Dev wasm

.devcontainer/Dockerfile

@@ -121,7 +121,7 @@ ENV PATH="/opt/python/cp312-cp312/bin:${PATH}"
 
 RUN python3 --version && pip3 --version && \
     pip3 install numpy Cython setuptools && \
-    sudo ln -sf /opt/python/cp312-cp312/bin/cython /bin/cython
+    ln -sf /opt/python/cp312-cp312/bin/cython /bin/cython
 
 # 3. Create 'vscode' user
 # Manylinux images are root-only by default. We must recreate the vscode user 

.github/workflows/build_on_linux.yaml

@@ -21,11 +21,11 @@ on:
       target_platforms:
         required: true
         type: string
-        default: linux,windows,android
+        default: linux,windows,android,wasm
       target_archs:
         required: true
         type: string
-        default: x86_64,aarch64,armv7a
+        default: x86_64,aarch64,armv7a,wasm32
       bundles:
         required: true
         type: string
@@ -43,12 +43,12 @@ on:
       target_platforms:
         description: "Comma-separated target platforms this runner can build"
         required: true
-        default: "linux,windows,android"
+        default: "linux,windows,android,wasm"
         type: string
       target_archs:
         description: "Comma-separated target architectures to try for each selected platform"
         required: true
-        default: "x86_64,aarch64,armv7a"
+        default: "x86_64,aarch64,armv7a,wasm32"
         type: string
       force:
         description: "Force rebuild instead of using existing self release artifacts"

.github/workflows/builder_image.yaml

@@ -0,0 +1,83 @@
+name: builder_image
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: builder-image
+  # A newer immutable image build supersedes an older one. This also prevents
+  # an unresponsive BuildKit process from blocking the replacement run.
+  cancel-in-progress: true
+
+jobs:
+  image:
+    name: Publish Linux builder image
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - name: Checkout dispatched source commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
+      - name: Build and publish builder image
+        id: build
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: .devcontainer/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/ffmpeg-kit-builders-dev:sha-${{ github.sha }}
+            ghcr.io/${{ github.repository_owner }}/ffmpeg-kit-builders-dev:latest
+          labels: |
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Record immutable builder image reference
+        env:
+          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
+        shell: bash
+        run: |
+          image="ghcr.io/${GITHUB_REPOSITORY_OWNER}/ffmpeg-kit-builders-dev"
+          test -n "$IMAGE_DIGEST"
+          {
+            echo "image=${image}"
+            echo "source_sha=${GITHUB_SHA}"
+            echo "digest=${IMAGE_DIGEST}"
+            echo "immutable_ref=${image}@${IMAGE_DIGEST}"
+          } | tee builder-image-provenance.txt
+          {
+            echo '### Builder image'
+            echo
+            echo 'Use this digest as the `builder_image_digest` input for the Android AAR workflows:'
+            echo
+            echo '```text'
+            echo "$IMAGE_DIGEST"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload builder image provenance
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ffmpeg-kit-builder-image-${{ github.run_number }}-${{ github.run_attempt }}
+          path: builder-image-provenance.txt
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/repo-source-snapshot.yml

@@ -1,6 +1,53 @@
 name: FFmpegKit Builders Source Snapshot
 
 on:
+  workflow_call:
+    inputs:
+      source_ref:
+        description: Exact branch, tag, or commit to snapshot. Empty uses the caller event SHA.
+        required: false
+        type: string
+        default: ""
+      artifact_prefix:
+        description: Prefix for snapshot and log artifacts.
+        required: false
+        type: string
+        default: ffmpeg-kit-builders-source-snapshot
+      retention_days:
+        description: Artifact retention in days.
+        required: false
+        type: number
+        default: 7
+      include_submodules:
+        description: Recursively initialize Git submodules.
+        required: false
+        type: boolean
+        default: true
+      include_lfs:
+        description: Fetch Git LFS objects during checkout.
+        required: false
+        type: boolean
+        default: false
+    outputs:
+      snapshot_sha:
+        description: Exact checked-out source commit.
+        value: ${{ jobs.snapshot.outputs.snapshot_sha }}
+      artifact_name:
+        description: Uploaded source snapshot artifact name.
+        value: ${{ jobs.snapshot.outputs.artifact_name }}
+      artifact_id:
+        description: Uploaded source snapshot artifact ID.
+        value: ${{ jobs.snapshot.outputs.artifact_id }}
+      artifact_url:
+        description: Authenticated URL for the uploaded source snapshot artifact.
+        value: ${{ jobs.snapshot.outputs.artifact_url }}
+      artifact_digest:
+        description: Digest reported by actions/upload-artifact.
+        value: ${{ jobs.snapshot.outputs.artifact_digest }}
+    secrets:
+      GH_TOKEN:
+        required: false
+
   workflow_dispatch:
     inputs:
       source_ref:
@@ -9,10 +56,10 @@ on:
         type: string
         default: ""
       artifact_prefix:
-        description: Prefix for snapshot and diagnostic artifacts.
+        description: Prefix for snapshot and log artifacts.
         required: false
         type: string
-        default: ffmpeg-kit-builders-source
+        default: ffmpeg-kit-builders-source-snapshot
       retention_days:
         description: Artifact retention in days.
         required: false
@@ -29,16 +76,22 @@ on:
         type: boolean
         default: false
 
