Basis/.github/workflows/media-native.yml at developer · BasisVR/Basis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
# Builds librist from source — the only third-party native dependency of the Media
# Player's optional RIST transport (-DBASIS_WITH_RIST=ON). librist vendors its own
# mbedTLS and links it into a single static archive, so each job produces one lib.
# The statics are never committed; this workflow keeps the from-source build green
# on every change under Native~/ and publishes the archives as downloadable artifacts.
#
# Scope is librist only, not the plugin binary: basis_media_native's real backends
# include Unity's PluginAPI headers, which ship with the editor and aren't available
# here, so the plugin (.dll/.so) is still built on a Unity-equipped machine. Both jobs
# run the same build-librist scripts a developer runs locally — the recipe has one home.
#
# Note: workflow_dispatch only appears in the Actions UI once this file is on the
# default branch; until then the pull_request trigger exercises it on PRs.
name: media-native (RIST)

on:
  workflow_dispatch:
    inputs:
      librist_ref:
        description: "librist git tag (must match what basis_rist.c targets)"
        default: "v0.2.11"
  push:
    paths:
      - "Basis/Packages/com.basis.mediaplayer/Native~/**"
      - "tools/media-fuzz/**"
      - "tools/media-conformance/**"
      - ".github/workflows/media-native.yml"
  pull_request:
    paths:
      - "Basis/Packages/com.basis.mediaplayer/Native~/**"
      - "tools/media-fuzz/**"
      - "tools/media-conformance/**"
      - ".github/workflows/media-native.yml"

defaults:
  run:
    shell: bash

env:
  NATIVE_DIR: Basis/Packages/com.basis.mediaplayer/Native~
  LIBRIST_REF: ${{ inputs.librist_ref || 'v0.2.11' }}

jobs:
  win-x64:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5
      - uses: ilammy/msvc-dev-cmd@v1   # puts MSVC (vcvars) on PATH so meson uses cl
        with:
          arch: x64
      - run: pip install meson ninja
      - name: Build librist (static, /MD)
        shell: pwsh
        working-directory: ${{ env.NATIVE_DIR }}
        run: ./build-librist.ps1 -LibristRef "$env:LIBRIST_REF"
      - uses: actions/upload-artifact@v5
        with:
          name: librist-win-x64
          path: ${{ env.NATIVE_DIR }}/third_party/win-x64/rist.lib

  android-arm64:
    runs-on: ubuntu-latest   # Android NDK is preinstalled ($ANDROID_NDK_ROOT)
    steps:
      - uses: actions/checkout@v5
      - name: Install meson + ninja
        run: |
          sudo apt-get update && sudo apt-get install -y ninja-build
          pip install meson
      - name: Build librist (NDK arm64, static)
        working-directory: ${{ env.NATIVE_DIR }}
        run: ./build-librist.sh android-arm64
      - uses: actions/upload-artifact@v5
        with:
          name: librist-android-arm64
          path: ${{ env.NATIVE_DIR }}/third_party/android-arm64/librist.a

  # Fuzz the hand-rolled container/protocol parsers, which read attacker-controlled
  # bytes in-process. This gate is deterministic: it builds the libFuzzer targets
  # under ASan/UBSan and replays every pinned crash repro (tools/media-fuzz/testcases),
  # so a reintroduced memory-safety bug fails the PR. Coverage-growing fuzz runs are a
  # separate (future) scheduled job; this one stays fast and stable. See
  # tools/media-fuzz/README.md.
  fuzz-demux:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Install clang (libFuzzer + ASan/UBSan)
        run: sudo apt-get update && sudo apt-get install -y clang
      - name: Build fuzz targets
        run: ./tools/media-fuzz/build.sh
      - name: Replay pinned crash repros (regression gate)
        run: ./tools/media-fuzz/ci-replay.sh

  # Prove the demuxers produce the CORRECT output on valid input (the fuzz gate
  # proves they don't crash on hostile input). Generates synthetic fixtures with
  # ffmpeg -- a static Basis-logo track plus a tone, nothing committed -- then
  # diffs our demuxer's access units against ffprobe's packets, payload MD5 and
  # all. ffmpeg is used only as an external CLI tool here (no libav* linked, no
  # media in the repo). See tools/media-conformance/README.md.
  conformance-demux:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Install ffmpeg + a C compiler
        run: sudo apt-get update && sudo apt-get install -y ffmpeg gcc
      - name: Build the demux dumper
        run: ./tools/media-conformance/build.sh
      - name: Generate synthetic fixtures
        run: ./tools/media-conformance/gen_fixtures.sh "$RUNNER_TEMP/fixtures"
      - name: Require the advertised codec fixture set
        # gen_fixtures.sh skips codecs the runner's ffmpeg lacks, so on the
        # mutable ubuntu-latest image the gate could otherwise go green after
        # silently losing HEVC/VP9/AV1/Opus/MP3 coverage. Fail if any required
        # fixture is absent (apt's ffmpeg ships all of these).
        run: |
          required="h264_aac.ts hevc_aac.mp4 vp9.webm av1.webm opus.webm audio.opus aac.m4a cbr.mp3 vbr.mp3 vbr_id3.mp3 mp3_in_mp4.mp4 pcm16_stereo.wav lpcm51.m2ts"
          missing=""
          for f in $required; do
            [ -f "$RUNNER_TEMP/fixtures/$f" ] || missing="$missing $f"
          done
          if [ -n "$missing" ]; then
            echo "missing required codec fixtures (the runner's ffmpeg lost a codec):$missing"
            exit 1
          fi
          echo "all required codec fixtures present"
      - name: Diff demuxer output against ffprobe (regression gate)
        run: python3 ./tools/media-conformance/demux_gate.py "$RUNNER_TEMP/fixtures"