build-free-https.yml

name: Build 6.0 LTS (Free Https variant — Maven alias source)

# Produces the binary published under the Maven Central alias
# ffmpeg-kit-https — see build-81-free-https.yml's header for the full
# rationale (gmp+gnutls, not openssl; MediaCodec/zlib included as universal
# Android system libraries per Arthenica's original table).

on:
  workflow_dispatch:

jobs:
  build:
    name: Build ffmpeg-kit 6.0 LTS (free-https, arm64-v8a + x86_64)
    runs-on: ubuntu-24.04
    timeout-minutes: 180

    defaults:
      run:
        shell: bash
        working-directory: android-6.0-lts

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Set up JDK 17
        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: "17"

      - name: Install build prerequisites
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            autoconf automake libtool pkg-config curl git \
            build-essential yasm nasm gperf texinfo bison ragel \
            python3 python3-pip unzip zip wget meson ninja-build \
            doxygen cmake autogen autopoint groff gtk-doc-tools libtasn1-bin

      - name: Install Android platform 35
        run: |
          set +o pipefail
          yes | "${ANDROID_HOME}"/cmdline-tools/latest/bin/sdkmanager --licenses >/dev/null
          set -o pipefail
          "${ANDROID_HOME}"/cmdline-tools/latest/bin/sdkmanager "platforms;android-35"

      - name: Cache Android NDK r27c
        id: cache-ndk
        uses: actions/cache@v6
        with:
          path: ~/.ndk
          key: ndk-r27c-linux

      - name: Download Android NDK r27c
        if: steps.cache-ndk.outputs.cache-hit != 'true'
        run: |
          curl -s "https://dl.google.com/android/repository/android-ndk-r27c-linux.zip" -o ndk.zip
          unzip -q -o ndk.zip -d "${HOME}/.ndk"

      - name: Export ANDROID_NDK_ROOT
        run: echo "ANDROID_NDK_ROOT=${HOME}/.ndk/$(ls "${HOME}/.ndk")" >> "$GITHUB_ENV"

      - name: Restore latest build checkpoint from ci-cache-free-https branch
        run: |
          if git ls-remote --exit-code --heads origin ci-cache-free-https >/dev/null 2>&1; then
            echo "Found ci-cache-free-https branch, restoring prebuilt/ and src/ from it"
            git fetch --depth=1 origin ci-cache-free-https
            git archive FETCH_HEAD | tar -x
            echo "Restored:"
            find prebuilt src -maxdepth 2 -type d 2>/dev/null | sort || true
          else
            echo "No ci-cache-free-https branch yet - starting fresh"
          fi

      - name: Build free-https variant (arm64-v8a + x86_64)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |

          touch build.log
          set +e
          ./android.sh --enable-gnutls --enable-gmp \
            --enable-android-media-codec --enable-android-zlib \
            --disable-arm-v7a --disable-arm-v7a-neon --disable-x86
          BUILD_EXIT=$?
          exit "$BUILD_EXIT"

      - name: Print build log on failure
        if: failure() || cancelled()
        run: cat build.log || echo "no build.log produced (failed before the build step ran)"

      - name: Print ffbuild config log on failure
        if: failure() || cancelled()
        run: '[[ -f ./src/ffmpeg/ffbuild/config.log ]] && tail -100 ./src/ffmpeg/ffbuild/config.log || true'

      - name: Print toolchain env and per-library config logs on failure
        if: failure() || cancelled()
        run: |
          echo "=== toolchain env ==="
          echo "CC=$CC"
          echo "CXX=$CXX"
          echo "AR=$AR"
          echo "AS=$AS"
          echo "LD=$LD"
          echo "STRIP=$STRIP"
          echo "RANLIB=$RANLIB"
          echo "CFLAGS=$CFLAGS"
          echo "CXXFLAGS=$CXXFLAGS"
          echo "LDFLAGS=$LDFLAGS"
          echo "ANDROID_NDK_ROOT=$ANDROID_NDK_ROOT"
          echo
          echo "=== config.log files under src/ (most recently modified first) ==="
          while IFS= read -r log; do
            echo "--- $log ---"
            tail -150 "$log"
            echo
          done < <(find src -iname "config.log" -printf '%T@ %p\n' 2>/dev/null | sort -rn | cut -d' ' -f2- | head -3)

