Merge remote-tracking branch 'origin/main' into ladvoc/livekit-capture

Author: ladvoc

.changeset/fix-publisher-renegotiation-deadlock.md

@@ -0,0 +1,8 @@
+---
+libwebrtc: patch
+livekit: patch
+livekit-ffi: patch
+webrtc-sys: patch
+---
+
+Only advertise internal H264 decode formats if the decoder works - #1313 (@MaxHeimbrock)

.changeset/fix_nvenc_dynamic_bitrate_updates.md

@@ -5,8 +5,3 @@ runs:
     - name: Install cargo-make
       uses: taiki-e/install-action@682e7d9e49c5e653d371fc6adbda67653461378a # v2.82.4
       with: { tool: cargo-make@0.37 }
-    - name: Install tera-cli
-      uses: taiki-e/install-action@682e7d9e49c5e653d371fc6adbda67653461378a # v2.82.4
-      with: { tool: tera-cli@0.5.0 }
-    # ^ This would be installed by the cargo-make file automatically, but this ensures
-    # it is already available and downloads binary distribution (no need to build from source).

.changeset/only_advertise_internal_h264_decode_formats_if_the_decoder_w.md

@@ -35,6 +35,8 @@
     "present":           [[pkg, bump], ...], # bumps already in the changeset
     "missing":           [pkg, ...],         # required packages not yet covered
     "invalid":           [{...}, ...],       # bump lines in a format knope would ignore
+    "unmanaged":         [pkg, ...],         # publishable crates missing from knope.toml
+    "stale":             [pkg, ...],         # knope.toml entries with no workspace crate
     "changeset_content": str,               # a changeset prefilled with `missing`
   }
 """
@@ -204,6 +206,38 @@ def detect(meta, knope_packages, changed_files, present):
     }
 
 
+def is_publishable(pkg):
+    """True unless the crate opts out of publishing with `publish = false`.
+
+    `cargo metadata` encodes the manifest's `publish` field as: `null` (default,
+    publishable to any registry), `[]` (`publish = false`), or a list of allowed
+    registry names. Only the empty list means "never published".
+    """
+    return pkg.get("publish") != []
+
+
+def reconcile_knope_config(meta, knope_packages):
+    """Find drift between the Cargo workspace and knope.toml.
+
+    Returns (unmanaged, stale):
+      unmanaged  publishable workspace crates absent from knope.toml. These
+                 silently escape changeset enforcement and are never released.
+                 Fix by adding a `[packages.<name>]` block, or by setting
+                 `publish = false` if the crate isn't meant to ship.
+      stale      knope.toml package names with no matching workspace crate
+                 (e.g. a renamed or removed crate leaving a dangling entry).
+
+    Note the rule is one-directional: publishable implies knope-managed, but a
+    knope-managed crate may set `publish = false` (e.g. livekit-ffi / livekit-
+    uniffi, which CI publishes via wrapper packages rather than `cargo publish`).
+    """
+    workspace_names = {pkg["name"] for pkg in meta["packages"]}
+    publishable = {pkg["name"] for pkg in meta["packages"] if is_publishable(pkg)}
+    unmanaged = sorted(publishable - knope_packages)
+    stale = sorted(knope_packages - workspace_names)
+    return unmanaged, stale
+
+
 def load_cargo_metadata():
     """Fetch workspace metadata (--no-deps avoids network access)."""
     return json.loads(subprocess.check_output(
@@ -227,12 +261,14 @@ def main():
             "direct": [], "downstream": [], "required": [],
             "present": sorted(present.items()), "missing": [],
             "invalid": invalid,
+            "unmanaged": [], "stale": [],
             "changeset_content": "",
         })
         return  # emit calls sys.exit, but guard against falling through
 
     result = detect(meta, knope_packages, changed_files, present)
     result["invalid"] = invalid
+    result["unmanaged"], result["stale"] = reconcile_knope_config(meta, knope_packages)
     emit(result)
 
 

.github/actions/uniffi-deps/action.yml

@@ -29,23 +29,28 @@
 import changeset_detect as cd
 
 
-def make_meta(packages, deps, workspace_root="/ws"):
+def make_meta(packages, deps, workspace_root="/ws", publish=None):
     """Build a fake `cargo metadata` document.
 
