha256 }}.tar.xz + key: oracle-archive-${{ steps.pin.outputs.sha256 }} diff --git a/.github/workflows/aac-encode.yml b/.github/workflows/aac-encode.yml index acec4c889..5277ff50b 100644 --- a/.github/workflows/aac-encode.yml +++ b/.github/workflows/aac-encode.yml @@ -11,10 +11,10 @@ name: aac-encode on: push: branches: [main] - paths: ["crates/coreav-transcode/src/aac.rs", "crates/coreav-transcode/src/audio.rs", "scripts/aac_encode_check.py", "scripts/opus_encode_check.py", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", ".github/workflows/aac-encode.yml"] + paths: ["crates/coreav-transcode/src/aac.rs", "crates/coreav-transcode/src/audio.rs", "scripts/aac_encode_check.py", "scripts/opus_encode_check.py", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", ".github/workflows/aac-encode.yml"] pull_request: types: [opened, synchronize, reopened, ready_for_review] - paths: ["crates/coreav-transcode/src/aac.rs", "crates/coreav-transcode/src/audio.rs", "scripts/aac_encode_check.py", "scripts/opus_encode_check.py", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", ".github/workflows/aac-encode.yml"] + paths: ["crates/coreav-transcode/src/aac.rs", "crates/coreav-transcode/src/audio.rs", "scripts/aac_encode_check.py", "scripts/opus_encode_check.py", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", ".github/workflows/aac-encode.yml"] workflow_dispatch: permissions: @@ -39,15 +39,9 @@ jobs: - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: save-if: ${{ github.ref == 'refs/heads/main' }} - - name: Cache the pinned FFmpeg - id: ffmpeg-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.ffmpeg-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Check the pinned FFmpeg run: python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/coreav-oracle-bin" - name: Build coreav diff --git a/.github/workflows/audio-conformance.yml b/.github/workflows/audio-conformance.yml index a88cae6e7..1064336e6 100644 --- a/.github/workflows/audio-conformance.yml +++ b/.github/workflows/audio-conformance.yml @@ -8,10 +8,10 @@ name: audio-conformance on: push: branches: [main] - paths: ["scripts/aac_pns.py", "scripts/tests/test_aac_pns.py", "scripts/aac-pns-requirements.txt", "docs/design/aac-pns-eligibility.md", "scripts/aac_pcm_eligibility.py", "scripts/tests/test_aac_pcm_eligibility.py", "docs/design/aac-pcm-eligibility.md", "crates/coreav-cli/Cargo.toml", "scripts/opus_pcm_eligibility.py", "scripts/tests/test_opus_pcm_eligibility.py", "docs/design/opus-pcm-eligibility.md", "scripts/opus_matroska_padding.py", "scripts/tests/test_opus_matroska_padding.py", "scripts/pr-text-requirements.txt", "docs/compat/audio-decoder-eligibility.json", "docs/design/lossy-pcm-eligibility.md", "scripts/audio_decoder_eligibility.py", "scripts/tests/test_audio_decoder_eligibility.py", "scripts/opus_mp4_presentation.py", "scripts/tests/test_opus_mp4_presentation.py", "crates/coreav-transcode/**", "crates/coreav-cli/src/ffmpeg/**", "scripts/composed_audio*.py", "scripts/transcode_check.py", "docs/design/composed-opus-aac-v2.*", "crates/coreav-audio/**", "crates/coreav-aac/**", "scripts/aac_agreement.py", "scripts/decode_audio_check.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "crates/coreav-opus/**", "scripts/opus_tables.py", "scripts/pinned_sources.py", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", ".github/workflows/audio-conformance.yml", "crates/coreav-cli/tests/ffmpeg_raw.rs", "crates/coreav-cli/tests/ffmpeg_wav.rs", "scripts/raw_pcm_check.py", "scripts/pcm_output_check.py", "scripts/swr_characterize.py", "scripts/tests/test_raw_pcm_check.py", "scripts/tests/test_swr_characterize.py", "scripts/oracle_pin.py", "crates/coreav-cli/tests/ffmpeg_flac.rs", "crates/coreav-cli/src/ffprobe/audio/**"] + paths: ["scripts/aac_pns.py", "scripts/tests/test_aac_pns.py", "scripts/aac-pns-requirements.txt", "docs/design/aac-pns-eligibility.md", "scripts/aac_pcm_eligibility.py", "scripts/tests/test_aac_pcm_eligibility.py", "docs/design/aac-pcm-eligibility.md", "crates/coreav-cli/Cargo.toml", "scripts/opus_pcm_eligibility.py", "scripts/tests/test_opus_pcm_eligibility.py", "docs/design/opus-pcm-eligibility.md", "scripts/opus_matroska_padding.py", "scripts/tests/test_opus_matroska_padding.py", "scripts/pr-text-requirements.txt", "docs/compat/audio-decoder-eligibility.json", "docs/design/lossy-pcm-eligibility.md", "scripts/audio_decoder_eligibility.py", "scripts/tests/test_audio_decoder_eligibility.py", "scripts/opus_mp4_presentation.py", "scripts/tests/test_opus_mp4_presentation.py", "crates/coreav-transcode/**", "crates/coreav-cli/src/ffmpeg/**", "scripts/composed_audio*.py", "scripts/transcode_check.py", "docs/design/composed-opus-aac-v2.*", "crates/coreav-audio/**", "crates/coreav-aac/**", "scripts/aac_agreement.py", "scripts/decode_audio_check.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "crates/coreav-opus/**", "scripts/opus_tables.py", "scripts/pinned_sources.py", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", ".github/workflows/audio-conformance.yml", "crates/coreav-cli/tests/ffmpeg_raw.rs", "crates/coreav-cli/tests/ffmpeg_wav.rs", "scripts/raw_pcm_check.py", "scripts/pcm_output_check.py", "scripts/swr_characterize.py", "scripts/tests/test_raw_pcm_check.py", "scripts/tests/test_swr_characterize.py", "scripts/oracle_pin.py", "crates/coreav-cli/tests/ffmpeg_flac.rs", "crates/coreav-cli/src/ffprobe/audio/**"] pull_request: types: [opened, synchronize, reopened, ready_for_review] - paths: ["scripts/aac_pns.py", "scripts/tests/test_aac_pns.py", "scripts/aac-pns-requirements.txt", "docs/design/aac-pns-eligibility.md", "scripts/aac_pcm_eligibility.py", "scripts/tests/test_aac_pcm_eligibility.py", "docs/design/aac-pcm-eligibility.md", "crates/coreav-cli/Cargo.toml", "scripts/opus_pcm_eligibility.py", "scripts/tests/test_opus_pcm_eligibility.py", "docs/design/opus-pcm-eligibility.md", "scripts/opus_matroska_padding.py", "scripts/tests/test_opus_matroska_padding.py", "scripts/pr-text-requirements.txt", "docs/compat/audio-decoder-eligibility.json", "docs/design/lossy-pcm-eligibility.md", "scripts/audio_decoder_eligibility.py", "scripts/tests/test_audio_decoder_eligibility.py", "scripts/opus_mp4_presentation.py", "scripts/tests/test_opus_mp4_presentation.py", "crates/coreav-transcode/**", "crates/coreav-cli/src/ffmpeg/**", "scripts/composed_audio*.py", "scripts/transcode_check.py", "docs/design/composed-opus-aac-v2.*", "crates/coreav-audio/**", "crates/coreav-aac/**", "scripts/aac_agreement.py", "scripts/decode_audio_check.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "crates/coreav-opus/**", "scripts/opus_tables.py", "scripts/pinned_sources.py", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", ".github/workflows/audio-conformance.yml", "crates/coreav-cli/tests/ffmpeg_raw.rs", "crates/coreav-cli/tests/ffmpeg_wav.rs", "scripts/raw_pcm_check.py", "scripts/pcm_output_check.py", "scripts/swr_characterize.py", "scripts/tests/test_raw_pcm_check.py", "scripts/tests/test_swr_characterize.py", "scripts/oracle_pin.py", "crates/coreav-cli/tests/ffmpeg_flac.rs", "crates/coreav-cli/src/ffprobe/audio/**"] + paths: ["scripts/aac_pns.py", "scripts/tests/test_aac_pns.py", "scripts/aac-pns-requirements.txt", "docs/design/aac-pns-eligibility.md", "scripts/aac_pcm_eligibility.py", "scripts/tests/test_aac_pcm_eligibility.py", "docs/design/aac-pcm-eligibility.md", "crates/coreav-cli/Cargo.toml", "scripts/opus_pcm_eligibility.py", "scripts/tests/test_opus_pcm_eligibility.py", "docs/design/opus-pcm-eligibility.md", "scripts/opus_matroska_padding.py", "scripts/tests/test_opus_matroska_padding.py", "scripts/pr-text-requirements.txt", "docs/compat/audio-decoder-eligibility.json", "docs/design/lossy-pcm-eligibility.md", "scripts/audio_decoder_eligibility.py", "scripts/tests/test_audio_decoder_eligibility.py", "scripts/opus_mp4_presentation.py", "scripts/tests/test_opus_mp4_presentation.py", "crates/coreav-transcode/**", "crates/coreav-cli/src/ffmpeg/**", "scripts/composed_audio*.py", "scripts/transcode_check.py", "docs/design/composed-opus-aac-v2.*", "crates/coreav-audio/**", "crates/coreav-aac/**", "scripts/aac_agreement.py", "scripts/decode_audio_check.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "crates/coreav-opus/**", "scripts/opus_tables.py", "scripts/pinned_sources.py", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", ".github/workflows/audio-conformance.yml", "crates/coreav-cli/tests/ffmpeg_raw.rs", "crates/coreav-cli/tests/ffmpeg_wav.rs", "scripts/raw_pcm_check.py", "scripts/pcm_output_check.py", "scripts/swr_characterize.py", "scripts/tests/test_raw_pcm_check.py", "scripts/tests/test_swr_characterize.py", "scripts/oracle_pin.py", "crates/coreav-cli/tests/ffmpeg_flac.rs", "crates/coreav-cli/src/ffprobe/audio/**"] schedule: - cron: '17 6 * * 2' workflow_dispatch: @@ -50,13 +50,8 @@ jobs: with: toolchain: stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 - - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 - id: oracle - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} - - if: steps.oracle.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + - uses: ./.github/actions/oracle-cache + - run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Verify the pinned oracle and native raw output env: COREAV_FFMPEG: ${{ runner.temp }}/coreav-oracle-bin/ffmpeg @@ -100,13 +95,8 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 with: persist-credentials: false - - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 - id: oracle - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} - - if: steps.oracle.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + - uses: ./.github/actions/oracle-cache + - run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - run: | python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/coreav-oracle-bin" python3 -I scripts/swr_characterize.py --ffmpeg "$RUNNER_TEMP/coreav-oracle-bin/ffmpeg" --out "$RUNNER_TEMP/swr-capture" --wave "$SWR_WAVE" @@ -247,15 +237,9 @@ jobs: run: cargo test --locked --release -p coreav-aac --test conformance conformance_streams -- --ignored --nocapture # Bars 2 to 5 (docs/design/audio-decode.md, "AAC-LC bars"): against # the pinned oracle FFmpeg (scripts/oracle-ffmpeg.env). - - name: Cache the pinned FFmpeg - id: ffmpeg-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.ffmpeg-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Build the command with the feature aac run: | set -euo pipefail @@ -333,15 +317,9 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - - name: Cache the pinned FFmpeg - id: ffmpeg-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.ffmpeg-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: The generated set's sources run: | python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/coreav-oracle-bin" @@ -408,15 +386,9 @@ jobs: done | xargs -P 8 -n 2 sh -c 'curl -fsSL --retry 3 -o "$1" "$0"' - name: Check the streams run: cd "$RUNNER_TEMP/aac" && sha256sum --quiet -c "$GITHUB_WORKSPACE/crates/coreav-aac/tests/conformance.sha256" - - name: Cache the pinned FFmpeg - id: ffmpeg-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.ffmpeg-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: he-aac-generated @@ -565,13 +537,8 @@ jobs: COREAV_OPUS_VECTORS: ${{ runner.temp }}/opus-vectors/opus_newvectors COREAV_OPUS_COMPARE: ${{ runner.temp }}/opus-compare/opus_compare run: cargo test --locked --release -p coreav-opus -- --ignored --nocapture - - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 - id: oracle - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} - - if: steps.oracle.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + - uses: ./.github/actions/oracle-cache + - run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Qualify scoped Opus MP4 presentation and terminal output run: | python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/coreav-oracle-bin" diff --git a/.github/workflows/avi-output.yml b/.github/workflows/avi-output.yml index 3cba581af..f2d652277 100644 --- a/.github/workflows/avi-output.yml +++ b/.github/workflows/avi-output.yml @@ -24,7 +24,8 @@ on: - scripts/oracle_audio.py - scripts/oracle-ffmpeg-macos.env - scripts/oracle-audio-args.txt - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - .github/workflows/avi-output.yml workflow_dispatch: @@ -47,8 +48,9 @@ jobs: with: toolchain: stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + - uses: ./.github/actions/oracle-cache - name: Install the pinned oracle - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Build commands and run packet tests id: build run: | diff --git a/.github/workflows/ci-full.yml b/.github/workflows/ci-full.yml index f8b025940..9d039cfdd 100644 --- a/.github/workflows/ci-full.yml +++ b/.github/workflows/ci-full.yml @@ -230,12 +230,14 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install pinned FFmpeg, ffprobe and MediaInfo if: steps.ffmpeg-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | @@ -320,11 +322,13 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install the pinned oracle if: steps.ffmpeg-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f74563bb0..300fe8e91 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -160,7 +160,8 @@ jobs: uses: ./.github/actions/changed-paths with: paths: | - scripts/install-oracle-ffmpeg.sh + scripts/install-ci-oracle-ffmpeg.sh + .github/actions/oracle-cache/action.yml - id: bench-guard uses: ./.github/actions/changed-paths with: @@ -170,7 +171,8 @@ jobs: Cargo.lock rust-toolchain.toml scripts/gen-fixtures.sh - scripts/install-oracle-ffmpeg.sh + scripts/install-ci-oracle-ffmpeg.sh + .github/actions/oracle-cache/action.yml scripts/oracle-ffmpeg.env scripts/bench_guard.py scripts/ts_craft.py @@ -250,12 +252,14 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-encoders - key: linux-x64-encoders-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-x264.sh') }} + key: linux-x64-encoders-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-x264.sh') }} + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-encoders" - name: Install the pinned FFmpeg and build x264 if: steps.encoders-cache.outputs.cache-hit != 'true' run: | sudo apt-get install -y --no-install-recommends nasm - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-encoders" scripts/install-x264.sh "$RUNNER_TEMP/coreav-encoders" - name: Verify the pinned encoder oracle run: | @@ -706,12 +710,14 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install pinned FFmpeg, ffprobe and MediaInfo if: steps.ffmpeg-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | @@ -939,12 +945,14 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install pinned FFmpeg, ffprobe and MediaInfo if: steps.ffmpeg-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | @@ -1034,12 +1042,14 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install pinned FFmpeg, ffprobe and MediaInfo if: steps.ffmpeg-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | @@ -1245,12 +1255,14 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install pinned FFmpeg, ffprobe and MediaInfo if: steps.ffmpeg-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | @@ -1502,11 +1514,13 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install pinned FFmpeg, ffprobe and MediaInfo if: steps.bin-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | @@ -1718,11 +1732,13 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install pinned FFmpeg and ffprobe if: steps.bin-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | @@ -2001,15 +2017,9 @@ jobs: - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: save-if: ${{ github.ref == 'refs/heads/main' }} - - name: Cache the pinned FFmpeg - id: ffmpeg-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.ffmpeg-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Decode the synthetic set in both modes run: | python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/coreav-oracle-bin" @@ -2205,15 +2215,9 @@ jobs: # Since the decoder build moved to target/decoder: an entry saved # before has none, and rust-cache does not save over an exact hit. key: decoder - - name: Cache the pinned FFmpeg - id: ffmpeg-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.ffmpeg-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install Valgrind run: sudo apt-get update -q && sudo apt-get install -y --no-install-recommends valgrind - name: Generate the fixtures @@ -2424,11 +2428,8 @@ jobs: python3 scripts/encoders/svt-av1/build.py --target x86_64-unknown-linux-musl --prefix "$RUNNER_TEMP/svt-av1" --jobs 2 fi packages/cli/scripts/codecs.sh x86_64-unknown-linux-musl "$RUNNER_TEMP/dav1d" dav1d - - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} - - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + - uses: ./.github/actions/oracle-cache + - run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Test AV1 frame ownership and worker protocol run: cargo test -p coreav-transcode --features svt-av1 --lib --test av1 --test av1_timeline --test av1_process --test contracts --locked - name: Build the opt-in sandboxed AV1 CLI diff --git a/.github/workflows/codec-coverage.yml b/.github/workflows/codec-coverage.yml index 19cdec557..a8016649b 100644 --- a/.github/workflows/codec-coverage.yml +++ b/.github/workflows/codec-coverage.yml @@ -65,7 +65,8 @@ on: - scripts/tests/test_registered_candidate.py - scripts/oracle-ffmpeg.env - scripts/oracle-ffmpeg-macos.env - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - scripts/install-x264.sh - scripts/clip_check.py - scripts/codec_coverage_gcp.py @@ -406,15 +407,9 @@ jobs: with: name: coverage-binaries path: ${{ runner.temp }}/bin - - name: Cache the pinned FFmpeg - id: oracle-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/oracle - key: coverage-oracle-${{ hashFiles('scripts/install-oracle-ffmpeg.sh', 'scripts/oracle-ffmpeg.env') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.oracle-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Verify the pinned FFmpeg run: python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - name: Record the host @@ -539,15 +534,9 @@ jobs: with: name: coverage-binaries path: ${{ runner.temp }}/bin - - name: Cache the pinned FFmpeg - id: oracle-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/oracle - key: coverage-oracle-${{ hashFiles('scripts/install-oracle-ffmpeg.sh', 'scripts/oracle-ffmpeg.env') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.oracle-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Verify the pinned FFmpeg run: python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable @@ -600,15 +589,9 @@ jobs: with: name: coverage-binaries path: ${{ runner.temp }}/bin - - name: Cache the pinned FFmpeg - id: oracle-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/oracle - key: coverage-oracle-${{ hashFiles('scripts/install-oracle-ffmpeg.sh', 'scripts/oracle-ffmpeg.env') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.oracle-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Verify the pinned FFmpeg run: python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - name: Make the fixtures with the pinned FFmpeg @@ -727,10 +710,11 @@ jobs: with: name: coverage-binaries path: ${{ runner.temp }}/bin + - uses: ./.github/actions/oracle-cache - name: Install and verify the pinned image oracle run: | set -euo pipefail - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - name: Generate and check the registered fixture inputs run: | diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml index c565224ad..127e81461 100644 --- a/.github/workflows/deny.yml +++ b/.github/workflows/deny.yml @@ -83,6 +83,7 @@ jobs: python3 -I scripts/compat_frozen_check.py python3 -I scripts/oracle_pin.py --check python3 -I scripts/workflow_check_selftest.py + python3 -I -m unittest discover -s scripts/tests -p 'test_oracle_install.py' -v python3 -I -m unittest discover -s .github/actions/changed-paths/tests -p 'test_*.py' python3 -I scripts/pr_text_check_selftest.py python3 -I scripts/pr_shape_check_selftest.py @@ -126,16 +127,11 @@ jobs: # docs/measurements/compat-ffprobe.md says what its JSON evidence # holds (tools/compat-corpus/record.py). It runs here, not in ci.yml, # because the notes it reads are behind that workflow's path filter. - - name: Cache the pinned test oracle + - uses: ./.github/actions/oracle-cache if: steps.result.outputs.reuse != 'true' - id: test-oracle-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-test-oracle - key: linux-x64-test-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} - name: Install the pinned test oracle - if: steps.result.outputs.reuse != 'true' && steps.test-oracle-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-test-oracle" + if: steps.result.outputs.reuse != 'true' + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-test-oracle" - name: Verify the test oracle before real Python discovery if: steps.result.outputs.reuse != 'true' run: | diff --git a/.github/workflows/flac-output.yml b/.github/workflows/flac-output.yml index 68ed81bfa..9cfda1a51 100644 --- a/.github/workflows/flac-output.yml +++ b/.github/workflows/flac-output.yml @@ -18,7 +18,8 @@ on: - scripts/oracle-audio-args.txt - scripts/oracle_pin.py - scripts/oracle-ffmpeg.env - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - tools/compat-corpus/speed.py - .github/workflows/flac-output.yml workflow_dispatch: @@ -47,9 +48,10 @@ jobs: with: toolchain: stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 + - uses: ./.github/actions/oracle-cache - name: Install and verify the pinned oracle run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - name: Check native frames and failure states env: diff --git a/.github/workflows/github-shapes.yml b/.github/workflows/github-shapes.yml index f97048ea5..1dcc506cd 100644 --- a/.github/workflows/github-shapes.yml +++ b/.github/workflows/github-shapes.yml @@ -12,7 +12,8 @@ on: - tools/compat-corpus/decoded_output.py - tools/compat-corpus/encode_breadth.py - tools/compat-corpus/tests/test_github_shapes*.py - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - scripts/install-x264.sh - scripts/oracle* - scripts/aac_pcm_eligibility.py @@ -50,8 +51,9 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false + - uses: ./.github/actions/oracle-cache - name: Install the pinned black-box oracle - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/writer-oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/writer-oracle" - name: Check actual writer output on independent controls run: | set -euo pipefail @@ -96,12 +98,13 @@ jobs: if not all(os.environ.get(name) for name in names): raise SystemExit('private_retention_configuration') PY + - uses: ./.github/actions/oracle-cache - name: Install build dependencies and pinned programs run: | set -euo pipefail sudo apt-get update -q sudo apt-get install -y --no-install-recommends libdav1d-dev libvpx-dev libopus-dev nasm pkg-config - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" scripts/install-x264.sh "$RUNNER_TEMP/oracle" python3 -m venv "$RUNNER_TEMP/aac-python" "$RUNNER_TEMP/aac-python/bin/pip" install --quiet --only-binary=:all: --require-hashes -r scripts/aac-pns-requirements.txt @@ -168,10 +171,11 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false + - uses: ./.github/actions/oracle-cache - name: Install the pinned oracle and transform dependency run: | set -euo pipefail - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/aac-oracle" + scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/aac-oracle" python3 -m venv "$RUNNER_TEMP/aac-python" "$RUNNER_TEMP/aac-python/bin/pip" install --quiet --only-binary=:all: --require-hashes -r scripts/aac-pns-requirements.txt echo "$RUNNER_TEMP/aac-python/bin" >> "$GITHUB_PATH" diff --git a/.github/workflows/h264-encoder.yml b/.github/workflows/h264-encoder.yml index ee1057c3e..b0ee60c7b 100644 --- a/.github/workflows/h264-encoder.yml +++ b/.github/workflows/h264-encoder.yml @@ -25,7 +25,8 @@ on: - scripts/jm-decoder.env - scripts/oracle-ffmpeg.env - scripts/oracle_pin.py - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - scripts/gen-fixtures.sh - .github/workflows/h264-encoder.yml - Cargo.toml @@ -52,7 +53,8 @@ on: - scripts/jm-decoder.env - scripts/oracle-ffmpeg.env - scripts/oracle_pin.py - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - scripts/gen-fixtures.sh - .github/workflows/h264-encoder.yml - Cargo.toml @@ -181,9 +183,10 @@ jobs: python3 -I -m unittest discover -s scripts/tests -p 'test_h264_deblock.py' python3 -I -m unittest discover -s scripts/tests -p 'test_h264_p.py' python3 -I -m unittest discover -s scripts/tests -p 'test_h264_crf.py' + - uses: ./.github/actions/oracle-cache - name: Install black-box decoder oracles run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/g1-oracles" + scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/g1-oracles" bash scripts/install-jm-decoder.sh "$RUNNER_TEMP/g1-oracles" python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/g1-oracles" cat "$RUNNER_TEMP/g1-oracles/jm-build.txt" diff --git a/.github/workflows/hevc-conformance.yml b/.github/workflows/hevc-conformance.yml index 38f4ea510..a0347544e 100644 --- a/.github/workflows/hevc-conformance.yml +++ b/.github/workflows/hevc-conformance.yml @@ -5,10 +5,10 @@ name: hevc-conformance on: push: branches: [main] - paths: ["crates/coreav-hevc/**", "crates/coreav-kernels-hevc/**", "crates/coreav-backend-hevc/**", "crates/coreav-thumbnail/**", "crates/coreav-decode/**", "crates/coreav-frame/**", "crates/coreav-isobmff/**", "crates/coreav-cli/**", "bench/hevc-conformance/**", "scripts/hevc_conformance.py", "scripts/hevc_intra.py", "scripts/hevc_decode.py", "scripts/hevc_boundary.py", "scripts/hevc_fixture.py", "scripts/hevc_synthetic.py", "scripts/hevc_smoke.py", "scripts/test_oracle.py", "scripts/hevc_oracle_input.py", "scripts/tests/test_hevc*.py", "docs/measurements/hevc-native/roster.json", "docs/measurements/transcode/round-2/corpus-selection.json", "docs/spikes/thumbnail-bench/evidence/speed-dev-2.jsonl", "docs/spikes/thumbnail-bench/evidence/speed-2-hevc.jsonl", "docs/measurements/transcode/speed-selection.json", "tools/compat-corpus/**", "tools/stage3-report/**", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", "scripts/oracle_pin.py", "scripts/oracle_from_r2.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "Cargo.toml", "Cargo.lock", ".github/workflows/hevc-conformance.yml"] + paths: ["crates/coreav-hevc/**", "crates/coreav-kernels-hevc/**", "crates/coreav-backend-hevc/**", "crates/coreav-thumbnail/**", "crates/coreav-decode/**", "crates/coreav-frame/**", "crates/coreav-isobmff/**", "crates/coreav-cli/**", "bench/hevc-conformance/**", "scripts/hevc_conformance.py", "scripts/hevc_intra.py", "scripts/hevc_decode.py", "scripts/hevc_boundary.py", "scripts/hevc_fixture.py", "scripts/hevc_synthetic.py", "scripts/hevc_smoke.py", "scripts/test_oracle.py", "scripts/hevc_oracle_input.py", "scripts/tests/test_hevc*.py", "docs/measurements/hevc-native/roster.json", "docs/measurements/transcode/round-2/corpus-selection.json", "docs/spikes/thumbnail-bench/evidence/speed-dev-2.jsonl", "docs/spikes/thumbnail-bench/evidence/speed-2-hevc.jsonl", "docs/measurements/transcode/speed-selection.json", "tools/compat-corpus/**", "tools/stage3-report/**", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", "scripts/oracle_pin.py", "scripts/oracle_from_r2.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "Cargo.toml", "Cargo.lock", ".github/workflows/hevc-conformance.yml"] pull_request: types: [opened, synchronize, reopened, ready_for_review] - paths: ["crates/coreav-hevc/**", "crates/coreav-kernels-hevc/**", "crates/coreav-backend-hevc/**", "crates/coreav-thumbnail/**", "crates/coreav-decode/**", "crates/coreav-frame/**", "crates/coreav-isobmff/**", "crates/coreav-cli/**", "bench/hevc-conformance/**", "scripts/hevc_conformance.py", "scripts/hevc_intra.py", "scripts/hevc_decode.py", "scripts/hevc_boundary.py", "scripts/hevc_fixture.py", "scripts/hevc_synthetic.py", "scripts/hevc_smoke.py", "scripts/test_oracle.py", "scripts/hevc_oracle_input.py", "scripts/tests/test_hevc*.py", "docs/measurements/hevc-native/roster.json", "docs/measurements/transcode/round-2/corpus-selection.json", "docs/spikes/thumbnail-bench/evidence/speed-dev-2.jsonl", "docs/spikes/thumbnail-bench/evidence/speed-2-hevc.jsonl", "docs/measurements/transcode/speed-selection.json", "tools/compat-corpus/**", "tools/stage3-report/**", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", "scripts/oracle_pin.py", "scripts/oracle_from_r2.