Merge branch 'master' into feature/season-provider-id-from-path

9 files changed, 206 insertions, 109 deletions

diff --git a/.github/workflows/ci-codeql-analysis.yml b/.github/workflows/ci-codeql-analysis.yml
index 0f1463c0f0..65752af977 100644
--- a/.github/workflows/ci-codeql-analysis.yml
+++ b/.github/workflows/ci-codeql-analysis.yml
@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: '24 2 * * 4'
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   analyze:
     name: Analyze
@@ -28,13 +32,13 @@ jobs:
         dotnet-version: '10.0.x'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+      uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
       with:
         languages: ${{ matrix.language }}
         queries: +security-extended
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+      uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+      uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
diff --git a/.github/workflows/ci-compat.yml b/.github/workflows/ci-compat.yml
index f9e2fbc3a6..dd48209a1f 100644
--- a/.github/workflows/ci-compat.yml
+++ b/.github/workflows/ci-compat.yml
@@ -26,7 +26,7 @@ jobs:
           dotnet build Jellyfin.Server -o ./out
 
       - name: Upload Head
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: abi-head
           retention-days: 14
@@ -65,7 +65,7 @@ jobs:
           dotnet build Jellyfin.Server -o ./out
 
       - name: Upload Head
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: abi-base
           retention-days: 14
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index fc32cc884d..2a26bf15a4 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -35,7 +35,7 @@ jobs:
           --verbosity minimal
 
       - name: Merge code coverage results
-        uses: danielpalme/ReportGenerator-GitHub-Action@cf6fe1b38ed5becc89ffe056c1f240825993be5b # v5.5.4
+        uses: danielpalme/ReportGenerator-GitHub-Action@c31aa4ed4f12f147061186cf2a029f307b5c3636 # v5.5.9
         with:
           reports: "**/coverage.cobertura.xml"
           targetdir: "merged/"
diff --git a/.github/workflows/commands.yml b/.github/workflows/commands.yml
index 2adb8f1010..9d3d99cb71 100644
--- a/.github/workflows/commands.yml
+++ b/.github/workflows/commands.yml
@@ -36,7 +36,7 @@ jobs:
 
   rename:
     name: Rename
-    if: contains(github.event.comment.body, '@jellyfin-bot rename') && github.event.comment.author_association == 'MEMBER'
+    if: contains(github.event.comment.body, '@jellyfin-bot rename')
     runs-on: ubuntu-latest
     steps:
       - name: pull in script
diff --git a/.github/workflows/openapi-generate.yml b/.github/workflows/openapi-generate.yml
new file mode 100644
index 0000000000..dbfaf9d30b
--- /dev/null
+++ b/.github/workflows/openapi-generate.yml
@@ -0,0 +1,44 @@
+name: OpenAPI Generate
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+      repository:
+        required: true
+        type: string
+      artifact:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  main:
+    name: Main
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }}
+        repository: ${{ inputs.repository }}
+
+    - name: Configure .NET
+      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      with:
+        dotnet-version: '10.0.x'
+
+    - name: Create File
+      run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter Jellyfin.Server.Integration.Tests.OpenApiSpecTests
+
+    - name: Upload Artifact
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: ${{ inputs.artifact }}
+        path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
+        retention-days: 14
+        if-no-files-found: error
diff --git a/.github/workflows/ci-openapi.yml b/.github/workflows/openapi-merge.yml
index f4fd0829b0..2421c09ad7 100644
--- a/.github/workflows/ci-openapi.yml
+++ b/.github/workflows/openapi-merge.yml
@@ -1,118 +1,28 @@
-name: OpenAPI
+name: OpenAPI Publish
 on:
   push:
     branches:
       - master
     tags:
       - 'v*'
-  pull_request:
-
-permissions: {}
 
 jobs:
-  openapi-head:
-    name: OpenAPI - HEAD
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
-        with:
-          dotnet-version: '10.0.x'
-      - name: Generate openapi.json
-        run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter "Jellyfin.Server.Integration.Tests.OpenApiSpecTests"
-
-      - name: Upload openapi.json
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: openapi-head
-          retention-days: 14
-          if-no-files-found: error
-          path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
-
-  openapi-base:
-    name: OpenAPI - BASE
-    if: ${{ github.base_ref != '' }}
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          fetch-depth: 0
-
-      - name: Checkout common ancestor
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-        run: |
-          git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
-          git -c protocol.version=2 fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
-          ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} origin/$HEAD_REF)
-          git checkout --progress --force $ANCESTOR_REF
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
-        with:
-          dotnet-version: '10.0.x'
-      - name: Generate openapi.json
-        run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter "Jellyfin.Server.Integration.Tests.OpenApiSpecTests"
-
-      - name: Upload openapi.json
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: openapi-base
-          retention-days: 14
-          if-no-files-found: error
-          path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
-
-  openapi-diff:
+  publish-openapi:
+    name: OpenAPI - Publish Artifact
+    uses: ./.github/workflows/openapi-generate.yml
     permissions:
-      pull-requests: write
-
-    name: OpenAPI - Difference
-    if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    needs:
-      - openapi-head
-      - openapi-base
-    steps:
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-
-      - name: Download openapi-base
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-base
-          path: openapi-base
-
-      - name: Detect OpenAPI changes
-        id: openapi-diff
-        uses: jellyfin/openapi-diff-action@9274f6bda9d01ab091942a4a8334baa53692e8a4 # v1.0.0
-        with:
-          old-spec: openapi-base/openapi.json
-          new-spec: openapi-head/openapi.json
-          markdown: openapi-changelog.md
-          add-pr-comment: true
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
+      contents: read
+    with:
+      ref: ${{ github.sha }}
+      repository: ${{ github.repository }}
+      artifact: openapi-head
 