     packages: {name -> relative dir}
     deps:     {name -> [dependency names]}
+    publish:  {name -> publish value}, mirroring cargo metadata's `publish`
+              field (`[]` for `publish = false`, a list for restricted
+              registries). Names omitted here get no `publish` key, i.e. the
+              default publishable-to-any-registry state.
     """
-    return {
-        "workspace_root": workspace_root,
-        "packages": [
-            {
-                "name": name,
-                "manifest_path": f"{workspace_root}/{rel}/Cargo.toml",
-                "dependencies": [{"name": d} for d in deps.get(name, [])],
-            }
-            for name, rel in packages.items()
-        ],
-    }
+    publish = publish or {}
+    pkgs = []
+    for name, rel in packages.items():
+        entry = {
+            "name": name,
+            "manifest_path": f"{workspace_root}/{rel}/Cargo.toml",
+            "dependencies": [{"name": d} for d in deps.get(name, [])],
+        }
+        if name in publish:
+            entry["publish"] = publish[name]
+        pkgs.append(entry)
+    return {"workspace_root": workspace_root, "packages": pkgs}
 
 
 # A small synthetic workspace:
@@ -220,6 +225,48 @@ def test_changeset_content_prefills_missing(self):
         self.assertNotIn("a-sys", r["changeset_content"])
 
 
+class TestReconcile(unittest.TestCase):
+    def test_publishable_crate_missing_from_knope_is_unmanaged(self):
+        # Both crates are publishable (no `publish` key); only `a` is in knope.
+        meta = make_meta({"a": "a", "b": "b"}, {})
+        unmanaged, stale = cd.reconcile_knope_config(meta, {"a"})
+        self.assertEqual(unmanaged, ["b"])
+        self.assertEqual(stale, [])
+
+    def test_publish_false_crate_not_required_in_knope(self):
+        # An example crate (publish = false) need not be knope-managed.
+        meta = make_meta({"a": "a", "ex": "examples/ex"}, {}, publish={"ex": []})
+        unmanaged, stale = cd.reconcile_knope_config(meta, {"a"})
+        self.assertEqual(unmanaged, [])
+        self.assertEqual(stale, [])
+
+    def test_publish_false_crate_may_still_be_knope_managed(self):
+        # e.g. livekit-ffi: publish = false but released via CI, so it's in
+        # knope. This must not be flagged as stale.
+        meta = make_meta({"ffi": "ffi"}, {}, publish={"ffi": []})
+        unmanaged, stale = cd.reconcile_knope_config(meta, {"ffi"})
+        self.assertEqual(unmanaged, [])
+        self.assertEqual(stale, [])
+
+    def test_restricted_registry_is_still_publishable(self):
+        meta = make_meta({"a": "a"}, {}, publish={"a": ["crates-io"]})
+        unmanaged, stale = cd.reconcile_knope_config(meta, set())
+        self.assertEqual(unmanaged, ["a"])
+        self.assertEqual(stale, [])
+
+    def test_stale_knope_entry_with_no_matching_crate(self):
+        meta = make_meta({"a": "a"}, {})
+        unmanaged, stale = cd.reconcile_knope_config(meta, {"a", "ghost"})
+        self.assertEqual(unmanaged, [])
+        self.assertEqual(stale, ["ghost"])
+
+    def test_both_directions_at_once(self):
+        meta = make_meta({"a": "a", "b": "b"}, {})
+        unmanaged, stale = cd.reconcile_knope_config(meta, {"a", "ghost"})
+        self.assertEqual(unmanaged, ["b"])
+        self.assertEqual(stale, ["ghost"])
+
+
 class TestBuildChangesetContent(unittest.TestCase):
     def test_deterministic_with_explicit_metadata(self):
         content = cd.build_changeset_content(