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "Cargo.toml", "Cargo.lock", ".github/workflows/hevc-conformance.yml"] + paths: ["crates/coreav-hevc/**", "crates/coreav-kernels-hevc/**", "crates/coreav-backend-hevc/**", "crates/coreav-thumbnail/**", "crates/coreav-decode/**", "crates/coreav-frame/**", "crates/coreav-isobmff/**", "crates/coreav-cli/**", "bench/hevc-conformance/**", "scripts/hevc_conformance.py", "scripts/hevc_intra.py", "scripts/hevc_decode.py", "scripts/hevc_boundary.py", "scripts/hevc_fixture.py", "scripts/hevc_synthetic.py", "scripts/hevc_smoke.py", "scripts/test_oracle.py", "scripts/hevc_oracle_input.py", "scripts/tests/test_hevc*.py", "docs/measurements/hevc-native/roster.json", "docs/measurements/transcode/round-2/corpus-selection.json", "docs/spikes/thumbnail-bench/evidence/speed-dev-2.jsonl", "docs/spikes/thumbnail-bench/evidence/speed-2-hevc.jsonl", "docs/measurements/transcode/speed-selection.json", "tools/compat-corpus/**", "tools/stage3-report/**", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", "scripts/oracle_pin.py", "scripts/oracle_from_r2.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "Cargo.toml", "Cargo.lock", ".github/workflows/hevc-conformance.yml"] schedule: - cron: "45 3 * * *" - cron: "45 4 * * 0" @@ -104,8 +104,9 @@ jobs: with: toolchain: stable - run: cargo build --locked --release -p coreav-hevc --features native-hevc --example headers --example intra + - uses: ./.github/actions/oracle-cache - name: Install the pinned binary oracle - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Verify registered synthetic references before smoke comparison run: | python3 -I scripts/hevc_fixture.py verify \ @@ -142,8 +143,9 @@ jobs: toolchain: stable - run: cargo build --locked --release -p coreav-hevc --features native-hevc${{ inputs.scalar && ',scalar' || '' }} --example headers --example intra --example decode - run: cargo build --locked --release -p coreav-backend-hevc --features native-hevc${{ inputs.scalar && ',coreav-hevc/scalar' || '' }} --example boundary + - uses: ./.github/actions/oracle-cache - name: Install the pinned binary oracle - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Verify registered synthetic references before native classification run: | python3 -I scripts/hevc_fixture.py verify \ @@ -213,8 +215,9 @@ jobs: toolchain: stable - run: cargo build --locked --release -p coreav-hevc --features native-hevc${{ inputs.scalar && ',scalar' || '' }} --example headers --example intra --example packets - run: cargo build --locked --release -p coreav-backend-hevc --features native-hevc${{ inputs.scalar && ',coreav-hevc/scalar' || '' }} --example boundary + - uses: ./.github/actions/oracle-cache - name: Install the pinned binary oracle - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Inspect all fixed files with isolated metadata subprocesses env: R2_ENDPOINT: ${{ secrets.COREAV_CORPUS_R2_ENDPOINT }} diff --git a/.github/workflows/input-summary.yml b/.github/workflows/input-summary.yml index 9d6134de8..e1acf4f60 100644 --- a/.github/workflows/input-summary.yml +++ b/.github/workflows/input-summary.yml @@ -31,7 +31,8 @@ on: - scripts/oracle-ffmpeg.env - scripts/oracle_pin.py - scripts/oracle_pin_macos.py - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - scripts/tests/test_input_summary_*.py - .github/workflows/input-summary.yml workflow_dispatch: @@ -65,8 +66,9 @@ jobs: toolchain: stable - name: Verify fixture checker behavior run: python3 -I -m unittest discover -s scripts/tests -p 'test_input_summary_*.py' + - uses: ./.github/actions/oracle-cache - name: Install the pinned black-box oracle - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Build the native CLI run: cargo build --locked --release -p coreav-cli --bin coreav - name: Compare exact summary bytes @@ -95,8 +97,9 @@ jobs: (pathlib.Path(os.environ['RUNNER_TEMP']) / 'evidence.pem').write_bytes(value) PY openssl x509 -in "$RUNNER_TEMP/evidence.pem" -noout + - uses: ./.github/actions/oracle-cache - name: Install the pinned black-box oracle - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Build the native CLI run: cargo build --locked --release -p coreav-cli --bin coreav - name: Compare development summaries without held-out inputs diff --git a/.github/workflows/mediainfo-oracle.yml b/.github/workflows/mediainfo-oracle.yml index 54b0c45ca..a076b8731 100644 --- a/.github/workflows/mediainfo-oracle.yml +++ b/.github/workflows/mediainfo-oracle.yml @@ -27,7 +27,8 @@ on: paths: - tools/mediainfo-oracle/** - scripts/oracle-ffmpeg.env - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - .github/workflows/mediainfo-oracle.yml workflow_dispatch: @@ -60,11 +61,13 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install pinned FFmpeg, ffprobe and MediaInfo if: steps.bin-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml index bbe0ad843..ea32c9240 100644 --- a/.github/workflows/npm.yml +++ b/.github/workflows/npm.yml @@ -98,7 +98,8 @@ jobs: # The policy examples both test suites run over. docs/schema/policy-examples/** scripts/oracle-ffmpeg.env - scripts/install-oracle-ffmpeg.sh + scripts/install-ci-oracle-ffmpeg.sh + .github/actions/oracle-cache/action.yml scripts/binaryen.env scripts/install-binaryen.sh .github/workflows/npm.yml @@ -177,11 +178,13 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + - uses: ./.github/actions/oracle-cache + - name: Install the checksum-verified FFmpeg + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Install pinned FFmpeg if: steps.ffmpeg-cache.outputs.cache-hit != 'true' run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Use pinned binaries run: | diff --git a/.github/workflows/opus-encode.yml b/.github/workflows/opus-encode.yml index 846a7be11..0e0a93d1f 100644 --- a/.github/workflows/opus-encode.yml +++ b/.github/workflows/opus-encode.yml @@ -12,10 +12,10 @@ name: opus-encode on: push: branches: [main] - paths: ["crates/coreav-backend-libopus/**", "crates/coreav-worker/src/opus.rs", "crates/coreav-transcode/src/audio.rs", "scripts/opus_encode_check.py", "packages/cli/scripts/codecs.sh", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", ".github/workflows/opus-encode.yml"] + paths: ["crates/coreav-backend-libopus/**", "crates/coreav-worker/src/opus.rs", "crates/coreav-transcode/src/audio.rs", "scripts/opus_encode_check.py", "packages/cli/scripts/codecs.sh", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", ".github/workflows/opus-encode.yml"] pull_request: types: [opened, synchronize, reopened, ready_for_review] - paths: ["crates/coreav-backend-libopus/**", "crates/coreav-worker/src/opus.rs", "crates/coreav-transcode/src/audio.rs", "scripts/opus_encode_check.py", "packages/cli/scripts/codecs.sh", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", ".github/workflows/opus-encode.yml"] + paths: ["crates/coreav-backend-libopus/**", "crates/coreav-worker/src/opus.rs", "crates/coreav-transcode/src/audio.rs", "scripts/opus_encode_check.py", "packages/cli/scripts/codecs.sh", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", ".github/workflows/opus-encode.yml"] workflow_dispatch: permissions: @@ -48,15 +48,9 @@ jobs: set -euo pipefail sudo apt-get update -q && sudo apt-get install -y --no-install-recommends meson ninja-build packages/cli/scripts/codecs.sh x86_64-unknown-linux-gnu "$RUNNER_TEMP/codecs" opus - - name: Cache the pinned FFmpeg - id: ffmpeg-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.ffmpeg-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Check the pinned FFmpeg run: python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/coreav-oracle-bin" - name: Build coreav with libopus diff --git a/.github/workflows/png-bmp-yuv.yml b/.github/workflows/png-bmp-yuv.yml index af8329a9c..4bc075625 100644 --- a/.github/workflows/png-bmp-yuv.yml +++ b/.github/workflows/png-bmp-yuv.yml @@ -15,6 +15,7 @@ on: - tools/compat-corpus/** - docs/design/png-bmp-yuv-v1.md - .github/workflows/png-bmp-yuv.yml + - .github/actions/oracle-cache/action.yml push: branches: [main] paths: @@ -27,6 +28,7 @@ on: - tools/compat-corpus/** - docs/design/png-bmp-yuv-v1.md - .github/workflows/png-bmp-yuv.yml + - .github/actions/oracle-cache/action.yml workflow_dispatch: permissions: @@ -49,10 +51,11 @@ jobs: toolchain: stable - name: Install the worker decoder dependency run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libvpx-dev pkg-config + - uses: ./.github/actions/oracle-cache - name: Install and verify the frozen oracle run: | set -euo pipefail - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/image-oracle" + scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/image-oracle" python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/image-oracle" - name: Build the normal command and both harnesses run: | diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml index 75132dacb..7ae3574ba 100644 --- a/.github/workflows/python.yml +++ b/.github/workflows/python.yml @@ -75,7 +75,8 @@ jobs: # The policy examples both test suites run over. docs/schema/policy-examples/** scripts/oracle-ffmpeg.env - scripts/install-oracle-ffmpeg.sh + scripts/install-ci-oracle-ffmpeg.sh + .github/actions/oracle-cache/action.yml .github/workflows/python.yml .github/actions/changed-paths/** .github/actions/merge-group-result/** @@ -100,15 +101,9 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - - name: Cache the pinned FFmpeg - id: ffmpeg-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.ffmpeg-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Generate the fixtures env: COREAV_REQUIRE_ALL_FIXTURES: '1' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5fc51995e..dd2233eba 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -42,7 +42,8 @@ on: - scripts/oracle_audio.py - scripts/oracle-ffmpeg-macos.env - scripts/oracle-audio-args.txt - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - crates/**/Cargo.toml - Cargo.toml - Cargo.lock @@ -70,10 +71,11 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false + - uses: ./.github/actions/oracle-cache - name: Generate the clips with the pinned FFmpeg run: | set -euo pipefail - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/ffmpeg" + scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/ffmpeg" PATH="$RUNNER_TEMP/ffmpeg:$PATH" packages/cli/test/release-clips.sh "$RUNNER_TEMP/clips" # Not named release-*: release-checksums gathers every artifact of # that name into the release's files. diff --git a/.github/workflows/vp9-corpus.yml b/.github/workflows/vp9-corpus.yml index 5f7d38a4d..761d377f2 100644 --- a/.github/workflows/vp9-corpus.yml +++ b/.github/workflows/vp9-corpus.yml @@ -3,10 +3,10 @@ name: vp9-corpus on: push: branches: [main] - paths: ["crates/coreav-vp9/**", "crates/coreav-backend-vp9/**", "crates/coreav-decode/**", "crates/coreav-frame/**", "crates/coreav-kernels-vp9/**", "crates/coreav-mkv/**", "crates/coreav-isobmff/**", "tools/vp9-corpus-oracle/**", "scripts/vp9_corpus.py", "scripts/vp9_smoke.py", "scripts/tests/test_vp9_smoke.py", "scripts/tests/test_vp9_corpus*.py", "docs/measurements/vp9-native/**", "tools/compat-corpus/round_files.py", "tools/compat-corpus/release_round.py", "tools/compat-corpus/evidence-public.pem", "tools/stage3-report/r2pool.py", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", "scripts/oracle_pin.py", "scripts/oracle_from_r2.py", "Cargo.toml", "Cargo.lock", ".github/workflows/vp9-corpus.yml"] + paths: ["crates/coreav-vp9/**", "crates/coreav-backend-vp9/**", "crates/coreav-decode/**", "crates/coreav-frame/**", "crates/coreav-kernels-vp9/**", "crates/coreav-mkv/**", "crates/coreav-isobmff/**", "tools/vp9-corpus-oracle/**", "scripts/vp9_corpus.py", "scripts/vp9_smoke.py", "scripts/tests/test_vp9_smoke.py", "scripts/tests/test_vp9_corpus*.py", "docs/measurements/vp9-native/**", "tools/compat-corpus/round_files.py", "tools/compat-corpus/release_round.py", "tools/compat-corpus/evidence-public.pem", "tools/stage3-report/r2pool.py", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", "scripts/oracle_pin.py", "scripts/oracle_from_r2.py", "Cargo.toml", "Cargo.lock", ".github/workflows/vp9-corpus.yml"] pull_request: types: [opened, synchronize, reopened, ready_for_review] - paths: ["crates/coreav-vp9/**", "crates/coreav-backend-vp9/**", "crates/coreav-decode/**", "crates/coreav-frame/**", "crates/coreav-kernels-vp9/**", "crates/coreav-mkv/**", "crates/coreav-isobmff/**", "tools/vp9-corpus-oracle/**", "scripts/vp9_corpus.py", "scripts/vp9_smoke.py", "scripts/tests/test_vp9_smoke.py", "scripts/tests/test_vp9_corpus*.py", "docs/measurements/vp9-native/**", "tools/compat-corpus/round_files.py", "tools/compat-corpus/release_round.py", "tools/compat-corpus/evidence-public.pem", "tools/stage3-report/r2pool.py", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", "scripts/oracle_pin.py", "scripts/oracle_from_r2.py", "Cargo.toml", "Cargo.lock", ".github/workflows/vp9-corpus.yml"] + paths: ["crates/coreav-vp9/**", "crates/coreav-backend-vp9/**", "crates/coreav-decode/**", "crates/coreav-frame/**", "crates/coreav-kernels-vp9/**", "crates/coreav-mkv/**", "crates/coreav-isobmff/**", "tools/vp9-corpus-oracle/**", "scripts/vp9_corpus.py", "scripts/vp9_smoke.py", "scripts/tests/test_vp9_smoke.py", "scripts/tests/test_vp9_corpus*.py", "docs/measurements/vp9-native/**", "tools/compat-corpus/round_files.py", "tools/compat-corpus/release_round.py", "tools/compat-corpus/evidence-public.pem", "tools/stage3-report/r2pool.py", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", "scripts/oracle_pin.py", "scripts/oracle_from_r2.py", "Cargo.toml", "Cargo.lock", ".github/workflows/vp9-corpus.yml"] schedule: - cron: '11 17 * * *' - cron: '11 18 * * 0' @@ -67,15 +67,9 @@ jobs: cargo test --locked -p coreav-vp9-corpus-oracle --features native-vp9 cargo clippy --locked -p coreav-vp9-corpus-oracle --features native-vp9 --all-targets -- -D warnings cargo build --locked --release -p coreav-vp9-corpus-oracle --features native-vp9 - - name: Cache the pinned FFmpeg - id: ffmpeg-cache - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned FFmpeg - if: steps.ffmpeg-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Preflight the original-file oracle on a pinned public vector run: | set -euo pipefail diff --git a/.github/workflows/vp9-filter.yml b/.github/workflows/vp9-filter.yml index 7829d9c7e..9b634392d 100644 --- a/.github/workflows/vp9-filter.yml +++ b/.github/workflows/vp9-filter.yml @@ -4,9 +4,9 @@ name: vp9-filter on: push: branches: [main] - paths: ["scripts/vp9_filter*.py", "scripts/tests/test_vp9_filter*.py", "scripts/vp9_corpus.