Harden Actions and build verified release packages

.github/workflows/build.yml

@@ -12,8 +12,8 @@ jobs:
   windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
       - name: Restore
@@ -36,7 +36,7 @@ jobs:
         run: dotnet publish MusicDrop3/MFlacDrop.csproj -c Release -r win-x64 --self-contained true --no-restore -o artifacts/gui
       - name: Publish CLI
         run: dotnet publish MusicDrop3.Cli/MusicDrop3.Cli.csproj -c Release -r win-x64 --self-contained true --no-restore -o artifacts/cli
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: MusicDrop-community-win-x64-slim
           path: |

.github/workflows/portable.yml

@@ -16,8 +16,8 @@ jobs:
         os: [windows-latest, macos-15]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
       - run: dotnet restore MusicDrop.Portable.slnx --configfile NuGet.Config

.github/workflows/release-macos.yml

@@ -4,6 +4,11 @@ on:
   push:
     tags: ['v*']
   workflow_dispatch:
+    inputs:
+      version:
+        description: Package version used for a non-release validation run
+        required: true
+        default: v3.1.0-preview.1-ci
 
 permissions:
   contents: write
@@ -19,16 +24,20 @@ jobs:
           - runner: macos-15
             rid: osx-arm64
     runs-on: ${{ matrix.runner }}
+    env:
+      PACKAGE_VERSION: ${{ github.event_name == 'push' && github.ref_name || inputs.version }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.301
       - name: Build pinned LGPL FFmpeg
         run: bash tools/build_ffmpeg_macos.sh "$RUNNER_TEMP/musicdrop-ffmpeg"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
       - name: Build and package app
-        run: bash tools/package_macos.sh "${{ matrix.rid }}" "$RUNNER_TEMP/musicdrop-ffmpeg" "$RUNNER_TEMP/dist"
-      - uses: actions/upload-artifact@v4
+        run: bash tools/package_macos.sh "${{ matrix.rid }}" "$RUNNER_TEMP/musicdrop-ffmpeg" "$RUNNER_TEMP/dist" "$PACKAGE_VERSION"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: MusicDrop-${{ matrix.rid }}
           path: |
@@ -41,12 +50,12 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: MusicDrop-osx-*
           path: release
           merge-multiple: true
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             release/MusicDrop-*.zip

.github/workflows/release.yml

@@ -3,34 +3,50 @@ name: release
 on:
   push:
     tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Package version used for a non-release validation run
+        required: true
+        default: v3.1.0-preview.1-ci
 
 permissions:
   contents: write
 
 jobs:
-  release:
+  build:
     runs-on: windows-latest
+    env:
+      PACKAGE_VERSION: ${{ github.event_name == 'push' && github.ref_name || inputs.version }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.301
       - run: dotnet restore MusicDrop.slnx --configfile NuGet.Config
-      - run: dotnet publish MusicDrop3/MFlacDrop.csproj -c Release -r win-x64 --self-contained true --no-restore -o publish/gui
-      - run: dotnet publish MusicDrop3.Cli/MusicDrop3.Cli.csproj -c Release -r win-x64 --self-contained true --no-restore -o publish/cli
-      - name: Assemble slim archive
+      - name: Build verified Full and Slim packages
         shell: pwsh
-        run: |
-          New-Item -ItemType Directory -Path package | Out-Null
-          Copy-Item publish/gui/MusicDrop3.exe package/
-          Copy-Item publish/cli/MusicDrop3.Cli.exe package/
-          Copy-Item README.md,LICENSE,THIRD-PARTY-NOTICES.md,TRADEMARKS.md,PRIVACY.md package/
-          Compress-Archive -Path package/* -DestinationPath MusicDrop-${{ github.ref_name }}-Slim-Windows-x64.zip
-          (Get-FileHash MusicDrop-${{ github.ref_name }}-Slim-Windows-x64.zip -Algorithm SHA256).Hash.ToLowerInvariant() |
-            Set-Content MusicDrop-${{ github.ref_name }}-Slim-Windows-x64.zip.sha256.txt -Encoding ascii
-      - uses: softprops/action-gh-release@v2
+        run: ./tools/package_windows.ps1 -Version $env:PACKAGE_VERSION -OutputDirectory release
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: MusicDrop-Windows-x64
+          path: |
+            release/MusicDrop-*.zip
+            release/MusicDrop-*.sha256.txt
+          if-no-files-found: error
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: MusicDrop-Windows-x64
+          path: release
+      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
-            MusicDrop-*.zip
-            MusicDrop-*.sha256.txt
+            release/MusicDrop-*.zip
+            release/MusicDrop-*.sha256.txt
           generate_release_notes: true