.github/scripts/changeset_detect.py

@@ -126,6 +126,46 @@ jobs:
             exit 1
           fi
 
+          # --- Gate: knope.toml must stay in sync with the workspace ---
+          # A publishable crate missing from knope.toml silently escapes changeset
+          # enforcement and is never released; a knope entry with no matching crate
+          # is dangling config. Either is a release-pipeline bug, so fail hard until
+          # the config is reconciled. This runs before the "no versioned packages"
+          # early-out below because a brand-new unmanaged crate maps to no knope
+          # package and would otherwise slip through as "nothing affected".
+          NUM_UNMANAGED=$(echo "$DETECTION" | jq '.unmanaged | length')
+          NUM_STALE=$(echo "$DETECTION" | jq '.stale | length')
+          if [ "$NUM_UNMANAGED" != "0" ] || [ "$NUM_STALE" != "0" ]; then
+            COMMENT_BODY=$(
+              echo "$COMMENT_MARKER"
+              echo "### knope.toml is out of sync with the workspace"
+              echo ""
+              if [ "$NUM_UNMANAGED" != "0" ]; then
+                UNMANAGED_LIST=$(echo "$DETECTION" | jq -r '.unmanaged[] | "- `\(.)`"')
+                echo "These publishable crates are **not** managed by knope, so they would never get a changeset requirement or a release:"
+                echo ""
+                echo "$UNMANAGED_LIST"
+                echo ""
+                echo "Fix each one by **either**:"
+                echo "- adding a \`[packages.<name>]\` block to \`knope.toml\` (if it should be released), **or**"
+                echo "- setting \`publish = false\` in its \`Cargo.toml\` (if it should not)."
+                echo ""
+              fi
+              if [ "$NUM_STALE" != "0" ]; then
+                STALE_LIST=$(echo "$DETECTION" | jq -r '.stale[] | "- `\(.)`"')
+                echo "These \`knope.toml\` packages have no matching workspace crate (renamed or removed?):"
+                echo ""
+                echo "$STALE_LIST"
+                echo ""
+                echo "Remove the stale \`[packages.<name>]\` block(s) from \`knope.toml\`."
+                echo ""
+              fi
+            )
+            upsert_comment "$COMMENT_BODY" || echo "::warning::Could not post PR comment (this can happen for fork PRs with limited permissions)"
+            echo "::error::knope.toml is out of sync with the workspace (unmanaged: ${NUM_UNMANAGED}, stale: ${NUM_STALE}). See the PR comment for details."
+            exit 1
+          fi
+
           # --- If no versioned packages are affected, no changeset is required ---
           NUM_REQUIRED=$(echo "$DETECTION" | jq '.required | length')
           if [ "$NUM_REQUIRED" = "0" ]; then

.github/scripts/test_changeset_detect.py

@@ -33,6 +33,8 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          # Build the tagged source, not the dispatch ref (which defaults to main).
+          ref: ${{ inputs.tag_name }}
           submodules: recursive
 
       - name: Setup Rust toolchain

.github/workflows/changeset-check.yml

@@ -1,64 +1,53 @@
 name: UniFFI packages
 
-# Orchestrates per-language wrapper-package publishing on knope draft releases
-# for the livekit-uniffi crate. Resolves the source tag once, then delegates
-# to per-language reusable workflows (uniffi-swift.yml today; uniffi-kotlin.yml
-# / uniffi-python.yml would slot in as additional jobs).
+# Publishes the per-language livekit-uniffi wrapper packages (Swift xcframework →
+# livekit/livekit-uniffi-xcframework; Android AAR → Maven Central) when a
+# livekit-uniffi release is published.
 #
-# Trigger pattern mirrors ffi-builds.yml: every push to main checks for a
-# draft release with prefix `livekit-uniffi/v`; workflow_dispatch allows
-# manual runs with an explicit tag.
+# knope publishes the `livekit-uniffi/v*` GitHub release (and its git tag)
+# directly on the release merge — no draft — so this reacts to the published
+# release event, which fires only for genuine livekit-uniffi releases (the gate
+# is free). workflow_dispatch allows a manual re-run with an explicit tag.
+#
+# The Dart/Flutter cdylib target is experimental and not published for now; add a
+# `cdylib` job (uniffi-cdylib.yml) back when it ships.
 
