_build.yml

name: Build (Reusable)

on:
  workflow_call:
    inputs:
      ref:
        # Git ref to checkout. Empty string falls back to caller's github.sha
        description: 'Git ref to build'
        type: string
        default: ''
      retention-days:
        description: 'Artifact retention days'
        type: number
        default: 30

permissions:
  contents: read
  id-token: write
  attestations: write

jobs:
  build:
    name: build-${{ matrix.platform }}-${{ matrix.license }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: true
      matrix:
        # Define arrays for cartesian product (5 platforms × 2 licenses = 10 jobs)
        platform: [darwin-arm64, darwin-x64, linux-x64, linux-arm64, linuxmusl-x64]
        license: [free, non-free]
        # Add extra properties (runner, os) for each platform
        include:
          - platform: darwin-arm64
            runner: macos-15
            os: darwin
          - platform: darwin-x64
            runner: macos-15-intel
            os: darwin
          - platform: linux-x64
            runner: ubuntu-24.04
            os: linux
          - platform: linux-arm64
            runner: ubuntu-24.04
            os: linux
          - platform: linuxmusl-x64
            runner: ubuntu-24.04
            os: linux

    # Cancel in-progress builds for same platform/license/ref combination
    # Uses inputs.ref for release builds, github.sha for CI builds
    concurrency:
      group: build-${{ matrix.platform }}-${{ matrix.license }}-${{ inputs.ref || github.sha }}
      cancel-in-progress: true

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref || github.sha }}

      # QEMU setup for ARM64 cross-compilation on Linux
      - name: Set up QEMU
        if: matrix.platform == 'linux-arm64'
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        if: startsWith(matrix.platform, 'linux')
        uses: docker/setup-buildx-action@v3

      - name: Cache sources
        uses: actions/cache@v5
        with:
          path: build/${{ matrix.platform }}/sources
          key: sources-${{ matrix.platform }}-${{ hashFiles('shared/versions.mk') }}
          restore-keys: |
            sources-${{ matrix.platform }}-

      # macOS builds run natively
      - name: Build FFmpeg (macOS)
        if: matrix.os == 'darwin'
        run: LICENSE=${{ matrix.license }} ./platforms/${{ matrix.platform }}/build.sh all
        env:
          DEBUG: ${{ runner.debug }}

      # Linux builds run in Docker
      - name: Build FFmpeg (Linux)
        if: matrix.os == 'linux'
        run: LICENSE=${{ matrix.license }} ./docker/build.sh ${{ matrix.platform }} all
        env:
          DEBUG: ${{ runner.debug }}

      - name: Verify binary architecture
        run: |
          # Architecture patterns for file command
          case "${{ matrix.platform }}" in
            darwin-arm64)  EXPECTED_ARCH="arm64" ;;
            darwin-x64)    EXPECTED_ARCH="x86_64" ;;
            linux-x64)     EXPECTED_ARCH="x86-64" ;;
            linux-arm64)   EXPECTED_ARCH="aarch64" ;;
            linuxmusl-x64) EXPECTED_ARCH="x86-64" ;;
            *)             EXPECTED_ARCH="unknown" ;;
          esac

          FFMPEG_BIN="artifacts/${{ matrix.platform }}-${{ matrix.license }}/bin/ffmpeg"

          if [[ ! -f "$FFMPEG_BIN" ]]; then
            echo "::error::Binary not found: $FFMPEG_BIN"
            exit 1
          fi

          echo "Verifying $FFMPEG_BIN is $EXPECTED_ARCH..."
          file "$FFMPEG_BIN"

          if ! file "$FFMPEG_BIN" | grep -q "$EXPECTED_ARCH"; then
            echo "::error::Architecture mismatch! Expected $EXPECTED_ARCH"
            exit 1
          fi

          echo "Architecture verified: $EXPECTED_ARCH"

      - name: Create tarball and checksum
        run: |
          TARBALL="ffmpeg-${{ matrix.platform }}-${{ matrix.license }}.tar.gz"

          tar -czvf "$TARBALL" \
            -C artifacts "${{ matrix.platform }}-${{ matrix.license }}"

          # Verify tarball has reasonable size (>1MB for FFmpeg)
          # Use portable stat syntax (Linux uses -c, macOS uses -f)
          if [[ "${{ matrix.os }}" == "darwin" ]]; then
            TARBALL_SIZE=$(stat -f%z "$TARBALL")
          else
            TARBALL_SIZE=$(stat -c%s "$TARBALL")
          fi

          if [[ "$TARBALL_SIZE" -lt 1000000 ]]; then
            echo "::error::Tarball suspiciously small: ${TARBALL_SIZE} bytes"
            exit 1
          fi
          echo "Created $TARBALL (${TARBALL_SIZE} bytes)"

          # Use portable checksum command
          if [[ "${{ matrix.os }}" == "darwin" ]]; then
            shasum -a 256 "$TARBALL" > "${TARBALL}.sha256"
          else
            sha256sum "$TARBALL" > "${TARBALL}.sha256"
          fi

      - name: Generate build attestation
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: 'ffmpeg-${{ matrix.platform }}-${{ matrix.license }}.tar.gz'

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: ffmpeg-${{ matrix.platform }}-${{ matrix.license }}
          path: |
            ffmpeg-${{ matrix.platform }}-${{ matrix.license }}.tar.gz
            ffmpeg-${{ matrix.platform }}-${{ matrix.license }}.tar.gz.sha256
          retention-days: ${{ inputs.retention-days }}