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "scripts/oracle_pin.py", "scripts/test_oracle.py", "scripts/oracle_pin_macos.py", "scripts/oracle_from_r2.py", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", "docs/measurements/vp9-filter-coverage/plan.json", "tools/vp9-corpus-oracle/**", "crates/coreav-vp9/**", "crates/coreav-kernels-vp9/**", "crates/coreav-mkv/**", "Cargo.toml", "Cargo.lock", ".github/workflows/vp9-filter.yml"] + paths: ["scripts/vp9_filter*.py", "scripts/tests/test_vp9_filter*.py", "scripts/vp9_corpus.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "scripts/oracle_pin.py", "scripts/test_oracle.py", "scripts/oracle_pin_macos.py", "scripts/oracle_from_r2.py", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", "docs/measurements/vp9-filter-coverage/plan.json", "tools/vp9-corpus-oracle/**", "crates/coreav-vp9/**", "crates/coreav-kernels-vp9/**", "crates/coreav-mkv/**", "Cargo.toml", "Cargo.lock", ".github/workflows/vp9-filter.yml"] pull_request: - paths: ["scripts/vp9_filter*.py", "scripts/tests/test_vp9_filter*.py", "scripts/vp9_corpus.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "scripts/oracle_pin.py", "scripts/test_oracle.py", "scripts/oracle_pin_macos.py", "scripts/oracle_from_r2.py", "scripts/oracle-ffmpeg.env", "scripts/install-oracle-ffmpeg.sh", "docs/measurements/vp9-filter-coverage/plan.json", "tools/vp9-corpus-oracle/**", "crates/coreav-vp9/**", "crates/coreav-kernels-vp9/**", "crates/coreav-mkv/**", "Cargo.toml", "Cargo.lock", ".github/workflows/vp9-filter.yml"] + paths: ["scripts/vp9_filter*.py", "scripts/tests/test_vp9_filter*.py", "scripts/vp9_corpus.py", "scripts/oracle_audio.py", "scripts/oracle-audio-args.txt", "scripts/oracle_pin.py", "scripts/test_oracle.py", "scripts/oracle_pin_macos.py", "scripts/oracle_from_r2.py", "scripts/oracle-ffmpeg.env", "scripts/install-ci-oracle-ffmpeg.sh", ".github/actions/oracle-cache/action.yml", "docs/measurements/vp9-filter-coverage/plan.json", "tools/vp9-corpus-oracle/**", "crates/coreav-vp9/**", "crates/coreav-kernels-vp9/**", "crates/coreav-mkv/**", "Cargo.toml", "Cargo.lock", ".github/workflows/vp9-filter.yml"] workflow_dispatch: inputs: mode: @@ -49,14 +49,9 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Build the unpublished scalar adapter run: cargo build --locked --release -p coreav-vp9-corpus-oracle - - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 - id: oracle - with: - path: ${{ runner.temp }}/oracle - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned oracle - if: steps.oracle.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Verify the oracle including cache hits run: python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - name: Capture the registered filter controls diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml index 0d4cedc9a..8b43f39e6 100644 --- a/.github/workflows/wasm.yml +++ b/.github/workflows/wasm.yml @@ -28,7 +28,8 @@ on: - scripts/iso_patch.py - scripts/stss_craft.py - docs/schema/policy-examples/** - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - scripts/oracle-ffmpeg.env - scripts/test_oracle.py - scripts/oracle_pin.py @@ -68,7 +69,8 @@ on: - scripts/iso_patch.py - scripts/stss_craft.py - docs/schema/policy-examples/** - - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - scripts/oracle-ffmpeg.env - scripts/test_oracle.py - scripts/oracle_pin.py @@ -161,21 +163,16 @@ jobs: set -euo pipefail helpers=$(grep -o '\$SCRIPTS/[A-Za-z0-9_.-]*' scripts/gen-fixtures.sh | sed 's|^\$SCRIPTS/|scripts/|' | sort -u) support=$(python3 -I -B -c 'import sys; sys.path.insert(0, "scripts"); from test_oracle import SUPPORT; print(" ".join("scripts/" + name for name in SUPPORT))') - identity="$(cat scripts/gen-fixtures.sh scripts/install-oracle-ffmpeg.sh scripts/oracle-ffmpeg.env $helpers $support | sha256sum | cut -c1-32)" + identity="$(cat scripts/gen-fixtures.sh scripts/install-ci-oracle-ffmpeg.sh scripts/oracle-ffmpeg.env $helpers $support | sha256sum | cut -c1-32)" echo "key=linux-x64-fixtures-$identity" >> "$GITHUB_OUTPUT" - uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 id: fixtures with: path: ${{ runner.temp }}/coreav-fixtures key: ${{ steps.fixtures-key.outputs.key }} - - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 - id: oracle-cache - with: - path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }} + - uses: ./.github/actions/oracle-cache - name: Install the pinned fixture generator - if: steps.oracle-cache.outputs.cache-hit != 'true' - run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Generate required fixtures if: steps.fixtures.outputs.cache-hit != 'true' env: diff --git a/docs/agents/ffmpeg-cli.md b/docs/agents/ffmpeg-cli.md index 6358e1661..2a5cf1399 100644 --- a/docs/agents/ffmpeg-cli.md +++ b/docs/agents/ffmpeg-cli.md @@ -2,6 +2,10 @@ CLI and ffprobe behavior, the FFmpeg pin, and fallback names. +Future oracle pins must select the last autobuild of a month and confirm that it belongs to the publisher's retained monthly set. The [release retention policy](https://github.com/BtbN/FFmpeg-Builds#release-retention-policy) keeps those builds for two years, but only the last fourteen daily builds. A cache is not permanent storage; reconsider acquisition before that retention expires. + +Ordinary CI uses `scripts/install-ci-oracle-ffmpeg.sh` with a SHA256-keyed archive cache. Registered and historical workflows retain `scripts/install-oracle-ffmpeg.sh` because its source identity is frozen. Both entry points read the same pin file; changing acquisition for current CI does not change registered measurement inputs. + | Rule | Enforced by | |---|---| | Newly admitted default-video options match the pinned oracle's decoded frames and aspect, not merely the existing explicit encoder path | The MP4 parser keeps implicit scale and bitrate on fallback; `transcode_job` admits implicit output size only when source dimensions match. `ffmpeg_default_video_encoder_applies_options` compares complete frame hashes and geometry/aspect with the oracle and checks unchanged destinations plus byte-exact fallback for excluded paths. Runtime source dimensions and external output cannot be established by argument types | diff --git a/scripts/install-ci-oracle-ffmpeg.sh b/scripts/install-ci-oracle-ffmpeg.sh new file mode 100755 index 000000000..7e105617b --- /dev/null +++ b/scripts/install-ci-oracle-ffmpeg.sh @@ -0,0 +1,52 @@ +#!/usr/bin/env bash +# Install the pinned oracle FFmpeg (scripts/oracle-ffmpeg.env): test-only +# black-box binaries; no libraries or implementation source. +set -euo pipefail +DEST="${1:?usage: install-ci-oracle-ffmpeg.sh /absolute/bin/dir}" +HERE=$(dirname "${BASH_SOURCE[0]}") +# shellcheck source=oracle-ffmpeg.env +source "$HERE/oracle-ffmpeg.env" +[[ "$(uname -s)" == Linux && "$(uname -m)" == x86_64 ]] || { + echo 'The pinned fixture binary supports Linux x86_64 only.' >&2 + exit 1 +} +mkdir -p "$DEST" +WORK=$(mktemp -d "$DEST/.download.XXXXXX") +trap 'rm -rf "$WORK"' EXIT +ARCHIVE_FILE="$WORK/ffmpeg.tar.xz" +CACHED_ARCHIVE="${COREAV_ORACLE_ARCHIVE:-${XDG_CACHE_HOME:-$HOME/.cache}/coreav-oracle/$SHA256.tar.xz}" +pinned() { + echo "$SHA256 $ARCHIVE_FILE" | sha256sum --check --strict +} +if [[ -f "$CACHED_ARCHIVE" ]]; then + cp "$CACHED_ARCHIVE" "$ARCHIVE_FILE" + if ! pinned; then + echo 'install-ci-oracle-ffmpeg.sh: discarding an unverified cached archive' >&2 + rm -f "$ARCHIVE_FILE" + fi +fi +if [[ ! -f "$ARCHIVE_FILE" ]]; then + if [[ "${COREAV_ORACLE_FROM_R2:-0}" == 1 ]] || + ! { curl --fail --location --retry 5 --retry-all-errors --retry-connrefused \ + --retry-max-time 300 --connect-timeout 20 --max-time 60 \ + "$URL" --output "$ARCHIVE_FILE" && pinned; }; then + if [[ -n "${R2_ACCESS_KEY_ID:-}" && -n "${R2_SECRET_ACCESS_KEY:-}" && -n "${R2_ENDPOINT:-}" ]]; then + echo 'install-ci-oracle-ffmpeg.sh: taking the pinned archive from R2' >&2 + python3 -I "$HERE/oracle_from_r2.py" "$ARCHIVE_FILE" + pinned + else + echo 'install-ci-oracle-ffmpeg.sh: oracle_download_unavailable after bounded retries' >&2 + exit 1 + fi + fi + mkdir -p "$(dirname "$CACHED_ARCHIVE")" + CACHE_PART=$(mktemp "$CACHED_ARCHIVE.XXXXXX") + cp "$ARCHIVE_FILE" "$CACHE_PART" + mv -f "$CACHE_PART" "$CACHED_ARCHIVE" +fi +tar -xJf "$ARCHIVE_FILE" -C "$WORK" "$ARCHIVE/bin/ffmpeg" "$ARCHIVE/bin/ffprobe" +python3 -I "$HERE/oracle_pin.py" --verify-bin "$WORK/$ARCHIVE/bin" +install -m 755 "$WORK/$ARCHIVE/bin/ffmpeg" "$WORK/$ARCHIVE/bin/ffprobe" "$DEST/" +python3 -I "$HERE/oracle_pin.py" --verify-bin "$DEST" +"$DEST/ffmpeg" -version +"$DEST/ffprobe" -version diff --git a/scripts/tests/test_hevc_workflow.py b/scripts/tests/test_hevc_workflow.py index f30cd21e3..ba19f86a6 100644 --- a/scripts/tests/test_hevc_workflow.py +++ b/scripts/tests/test_hevc_workflow.py @@ -72,7 +72,7 @@ def test_smoke_has_only_synthetic_work_and_safe_always_reports(self): workflow = (root / '.github/workflows/hevc-conformance.yml').read_text() job = workflow.split(' hevc-smoke:\n', 1)[1].split(' hevc-vectors:', 1)[0] for required in ('runs-on: ubuntu-24.04', 'timeout-minutes: 30', - '--example headers --example intra', 'scripts/install-oracle-ffmpeg.sh', + '--example headers --example intra', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/hevc_fixture.py verify', 'scripts/hevc_smoke.py', 'if: always()'): self.assertIn(required, job) for forbidden in ('secrets.', 'R2_', ' acquire ', 'corpus-online', 'hevc_decode.py'): diff --git a/scripts/tests/test_oracle_install.py b/scripts/tests/test_oracle_install.py new file mode 100644 index 000000000..644f198ee --- /dev/null +++ b/scripts/tests/test_oracle_install.py @@ -0,0 +1,211 @@ +"""Run the Linux installer with local archives and real HTTP failures.""" +import hashlib +import http.server +import io +import json +import os +from pathlib import Path +import shutil +import subprocess +import sys +import tarfile +import tempfile +import threading +import unittest + +ROOT = Path(__file__).resolve().parents[2] +sys.path.insert(0, str(ROOT / 'scripts')) +import oracle_pin +import workflow_check + + +class OracleInstall(unittest.TestCase): + def setUp(self): + temporary = tempfile.TemporaryDirectory() + self.addCleanup(temporary.cleanup) + self.root = Path(temporary.name) + self.scripts = self.root / 'scripts' + self.scripts.mkdir() + for name in ('install-ci-oracle-ffmpeg.sh', 'oracle_pin.py'): + shutil.copyfile(ROOT / 'scripts' / name, self.scripts / name) + self.tools = self.root / 'tools' + self.tools.mkdir() + uname = self.tools / 'uname' + uname.write_text('#!/bin/sh\ncase "$1" in -s) echo Linux;; -m) echo x86_64;; esac\n') + uname.chmod(0o755) + self.dest = self.root / 'bin' + self.cache = self.root / 'cache' / 'archive.tar.xz' + self.pin = oracle_pin.load() + self.pin['ARCHIVE'] = 'oracle-fixture' + self.programs = {} + archive = io.BytesIO() + with tarfile.open(fileobj=archive, mode='w:xz') as tar: + for name in ('ffmpeg', 'ffprobe'): + data = f'#!/bin/sh\necho "{name} version {self.pin["BUILD"]}"\n'.encode() + self.programs[name] = data + member = tarfile.TarInfo(f'{self.pin["ARCHIVE"]}/bin/{name}') + member.size, member.mode = len(data), 0o755 + tar.addfile(member, io.BytesIO(data)) + self.archive = archive.getvalue() + self.pin['SHA256'] = hashlib.sha256(self.archive).hexdigest() + self.statuses = [] + self.requests = [] + owner = self + + class Handler(http.server.BaseHTTPRequestHandler): + def do_GET(self): + status = owner.statuses.pop(0) if owner.statuses else 200 + owner.requests.append(status) + self.send_response(status) + self.end_headers() + self.wfile.write(owner.archive if status == 200 else b'unavailable') + + def log_message(self, *_args): + pass + + server = http.server.ThreadingHTTPServer(('127.0.0.1', 0), Handler) + thread = threading.Thread(target=server.serve_forever, daemon=True) + thread.start() + + def stop(): + server.shutdown() + server.server_close() + thread.join() + + self.addCleanup(stop) + self.pin['URL'] = f'http://127.0.0.1:{server.server_port}/archive' + self.env = {key: value for key, value in os.environ.items() + if not key.startswith(('R2_', 'COREAV_ORACLE_'))} + self.env.update(PATH=str(self.tools) + os.pathsep + os.environ['PATH'], + COREAV_ORACLE_ARCHIVE=str(self.cache), NO_PROXY='127.0.0.1') + + def install(self): + (self.scripts / 'oracle-ffmpeg.env').write_text(''.join(f'{k}={v}\n' for k, v in self.pin.items())) + return subprocess.run(['bash', str(self.scripts / 'install-ci-oracle-ffmpeg.sh'), str(self.dest)], + env=self.env, capture_output=True, text=True, timeout=45) + + def assert_installed(self, result): + self.assertEqual(result.returncode, 0, result.stdout + result.stderr) + for name, data in self.programs.items(): + self.assertEqual((self.dest / name).read_bytes(), data) + self.assertIn(f'{name} version {self.pin["BUILD"]}', result.stdout) + self.assertEqual(self.cache.read_bytes(), self.archive) + + def test_http_503_504_and_404_recover_with_real_curl_backoff(self): + self.statuses = [503, 504, 404, 200] + result = self.install() + self.assert_installed(result) + self.assertEqual(self.requests, [503, 504, 404, 200]) + self.assertNotIn('R2', result.stderr) + + def test_cache_hit_avoids_a_404_and_replaces_independent_binary_cache(self): + self.cache.parent.mkdir() + self.cache.write_bytes(self.archive) + self.dest.mkdir() + for name in self.programs: + (self.dest / name).write_text('unverified binary cache') + self.statuses = [404] + self.assert_installed(self.install()) + self.assertEqual(self.requests, []) + + def test_corrupt_cache_is_replaced_only_with_verified_download(self): + self.cache.parent.mkdir() + self.cache.write_bytes(b'corrupt cache') + result = self.install() + self.assert_installed(result) + self.assertEqual(self.requests, [200]) + self.assertIn('discarding an unverified cached archive', result.stderr) + + def test_wrong_download_hash_fails_without_r2_or_publishing(self): + self.archive += b'wrong bytes' + result = self.install() + self.assertNotEqual(result.returncode, 