build-free-https.yml

name: Build 6.0 LTS (Free Https variant — Maven alias source)

# Produces the binary published under the Maven Central alias
# ffmpeg-kit-https — see build-81-free-https.yml's header for the full
# rationale (gmp+gnutls, not openssl; MediaCodec/zlib included as universal
# Android system libraries per Arthenica's original table).

on:
  workflow_dispatch:

jobs:
  build:
    name: Build ffmpeg-kit 6.0 LTS (free-https, arm64-v8a + x86_64)
    runs-on: ubuntu-24.04
    timeout-minutes: 180

    defaults:
      run:
        shell: bash
        working-directory: android-6.0-lts

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Install build prerequisites
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            autoconf automake libtool pkg-config curl git \
            build-essential yasm nasm gperf texinfo bison ragel \
            python3 python3-pip unzip zip wget meson ninja-build \
            doxygen cmake autogen autopoint groff gtk-doc-tools libtasn1-bin

      - name: Install Android platform 35
        run: |
          set +o pipefail
          yes | "${ANDROID_HOME}"/cmdline-tools/latest/bin/sdkmanager --licenses >/dev/null
          set -o pipefail
          "${ANDROID_HOME}"/cmdline-tools/latest/bin/sdkmanager "platforms;android-35"

      - name: Cache Android NDK r26c
        id: cache-ndk
        uses: actions/cache@v4
        with:
          path: ~/.ndk
          key: ndk-r26c-linux

      - name: Download Android NDK r26c
        if: steps.cache-ndk.outputs.cache-hit != 'true'
        run: |
          curl -s "https://dl.google.com/android/repository/android-ndk-r26c-linux.zip" -o ndk.zip
          unzip -q -o ndk.zip -d "${HOME}/.ndk"

      - name: Export ANDROID_NDK_ROOT
        run: echo "ANDROID_NDK_ROOT=${HOME}/.ndk/$(ls "${HOME}/.ndk")" >> "$GITHUB_ENV"

      - name: Restore latest build checkpoint from ci-cache-free-https branch
        run: |
          if git ls-remote --exit-code --heads origin ci-cache-free-https >/dev/null 2>&1; then
            echo "Found ci-cache-free-https branch, restoring prebuilt/ and src/ from it"
            git fetch --depth=1 origin ci-cache-free-https
            git archive FETCH_HEAD | tar -x
            echo "Restored:"
            find prebuilt src -maxdepth 2 -type d 2>/dev/null | sort || true
          else
            echo "No ci-cache-free-https branch yet - starting fresh"
          fi

      - name: Build free-https variant (arm64-v8a + x86_64)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |

          touch build.log
          set +e
          ./android.sh --enable-gnutls --enable-gmp \
            --enable-android-media-codec --enable-android-zlib \
            --disable-arm-v7a --disable-arm-v7a-neon --disable-x86
          BUILD_EXIT=$?
          exit "$BUILD_EXIT"

      - name: Print build log on failure
        if: failure() || cancelled()
        run: cat build.log || echo "no build.log produced (failed before the build step ran)"

      - name: Print ffbuild config log on failure
        if: failure() || cancelled()
        run: '[[ -f ./src/ffmpeg/ffbuild/config.log ]] && tail -100 ./src/ffmpeg/ffbuild/config.log || true'

      - name: Print toolchain env and per-library config logs on failure
        if: failure() || cancelled()
        run: |
          echo "=== toolchain env ==="
          echo "CC=$CC"
          echo "CXX=$CXX"
          echo "AR=$AR"
          echo "AS=$AS"
          echo "LD=$LD"
          echo "STRIP=$STRIP"
          echo "RANLIB=$RANLIB"
          echo "CFLAGS=$CFLAGS"
          echo "CXXFLAGS=$CXXFLAGS"
          echo "LDFLAGS=$LDFLAGS"
          echo "ANDROID_NDK_ROOT=$ANDROID_NDK_ROOT"
          echo
          echo "=== config.log files under src/ (most recently modified first) ==="
          while IFS= read -r log; do
            echo "--- $log ---"
            tail -150 "$log"
            echo
          done < <(find src -iname "config.log" -printf '%T@ %p\n' 2>/dev/null | sort -rn | cut -d' ' -f2- | head -3)

      - name: Verify 16 KB page size alignment
        run: |
          set -e
          fail=0
          while IFS= read -r so; do
            min_exp=99
            while IFS= read -r exp; do
              [[ -z "$exp" ]] && continue
              (( exp < min_exp )) && min_exp=$exp
            done < <(objdump -p "$so" | grep -A1 LOAD | grep -oE 'align 2\*\*[0-9]+' | grep -oE '[0-9]+$')
            echo "$so: align=2**${min_exp}"
            if (( min_exp < 14 )); then
              echo "::error file=${so}::not 16 KB aligned (got 2**${min_exp})"
              fail=1
            fi
          done < <(find prebuilt -name "*.so")
          exit "$fail"

      - name: Verify tier content matches "https" exactly (binary check)
        run: |
          set -e
          fail=0
          echo "=== Negative: paid-tier-only strings must be ABSENT ==="
          for term in tesseract leptonica chromaprint whisper ggml libass; do
            hits=$(grep -a -il -- "$term" $(find prebuilt -name "*.so") 2>/dev/null || true)
            if [[ -n "$hits" ]]; then
              echo "::error::found '$term' in: $hits (must not be in https)"
              fail=1
            else
              echo "OK: '$term' absent"
            fi
          done
          if find prebuilt -iname "*whisper*" | grep -q .; then
            echo "::error::a libwhisperkit*.so file is present — must not be in a Free build"
            fail=1
          fi
          # GPL encoders: check real API symbols, not bare "x264"/"x265" -- FFmpeg's own
          # H.264 SEI decoder recognizes and logs x264's "x264 - core N" version string
          # embedded by ANY x264-encoded source video, in every build that can decode
          # H.264 at all (i.e. all of them) -- a naive substring match false-positives on
          # that decoder-side string even when the encoder itself was never linked.
          for symbol in x264_encoder_open x265_encoder_open xvid_encore; do
            hits=$(grep -a -il -- "$symbol" $(find prebuilt -name "*.so") 2>/dev/null || true)
            if [[ -n "$hits" ]]; then
              echo "::error::found GPL encoder symbol '$symbol' in: $hits (must not be in https)"
              fail=1
            else
              echo "OK: '$symbol' absent"
            fi
          done
          echo "=== Positive: gnutls + mediacodec must be PRESENT ==="
          for term in gnutls mediacodec; do
            hits=$(grep -a -il -- "$term" $(find prebuilt -name "*.so") 2>/dev/null || true)
            if [[ -z "$hits" ]]; then
              echo "::error::'$term' not found in any .so — https build is incomplete"
              fail=1
            else
              echo "OK: '$term' present in: $hits"
            fi
          done
          exit "$fail"

      - name: Upload AAR artifact
        uses: actions/upload-artifact@v4
        with:
          name: ffmpeg-kit-free-https-arm64-v8a-x86_64
          path: android-6.0-lts/prebuilt/bundle-android-aar/ffmpeg-kit/ffmpeg-kit.aar
          retention-days: 3