Merge main into dev

.github/homebrew/Formula/moq-cli.rb.tmpl

@@ -27,10 +27,10 @@ class MoqCli < Formula
   end
 
   def install
-    bin.install "bin/moq-cli"
+    bin.install "bin/moq"
   end
 
   test do
-    system bin/"moq-cli", "--help"
+    system bin/"moq", "--help"
   end
 end

.github/workflows/apt-repo.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/cachix.yml

@@ -28,13 +28,11 @@ jobs:
             runs-on: ubuntu-latest
           - os: macos-latest # aarch64-darwin
             runs-on: macos-latest
-          # aarch64-linux on the moq-dev self-hosted A1 (warm /nix/store). Tag
-          # pushes are trusted, so no fork concern.
           - os: aarch64-linux
-            runs-on: [self-hosted, nix]
+            runs-on: ubuntu-24.04-arm
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -53,29 +51,14 @@ jobs:
           fi
           echo "name=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
 
-      # The cachix action and `nix build` below run `nix` directly, so put it on
-      # PATH. A login shell resolves it via /etc/profile.d regardless of the
-      # box's install path. Self-hosted only; the hosted runners get Nix from
-      # the installer step.
-      - name: Add Nix to PATH
-        if: runner.environment == 'self-hosted'
-        shell: bash -leo pipefail {0}
-        run: dirname "$(command -v nix)" >> "$GITHUB_PATH"
-
-      - if: runner.environment == 'github-hosted'
-        uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
+      - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
           determinate: false
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
           name: kixelated
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          # The self-hosted box's runner user isn't a Nix trusted-user and the
-          # box deliberately substitutes only from its warm local store, so
-          # don't let `cachix use` rewrite nix.conf there. Push auth (above)
-          # still works; this leg only pushes.
-          skipAddingSubstituter: ${{ runner.environment == 'self-hosted' }}
 
       - name: Build and cache
         env:

.github/workflows/check.yml

@@ -22,77 +22,34 @@ jobs:
     # Skip the actual work on close/merge: this run exists only to cancel the
     # superseded in-flight build via the concurrency group above.
     if: github.event.action != 'closed'
-    # Trusted events run on the moq-dev self-hosted A1 runner (warm /nix/store +
-    # persistent CARGO_TARGET_DIR). Fork PRs fall back to GitHub-hosted ARM so
-    # untrusted code never runs on the box.
-    runs-on: ${{ github.event.pull_request.head.repo.fork && fromJSON('["ubuntu-24.04-arm"]') || fromJSON('["self-hosted", "nix"]') }}
+    runs-on: ubuntu-24.04-arm
     # Backstop a hang (e.g. a wedged test) instead of holding the runner for the
     # 6-hour default. Generous enough for a cold first build.
     timeout-minutes: 60
 
     steps:
-      # GitHub-hosted fallback only: the self-hosted box already has disk space,
-      # Determinate Nix, and a warm store.
       - name: Free disk space
-        if: runner.environment == 'github-hosted'
         uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
         with:
           tool-cache: false
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           # Full history so `just changed` can diff against origin/$GITHUB_BASE_REF.
           fetch-depth: 0
 
-      - if: runner.environment == 'github-hosted'
-        uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
+      - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
           determinate: false
-      - if: runner.environment == 'github-hosted'
-        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # main
-      - if: runner.environment == 'github-hosted'
-        uses: DeterminateSystems/flake-checker-action@a0f068d37b542f3150564fbf1164fec2d958ee11 # main
+      - uses: DeterminateSystems/flake-checker-action@a0f068d37b542f3150564fbf1164fec2d958ee11 # main
 
-      # GitHub-hosted fallback caches Rust via the Actions cache. The self-hosted
-      # box runs the heavy Rust CI (clippy/doc/test) as crane derivations via
-      # `nix flake check`, so deps cache in /nix/store and there's no persistent
-      # CARGO_TARGET_DIR to manage -- the residual `cargo check`s use the
-      # workspace ./target, which the runner wipes per job.
+      # Cache Rust dependencies and build artifacts via the Actions cache.
       - name: Rust Cache
-        if: runner.environment == 'github-hosted'
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           cache-on-failure: true
 