0, result.stdout + result.stderr) + self.assertIn('oracle_download_unavailable', result.stderr) + self.assertNotIn('R2', result.stderr) + self.assertFalse(self.cache.exists()) + self.assertFalse((self.dest / 'ffmpeg').exists()) + + def test_bad_build_in_a_checksum_valid_cache_is_not_installed(self): + self.cache.parent.mkdir() + self.cache.write_bytes(self.archive) + self.pin['BUILD'] = 'unregistered' + result = self.install() + self.assertNotEqual(result.returncode, 0, result.stdout + result.stderr) + self.assertIn('expected the', result.stderr) + self.assertEqual(self.requests, []) + self.assertFalse((self.dest / 'ffmpeg').exists()) + + def test_credentialed_r2_override_still_checks_the_archive(self): + fixture = self.root / 'r2-archive' + fixture.write_bytes(self.archive) + (self.scripts / 'oracle_from_r2.py').write_text( + 'import os, shutil, sys\nshutil.copyfile(os.environ["R2_FIXTURE"], sys.argv[1])\n') + self.env.update(COREAV_ORACLE_FROM_R2='1', R2_ACCESS_KEY_ID='fixture', + R2_SECRET_ACCESS_KEY='fixture', R2_ENDPOINT='fixture', R2_FIXTURE=str(fixture)) + self.assert_installed(self.install()) + self.cache.unlink() + fixture.write_bytes(b'corrupt mirror') + result = self.install() + self.assertNotEqual(result.returncode, 0, result.stdout + result.stderr) + self.assertFalse(self.cache.exists()) + self.assertEqual(self.requests, []) + + +class OracleArchiveWorkflow(unittest.TestCase): + def test_the_ci_installer_cannot_duplicate_the_pin(self): + with tempfile.TemporaryDirectory() as directory: + root = Path(directory) + (root / 'scripts').mkdir() + shutil.copyfile(ROOT / oracle_pin.PIN, root / oracle_pin.PIN) + installer = root / workflow_check.CI_ORACLE_PIN[1] + installer.write_text(f'URL={oracle_pin.load()["URL"]}\n') + subprocess.run(['git', 'init', '-q', str(root)], check=True) + subprocess.run(['git', '-C', str(root), 'add', '.'], check=True) + found = list(oracle_pin.problems(root)) + self.assertTrue(any(workflow_check.CI_ORACLE_PIN[1] in problem for problem in found), found) + + @staticmethod + def data(path): + return json.loads(subprocess.check_output( + ['ruby', '-ryaml', '-rjson', '-e', + 'puts JSON.generate(YAML.load_file(ARGV[0], aliases: true))', str(path)])) + + def test_archive_cache_is_keyed_only_by_the_pin_digest(self): + action = ROOT / '.github/actions/oracle-cache' + data = self.data(action / 'action.yml') + pin, cache = data['runs']['steps'] + self.assertEqual(cache['with']['key'], 'oracle-archive-${{ steps.pin.outputs.sha256 }}') + self.assertNotIn('restore-keys', cache['with']) + with tempfile.TemporaryDirectory() as directory: + output, env = Path(directory) / 'output', Path(directory) / 'env' + subprocess.run(['bash', '-e', '-c', pin['run']], check=True, env=os.environ | { + 'GITHUB_ACTION_PATH': str(action), 'GITHUB_OUTPUT': str(output), + 'GITHUB_ENV': str(env), 'RUNNER_TEMP': directory}) + sha = oracle_pin.load()['SHA256'] + self.assertEqual(output.read_text(), f'sha256={sha}\n') + self.assertEqual(env.read_text(), + f'COREAV_ORACLE_ARCHIVE={directory}/coreav-oracle-archive/{sha}.tar.xz\n') + + def test_cache_users_always_reinstall_from_the_verified_archive(self): + count = 0 + for path in (ROOT / '.github/workflows').glob('*.yml'): + for job in self.data(path).get('jobs', {}).values(): + steps = job.get('steps', []) + caches = [i for i, s in enumerate(steps) + if s.get('uses') == './.github/actions/oracle-cache'] + installers = [s for s in steps if any(workflow_check.calls_installer(line, workflow_check.CI_ORACLE_PIN[1]) + for line in s.get('run', '').splitlines())] + if installers: + self.assertTrue(caches, str(path)) + for i in caches: + installer = next((s for s in steps[i + 1:] if any( + workflow_check.calls_installer(line, workflow_check.CI_ORACLE_PIN[1]) for line in s.get('run', '').splitlines())), None) + self.assertIsNotNone(installer, str(path)) + self.assertNotIn('cache-hit', installer.get('if', ''), str(path)) + self.assertEqual(steps[i].get('if'), installer.get('if'), str(path)) + count += 1 + self.assertGreater(count, 30) + + +if __name__ == '__main__': + unittest.main() diff --git a/scripts/tests/test_vp9_filter_coverage.py b/scripts/tests/test_vp9_filter_coverage.py index 29cbfc371..ea2603cca 100644 --- a/scripts/tests/test_vp9_filter_coverage.py +++ b/scripts/tests/test_vp9_filter_coverage.py @@ -327,7 +327,8 @@ def test_measurement_is_explicit_and_prs_only_run_smoke(self): self.assertIn('"$MODE"', run['run']) triggers = workflow.get('on', workflow.get('true')) for event in ('push', 'pull_request'): - for path in (*coverage.SOURCES, 'scripts/install-oracle-ffmpeg.sh', 'scripts/oracle_from_r2.py'): + for path in (*coverage.SOURCES, 'scripts/install-ci-oracle-ffmpeg.sh', + '.github/actions/oracle-cache/action.yml', 'scripts/oracle_from_r2.py'): with self.subTest(event=event, path=path): self.assertTrue(any(fnmatchcase(path, pattern) for pattern in triggers[event]['paths'])) for job in jobs.values(): diff --git a/scripts/workflow_check.py b/scripts/workflow_check.py index 25b5b2b6d..7552fb1c2 100644 --- a/scripts/workflow_check.py +++ b/scripts/workflow_check.py @@ -116,8 +116,11 @@ # The oracle FFmpeg's pin and its installer: a workflow that runs the # installer starts when either changes. ORACLE_PIN = ('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') +ORACLE_CACHE = '.github/actions/oracle-cache/action.yml' +CI_ORACLE_PIN = (ORACLE_PIN[0], 'scripts/install-ci-oracle-ffmpeg.sh', ORACLE_CACHE) ORACLE_PINS = (ORACLE_PIN, ('scripts/oracle-ffmpeg-macos.env', 'scripts/install-oracle-ffmpeg-macos.sh', - 'scripts/oracle_pin_macos.py', 'scripts/oracle-ffmpeg.env', 'scripts/oracle_pin.py')) + 'scripts/oracle_pin_macos.py', 'scripts/oracle-ffmpeg.env', 'scripts/oracle_pin.py'), + CI_ORACLE_PIN) STOPS_SHELL = ('help', 'version', 'dump-strings', 'dump-po-strings') TAKES_OPERAND = ('rcfile', 'init-file') diff --git a/scripts/workflow_check_selftest.py b/scripts/workflow_check_selftest.py index 7ca0628d2..8b6a15f7e 100755 --- a/scripts/workflow_check_selftest.py +++ b/scripts/workflow_check_selftest.py @@ -380,8 +380,8 @@ def test_a_pin_change_starts_every_workflow_that_installs_the_oracle(self): workflows = self.root / '.github' / 'workflows' audio = workflows / 'audio-conformance.yml' text = audio.read_text() - self.assertEqual(text.count(' "scripts/install-oracle-ffmpeg.sh",'), 2) - audio.write_text(text.replace(' "scripts/install-oracle-ffmpeg.sh",', '')) + self.assertEqual(text.count(' "scripts/install-ci-oracle-ffmpeg.sh",'), 2) + audio.write_text(text.replace(' "scripts/install-ci-oracle-ffmpeg.sh",', '')) mediainfo = workflows / 'mediainfo-oracle.yml' text = mediainfo.read_text() self.assertIn(" - '*.md'\n", text) @@ -393,12 +393,23 @@ def problem(workflow, pin, fix, key, event): return (f'{workflow}: runs the oracle FFmpeg installer, but a change of scripts/{pin} ' f'does not start it: {fix} the `{key}` of `{event}`') self.assertEqual(sorted(check.check(self.root)), sorted([ - problem('audio-conformance.yml', 'install-oracle-ffmpeg.sh', 'add it to', 'paths', 'push'), - problem('audio-conformance.yml', 'install-oracle-ffmpeg.sh', 'add it to', 'paths', 'pull_request'), + problem('audio-conformance.yml', 'install-ci-oracle-ffmpeg.sh', 'add it to', 'paths', 'push'), + problem('audio-conformance.yml', 'install-ci-oracle-ffmpeg.sh', 'add it to', 'paths', 'pull_request'), problem('mediainfo-oracle.yml', 'oracle-ffmpeg.env', 'take it out of', 'paths-ignore', 'push'), problem('mediainfo-oracle.yml', 'oracle-ffmpeg.env', 'add it to', 'paths', 'pull_request'), ])) + def test_archive_cache_changes_start_its_installer_workflows(self): + path = self.root / '.github/workflows/audio-conformance.yml' + original = path.read_text() + path.write_text(original.replace(' ".github/actions/oracle-cache/action.yml",', '')) + found = check.check(self.root) + self.assertEqual(len(found), 2, found) + self.assertTrue(all('change of .github/actions/oracle-cache/action.yml does not start it' in p + for p in found), found) + path.write_text(original) + self.assertEqual(check.check(self.root), []) + def test_only_a_workflow_that_runs_the_installer_must_start_on_the_pin(self): def workflow(*steps): return ('# workflow-check: not required\non:\n pull_request:\n' From e13722d2f97fbf0148179ead854cb136043039bb Mon Sep 17 00:00:00 2001 From: Gunwoo Kim Date: Sun, 8 Nov 2026 18:43:16 +0900 Subject: [PATCH 2/8] fix(ci): harden oracle acquisition recovery Signed-off-by: Gunwoo Kim --- .github/workflows/ci-full.yml | 4 +-- .github/workflows/ci.yml | 14 ++++---- .github/workflows/codec-coverage.yml | 36 ++++++++++++++------ .github/workflows/github-shapes.yml | 4 +-- .github/workflows/mediainfo-oracle.yml | 2 +- .github/workflows/npm.yml | 2 +- docs/agents/ffmpeg-cli.md | 2 ++ scripts/install-ci-oracle-ffmpeg.sh | 19 ++++++----- scripts/tests/test_oracle_install.py | 46 +++++++++++++++++++++++++- 9 files changed, 97 insertions(+), 32 deletions(-) diff --git a/.github/workflows/ci-full.yml b/.github/workflows/ci-full.yml index 9d039cfdd..c9448a668 100644 --- a/.github/workflows/ci-full.yml +++ b/.github/workflows/ci-full.yml @@ -230,7 +230,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg @@ -322,7 +322,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 300fe8e91..6fd7a6022 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -252,7 +252,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-encoders - key: linux-x64-encoders-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-x264.sh') }} + key: linux-x64-encoders-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-x264.sh') }} - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-encoders" @@ -710,7 +710,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg @@ -945,7 +945,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg @@ -1042,7 +1042,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg @@ -1255,7 +1255,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} # MediaInfo is a gating oracle for extracted M4A files only; elsewhere it stays informational. - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg @@ -1514,7 +1514,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" @@ -1732,7 +1732,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" diff --git a/.github/workflows/codec-coverage.yml b/.github/workflows/codec-coverage.yml index a8016649b..19cdec557 100644 --- a/.github/workflows/codec-coverage.yml +++ b/.github/workflows/codec-coverage.yml @@ -65,8 +65,7 @@ on: - scripts/tests/test_registered_candidate.py - scripts/oracle-ffmpeg.env - scripts/oracle-ffmpeg-macos.env - - scripts/install-ci-oracle-ffmpeg.sh - - .github/actions/oracle-cache/action.yml + - scripts/install-oracle-ffmpeg.sh - scripts/install-x264.sh - scripts/clip_check.py - scripts/codec_coverage_gcp.py @@ -407,9 +406,15 @@ jobs: with: name: coverage-binaries path: ${{ runner.temp }}/bin - - uses: ./.github/actions/oracle-cache + - name: Cache the pinned FFmpeg + id: oracle-cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + with: + path: ${{ runner.temp }}/oracle + key: coverage-oracle-${{ hashFiles('scripts/install-oracle-ffmpeg.sh', 'scripts/oracle-ffmpeg.env') }} - name: Install the pinned FFmpeg - run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + if: steps.oracle-cache.outputs.cache-hit != 'true' + run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Verify the pinned FFmpeg run: python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - name: Record the host @@ -534,9 +539,15 @@ jobs: with: name: coverage-binaries path: ${{ runner.temp }}/bin - - uses: ./.github/actions/oracle-cache + - name: Cache the pinned FFmpeg + id: oracle-cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + with: + path: ${{ runner.temp }}/oracle + key: coverage-oracle-${{ hashFiles('scripts/install-oracle-ffmpeg.sh', 'scripts/oracle-ffmpeg.env') }} - name: Install the pinned FFmpeg - run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + if: steps.oracle-cache.outputs.cache-hit != 'true' + run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Verify the pinned FFmpeg run: python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable @@ -589,9 +600,15 @@ jobs: with: name: coverage-binaries path: ${{ runner.temp }}/bin - - uses: ./.github/actions/oracle-cache + - name: Cache the pinned FFmpeg + id: oracle-cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + with: + path: ${{ runner.temp }}/oracle + key: coverage-oracle-${{ hashFiles('scripts/install-oracle-ffmpeg.sh', 'scripts/oracle-ffmpeg.env') }} - name: Install the pinned FFmpeg - run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + if: steps.oracle-cache.outputs.cache-hit != 'true' + run: scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Verify the pinned FFmpeg run: python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - name: Make the fixtures with the pinned FFmpeg @@ -710,11 +727,10 @@ jobs: with: name: coverage-binaries path: ${{ runner.temp }}/bin - - uses: ./.github/actions/oracle-cache - name: Install and verify the pinned image oracle run: | set -euo pipefail - scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/oracle" - name: Generate and check the registered fixture inputs run: | diff --git a/.github/workflows/github-shapes.yml b/.github/workflows/github-shapes.yml index 1dcc506cd..b8e0cd77f 100644 --- a/.github/workflows/github-shapes.yml +++ b/.github/workflows/github-shapes.yml @@ -13,6 +13,7 @@ on: - tools/compat-corpus/encode_breadth.py - tools/compat-corpus/tests/test_github_shapes*.py - scripts/install-ci-oracle-ffmpeg.sh + - scripts/install-oracle-ffmpeg.sh - .github/actions/oracle-cache/action.yml - scripts/install-x264.sh - scripts/oracle* @@ -98,13 +99,12 @@ jobs: if not all(os.environ.get(name) for name in names): raise SystemExit('private_retention_configuration') PY - - uses: ./.github/actions/oracle-cache - name: Install build dependencies and pinned programs run: | set -euo pipefail sudo apt-get update -q sudo apt-get install -y --no-install-recommends libdav1d-dev libvpx-dev libopus-dev nasm pkg-config - scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" + scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" scripts/install-x264.sh "$RUNNER_TEMP/oracle" python3 -m venv "$RUNNER_TEMP/aac-python" "$RUNNER_TEMP/aac-python/bin/pip" install --quiet --only-binary=:all: --require-hashes -r scripts/aac-pns-requirements.txt diff --git a/.github/workflows/mediainfo-oracle.yml b/.github/workflows/mediainfo-oracle.yml index a076b8731..a5086386b 100644 --- a/.github/workflows/mediainfo-oracle.yml +++ b/.github/workflows/mediainfo-oracle.yml @@ -61,7 +61,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml index ea32c9240..a20ee0b34 100644 --- a/.github/workflows/npm.yml +++ b/.github/workflows/npm.yml @@ -178,7 +178,7 @@ jobs: uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 with: path: ${{ runner.temp }}/coreav-oracle-bin - key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} + key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} - uses: ./.github/actions/oracle-cache - name: Install the checksum-verified FFmpeg run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" diff --git a/docs/agents/ffmpeg-cli.md b/docs/agents/ffmpeg-cli.md index 2a5cf1399..1e9639c93 100644 --- a/docs/agents/ffmpeg-cli.md +++ b/docs/agents/ffmpeg-cli.md @@ -8,6 +8,8 @@ Ordinary CI uses `scripts/install-ci-oracle-ffmpeg.sh` with a SHA256-keyed archi | Rule | Enforced by | |---|---| +| Oracle acquisition remains available when a measurement checks out a historical candidate | `test_historical_measurements_keep_the_frozen_installer` requires the original installer and excludes new local-action dependencies in all five historical measurement jobs. Their candidate owns the acquisition files; runtime checkout contents cannot be established by a path type | +| A failed oracle archive cache read or publication cannot fail a verified CI installation | `test_oracle_install.py` exercises unreadable cache reads, an unwritable cache directory and failed atomic publication, verifies both installed programs and checks partial-file cleanup. Cache availability is an external I/O fact, so the installer handles it at the acquisition boundary | | Newly admitted default-video options match the pinned oracle's decoded frames and aspect, not merely the existing explicit encoder path | The MP4 parser keeps implicit scale and bitrate on fallback; `transcode_job` admits implicit output size only when source dimensions match. `ffmpeg_default_video_encoder_applies_options` compares complete frame hashes and geometry/aspect with the oracle and checks unchanged destinations plus byte-exact fallback for excluded paths. Runtime source dimensions and external output cannot be established by argument types | | Generated default-video option coverage treats x264 as optional only outside required verification, without requiring unrelated fixtures | `ffmpeg_default_video_encoder_applies_options` checks the shared `required()` policy when x264 is absent. Its explicit macOS CI step sets `COREAV_REQUIRE_FFMPEG=1` and requires the exact test-success witness. Filesystem availability is a runtime fact, so a type cannot decide whether the selected executable exists | | New default AAC bitrate admission requires effective selected AAC encoding without removing pre-existing explicit-encoder command admission | `non_pcm_audio_options` checks the resolved audio codec only for the newly admitted implicit-encoder case. `copied_bitrate_metadata_preserves_command_admission` covers copied and absent audio, ordered and unmatched overrides, and destination preservation. A syntax type cannot establish selected source streams | diff --git a/scripts/install-ci-oracle-ffmpeg.sh b/scripts/install-ci-oracle-ffmpeg.sh index 7e105617b..a32d28633 100755 --- a/scripts/install-ci-oracle-ffmpeg.sh +++ b/scripts/install-ci-oracle-ffmpeg.sh @@ -19,16 +19,16 @@ pinned() { echo "$SHA256 $ARCHIVE_FILE" | sha256sum --check --strict } if [[ -f "$CACHED_ARCHIVE" ]]; then - cp "$CACHED_ARCHIVE" "$ARCHIVE_FILE" - if ! pinned; then + if ! { cp "$CACHED_ARCHIVE" "$ARCHIVE_FILE" && pinned; }; then echo 'install-ci-oracle-ffmpeg.sh: discarding an unverified cached archive' >&2 rm -f "$ARCHIVE_FILE" fi fi if [[ ! -f "$ARCHIVE_FILE" ]]; then if [[ "${COREAV_ORACLE_FROM_R2:-0}" == 1 ]] || - ! { curl --fail --location --retry 5 --retry-all-errors --retry-connrefused \ - --retry-max-time 300 --connect-timeout 20 --max-time 60 \ + ! { curl --fail --location --retry 8 --retry-all-errors --retry-connrefused \ + --retry-max-time 360 --connect-timeout 20 --max-time 300 \ + --speed-limit 1024 --speed-time 30 \ "$URL" --output "$ARCHIVE_FILE" && pinned; }; then if [[ -n "${R2_ACCESS_KEY_ID:-}" && -n "${R2_SECRET_ACCESS_KEY:-}" && -n "${R2_ENDPOINT:-}" ]]; then echo 'install-ci-oracle-ffmpeg.sh: taking the pinned archive from R2' >&2 @@ -39,10 +39,13 @@ if [[ ! -f "$ARCHIVE_FILE" ]]; then exit 1 fi fi - mkdir -p "$(dirname "$CACHED_ARCHIVE")" - CACHE_PART=$(mktemp "$CACHED_ARCHIVE.XXXXXX") - cp "$ARCHIVE_FILE" "$CACHE_PART" - mv -f "$CACHE_PART" "$CACHED_ARCHIVE" + CACHE_PART='' + if ! { mkdir -p "$(dirname "$CACHED_ARCHIVE")" && + CACHE_PART=$(mktemp "$CACHED_ARCHIVE.XXXXXX") && + cp "$ARCHIVE_FILE" "$CACHE_PART" && mv -f "$CACHE_PART" "$CACHED_ARCHIVE"; }; then + rm -f "$CACHE_PART" || true + echo 'install-ci-oracle-ffmpeg.sh: could not update the archive cache' >&2 + fi fi tar -xJf "$ARCHIVE_FILE" -C "$WORK" "$ARCHIVE/bin/ffmpeg" "$ARCHIVE/bin/ffprobe" python3 -I "$HERE/oracle_pin.py" --verify-bin "$WORK/$ARCHIVE/bin" diff --git a/scripts/tests/test_oracle_install.py b/scripts/tests/test_oracle_install.py index 644f198ee..4de4d026b 100644 --- a/scripts/tests/test_oracle_install.py +++ b/scripts/tests/test_oracle_install.py @@ -84,11 +84,14 @@ def install(self): return subprocess.run(['bash', str(self.scripts / 'install-ci-oracle-ffmpeg.sh'), str(self.dest)], env=self.env, capture_output=True, text=True, timeout=45) - def assert_installed(self, result): + def assert_programs(self, result): self.assertEqual(result.returncode, 0, result.stdout + result.stderr) for name, data in self.programs.items(): self.assertEqual((self.dest / name).read_bytes(), data) self.assertIn(f'{name} version {self.pin["BUILD"]}', result.stdout) + + def assert_installed(self, result): + self.assert_programs(result) self.assertEqual(self.cache.read_bytes(), self.archive) def test_http_503_504_and_404_recover_with_real_curl_backoff(self): @@ -116,6 +119,33 @@ def test_corrupt_cache_is_replaced_only_with_verified_download(self): self.assertEqual(self.requests, [200]) self.assertIn('discarding an unverified cached archive', result.stderr) + def test_unreadable_cache_falls_back_to_a_verified_download(self): + self.cache.parent.mkdir() + self.cache.write_bytes(self.archive) + tool = self.tools / 'cp' + tool.write_text('#!/bin/sh\n[ "$1" != "$COREAV_ORACLE_ARCHIVE" ] || exit 1\n' + + f'exec "{shutil.which("cp")}" "$@"\n') + tool.chmod(0o755) + self.assert_installed(self.install()) + self.assertEqual(self.requests, [200]) + + def test_unwritable_cache_does_not_fail_verified_installation(self): + self.cache.parent.write_bytes(b'not a directory') + result = self.install() + self.assert_programs(result) + self.assertIn('could not update the archive cache', result.stderr) + self.assertEqual(self.requests, [200]) + self.assertEqual(self.cache.parent.read_bytes(), b'not a directory') + + def test_failed_cache_publication_removes_its_partial_file(self): + tool = self.tools / 'mv' + tool.write_text('#!/bin/sh\nexit 1\n') + tool.chmod(0o755) + result = self.install() + self.assert_programs(result) + self.assertIn('could not update the archive cache', result.stderr) + self.assertEqual(list(self.cache.parent.iterdir()), []) + def test_wrong_download_hash_fails_without_r2_or_publishing(self): self.archive += b'wrong bytes' result = self.install() @@ -152,6 +182,20 @@ def test_credentialed_r2_override_still_checks_the_archive(self): class OracleArchiveWorkflow(unittest.TestCase): + def test_historical_measurements_keep_the_frozen_installer(self): + rosters = {'github-shapes.yml': ('measure',), + 'codec-coverage.yml': ('coverage-v1', 'coverage-v1-fixtures', + 'coverage-v2-v3', 'coverage-v2-images')} + for workflow, jobs in rosters.items(): + data = self.data(ROOT / '.github/workflows' / workflow) + for job in jobs: + with self.subTest(workflow=workflow, job=job): + steps = data['jobs'][job]['steps'] + self.assertFalse(any(s.get('uses') == './.github/actions/oracle-cache' for s in steps)) + run = '\n'.join(s.get('run', '') for s in steps) + self.assertIn('scripts/install-oracle-ffmpeg.sh', run) + self.assertNotIn(workflow_check.CI_ORACLE_PIN[1], run) + def test_the_ci_installer_cannot_duplicate_the_pin(self): with tempfile.TemporaryDirectory() as directory: root = Path(directory) From 8b7772c2f4d33134daaeb5bb089bb783e045fd50 Mon Sep 17 00:00:00 2001 From: Gunwoo Kim Date: Sun, 8 Nov 2026 18:57:46 +0900 Subject: [PATCH 3/8] fix(ci): reuse the oracle across replay modes Signed-off-by: Gunwoo Kim --- .github/workflows/videotoolbox.yml | 9 ++++++- docs/agents/videotoolbox.md | 1 + scripts/encoders/macos/smoke.py | 7 ++++-- scripts/encoders/macos/test_tools.py | 6 ++++- scripts/tests/test_oracle_install.py | 37 ++++++++++++++++++++++++++++ 5 files changed, 56 insertions(+), 4 deletions(-) diff --git a/.github/workflows/videotoolbox.yml b/.github/workflows/videotoolbox.yml index 44e68a916..1846fc2a5 100644 --- a/.github/workflows/videotoolbox.yml +++ b/.github/workflows/videotoolbox.yml @@ -16,6 +16,8 @@ on: - deny.toml - scripts/encoders/macos/** - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - scripts/oracle-ffmpeg.env - scripts/oracle_pin.py - scripts/install-oracle-ffmpeg-macos.sh @@ -36,6 +38,8 @@ on: - deny.toml - scripts/encoders/macos/** - scripts/install-oracle-ffmpeg.sh + - scripts/install-ci-oracle-ffmpeg.sh + - .github/actions/oracle-cache/action.yml - scripts/oracle-ffmpeg.env - scripts/oracle_pin.py - scripts/install-oracle-ffmpeg-macos.sh @@ -131,6 +135,9 @@ jobs: rust-version: stable - name: Test Linux evidence replay and child cleanup run: python3 -m unittest discover -s scripts/encoders/macos -p 'test_*.py' -v + - uses: ./.github/actions/oracle-cache + - name: Install the pinned Linux replay oracle + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/oracle" - name: Decode with the existing pinned Linux oracle shell: bash run: | @@ -143,7 +150,7 @@ jobs: fi python3 scripts/encoders/macos/smoke.py verify \ --capture "captures/$mode" --mode "$mode" \ - --oracle-bin "$RUNNER_TEMP/oracle" --install-oracle \ + --oracle-bin "$RUNNER_TEMP/oracle" \ --coreav-decoder crates/coreav-backend-apple/target/dist/examples/videotoolbox \ --report "reports/$mode.json" "$@" done diff --git a/docs/agents/videotoolbox.md b/docs/agents/videotoolbox.md index 3bb43c724..f8b844631 100644 --- a/docs/agents/videotoolbox.md +++ b/docs/agents/videotoolbox.md @@ -4,6 +4,7 @@ VideoToolbox encode, hardware status, and the macOS encoder measurement tools. | Rule | Enforced by | |---|---| +| Linux synthetic replay modes share one qualified installation and explicit reinstalls use the verified archive cache | `test_second_install_in_one_job_reuses_verified_bytes_without_credentials` executes two installs with an unavailable origin for the second; `test_videotoolbox_modes_share_one_provisioned_archive_cache` checks provisioning before the mode loop. Synthetic smoke tests bind the explicit reinstall command and preserve a closed `oracle_install_failed` stage diagnostic without exposing child stderr | | The physical-host fingerprint regression matches every other host field and cannot pass when the fingerprint comparison is neutralized | The matching-host positive control reaches a guarded file-hash boundary, while the changed-fingerprint case requires exact `host_mismatch` before that boundary. `test_fingerprint_regression_detects_neutralized_hardware_comparison` applies the masking mutation and requires the original test to fail for that boundary. Types cannot establish which runtime predicate caused a test refusal | | Hosted VideoToolbox software refusals never become availability or conformance, and the exemption expires when status is observable | The initial-only MissingHardwareFlag error requires a complete unique-ID scan. The hosted classifier and closed refusal schemas reject other conditions and observable status; native_preflight_manifest rejects the outcome before judged accounting. Rust/Python refusal, stale-exemption, preflight-ledger and workflow-argument regressions cover these boundaries (videotoolbox.yml, deny.yml). External native metadata and transported JSON require runtime checks | | VideoToolbox unit fixtures that register sessions share the SERIAL guard with global-registry assertions | tests.rs owns the session-construction fixtures under the same SERIAL mutex; sys.rs keeps only CF-object parser fixtures. Guard acquisition in new fixtures remains review judgment: the public production constructor cannot require a test-only synchronization token | diff --git a/scripts/encoders/macos/smoke.py b/scripts/encoders/macos/smoke.py index c1793f3e8..1dc509fc9 100644 --- a/scripts/encoders/macos/smoke.py +++ b/scripts/encoders/macos/smoke.py @@ -220,8 +220,11 @@ def verify_capture(directory, oracle, mode, coreav_decoder, install=False, hoste with tempfile.TemporaryDirectory() as temporary: temporary = Path(temporary) if install: - run(["bash", str(ROOT / "scripts/install-oracle-ffmpeg.sh"), str(oracle)], - temporary, 1800, stdout="install-out", stderr="install-error") + try: + run(["bash", str(ROOT / "scripts/install-ci-oracle-ffmpeg.sh"), str(oracle)], + temporary, 1800, stdout="install-out", stderr="install-error") + except Invalid: + raise Invalid("oracle_install_failed") from None try: oracle = test_oracle.require(oracle / "ffmpeg", oracle / "ffprobe") except test_oracle.QualificationError: diff --git a/scripts/encoders/macos/test_tools.py b/scripts/encoders/macos/test_tools.py index 01c8b73c6..ef9cfdec0 100644 --- a/scripts/encoders/macos/test_tools.py +++ b/scripts/encoders/macos/test_tools.py @@ -537,7 +537,11 @@ def fake(command, temporary, timeout, stdout="stdout", stderr="stderr", **kwargs result = smoke.verify_capture(capture, oracle, "hardware", decoder, True) owner.assert_called_once_with(oracle.resolve() / "ffmpeg", oracle.resolve() / "ffprobe") self.assertEqual(result["status"], "verified") - self.assertTrue(any("install-oracle-ffmpeg.sh" in