Merge branch 'main' into feat/notes-teleprompter-67

Author: EtienneLescot

.github/workflows/build.yml

@@ -89,10 +89,19 @@ jobs:
 
   build-macos:
     name: macOS ${{ matrix.arch }} DMG
-    # RELEASE-BRANCH-ONLY: 1.8.0 ships Windows-only. Do NOT let this `if: false`
-    # reach main when promoting, or every later release becomes Windows-only too.
-    if: false
-    runs-on: macos-latest
+    # Build each arch NATIVELY. `macos-latest` is Apple Silicon, and everything the
+    # 1.8.0 macOS path added keys off the HOST arch: fetch-ffmpeg-macos.mjs configures
+    # with `--arch=${process.arch}`, and build-macos-compositor-addon.mjs installs into
+    # `darwin-${process.arch}` and runs cargo without `--target`. So the x64 job on an
+    # arm64 runner produced arm64 output in darwin-arm64/, and packaging then failed
+    # with "Refusing to package an incomplete macOS payload — looked in darwin-x64".
+    # v1.7.0 shipped an x64 DMG because it had neither the compositor addon nor a
+    # vendored ffmpeg to build; both arrived with 1.8.0 and nobody could see the
+    # breakage while this job sat behind `if: false`.
+    # Running x64 on an Intel runner fixes it without threading a target arch through
+    # ffmpeg's configure, cargo and the output paths — four blind changes on a release
+    # branch, none of them testable without a Mac.
+    runs-on: ${{ matrix.arch == 'x64' && 'macos-15-intel' || 'macos-latest' }}
     strategy:
       fail-fast: false
       matrix:
@@ -300,8 +309,6 @@ jobs:
 
   build-linux:
     name: Linux packages
-    # RELEASE-BRANCH-ONLY: see the note on build-macos above.
-    if: false
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -337,11 +344,10 @@ jobs:
   publish-release:
     name: Publish GitHub release
     runs-on: ubuntu-latest
-    # RELEASE-BRANCH-ONLY: build-macos / build-linux are disabled for this
-    # Windows-only release. A skipped job in `needs` skips this one too, so they
-    # must come out of the list, not just be gated. Restore all three on main.
     needs:
       - build-windows
+      - build-macos
+      - build-linux
     if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || (github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag != '') }}
     steps:
       - name: Checkout code
@@ -409,23 +415,18 @@ jobs:
           path: artifacts/windows
 
       - name: Download macOS arm64 DMG
-        continue-on-error: true
         uses: actions/download-artifact@v4
         with:
           name: openscreen-mac-arm64
           path: artifacts/mac-arm64
 
       - name: Download macOS x64 DMG
-        continue-on-error: true
         uses: actions/download-artifact@v4
         with:
           name: openscreen-mac-x64
           path: artifacts/mac-x64
 
       - name: Download Linux packages
-        # RELEASE-BRANCH-ONLY: tolerate the missing artifact from the disabled
-        # Linux job (the macOS downloads below already do). Drop with the rest.
-        continue-on-error: true
         uses: actions/download-artifact@v4
         with:
           name: openscreen-linux

.github/workflows/docs.yml

@@ -11,6 +11,14 @@ on:
     paths:
       - "website/**"
       - ".github/workflows/docs.yml"
+  # The /download page resolves the current release's assets at build time so it
+  # can link each platform to its actual file. Without this trigger that data
+  # would freeze at whatever the last website/** change saw, and the page would
+  # keep serving the previous version's binaries after every release.
+  # Pre-releases are skipped: /releases/latest ignores them, so the built output
+  # would be byte-identical.
+  release:
+    types: [published]
   workflow_dispatch:
 
 # Cancel in-flight runs on the same ref so fast follow-up pushes
@@ -26,6 +34,9 @@ jobs:
   build:
     name: Build site
     runs-on: ubuntu-latest
+    # A pre-release does not change what /releases/latest resolves to, so
+    # rebuilding for one would burn a run to produce identical output.
+    if: github.event_name != 'release' || github.event.release.prerelease == false
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
@@ -53,7 +64,9 @@ jobs:
     name: Deploy to GitHub Pages
     runs-on: ubuntu-latest
     needs: build
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+      || github.event_name == 'release'
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

electron/native/whisper-stt/CMakeLists.txt

@@ -127,6 +127,21 @@ set(HTTPLIB_USE_OPENSSL_IF_AVAILABLE OFF CACHE BOOL "" FORCE)
 set(HTTPLIB_USE_ZLIB_IF_AVAILABLE    OFF CACHE BOOL "" FORCE)
 set(HTTPLIB_USE_BROTLI_IF_AVAILABLE  OFF CACHE BOOL "" FORCE)
 
