mirror of
https://github.com/yt-dlp/yt-dlp.git
synced 2025-12-31 20:11:26 +00:00
ab3ff2d5dd
* NOTE: the release workflows' new handling of secrets may be a breaking change for forks that are using any secrets other than GPG_SIGNING_KEY or ARCHIVE_REPO_TOKEN. Previously, the release workflow would try to resolve a token secret name based on the `target` or `source` input, e.g. NIGHTLY_ARCHIVE_REPO_TOKEN or CUSTOM_ARCHIVE_REPO_TOKEN, and then fall back to using the ARCHIVE_REPO_TOKEN secret if the resolved token secret name was not found in the repository. This behavior has been replaced by the release workflow always using the ARCHIVE_REPO_TOKEN secret as the token for publishing releases to any external archive repository. * Add zizmor CI job for auditing workflows * Pin all actions to commit hashes instead of symbolic references * Explicitly set GITHUB_TOKEN permissions at the job level * Use actions/checkout with `persist-credentials: false` whenever possible * Remove/replace template expansions in workflow scripts * Remove all usage of actions/cache from build/release workflows * Remove the cache-warmer.yml workflow * Remove the unused download.yml workflow * Set concurrency limits for any workflows that are triggered by PRs * Avoid loading the entire secrets context * Replace usage of `secrets: inherit` with explicit `secrets:` blocks * Pin all external docker images to hash that are used by the build workflow * Explicitly set `shell: bash` for some steps to avoid pwsh or set pipefail * Ensure any pwsh steps will fail on non-zero exit codes Authored by: bashonly
179 lines
4.1 KiB
YAML
179 lines
4.1 KiB
YAML
services:
|
|
|
|
linux_x86_64:
|
|
build:
|
|
context: linux
|
|
target: build
|
|
platforms:
|
|
- "linux/amd64"
|
|
args:
|
|
BUILDIMAGE: ghcr.io/yt-dlp/manylinux2014_x86_64-shared:latest
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
CHANNEL: ${CHANNEL:?}
|
|
ORIGIN: ${ORIGIN:?}
|
|
VERSION:
|
|
PYTHON_VERSION:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
volumes:
|
|
- ../..:/yt-dlp
|
|
|
|
linux_x86_64_verify:
|
|
build:
|
|
context: linux
|
|
target: verify
|
|
platforms:
|
|
- "linux/amd64"
|
|
args:
|
|
VERIFYIMAGE: quay.io/pypa/manylinux2014_x86_64:2025.12.19-1@sha256:b716645f9aecd0c1418283af930804bbdbd68a73d855a60101c5aab8548d737d
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
UPDATE_TO:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
volumes:
|
|
- ../../dist:/build
|
|
|
|
linux_aarch64:
|
|
build:
|
|
context: linux
|
|
target: build
|
|
platforms:
|
|
- "linux/arm64"
|
|
args:
|
|
BUILDIMAGE: ghcr.io/yt-dlp/manylinux2014_aarch64-shared:latest
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
CHANNEL: ${CHANNEL:?}
|
|
ORIGIN: ${ORIGIN:?}
|
|
VERSION:
|
|
PYTHON_VERSION:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
volumes:
|
|
- ../..:/yt-dlp
|
|
|
|
linux_aarch64_verify:
|
|
build:
|
|
context: linux
|
|
target: verify
|
|
platforms:
|
|
- "linux/arm64"
|
|
args:
|
|
VERIFYIMAGE: quay.io/pypa/manylinux2014_aarch64:2025.12.19-1@sha256:36cbe6638c7c605c2b44a92e35751baa537ec8902112f790139d89c7e1ccd2a4
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
UPDATE_TO:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
volumes:
|
|
- ../../dist:/build
|
|
|
|
linux_armv7l:
|
|
build:
|
|
context: linux
|
|
target: build
|
|
platforms:
|
|
- "linux/arm/v7"
|
|
args:
|
|
BUILDIMAGE: ghcr.io/yt-dlp/manylinux_2_31_armv7l-shared:latest
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
CHANNEL: ${CHANNEL:?}
|
|
ORIGIN: ${ORIGIN:?}
|
|
VERSION:
|
|
PYTHON_VERSION:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
volumes:
|
|
- ../..:/yt-dlp
|
|
- ../../venv:/yt-dlp-build-venv
|
|
|
|
linux_armv7l_verify:
|
|
build:
|
|
context: linux
|
|
target: verify
|
|
platforms:
|
|
- "linux/arm/v7"
|
|
args:
|
|
VERIFYIMAGE: arm32v7/debian:bullseye@sha256:9d544bf6ff73e36b8df1b7e415f6c8ee40ed84a0f3a26970cac8ea88b0ccf2ac
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
UPDATE_TO:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
volumes:
|
|
- ../../dist:/build
|
|
|
|
musllinux_x86_64:
|
|
build:
|
|
context: linux
|
|
target: build
|
|
platforms:
|
|
- "linux/amd64"
|
|
args:
|
|
BUILDIMAGE: ghcr.io/yt-dlp/musllinux_1_2_x86_64-shared:latest
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
CHANNEL: ${CHANNEL:?}
|
|
ORIGIN: ${ORIGIN:?}
|
|
VERSION:
|
|
PYTHON_VERSION:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
volumes:
|
|
- ../..:/yt-dlp
|
|
|
|
musllinux_x86_64_verify:
|
|
build:
|
|
context: linux
|
|
target: verify
|
|
platforms:
|
|
- "linux/amd64"
|
|
args:
|
|
VERIFYIMAGE: alpine:3.23.2@sha256:865b95f46d98cf867a156fe4a135ad3fe50d2056aa3f25ed31662dff6da4eb62
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
UPDATE_TO:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
volumes:
|
|
- ../../dist:/build
|
|
|
|
musllinux_aarch64:
|
|
build:
|
|
context: linux
|
|
target: build
|
|
platforms:
|
|
- "linux/arm64"
|
|
args:
|
|
BUILDIMAGE: ghcr.io/yt-dlp/musllinux_1_2_aarch64-shared:latest
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
CHANNEL: ${CHANNEL:?}
|
|
ORIGIN: ${ORIGIN:?}
|
|
VERSION:
|
|
PYTHON_VERSION:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
EXCLUDE_CURL_CFFI: "1"
|
|
volumes:
|
|
- ../..:/yt-dlp
|
|
|
|
musllinux_aarch64_verify:
|
|
build:
|
|
context: linux
|
|
target: verify
|
|
platforms:
|
|
- "linux/arm64"
|
|
args:
|
|
VERIFYIMAGE: alpine:3.23.2@sha256:865b95f46d98cf867a156fe4a135ad3fe50d2056aa3f25ed31662dff6da4eb62
|
|
environment:
|
|
EXE_NAME: ${EXE_NAME:?}
|
|
UPDATE_TO:
|
|
SKIP_ONEDIR_BUILD:
|
|
SKIP_ONEFILE_BUILD:
|
|
volumes:
|
|
- ../../dist:/build
|