-permissions:
-  contents: read
-
 concurrency:
   group: ffmpeg-kit-builders-source-snapshot-${{ github.repository_id }}-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
   snapshot:
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04
+    outputs:
+      snapshot_sha: ${{ steps.metadata.outputs.snapshot_sha }}
+      artifact_name: ${{ steps.metadata.outputs.artifact_name }}
+      artifact_id: ${{ steps.upload.outputs['artifact-id'] }}
+      artifact_url: ${{ steps.upload.outputs['artifact-url'] }}
+      artifact_digest: ${{ steps.upload.outputs['artifact-digest'] }}
+
     steps:
       - name: Initialize diagnostic log
         shell: bash
@@ -55,6 +108,7 @@ jobs:
             echo "ref=${GITHUB_REF}"
             echo "repository=${GITHUB_REPOSITORY}"
             echo "runner_os=${RUNNER_OS}"
+            echo "runtimeExecution=false"
             echo "started_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
           } | tee -a "$log"
 
@@ -65,27 +119,49 @@ jobs:
           fetch-depth: 1
           submodules: ${{ inputs.include_submodules && 'recursive' || 'false' }}
           lfs: ${{ inputs.include_lfs }}
+          token: ${{ secrets.GH_TOKEN || github.token }}
           persist-credentials: false
 
+      - name: Verify recursive submodule materialization
+        if: ${{ inputs.include_submodules }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          log="${RUNNER_TEMP}/ffmpeg-kit-builders-source-snapshot.log"
+          exec > >(tee -a "$log") 2>&1
+          if git submodule status --recursive | grep -E '^-'; then
+            echo "one or more submodules are uninitialized" >&2
+            exit 2
+          fi
+          git submodule status --recursive
+
       - name: Verify source authority
         id: metadata
         env:
           REQUESTED_REF: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
-          ARTIFACT_PREFIX: ${{ inputs.artifact_prefix != '' && inputs.artifact_prefix || 'ffmpeg-kit-builders-source' }}
+          ARTIFACT_PREFIX: ${{ inputs.artifact_prefix != '' && inputs.artifact_prefix || 'ffmpeg-kit-builders-source-snapshot' }}
         shell: bash
         run: |
           set -euo pipefail
           log="${RUNNER_TEMP}/ffmpeg-kit-builders-source-snapshot.log"
           exec > >(tee -a "$log") 2>&1
+          trap 'status=$?; echo "verify_source_exit=${status}"' EXIT
+
           snapshot_sha="$(git rev-parse HEAD)"
           artifact_name="${ARTIFACT_PREFIX}-${GITHUB_RUN_ID}"
+
           echo "requested_ref=${REQUESTED_REF}"
           echo "snapshot_sha=${snapshot_sha}"
+          echo "git_version=$(git --version)"
+          echo "tar_version=$(tar --version | head -n 1)"
+          echo "rsync_version=$(rsync --version | head -n 1)"
           git status --short
+
           if [[ "${REQUESTED_REF}" =~ ^[0-9a-fA-F]{40}$ ]] && [[ "${snapshot_sha,,}" != "${REQUESTED_REF,,}" ]]; then
             echo "exact source SHA mismatch: requested=${REQUESTED_REF}; actual=${snapshot_sha}" >&2
             exit 3
           fi
+
           echo "snapshot_sha=${snapshot_sha}" >> "$GITHUB_OUTPUT"
           echo "artifact_name=${artifact_name}" >> "$GITHUB_OUTPUT"
 