str(arg) for command in commands for arg in command)) + self.assertEqual(commands[0], ["bash", str(smoke.ROOT / "scripts/install-ci-oracle-ffmpeg.sh"), + str(oracle.resolve())]) + with mock.patch.object(smoke, "run", side_effect=evidence.Invalid("child_failure")), \ + self.assertRaisesRegex(evidence.Invalid, "oracle_install_failed"): + smoke.verify_capture(capture, oracle, "hardware", decoder, True) self.assertEqual([command[0] for command in commands[1:]], [str(selected.ffmpeg), str(selected.ffprobe), str(decoder.resolve())]) decode = next(command for command in commands if str(command[0]).endswith("ffmpeg")) diff --git a/scripts/tests/test_oracle_install.py b/scripts/tests/test_oracle_install.py index 4de4d026b..6936a6d44 100644 --- a/scripts/tests/test_oracle_install.py +++ b/scripts/tests/test_oracle_install.py @@ -111,6 +111,15 @@ def test_cache_hit_avoids_a_404_and_replaces_independent_binary_cache(self): self.assert_installed(self.install()) self.assertEqual(self.requests, []) + def test_second_install_in_one_job_reuses_verified_bytes_without_credentials(self): + self.assert_installed(self.install()) + self.statuses = [503, 404] + for name in self.programs: + (self.dest / name).write_bytes(b'unverified replacement') + self.assert_installed(self.install()) + self.assertEqual(self.requests, [200]) + self.assertEqual(self.statuses, [503, 404]) + def test_corrupt_cache_is_replaced_only_with_verified_download(self): self.cache.parent.mkdir() self.cache.write_bytes(b'corrupt cache') @@ -182,6 +191,34 @@ def test_credentialed_r2_override_still_checks_the_archive(self): class OracleArchiveWorkflow(unittest.TestCase): + def test_image_controls_use_the_secretless_ci_installer(self): + data = self.data(ROOT / '.github/workflows/png-bmp-yuv.yml') + steps = data['jobs']['image-synthetic-controls']['steps'] + cache = next(i for i, step in enumerate(steps) if step.get('uses') == './.github/actions/oracle-cache') + installer = next(i for i, step in enumerate(steps) if any( + workflow_check.calls_installer(line, workflow_check.CI_ORACLE_PIN[1]) + for line in step.get('run', '').splitlines())) + self.assertLess(cache, installer) + self.assertFalse(any(name.startswith('R2_') for name in steps[installer].get('env', {}))) + + def test_videotoolbox_modes_share_one_provisioned_archive_cache(self): + data = self.data(ROOT / '.github/workflows/videotoolbox.yml') + steps = data['jobs']['verify']['steps'] + cache = next(i for i, step in enumerate(steps) if step.get('uses') == './.github/actions/oracle-cache') + installer = next(i for i, step in enumerate(steps) if any( + workflow_check.calls_installer(line, workflow_check.CI_ORACLE_PIN[1]) + for line in step.get('run', '').splitlines())) + replay = next(i for i, step in enumerate(steps) + if 'scripts/encoders/macos/smoke.py verify' in step.get('run', '')) + self.assertLess(cache, installer) + self.assertLess(installer, replay) + self.assertIn('for mode in hardware software any', steps[replay]['run']) + self.assertNotIn('--install-oracle', steps[replay]['run']) + triggers = data.get('on', data.get('true')) + for event in ('push', 'pull_request'): + for path in workflow_check.CI_ORACLE_PIN: + self.assertIn(path, triggers[event]['paths']) + def test_historical_measurements_keep_the_frozen_installer(self): rosters = {'github-shapes.yml': ('measure',), 'codec-coverage.yml': ('coverage-v1', 'coverage-v1-fixtures', From ecd7334f0b7b49e139c40297facc81d397f94a02 Mon Sep 17 00:00:00 2001 From: Gunwoo Kim Date: Sun, 8 Nov 2026 19:11:24 +0900 Subject: [PATCH 4/8] fix(ci): preserve frozen replay tooling Signed-off-by: Gunwoo Kim --- .github/workflows/deny.yml | 1 + docs/agents/videotoolbox.md | 2 +- scripts/encoders/macos/smoke.py | 7 ++----- scripts/encoders/macos/test_tools.py | 6 +----- tools/compat-corpus/tests/test_github_shapes.py | 5 ++++- 5 files changed, 9 insertions(+), 12 deletions(-) diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml index 127e81461..528dbb0ef 100644 --- a/.github/workflows/deny.yml +++ b/.github/workflows/deny.yml @@ -84,6 +84,7 @@ jobs: python3 -I scripts/oracle_pin.py --check python3 -I scripts/workflow_check_selftest.py python3 -I -m unittest discover -s scripts/tests -p 'test_oracle_install.py' -v + python3 -m unittest discover -s scripts/encoders/macos -p 'test_source_freeze.py' -v python3 -I -m unittest discover -s .github/actions/changed-paths/tests -p 'test_*.py' python3 -I scripts/pr_text_check_selftest.py python3 -I scripts/pr_shape_check_selftest.py diff --git a/docs/agents/videotoolbox.md b/docs/agents/videotoolbox.md index f8b844631..5c3f8686b 100644 --- a/docs/agents/videotoolbox.md +++ b/docs/agents/videotoolbox.md @@ -4,7 +4,7 @@ VideoToolbox encode, hardware status, and the macOS encoder measurement tools. | Rule | Enforced by | |---|---| -| Linux synthetic replay modes share one qualified installation and explicit reinstalls use the verified archive cache | `test_second_install_in_one_job_reuses_verified_bytes_without_credentials` executes two installs with an unavailable origin for the second; `test_videotoolbox_modes_share_one_provisioned_archive_cache` checks provisioning before the mode loop. Synthetic smoke tests bind the explicit reinstall command and preserve a closed `oracle_install_failed` stage diagnostic without exposing child stderr | +| Linux synthetic replay modes share one qualified installation without changing frozen measurement tooling | `test_videotoolbox_modes_share_one_provisioned_archive_cache` requires cached provisioning before the mode loop and excludes reinstall flags from replay. The public source-freeze test preserves the original tooling identity. `test_second_install_in_one_job_reuses_verified_bytes_without_credentials` separately proves that repeated CI-installer calls verify and reuse cached bytes | | The physical-host fingerprint regression matches every other host field and cannot pass when the fingerprint comparison is neutralized | The matching-host positive control reaches a guarded file-hash boundary, while the changed-fingerprint case requires exact `host_mismatch` before that boundary. `test_fingerprint_regression_detects_neutralized_hardware_comparison` applies the masking mutation and requires the original test to fail for that boundary. Types cannot establish which runtime predicate caused a test refusal | | Hosted VideoToolbox software refusals never become availability or conformance, and the exemption expires when status is observable | The initial-only MissingHardwareFlag error requires a complete unique-ID scan. The hosted classifier and closed refusal schemas reject other conditions and observable status; native_preflight_manifest rejects the outcome before judged accounting. Rust/Python refusal, stale-exemption, preflight-ledger and workflow-argument regressions cover these boundaries (videotoolbox.yml, deny.yml). External native metadata and transported JSON require runtime checks | | VideoToolbox unit fixtures that register sessions share the SERIAL guard with global-registry assertions | tests.rs owns the session-construction fixtures under the same SERIAL mutex; sys.rs keeps only CF-object parser fixtures. Guard acquisition in new fixtures remains review judgment: the public production constructor cannot require a test-only synchronization token | diff --git a/scripts/encoders/macos/smoke.py b/scripts/encoders/macos/smoke.py index 1dc509fc9..c1793f3e8 100644 --- a/scripts/encoders/macos/smoke.py +++ b/scripts/encoders/macos/smoke.py @@ -220,11 +220,8 @@ def verify_capture(directory, oracle, mode, coreav_decoder, install=False, hoste with tempfile.TemporaryDirectory() as temporary: temporary = Path(temporary) if install: - try: - run(["bash", str(ROOT / "scripts/install-ci-oracle-ffmpeg.sh"), str(oracle)], - temporary, 1800, stdout="install-out", stderr="install-error") - except Invalid: - raise Invalid("oracle_install_failed") from None + run(["bash", str(ROOT / "scripts/install-oracle-ffmpeg.sh"), str(oracle)], + temporary, 1800, stdout="install-out", stderr="install-error") try: oracle = test_oracle.require(oracle / "ffmpeg", oracle / "ffprobe") except test_oracle.QualificationError: diff --git a/scripts/encoders/macos/test_tools.py b/scripts/encoders/macos/test_tools.py index ef9cfdec0..01c8b73c6 100644 --- a/scripts/encoders/macos/test_tools.py +++ b/scripts/encoders/macos/test_tools.py @@ -537,11 +537,7 @@ def fake(command, temporary, timeout, stdout="stdout", stderr="stderr", **kwargs result = smoke.verify_capture(capture, oracle, "hardware", decoder, True) owner.assert_called_once_with(oracle.resolve() / "ffmpeg", oracle.resolve() / "ffprobe") self.assertEqual(result["status"], "verified") - self.assertEqual(commands[0], ["bash", str(smoke.ROOT / "scripts/install-ci-oracle-ffmpeg.sh"), - str(oracle.resolve())]) - with mock.patch.object(smoke, "run", side_effect=evidence.Invalid("child_failure")), \ - self.assertRaisesRegex(evidence.Invalid, "oracle_install_failed"): - smoke.verify_capture(capture, oracle, "hardware", decoder, True) + self.assertTrue(any("install-oracle-ffmpeg.sh" in str(arg) for command in commands for arg in command)) self.assertEqual([command[0] for command in commands[1:]], [str(selected.ffmpeg), str(selected.ffprobe), str(decoder.resolve())]) decode = next(command for command in commands if str(command[0]).endswith("ffmpeg")) diff --git a/tools/compat-corpus/tests/test_github_shapes.py b/tools/compat-corpus/tests/test_github_shapes.py index ac5a603a7..6511afec4 100644 --- a/tools/compat-corpus/tests/test_github_shapes.py +++ b/tools/compat-corpus/tests/test_github_shapes.py @@ -941,7 +941,10 @@ def test_acquisition_is_manual_only_and_pr_controls_use_the_pinned_oracle(self): self.assertIn('workflow_dispatch:', text) self.assertIn("if: github.event_name == 'workflow_dispatch'", text.split(' measure:', 1)[1]) self.assertIn('COREAV_SHAPES_ORACLE="$RUNNER_TEMP/writer-oracle"', text) - self.assertIn('scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/writer-oracle"', text) + self.assertIn('scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/writer-oracle"', text) + controls = text.split(' probe-writer-controls:', 1)[1].split('\n measure:', 1)[0] + self.assertLess(controls.index('uses: ./.github/actions/oracle-cache'), + controls.index('scripts/install-ci-oracle-ffmpeg.sh')) self.assertIn(' '.join(run.BUILD), text) self.assertLess(text.index('candidate_not_merged'), text.index('cargo build')) From 45efdcb668213650cc80eb1e1e4a38de8183cd56 Mon Sep 17 00:00:00 2001 From: Gunwoo Kim Date: Sun, 8 Nov 2026 19:29:11 +0900 Subject: [PATCH 5/8] test(ci): bind HEVC to the shared oracle cache Signed-off-by: Gunwoo Kim --- scripts/tests/test_oracle_install.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/scripts/tests/test_oracle_install.py b/scripts/tests/test_oracle_install.py index 6936a6d44..f0c39e3f5 100644 --- a/scripts/tests/test_oracle_install.py +++ b/scripts/tests/test_oracle_install.py @@ -191,6 +191,25 @@ def test_credentialed_r2_override_still_checks_the_archive(self): class OracleArchiveWorkflow(unittest.TestCase): + def test_hevc_consumers_share_the_wasm_archive_cache(self): + wasm = self.data(ROOT / '.github/workflows/wasm.yml')['jobs']['wasm-module']['steps'] + shared, = [step for step in wasm if step.get('uses') == './.github/actions/oracle-cache'] + self.assertFalse(any(step.get('uses', '').startswith('actions/cache@') and + 'coreav-oracle-bin' in str(step.get('with', {}).get('path', '')) + for step in wasm)) + jobs = self.data(ROOT / '.github/workflows/hevc-conformance.yml')['jobs'] + for name in ('hevc-smoke', 'hevc-vectors', 'profile-census'): + with self.subTest(job=name): + steps = jobs[name]['steps'] + cache, = [step for step in steps if step.get('uses') == shared['uses']] + self.assertEqual(cache, shared) + installer, = [step for step in steps if any( + workflow_check.calls_installer(line, workflow_check.CI_ORACLE_PIN[1]) + for line in step.get('run', '').splitlines())] + self.assertLess(steps.index(cache), steps.index(installer)) + self.assertNotIn('cache-hit', installer.get('if', '')) + self.assertNotIn('secrets.', str(installer)) + def test_image_controls_use_the_secretless_ci_installer(self): data = self.data(ROOT / '.github/workflows/png-bmp-yuv.yml') steps = data['jobs']['image-synthetic-controls']['steps'] @@ -256,6 +275,8 @@ def test_archive_cache_is_keyed_only_by_the_pin_digest(self): data = self.data(action / 'action.yml') pin, cache = data['runs']['steps'] self.assertEqual(cache['with']['key'], 'oracle-archive-${{ steps.pin.outputs.sha256 }}') + self.assertEqual(cache['with']['path'], + '${{ runner.temp }}/coreav-oracle-archive/${{ steps.pin.outputs.sha256 }}.tar.xz') self.assertNotIn('restore-keys', cache['with']) with tempfile.TemporaryDirectory() as directory: output, env = Path(directory) / 'output', Path(directory) / 'env' From 3ae29c460e1e58facd19145c567ec890915eda91 Mon Sep 17 00:00:00 2001 From: Gunwoo Kim Date: Sun, 8 Nov 2026 19:39:19 +0900 Subject: [PATCH 6/8] fix(ci): verify shared fixture oracle installs Signed-off-by: Gunwoo Kim --- .github/actions/ci-fixtures/action.yml | 15 ++++++--- docs/agents/ci.md | 3 +- scripts/tests/test_oracle_install.py | 33 +++++++++++++++++++ .../tests/test_shell_oracle_qualification.py | 2 +- 4 files changed, 46 insertions(+), 7 deletions(-) diff --git a/.github/actions/ci-fixtures/action.yml b/.github/actions/ci-fixtures/action.yml index df97f948b..cab4be0ea 100644 --- a/.github/actions/ci-fixtures/action.yml +++ b/.github/actions/ci-fixtures/action.yml @@ -17,7 +17,7 @@ runs: set -euo pipefail helpers=$(grep -o '\$SCRIPTS/[A-Za-z0-9_.