 on:
-  push:
-    branches: ["main"]
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
       tag_name:
-        description: "Release tag (e.g., livekit-uniffi/v0.0.7). Required if no draft release exists."
-        required: false
+        description: "Release tag (e.g. livekit-uniffi/v0.1.6)"
+        required: true
         type: string
       dry_run:
-        description: "Build artifacts but skip release upload/PR."
+        description: "Build artifacts but skip publishing."
         type: boolean
         default: false
 
 permissions:
   contents: read
 
-env:
-  TAG_PREFIX: livekit-uniffi/v
-
 jobs:
   resolve-tag:
     runs-on: ubuntu-latest
+    # The release event fires for every package's release, so proceed only for
+    # livekit-uniffi. workflow_dispatch always proceeds (explicit tag).
+    if: ${{ github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'livekit-uniffi/v') }}
     outputs:
       tag_name: ${{ steps.get-tag.outputs.tag_name }}
       version: ${{ steps.get-tag.outputs.version }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - id: get-tag
-        env:
-          GH_TOKEN: ${{ github.token }}
         run: |
-          MANUAL_TAG="${{ inputs.tag_name }}"
-          if [ -n "$MANUAL_TAG" ]; then
-            TAG="$MANUAL_TAG"
-            echo "Using manually provided tag: '$TAG'"
-          else
-            TAG=$(gh release list --repo "${{ github.repository }}" \
-              --json 'isDraft,tagName' \
-              --jq "[.[] | select(.isDraft and (.tagName | startswith(\"${TAG_PREFIX}\")))] | first | .tagName // empty")
-            echo "Resolved livekit-uniffi draft release tag: '${TAG:-<none>}'"
-          fi
+          TAG="${{ github.event.release.tag_name || inputs.tag_name }}"
           echo "tag_name=${TAG}" >> "$GITHUB_OUTPUT"
-          # Strip the "livekit-uniffi/v" prefix to get the hosting-repo tag (e.g., 0.0.7)
-          VERSION="${TAG#${TAG_PREFIX}}"
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          # Strip the "livekit-uniffi/v" prefix to get the package version (e.g. 0.1.6).
+          echo "version=${TAG#livekit-uniffi/v}" >> "$GITHUB_OUTPUT"
 
   swift:
     needs: resolve-tag
-    if: needs.resolve-tag.outputs.tag_name != ''
     uses: ./.github/workflows/uniffi-swift.yml
     with:
       version: ${{ needs.resolve-tag.outputs.version }}
@@ -69,26 +58,9 @@ jobs:
 
   android:
     needs: resolve-tag
-    if: needs.resolve-tag.outputs.tag_name != ''
     uses: ./.github/workflows/uniffi-android.yml
     with:
       version: ${{ needs.resolve-tag.outputs.version }}
       tag_name: ${{ needs.resolve-tag.outputs.tag_name }}
       dry_run: ${{ inputs.dry_run || false }}
     secrets: inherit
-
-  # Raw cdylibs for the Dart package's build-hook download (build-<triple>.zip).
-  cdylib:
-    needs: resolve-tag
-    if: needs.resolve-tag.outputs.tag_name != ''
-    # The reusable workflow uploads to this repo's release via github.token; a
-    # called workflow can't elevate the caller's token, so grant write here (the
-    # top-level default is read). Swift uses a PAT and Android uses Maven, so
-    # neither needs this.
-    permissions:
-      contents: write
-    uses: ./.github/workflows/uniffi-cdylib.yml
-    with:
-      version: ${{ needs.resolve-tag.outputs.version }}
-      tag_name: ${{ needs.resolve-tag.outputs.tag_name }}
-      dry_run: ${{ inputs.dry_run || false }}

.github/workflows/uniffi-android.yml

@@ -42,6 +42,8 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          # Build the tagged source, not the dispatch ref (which defaults to main).
+          ref: ${{ inputs.tag_name }}
           submodules: recursive
 
       - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
@@ -95,6 +97,7 @@ jobs:
             ${{ env.OUTPUT_DIR }}/LICENSE:LICENSE
             ${{ env.OUTPUT_DIR }}/PrivacyInfo.xcprivacy:PrivacyInfo.xcprivacy
             ${{ env.OUTPUT_DIR }}/Sources/${{ env.SPM_NAME }}/livekit_uniffi.swift:Sources/${{ env.SPM_NAME }}/livekit_uniffi.swift
+            ${{ env.OUTPUT_DIR }}/Sources/${{ env.SPM_NAME }}/livekit_datatrack.swift:Sources/${{ env.SPM_NAME }}/livekit_datatrack.swift
           token: ${{ secrets.UNIFFI_XCFRAMEWORK_PAT }}
           pr-body: |
             Source tag: `${{ inputs.tag_name }}`