   publish-unstable:
     name: OpenAPI - Publish Unstable Spec
     if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
     runs-on: ubuntu-latest
     needs:
-      - openapi-head
+    - publish-openapi
     steps:
       - name: Set unstable dated version
         id: version
@@ -173,7 +83,7 @@ jobs:
     if: ${{ startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
     runs-on: ubuntu-latest
     needs:
-      - openapi-head
+    - publish-openapi
     steps:
       - name: Set version number
         id: version
diff --git a/.github/workflows/openapi-pull-request.yml b/.github/workflows/openapi-pull-request.yml
new file mode 100644
index 0000000000..4acd0f4d4f
--- /dev/null
+++ b/.github/workflows/openapi-pull-request.yml
@@ -0,0 +1,80 @@
+name: OpenAPI Check
+on:
+  pull_request:
+
+jobs:
+  ancestor:
+    name: Common Ancestor
+    runs-on: ubuntu-latest
+    outputs:
+      base_ref: ${{ steps.ancestor.outputs.base_ref }}
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        repository: ${{ github.event.pull_request.head.repo.full_name }}
+        fetch-depth: 0
+    - name: Search History
+      id: ancestor
+      run: |
+        git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
+        git fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
+
+        ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} HEAD)
+
+        echo "ref: ${ANCESTOR_REF}"
+
+        echo "base_ref=${ANCESTOR_REF}" >> "$GITHUB_OUTPUT"
+
+  head:
+    name: Head Artifact
+    uses: ./.github/workflows/openapi-generate.yml
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+      repository: ${{ github.event.pull_request.head.repo.full_name }}
+      artifact: openapi-head
+
+  base:
+    name: Base Artifact
+    uses: ./.github/workflows/openapi-generate.yml
+    needs:
+    - ancestor
+    with:
+      ref: ${{ needs.ancestor.outputs.base_ref }}
+      repository: ${{ github.event.pull_request.base.repo.full_name }}
+      artifact: openapi-base
+
+  diff:
+    name: Generate Report
+    runs-on: ubuntu-latest
+    needs:
+    - head
+    - base
+    steps:
+    - name: Download Head
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-head
+        path: openapi-head
+    - name: Download Base
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-base
+        path: openapi-base
+    - name: Detect Changes
+      id: openapi-diff
+      run: |
+        sed -i 's:allOf:oneOf:g' openapi-head/openapi.json
+        sed -i 's:allOf:oneOf:g' openapi-base/openapi.json
+
+        mkdir -p /tmp/openapi-report
+        mv openapi-head/openapi.json /tmp/openapi-report/head.json
+        mv openapi-base/openapi.json /tmp/openapi-report/base.json
+
+        docker run -v /tmp/openapi-report:/data openapitools/openapi-diff:2.1.6 /data/base.json /data/head.json --state -l ERROR --markdown /data/openapi-report.md
+    - name: Upload Artifact
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: openapi-report
+        path: /tmp/openapi-report/openapi-report.md
diff --git a/.github/workflows/openapi-workflow-run.yml b/.github/workflows/openapi-workflow-run.yml
new file mode 100644
index 0000000000..0f9e84e56b
--- /dev/null
+++ b/.github/workflows/openapi-workflow-run.yml
@@ -0,0 +1,59 @@
+name: OpenAPI Report
+
+on:
+  workflow_run:
+    workflows:
+    - OpenAPI Check
+    types:
+    - completed
+
+jobs:
+  metadata:
+    name: Generate Metadata
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    outputs:
+      pr_number: ${{ steps.pr_number.outputs.pr_number }}
+    steps:
+    - name: Get Pull Request Number
+      id: pr_number
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+      run: |
+        API_RESPONSE=$(gh pr list --repo "${GITHUB_REPOSITORY}" --search "${HEAD_SHA}" --state open --json number)
+        PR_NUMBER=$(echo "${API_RESPONSE}" | jq '.[0].number')
+
+        echo "repository: ${GITHUB_REPOSITORY}"
+        echo "sha: ${HEAD_SHA}"
+        echo "response: ${API_RESPONSE}"
+        echo "pr: ${PR_NUMBER}"
+
+        echo "pr_number=${PR_NUMBER}" >> "${GITHUB_OUTPUT}"
+
+  comment:
+    name: Pull Request Comment
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    needs:
+    - metadata
+    permissions:
+      pull-requests: write
+      actions: read
+      contents: read
+    steps:
+    - name: Download OpenAPI Report
+      id: download_report
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-report
+        path: openapi-report
+        run-id: ${{ github.event.workflow_run.id }}
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Push Comment
+      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      with:
+        github-token: ${{ secrets.JF_BOT_TOKEN }}
+        file-path: ${{ steps.download_report.outputs.download-path }}/openapi-report.md
+        pr-number: ${{ needs.metadata.outputs.pr_number }}
+        comment-tag: openapi-report
diff --git a/.github/workflows/release-bump-version.yaml b/.github/workflows/release-bump-version.yaml
index 4c6b6b8e75..963b4a6023 100644
--- a/.github/workflows/release-bump-version.yaml
+++ b/.github/workflows/release-bump-version.yaml
@@ -28,7 +28,7 @@ jobs:
           timeoutSeconds: 3600
 
       - name: Setup YQ
-        uses: chrisdickinson/setup-yq@latest
+        uses: chrisdickinson/setup-yq@fa3192edd79d6eb0e4e12de8dde3a0c26f2b853b # latest
         with:
           yq-version: v4.9.8