THIRD-PARTY-NOTICES.md

@@ -37,7 +37,7 @@ Upstream: <https://ffmpeg.org/> · build scripts: <https://github.com/BtbN/FFmpe
 
 Binary packages that bundle FFmpeg include its `LICENSE.txt`. Users may replace the separate FFmpeg folder with a compatible build, subject to that build's license.
 
-macOS packages build the same FFmpeg commit from the pinned source archive instead of using BtbN Windows binaries. The macOS configuration disables GPL and nonfree, statically enables LAME (LGPL), libogg and libvorbis (BSD-style licenses), records the build configuration and includes the corresponding license files. See `docs/FFMPEG.md` and `tools/build_ffmpeg_macos.sh`.
+macOS packages build the same FFmpeg commit from the pinned source archive instead of using BtbN Windows binaries. The macOS configuration disables GPL and nonfree, statically enables LAME and mpg123 (LGPL), plus libogg and libvorbis (BSD-style licenses), records the build configuration and includes the corresponding license files. See `docs/FFMPEG.md` and `tools/build_ffmpeg_macos.sh`.
 
 ## Optional qqmusic_decrypt compatibility component
 

docs/FFMPEG.md

@@ -19,11 +19,13 @@ The macOS release workflow does not copy an opaque third-party binary. It downlo
 
 The script:
 
-- disables GPL, nonfree, network access, documentation and FFplay;
-- enables static LAME and Vorbis dependencies with compatible licenses;
+- disables GPL, nonfree, network access, documentation, FFplay and automatic external-library detection;
+- enables static LAME, mpg123 and Vorbis dependencies with compatible licenses;
 - rejects unexpected Homebrew dylib references;
 - verifies FLAC, PCM, MP3 and Vorbis encoders;
 - records `-version`, `-buildconf` and SHA-256 outputs;
-- copies FFmpeg, LAME, libogg and libvorbis license texts into the app bundle.
+- copies FFmpeg, LAME, mpg123, libogg and libvorbis license texts into the app bundle.
+
+Homebrew bottles do not consistently install their `COPYING` files. The repository therefore carries the complete license texts extracted from the formula-pinned LAME 4.0, libogg 1.3.6 and libvorbis 1.3.7 source archives after verifying SHA-256 `3df512…16eb`, `83e670…4638` and `b33cc4…954b`; packaging never silently omits them.
 
 See `tools/build_ffmpeg_macos.sh` and [macOS packaging](MACOS.md). A source-built LGPL configuration does not replace the need to comply with LGPL source/relinking obligations when distributing binaries.

docs/MACOS.md

@@ -41,7 +41,7 @@ On a matching Mac:
 
 ```bash
 ./tools/build_ffmpeg_macos.sh "$TMPDIR/musicdrop-ffmpeg"
-./tools/package_macos.sh osx-arm64 "$TMPDIR/musicdrop-ffmpeg" "$PWD/dist"
+./tools/package_macos.sh osx-arm64 "$TMPDIR/musicdrop-ffmpeg" "$PWD/dist" v3.1.0-preview.1
 ```
 
 ## Signing and notarization boundary