-      # Mark a baseline so the post-run assertion can tell whether anything wrote
-      # under the old persistent target dir (i.e. a CARGO_TARGET_DIR override
-      # leaked back in and would re-grow an unbounded tree).
-      - name: Target-dir baseline
-        if: runner.environment == 'self-hosted'
-        run: touch "$RUNNER_TEMP/target-baseline"
-
       # `just ci` calls `just changed` internally to skip unchanged scopes.
-      # Login shell so /etc/profile.d puts Nix on PATH; Actions shells don't by
-      # default. Harmless on the hosted fallback.
       - run: nix develop --command just ci
-        shell: bash -leo pipefail {0}
-
-      # Invariant: nothing should write to the old persistent target dir anymore.
-      # Fails loudly if a CARGO_TARGET_DIR override sneaks back in. Scope it to
-      # *this* repo's old per-runner dir (moq-$RUNNER_NAME) -- the box's
-      # $HOME/cargo-target is shared with other repos (e.g. moq-pro) and runners,
-      # whose jobs may run concurrently and legitimately still write there.
-      - name: Assert the persistent target dir stayed unused
-        if: runner.environment == 'self-hosted'
-        run: |
-          target="$HOME/cargo-target/moq-$RUNNER_NAME"
-          mkdir -p "$target"
-          leaked=$(find "$target" -type f -newer "$RUNNER_TEMP/target-baseline" 2>/dev/null | head)
-          if [ -n "$leaked" ]; then
-            echo "::error::cargo wrote to $target; a CARGO_TARGET_DIR override leaked back in"
-            echo "$leaked"
-            exit 1
-          fi
-          echo "OK: $target untouched this run"

.github/workflows/docker.yml

@@ -45,7 +45,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/libmoq.yml

@@ -38,7 +38,7 @@ jobs:
             use_nix: false
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -82,7 +82,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -108,3 +108,105 @@ jobs:
           RELEASE_TITLE: "libmoq v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
         run: .github/scripts/release.sh create artifacts
+
+  # The OBS plugin (cpp/obs) statically links libmoq, so it ships with every
+  # libmoq release: rebuild it against the release we just published (no
+  # second cargo build, guaranteed-matching ABI) and cut a parallel
+  # obs-moq-v<version> release. Runs after `release` so the libmoq archives
+  # the plugin's CMake fetches are already live.
+  obs-build:
+    name: OBS plugin (${{ matrix.target }})
+    needs: release
+    runs-on: ${{ matrix.os }}
+
+    # macOS + Windows only. These link the ffmpeg the obs-deps bundle ships
+    # (the same one OBS uses), so the binaries are portable. A Linux build
+    # would link nix/distro ffmpeg and not be portable, so Linux is
+    # build-from-source (see doc/bin/obs.md) and ships no prebuilt binary.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: aarch64-apple-darwin
+            os: macos-latest
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+
+    steps:
+      # Shallow: this job only compiles, it never reads git history or tags.
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Parse version
+        id: parse
+        shell: bash
+        run: .github/scripts/release.sh parse-version libmoq
+
+      # Native Xcode / Visual Studio; libobs/Qt6/ffmpeg come from the obs-deps
+      # bundle and libmoq from the release we just published (--libmoq-release).
+      - name: Build and package
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+          VERSION: ${{ steps.parse.outputs.version }}
+        run: |
+          ./cpp/obs/build.sh --target "$TARGET" --libmoq-release "$VERSION" --output dist
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: obs-moq-${{ matrix.target }}
+          path: dist/*
+
+  obs-release:
+    name: OBS plugin release
+    needs: obs-build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Parse version
+        id: parse
+        run: .github/scripts/release.sh parse-version libmoq
+
+      # Only the obs-moq archives: the libmoq-* artifacts from the build job
+      # belong to the libmoq release, not this one.
+      - name: Download artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          path: artifacts
+          pattern: obs-moq-*
+          merge-multiple: true
+
+      # release.sh prev-tag keys off the current tag, but the trigger here is a
+      # libmoq-v* tag, so it can't find the previous obs-moq tag. Take the
+      # newest existing obs-moq tag (excluding this version, for safe re-runs)
+      # so the release notes span only since the last obs-moq release.
+      - name: Find previous obs-moq tag
+        id: prev_tag
+        env:
+          VERSION: ${{ steps.parse.outputs.version }}
+        run: |
+          cur="obs-moq-v${VERSION}"
+          # awk (not grep -vx | head) so an empty result is exit 0, not 1:
+          # under `set -eo pipefail` the inaugural release has no prior tag and
+          # grep's exit 1 would fail the step. Empty tag is fine downstream.
+          prev=$(git tag --list 'obs-moq-v*' --sort=-v:refname | awk -v cur="$cur" '$0 != cur { print; exit }')
+          echo "tag=${prev}" >>"$GITHUB_OUTPUT"
+
+      # Cut a parallel obs-moq-v<version> release at this commit (gh creates
+      # the tag).
+      - name: Create or update release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: "obs-moq-v${{ steps.parse.outputs.version }}"
+          RELEASE_TITLE: "obs-moq v${{ steps.parse.outputs.version }}"
+          RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
+        run: .github/scripts/release.sh create artifacts