@@ -100,34 +176,51 @@ jobs:
           set -euo pipefail
           log="${RUNNER_TEMP}/ffmpeg-kit-builders-source-snapshot.log"
           exec > >(tee -a "$log") 2>&1
+          trap 'status=$?; echo "snapshot_archive_exit=${status}"' EXIT
+
           out="${RUNNER_TEMP}/ffmpeg-kit-builders-source-snapshot-result"
           source_dir="${out}/source"
           rm -rf "$out"
           mkdir -p "$source_dir"
-          rsync -a --exclude='.git' --exclude='.git/**' "${GITHUB_WORKSPACE}/" "$source_dir/"
+
+          rsync -a \
+            --exclude='.git' \
+            --exclude='.git/**' \
+            --exclude='.workflow-mailbox' \
+            --exclude='.workflow-mailbox/**' \
+            "${GITHUB_WORKSPACE}/" "$source_dir/"
+
           if find "$source_dir" -name .git -print -quit | grep -q .; then
             echo "snapshot unexpectedly contains .git metadata" >&2
             exit 4
           fi
+
           (
             cd "$out"
-            find source -type f -print0 | LC_ALL=C sort -z | xargs -0 -r sha256sum > SHA256SUMS
+            find source -type f -print0 \
+              | LC_ALL=C sort -z \
+              | xargs -0 -r sha256sum > SHA256SUMS
+
             : > SYMLINKS.tsv
             while IFS= read -r -d '' link; do
               printf '%s\t%s\n' "$link" "$(readlink "$link")"
             done < <(find source -type l -print0 | LC_ALL=C sort -z) > SYMLINKS.tsv
+
             if [[ "$INCLUDE_SUBMODULES" == "true" ]]; then
               git -C "$GITHUB_WORKSPACE" submodule status --recursive > SUBMODULES.txt
             else
               : > SUBMODULES.txt
             fi
+
             tar -czf source.tar.gz source
             sha256sum source.tar.gz > source.tar.gz.sha256
           )
+
           file_count="$(find "$source_dir" -type f | wc -l | tr -d ' ')"
           symlink_count="$(find "$source_dir" -type l | wc -l | tr -d ' ')"
           byte_count="$(du -sb "$source_dir" | awk '{print $1}')"
           archive_sha="$(awk '{print $1}' "${out}/source.tar.gz.sha256")"
+
           jq -n \
             --arg repository "$GITHUB_REPOSITORY" \
             --arg event "$GITHUB_EVENT_NAME" \
@@ -141,11 +234,30 @@ jobs:
             --argjson byte_count "$byte_count" \
             --argjson include_submodules "$INCLUDE_SUBMODULES" \
             --argjson include_lfs "$INCLUDE_LFS" \
-            '{repository: $repository, event: $event, event_sha: $event_sha, snapshot_sha: $snapshot_sha, artifact_name: $artifact_name, archive_sha256: $archive_sha256, file_count: $file_count, symlink_count: $symlink_count, byte_count: $byte_count, include_submodules: $include_submodules, include_lfs: $include_lfs, generated_at: $generated_at}' \
-            > "${out}/snapshot-metadata.json"
+            '{
+              repository: $repository,
+              event: $event,
+              event_sha: $event_sha,
+              snapshot_sha: $snapshot_sha,
+              artifact_name: $artifact_name,
+              archive_sha256: $archive_sha256,
+              file_count: $file_count,
+              symlink_count: $symlink_count,
+              byte_count: $byte_count,
+              include_submodules: $include_submodules,
+              include_lfs: $include_lfs,
+              runtimeExecution: false,
+              generated_at: $generated_at
+            }' > "${out}/snapshot-metadata.json"
+
+          echo "snapshot_file_count=${file_count}"
+          echo "snapshot_symlink_count=${symlink_count}"
+          echo "snapshot_byte_count=${byte_count}"
+          echo "archive_sha256=${archive_sha}"
           cat "${out}/snapshot-metadata.json"
 
       - name: Upload source snapshot
+        id: upload
         uses: actions/upload-artifact@v4
         with:
           name: ${{ steps.metadata.outputs.artifact_name }}
@@ -176,7 +288,25 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: ${{ inputs.artifact_prefix != '' && inputs.artifact_prefix || 'ffmpeg-kit-builders-source' }}-log-${{ github.run_id }}
+          name: ${{ inputs.artifact_prefix != '' && inputs.artifact_prefix || 'ffmpeg-kit-builders-source-snapshot' }}-log-${{ github.run_id }}
           path: ${{ runner.temp }}/ffmpeg-kit-builders-source-snapshot.log
           if-no-files-found: error
           retention-days: ${{ inputs.retention_days }}
+
+  mailbox:
+    if: always()
+    needs: [snapshot]
+    permissions:
+      actions: read
+      contents: write
+    uses: ./.github/workflows/workflow-mailbox-publisher.yml
+    with:
+      workflow_key: ffmpeg-kit-builders-source-snapshot
+      source_sha: ${{ needs.snapshot.outputs.snapshot_sha != '' && needs.snapshot.outputs.snapshot_sha || github.sha }}
+      source_ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.ref }}
+      result: ${{ needs.snapshot.result }}
+      summary: Repository source snapshot for the requested frozen implementation source.
+      artifact_name: ${{ needs.snapshot.outputs.artifact_name }}
+      artifact_id: ${{ needs.snapshot.outputs.artifact_id }}
+      artifact_url: ${{ needs.snapshot.outputs.artifact_url }}
+      artifact_digest: ${{ needs.snapshot.outputs.artifact_digest }}