-]*' scripts/gen-fixtures.sh | sed 's|^\$SCRIPTS/|scripts/|' | sort -u) support=$(python3 -I -B -c 'import sys; sys.path.insert(0, "scripts"); from test_oracle import SUPPORT; print(" ".join("scripts/" + name for name in SUPPORT))') - identity="$(cat scripts/gen-fixtures.sh scripts/install-oracle-ffmpeg.sh scripts/oracle-ffmpeg.env $helpers $support | sha256sum | cut -c1-32)" + identity="$(cat scripts/gen-fixtures.sh scripts/install-ci-oracle-ffmpeg.sh scripts/oracle-ffmpeg.env $helpers $support | sha256sum | cut -c1-32)" composed="$(cat docs/design/composed-opus-aac-v2.json scripts/composed_audio.py scripts/composed_audio_fixtures.py scripts/install-oracle-ffmpeg.sh $support | sha256sum | cut -c1-32)" comparator="$(python3 -I -c 'import json; print(json.load(open("docs/design/composed-opus-aac-v2.json"))["opus_compare"]["sha256"])')" echo "key=linux-x64-fixtures-$identity" >> "$GITHUB_OUTPUT" @@ -49,12 +49,17 @@ runs: with: path: ${{ runner.temp }}/coreav-oracle-bin key: linux-x64-oracle-mediainfo-26.10-${{ hashFiles('scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-oracle-mediainfo.sh') }} - - name: Install pinned FFmpeg, ffprobe and MediaInfo + - name: Cache the pinned oracle archive + if: inputs.fresh == 'true' || steps.fixtures.outputs.cache-hit != 'true' || (inputs.composed == 'true' && steps.composed.outputs.cache-hit != 'true') + uses: ./.github/actions/oracle-cache + - name: Install pinned FFmpeg and ffprobe + if: inputs.fresh == 'true' || steps.fixtures.outputs.cache-hit != 'true' || (inputs.composed == 'true' && steps.composed.outputs.cache-hit != 'true') + shell: bash + run: scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" + - name: Install pinned MediaInfo if: (inputs.fresh == 'true' || steps.fixtures.outputs.cache-hit != 'true' || (inputs.composed == 'true' && steps.composed.outputs.cache-hit != 'true')) && steps.ffmpeg-cache.outputs.cache-hit != 'true' shell: bash - run: | - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/coreav-oracle-bin" - scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" + run: scripts/install-oracle-mediainfo.sh "$RUNNER_TEMP/coreav-oracle-bin" - name: Generate all required fixtures if: inputs.fresh == 'true' || steps.fixtures.outputs.cache-hit != 'true' shell: bash diff --git a/docs/agents/ci.md b/docs/agents/ci.md index 6547c0b1f..b54aebe1f 100644 --- a/docs/agents/ci.md +++ b/docs/agents/ci.md @@ -93,5 +93,6 @@ List development caches with `docker volume ls --filter name=coreav-dev-`. After | The VideoToolbox smoke runs for every Rust path dependency it builds and the inherited workspace manifest | `test_videotoolbox_smoke_tracks_its_rust_build_closure` derives normal/build dependencies transitively and the standalone root's dev dependencies from TOML, then requires their directory globs and root manifest in both event filters (`deny.yml`). A Rust type cannot govern workflow triggers | | Design notes change in the same pull request as the design | test_videotoolbox_owner_docs_do_not_describe_it_as_unimplemented rejects former preimplementation wording for the implemented VideoToolbox owner and requires the plan's explicit CoreAV-to-FFmpeg payload ratio and inclusive bounds (deny.yml). Other design consistency is not enforced: judgment. Rust types cannot establish the meaning of external prose | | A change of an oracle platform's pin or installer starts every workflow that runs that installer | `scripts/workflow_check.py` (`deny.yml`) checks the platform-specific input lists, including the macOS verifier and its frozen Linux imports. `test_macos_installers_track_only_their_own_required_inputs` checks each macOS input and nested shell calls. A job-level filter (`changed-paths`) is review judgment | -| Fixture cache identities and fixture-consuming workflow triggers include every shared qualification support input, not only the directly called script | The existing `test_oracle.SUPPORT` owner supplies both cache keys; `test_both_fixture_cache_keys_bind_every_owner_support_file` executes both key blocks, changes every support file and rejects missing inputs. `test_all_fixture_support_changes_start_both_wasm_events` and `test_release_and_avi_triggers_cover_qualification_and_fixture_inputs` check the WASM, release and AVI filters against that owner and the generators they run. Workflow path filters cannot consume a Python owner at parse time, so checks prevent drift | +| Fixture cache identities and fixture-consuming workflow triggers include every shared qualification support input, not only the directly called script | The existing `test_oracle.SUPPORT` owner supplies both cache keys; `test_both_fixture_cache_keys_bind_every_owner_support_file` executes both key blocks, changes every support file and rejects missing inputs. `test_fixture_producers_compute_the_same_cache_key` executes the CI and WASM producers and requires identical keys. `test_all_fixture_support_changes_start_both_wasm_events` and `test_release_and_avi_triggers_cover_qualification_and_fixture_inputs` check the WASM, release and AVI filters against that owner and the generators they run. Workflow path filters cannot consume a Python owner at parse time, so checks prevent drift | +| Current local actions provision the oracle from the shared verified archive even when neighboring binary caches hit | The shared archive action and CI installer own acquisition and verification; `test_local_actions_cannot_keep_the_frozen_installer` scans every local action, rejects the frozen installer and requires matching cache/install conditions without a binary-cache bypass (`deny.yml`). Workflow shell commands cannot be constrained by a Rust type | | The pinned comparator archive comes from an Actions cache keyed by its registered digest on every branch, only digest-verified bytes enter that cache, and the generator's own digest check still judges what it is served | `test_comparator_archive_is_cached_by_its_registered_digest_on_every_branch` checks both cache steps' key and path against the registration and that neither save is limited to main; `test_fetch_keeps_only_a_digest_verified_archive_and_installs_the_stand_in_beside_it`, `test_stand_in_serves_only_the_generators_request_for_the_registered_archive` and `test_audio_conformance_builds_the_comparator_from_the_cached_archive` execute the shell blocks and the stand-in with a stand-in curl (`deny.yml`). A YAML type cannot govern what a cache step saves | diff --git a/scripts/tests/test_oracle_install.py b/scripts/tests/test_oracle_install.py index f0c39e3f5..57e471946 100644 --- a/scripts/tests/test_oracle_install.py +++ b/scripts/tests/test_oracle_install.py @@ -191,6 +191,39 @@ def test_credentialed_r2_override_still_checks_the_archive(self): class OracleArchiveWorkflow(unittest.TestCase): + def test_local_actions_cannot_keep_the_frozen_installer(self): + consumers = 0 + for path in (ROOT / '.github/actions').glob('*/action.y*ml'): + steps = self.data(path).get('runs', {}).get('steps', []) + with self.subTest(action=str(path.relative_to(ROOT))): + self.assertFalse(any(workflow_check.calls_installer(line) + for step in steps for line in step.get('run', '').splitlines())) + for index, step in enumerate(steps): + if not any(workflow_check.calls_installer(line, workflow_check.CI_ORACLE_PIN[1]) + for line in step.get('run', '').splitlines()): + continue + cache, = [s for s in steps[:index] if s.get('uses') == './.github/actions/oracle-cache'] + self.assertEqual(cache.get('if'), step.get('if')) + self.assertNotIn('ffmpeg-cache', step.get('if', '')) + consumers += 1 + self.assertGreater(consumers, 0) + + def test_fixture_producers_compute_the_same_cache_key(self): + action = self.data(ROOT / '.github/actions/ci-fixtures/action.yml')['runs']['steps'] + wasm = self.data(ROOT / '.github/workflows/wasm.yml')['jobs']['wasm-module']['steps'] + keys = [] + for steps, name in ((action, 'key'), (wasm, 'fixtures-key')): + script, = [step['run'] for step in steps if step.get('id') == name] + with tempfile.TemporaryDirectory() as directory: + output = Path(directory) / 'output' + run = subprocess.run(['bash', '-euo', 'pipefail', '-c', script], cwd=ROOT, + env=os.environ | {'GITHUB_OUTPUT': str(output)}, + capture_output=True, text=True, timeout=30) + self.assertEqual(run.returncode, 0, run.stderr) + key, = [line for line in output.read_text().splitlines() if line.startswith('key=')] + keys.append(key) + self.assertEqual(*keys) + def test_hevc_consumers_share_the_wasm_archive_cache(self): wasm = self.data(ROOT / '.github/workflows/wasm.yml')['jobs']['wasm-module']['steps'] shared, = [step for step in wasm if step.get('uses') == './.github/actions/oracle-cache'] diff --git a/scripts/tests/test_shell_oracle_qualification.py b/scripts/tests/test_shell_oracle_qualification.py index b808e33e4..b2197aef2 100644 --- a/scripts/tests/test_shell_oracle_qualification.py +++ b/scripts/tests/test_shell_oracle_qualification.py @@ -187,7 +187,7 @@ def test_probe_default_selection_preserves_audio_arguments_without_mapfile(self) class FixtureCacheInputs(unittest.TestCase): def test_both_fixture_cache_keys_bind_every_owner_support_file(self): generator = (ROOT / 'scripts/gen-fixtures.sh').read_text() - inputs = {'scripts/gen-fixtures.sh', 'scripts/install-oracle-ffmpeg.sh', + inputs = {'scripts/gen-fixtures.sh', 'scripts/install-oracle-ffmpeg.sh', 'scripts/install-ci-oracle-ffmpeg.sh', 'scripts/oracle-ffmpeg.env', *('scripts/' + name for name in test_oracle.SUPPORT), 'docs/design/composed-opus-aac-v2.json', 'scripts/composed_audio.py', 'scripts/composed_audio_fixtures.py', *('scripts/' + name for name in re.findall(r'\$SCRIPTS/([A-Za-z0-9_.-]+)', generator))} From af2503c350aa45ad73eeb380ddad8172c2acb230 Mon Sep 17 00:00:00 2001 From: Gunwoo Kim Date: Sun, 8 Nov 2026 19:42:10 +0900 Subject: [PATCH 7/8] test(ci): stage the fixture installer input Signed-off-by: Gunwoo Kim --- scripts/tests/test_ci_fixtures.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/tests/test_ci_fixtures.py b/scripts/tests/test_ci_fixtures.py index 9744ae904..1b2d0f80e 100644 --- a/scripts/tests/test_ci_fixtures.py +++ b/scripts/tests/test_ci_fixtures.py @@ -141,7 +141,8 @@ def test_key_changes_with_the_pin_generator_and_discovered_helpers(self): scripts = root / 'scripts' scripts.mkdir() contents = {'gen-fixtures.sh': '$SCRIPTS/craft.py\n', 'craft.py': 'first\n', - 'install-oracle-ffmpeg.sh': 'installer\n', 'oracle-ffmpeg.env': 'pin\n'} + 'install-oracle-ffmpeg.sh': 'installer\n', + 'install-ci-oracle-ffmpeg.sh': 'ci installer\n', 'oracle-ffmpeg.env': 'pin\n'} contents.update({name: (ROOT / 'scripts' / name).read_text() for name in test_oracle.SUPPORT}) for name, content in contents.items(): From 0e7523018441c43bc43363f892a1bef4f88eba1a Mon Sep 17 00:00:00 2001 From: Gunwoo Kim Date: Sun, 8 Nov 2026 22:12:56 +0900 Subject: [PATCH 8/8] fix(ci): share the native H.264 oracle archive Signed-off-by: Gunwoo Kim --- .github/workflows/h264-encoder.yml | 12 +++++++++++- scripts/tests/test_oracle_install.py | 28 ++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/.github/workflows/h264-encoder.yml b/.github/workflows/h264-encoder.yml index b0ee60c7b..f39350d5d 100644 --- a/.github/workflows/h264-encoder.yml +++ b/.github/workflows/h264-encoder.yml @@ -76,6 +76,14 @@ jobs: run: working-directory: candidate steps: + - name: Check out the shared acquisition action + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + sparse-checkout: | + .github/actions/oracle-cache + scripts/oracle-ffmpeg.env + sparse-checkout-cone-mode: false - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: candidate @@ -117,14 +125,16 @@ jobs: cargo clippy --locked -p coreav-cli --features native-h264-encoder,native-h264 --all-targets -- -D warnings cargo build --locked --release -p coreav-cli --features native-h264-encoder,native-h264 cargo build --locked --release -p coreav-h264-encoder --features full --example p + - uses: ./.github/actions/oracle-cache - name: Install pinned black-box tools and generate trusted fixtures run: | sudo apt-get update sudo apt-get install -y --no-install-recommends nasm echo 'Installing pinned FFmpeg' - scripts/install-oracle-ffmpeg.sh "$RUNNER_TEMP/cli-oracles" || { echo '::error::reason=pinned_ffmpeg_install_failed'; exit 1; } + scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/cli-oracles" || { echo '::error::reason=pinned_ffmpeg_install_failed'; exit 1; } echo 'Installing pinned x264' scripts/install-x264.sh "$RUNNER_TEMP/cli-oracles" || { echo '::error::reason=pinned_x264_install_failed'; exit 1; } + python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/cli-oracles" export PATH="$RUNNER_TEMP/cli-oracles:$PATH" scripts/gen-fixtures.sh "$RUNNER_TEMP/cli-fixtures" - name: Verify stored native output and unchanged external behavior diff --git a/scripts/tests/test_oracle_install.py b/scripts/tests/test_oracle_install.py index 57e471946..49a669ade 100644 --- a/scripts/tests/test_oracle_install.py +++ b/scripts/tests/test_oracle_install.py @@ -191,6 +191,34 @@ def test_credentialed_r2_override_still_checks_the_archive(self): class OracleArchiveWorkflow(unittest.TestCase): + def test_native_h264_cli_uses_the_shared_verified_archive(self): + data = self.data(ROOT / '.github/workflows/h264-encoder.yml') + job = data['jobs']['native-h264-cli'] + candidate = job['defaults']['run']['working-directory'] + self.assertTrue(any(step.get('with', {}).get('path') == candidate and + 'ref' not in step.get('with', {}) for step in job['steps'])) + owner, = [step for step in job['steps'] if 'sparse-checkout' in step.get('with', {})] + self.assertNotIn('path', owner['with']) + self.assertNotIn('ref', owner['with']) + self.assertFalse(owner['with']['sparse-checkout-cone-mode']) + self.assertEqual(owner['with']['sparse-checkout'].splitlines(), + ['.github/actions/oracle-cache', 'scripts/oracle-ffmpeg.env']) + cache, = [index for index, step in enumerate(job['steps']) + if step.get('uses') == './.github/actions/oracle-cache'] + install, = [index for index, step in enumerate(job['steps']) if any( + workflow_check.calls_installer(line, workflow_check.CI_ORACLE_PIN[1]) + for line in step.get('run', '').splitlines())] + self.assertLess(cache, install) + self.assertNotIn('if', job['steps'][install]) + run = job['steps'][install]['run'] + self.assertIn('scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/cli-oracles"', run) + self.assertLess(run.index('--verify-bin'), run.index('scripts/gen-fixtures.sh')) + self.assertFalse(any(workflow_check.calls_installer(line) for line in run.splitlines())) + triggers = data.get('on', data.get('true')) + for event in ('push', 'pull_request'): + for path in workflow_check.CI_ORACLE_PIN: + self.assertIn(path, triggers[event]['paths']) + def test_local_actions_cannot_keep_the_frozen_installer(self): consumers = 0 for path in (ROOT / '.github/actions').glob('*/action.y*ml'):