.github/workflows/moq-cli.yml

@@ -31,7 +31,7 @@ jobs:
             rpm-arch: aarch64
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -54,21 +54,10 @@ jobs:
         # and AlmaLinux/RHEL/Rocky 9+ (.rpm).
         run: cargo zigbuild --release --target ${{ matrix.target }}.2.34 -p moq-cli
 
-      - name: Rename binary
-        shell: bash
-        env:
-          TARGET: ${{ matrix.target }}
-        run: |
-          # The crate is named moq-cli but the .deb / .rpm and Homebrew
-          # formula present the binary as `moq`. Cargo produces
-          # target/release/moq-cli by default (no [[bin]] override),
-          # so make a sibling copy that the downstream packaging steps
-          # can point at without each one needing to know the rename.
-          cp "target/${TARGET}/release/moq-cli" "target/${TARGET}/release/moq"
-
       - name: Package bare binary
         shell: bash
         run: |
+          # The crate is named moq-cli but its `[[bin]]` ships as `moq`.
           version="${{ steps.parse.outputs.version }}"
           target="${{ matrix.target }}"
           name="moq-cli-v${version}-${target}"
@@ -83,7 +72,7 @@ jobs:
         run: |
           name="moq-cli-${VERSION}-${TARGET}"
           mkdir -p "dist/${name}/bin"
-          cp "target/${TARGET}/release/moq-cli" "dist/${name}/bin/moq-cli"
+          cp "target/${TARGET}/release/moq" "dist/${name}/bin/moq"
           cp LICENSE-MIT LICENSE-APACHE "dist/${name}/"
           if [[ -f rs/moq-cli/README.md ]]; then
             cp rs/moq-cli/README.md "dist/${name}/"
@@ -140,7 +129,7 @@ jobs:
             os: macos-latest
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -166,6 +155,7 @@ jobs:
         run: |
           ./rs/scripts/package-binary.sh \
             --crate moq-cli \
+            --bin moq \
             --target ${{ matrix.target }} \
             --version ${{ steps.parse.outputs.version }} \
             --output dist
@@ -187,7 +177,7 @@ jobs:
           - target: x86_64-pc-windows-msvc
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -213,6 +203,7 @@ jobs:
         run: |
           ./rs/scripts/package-windows.sh \
             --crate moq-cli \
+            --bin moq \
             --target ${{ matrix.target }} \
             --version ${{ steps.parse.outputs.version }} \
             --output dist
@@ -232,7 +223,7 @@ jobs:
       actions: write
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false