      # ⚠️ Les rustines de securite sont-elles DANS ce build ?
      #
      # Sur 6.0 et 7.1 les CVE arrivent par backport : `SOURCE_ID` ne bouge jamais, et
      # rien dans le tag pinne ne distingue un arbre avec les correctifs d'un arbre
      # sans. Un `prebuilt/` restaure du checkpoint peut donc expedier des binaires
      # sans les correctifs, avec un `check-filters --pin` qui passe -- puisque la
      # version, elle, est la bonne.
      #
      # Chaque rustine appliquee s'inscrit desormais dans `prebuilt/.security-patches`.
      # Ceci compare ce manifeste au jeu de rustines du depot et refuse de continuer
      # s'il en manque une, quelle qu'en soit la raison.
      # ⚠️ La chaine d'outils en usage est-elle celle que la ligne declare ?
      #
      # C'est deja arrive : 8.1.3 a ete publie en annoncant le r27c alors que l'URL de
      # telechargement du workflow pointait encore sur le r26c. Deux endroits nomment le
      # NDK et rien ne les comparait. Maven Central etant immuable, une version publiee
      # sur la foi d'une chaine d'outils qui n'est pas la sienne ne se corrige pas.
      - name: The NDK in use is the one this line declares
        run: python3 ../tools/check-ndk.py

      - name: The security patches are in this build
        run: python3 ../tools/check-security-patches.py

      # ⚠️ On lit l'AAR LIVRE, pas l'arbre de compilation.
      #
      # L'etape precedente parcourait `find prebuilt -name "*.so"`. Elle ne voyait donc
      # pas `libc++_shared.so`, que Gradle ajoute en fabriquant l'AAR et qui est copiee
      # telle quelle du NDK -- aucun drapeau d'edition de liens ne l'atteint. Et elle ne
      # regardait que p_align, jamais PT_GNU_RELRO.
      #
      # Mesure du 2026-09-25 : elle etait verte sur les lignes 6.0 et 7.1 alors que
      # 7 de leurs 9 paliers publies ne se chargeaient pas du tout --
      # `dlopen failed: can't enable GNU RELRO protection … Out of memory`, parce que
      # le lld du NDK r26c arrondit RELRO a 16 Ko sans completer le dernier LOAD.
      #
      # Ce qu'un client installe, c'est l'AAR. C'est donc l'AAR qu'on lit.
      - name: The native libraries can be loaded (16 KB pages, RELRO)
        run: python3 ../tools/check-elf-16kb.py prebuilt/bundle-android-aar/ffmpeg-kit/ffmpeg-kit.aar

      - name: Verify tier content matches "https" exactly (binary check)
        run: |
          set -e
          fail=0
          echo "=== Negative: paid-tier-only strings must be ABSENT ==="
          for term in tesseract leptonica chromaprint whisper ggml libass; do
            hits=$(grep -a -il -- "$term" $(find prebuilt -name "*.so") 2>/dev/null || true)
            if [[ -n "$hits" ]]; then
              echo "::error::found '$term' in: $hits (must not be in https)"
              fail=1
            else
              echo "OK: '$term' absent"
            fi
          done
          if find prebuilt -iname "*whisper*" | grep -q .; then
            echo "::error::a libwhisperkit*.so file is present — must not be in a Free build"
            fail=1
          fi
          # GPL encoders: check real API symbols, not bare "x264"/"x265" -- FFmpeg's own
          # H.264 SEI decoder recognizes and logs x264's "x264 - core N" version string
          # embedded by ANY x264-encoded source video, in every build that can decode
          # H.264 at all (i.e. all of them) -- a naive substring match false-positives on
          # that decoder-side string even when the encoder itself was never linked.
          for symbol in x264_encoder_open x265_encoder_open xvid_encore; do
            hits=$(grep -a -il -- "$symbol" $(find prebuilt -name "*.so") 2>/dev/null || true)
            if [[ -n "$hits" ]]; then
              echo "::error::found GPL encoder symbol '$symbol' in: $hits (must not be in https)"
              fail=1
            else
              echo "OK: '$symbol' absent"
            fi
          done
          echo "=== Positive: gnutls + mediacodec must be PRESENT ==="
          for term in gnutls mediacodec; do
            hits=$(grep -a -il -- "$term" $(find prebuilt -name "*.so") 2>/dev/null || true)
            if [[ -z "$hits" ]]; then
              echo "::error::'$term' not found in any .so — https build is incomplete"
              fail=1
            else
              echo "OK: '$term' present in: $hits"
            fi
          done
          exit "$fail"

      - name: Upload AAR artifact
        uses: actions/upload-artifact@v7
        with:
          name: ffmpeg-kit-free-https-arm64-v8a-x86_64
          path: android-6.0-lts/prebuilt/bundle-android-aar/ffmpeg-kit/ffmpeg-kit.aar
          retention-days: 3