+# ponytail: on Linux, ggml/whisper build as separate shared objects and CMake
+# bakes the absolute build-tree `bin/` path into each RUNPATH. The build script
+# then copies the binary and its libs side by side into
+# `electron/native/bin/linux-x64/`, where that absolute path is meaningless the
+# moment the build cache is wiped or the app is packaged on another machine.
+# Resolve relative to the executable instead. `$ORIGIN/bin` keeps the binary in
+# the build tree runnable too (it lands at the build root while the libs go to
+# `bin/`). Set before MakeAvailable so the whisper/ggml targets inherit it.
+# macOS is left alone: it needs @loader_path rather than $ORIGIN and is not
+# testable from here.
+if(UNIX AND NOT APPLE)
+  set(CMAKE_BUILD_WITH_INSTALL_RPATH ON)
+  set(CMAKE_INSTALL_RPATH "$ORIGIN:$ORIGIN/bin")
+endif()
+
 FetchContent_MakeAvailable(whisper httplib json)
 
 add_executable(whisper-stt-server src/main.cpp)

package.json

@@ -36,7 +36,7 @@
 		"build:native:linux": "node scripts/build-linux-pipewire-helper.mjs",
 		"build:win": "npm run build:native:win && npm run fetch:ffmpeg && npm run build:native:compositor && tsc && vite build && electron-builder --win --config.npmRebuild=false",
 		"build:win:store": "npm run build:native:win && npm run fetch:ffmpeg && npm run build:native:compositor && tsc && vite build && electron-builder --win appx --config.npmRebuild=false",
-		"build:linux": "npm run build:native:linux && npm run build:native:compositor:linux && tsc && vite build && electron-builder --linux AppImage deb pacman --config.npmRebuild=false",
+		"build:linux": "npm run fetch:ffmpeg:sdk && npm run build:native:linux && npm run build:native:compositor:linux && tsc && vite build && electron-builder --linux AppImage deb pacman --config.npmRebuild=false",
 		"build:whisper-binaries": "bash scripts/build-whisper-stt.sh",
 		"test:whisper-stt": "node scripts/test-whisper-stt.mjs",
 		"test": "vitest --run",
@@ -66,7 +66,8 @@
 		"test:e2e:windows-native-checklist": "playwright test tests/e2e/windows-native-checklist.spec.ts",
 		"prepare": "husky",
 		"fetch:ffmpeg": "node scripts/fetch-ffmpeg.mjs",
-		"fetch:ffmpeg:mac": "node scripts/fetch-ffmpeg-macos.mjs"
+		"fetch:ffmpeg:mac": "node scripts/fetch-ffmpeg-macos.mjs",
+		"fetch:ffmpeg:sdk": "node scripts/fetch-ffmpeg.mjs --sdk-only"
 	},
 	"dependencies": {
 		"@fix-webm-duration/fix": "^1.0.1",

scripts/fetch-ffmpeg-macos.mjs

@@ -93,6 +93,19 @@ run(
 		"--disable-static",
 		"--disable-doc",
 		"--disable-debug",
+		// ffmpeg's configure AUTO-DETECTS these from whatever the build machine happens
+		// to have installed, and a GitHub macOS runner has a large Homebrew prefix. That
+		// is how libavformat came to link /opt/homebrew/opt/libx11/lib/libX11.6.dylib and
+		// trip build-macos-compositor-addon.mjs's "no absolute build-machine paths" check,
+		// which is the check doing its job: such a dylib is unresolvable on a user's Mac.
+		// Disabled explicitly rather than left to chance, so the vendored tree depends on
+		// the source tarball and the SDK, never on the runner's incidental packages.
+		// None is used here: xlib/libxcb are X11 capture, sdl2 is only ffplay, and lzma
+		// only reaches decoders we do not ship (we decode mp4/webm).
+		"--disable-xlib",
+		"--disable-libxcb",
+		"--disable-sdl2",
+		"--disable-lzma",
 		"--enable-videotoolbox",
 		"--enable-audiotoolbox",
 		"--disable-x86asm",