3 Commits

Author	SHA1	Message	Date
bashonly	a4acc42232	[build] Harden release workflow (#16444) ... * Prepare to remove the `release` branch * Remove use of PUSH_VERSION_COMMIT variable * Use RELEASE_KEY for releases Authored by: bashonly	2026-04-07 23:32:29 +00:00
bashonly	ab3ff2d5dd	[build] Harden CI/CD pipeline (#15387) ... * NOTE: the release workflows' new handling of secrets may be a breaking change for forks that are using any secrets other than GPG_SIGNING_KEY or ARCHIVE_REPO_TOKEN. Previously, the release workflow would try to resolve a token secret name based on the `target` or `source` input, e.g. NIGHTLY_ARCHIVE_REPO_TOKEN or CUSTOM_ARCHIVE_REPO_TOKEN, and then fall back to using the ARCHIVE_REPO_TOKEN secret if the resolved token secret name was not found in the repository. This behavior has been replaced by the release workflow always using the ARCHIVE_REPO_TOKEN secret as the token for publishing releases to any external archive repository. * Add zizmor CI job for auditing workflows * Pin all actions to commit hashes instead of symbolic references * Explicitly set GITHUB_TOKEN permissions at the job level * Use actions/checkout with `persist-credentials: false` whenever possible * Remove/replace template expansions in workflow scripts * Remove all usage of actions/cache from build/release workflows * Remove the cache-warmer.yml workflow * Remove the unused download.yml workflow * Set concurrency limits for any workflows that are triggered by PRs * Avoid loading the entire secrets context * Replace usage of `secrets: inherit` with explicit `secrets:` blocks * Pin all external docker images to hash that are used by the build workflow * Explicitly set `shell: bash` for some steps to avoid pwsh or set pipefail * Ensure any pwsh steps will fail on non-zero exit codes Authored by: bashonly	2025-12-30 21:05:10 +00:00
bashonly	50136eeeb3	[build] Overhaul Linux builds and refactor release workflow (#13997) ... - Use `manylinux-shared` images for Linux builds - Discontinue `yt-dlp_linux_armv7l`/`linux_armv7l_exe` release binary - Add `yt-dlp_linux_armv7l.zip`/`linux_armv7l_dir` release binary - Add `yt-dlp_musllinux` and `yt-dlp_musllinux_aarch64` release binaries - Migrate `linux_exe` build strategy from staticx+musl to manylinux2014/glibc2.17 - Rewrite release.yml's "unholy bash monstrosity" as devscripts/setup_variables.py Closes #10072, Closes #10630, Closes #10578, Closes #13976, Closes #13977, Closes #14106 Authored by: bashonly	2025-09-05 22:38:20 +00:00