Merge remote-tracking branch 'upstream/master' into epg-fixes

8 files changed, 209 insertions, 116 deletions

diff --git a/.github/workflows/ci-codeql-analysis.yml b/.github/workflows/ci-codeql-analysis.yml
index 10fb775fea..5194c7df06 100644
--- a/.github/workflows/ci-codeql-analysis.yml
+++ b/.github/workflows/ci-codeql-analysis.yml
@@ -23,18 +23,18 @@ jobs:
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
+      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
       with:
         dotnet-version: '10.0.x'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
       with:
         languages: ${{ matrix.language }}
         queries: +security-extended
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+      uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
diff --git a/.github/workflows/ci-compat.yml b/.github/workflows/ci-compat.yml
index 8e3717b332..f9e2fbc3a6 100644
--- a/.github/workflows/ci-compat.yml
+++ b/.github/workflows/ci-compat.yml
@@ -17,7 +17,7 @@ jobs:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           dotnet-version: '10.0.x'
 
@@ -26,7 +26,7 @@ jobs:
           dotnet build Jellyfin.Server -o ./out
 
       - name: Upload Head
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: abi-head
           retention-days: 14
@@ -47,7 +47,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           dotnet-version: '10.0.x'
 
@@ -65,7 +65,7 @@ jobs:
           dotnet build Jellyfin.Server -o ./out
 
       - name: Upload Head
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: abi-base
           retention-days: 14
@@ -85,13 +85,13 @@ jobs:
 
     steps:
       - name: Download abi-head
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: abi-head
           path: abi-head
 
       - name: Download abi-base
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: abi-base
           path: abi-base
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index 5cb13d6947..fc32cc884d 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           dotnet-version: ${{ env.SDK_VERSION }}
 
@@ -35,7 +35,7 @@ jobs:
           --verbosity minimal
 
       - name: Merge code coverage results
-        uses: danielpalme/ReportGenerator-GitHub-Action@ee0ae774f6d3afedcbd1683c1ab21b83670bdf8e # v5.5.1
+        uses: danielpalme/ReportGenerator-GitHub-Action@cf6fe1b38ed5becc89ffe056c1f240825993be5b # v5.5.4
         with:
           reports: "**/coverage.cobertura.xml"
           targetdir: "merged/"
diff --git a/.github/workflows/openapi-generate.yml b/.github/workflows/openapi-generate.yml
new file mode 100644
index 0000000000..255cc49e82
--- /dev/null
+++ b/.github/workflows/openapi-generate.yml
@@ -0,0 +1,44 @@
+name: OpenAPI Generate
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+      repository:
+        required: true
+        type: string
+      artifact:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  main:
+    name: Main
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }}
+        repository: ${{ inputs.repository }}
+
+    - name: Configure .NET
+      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      with:
+        dotnet-version: '10.0.x'
+
+    - name: Create File
+      run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter Jellyfin.Server.Integration.Tests.OpenApiSpecTests
+
+    - name: Upload Artifact
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: ${{ inputs.artifact }}
+        path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
+        retention-days: 14
+        if-no-files-found: error
diff --git a/.github/workflows/ci-openapi.yml b/.github/workflows/openapi-merge.yml
index 3d04ac5e0b..2421c09ad7 100644
--- a/.github/workflows/ci-openapi.yml
+++ b/.github/workflows/openapi-merge.yml
@@ -1,125 +1,35 @@
-name: OpenAPI
+name: OpenAPI Publish
 on:
   push:
     branches:
       - master
     tags:
       - 'v*'
-  pull_request:
-
-permissions: {}
 
 jobs:
-  openapi-head:
-    name: OpenAPI - HEAD
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
-        with:
-          dotnet-version: '10.0.x'
-      - name: Generate openapi.json
-        run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter "Jellyfin.Server.Integration.Tests.OpenApiSpecTests"
-
-      - name: Upload openapi.json
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
-        with:
-          name: openapi-head
-          retention-days: 14
-          if-no-files-found: error
-          path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
-
-  openapi-base:
-    name: OpenAPI - BASE
-    if: ${{ github.base_ref != '' }}
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          fetch-depth: 0
-
-      - name: Checkout common ancestor
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-        run: |
-          git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
-          git -c protocol.version=2 fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
-          ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} origin/$HEAD_REF)
-          git checkout --progress --force $ANCESTOR_REF
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
-        with:
-          dotnet-version: '10.0.x'
-      - name: Generate openapi.json
-        run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter "Jellyfin.Server.Integration.Tests.OpenApiSpecTests"
-
-      - name: Upload openapi.json
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
-        with:
-          name: openapi-base
-          retention-days: 14
-          if-no-files-found: error
-          path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
-
-  openapi-diff:
+  publish-openapi:
+    name: OpenAPI - Publish Artifact
+    uses: ./.github/workflows/openapi-generate.yml
     permissions:
-      pull-requests: write
-
-    name: OpenAPI - Difference
-    if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    needs:
-      - openapi-head
-      - openapi-base
-    steps:
-      - name: Download openapi-head
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
-        with:
-          name: openapi-head
-          path: openapi-head
-
-      - name: Download openapi-base
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
-        with:
-          name: openapi-base
-          path: openapi-base
-
-      - name: Detect OpenAPI changes
-        id: openapi-diff
-        uses: jellyfin/openapi-diff-action@9274f6bda9d01ab091942a4a8334baa53692e8a4 # v1.0.0
-        with:
-          old-spec: openapi-base/openapi.json
-          new-spec: openapi-head/openapi.json
-          markdown: openapi-changelog.md
-          add-pr-comment: true
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
+      contents: read
+    with:
+      ref: ${{ github.sha }}
+      repository: ${{ github.repository }}
+      artifact: openapi-head
 
   publish-unstable:
     name: OpenAPI - Publish Unstable Spec
     if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
     runs-on: ubuntu-latest
     needs:
-      - openapi-head
+    - publish-openapi
     steps:
       - name: Set unstable dated version
         id: version
         run: |-
           echo "JELLYFIN_VERSION=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
       - name: Download openapi-head
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: openapi-head
           path: openapi-head
@@ -173,14 +83,14 @@ jobs:
     if: ${{ startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
     runs-on: ubuntu-latest
     needs:
-      - openapi-head
+    - publish-openapi
     steps:
       - name: Set version number
         id: version
         run: |-
           echo "JELLYFIN_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
       - name: Download openapi-head
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: openapi-head
           path: openapi-head
diff --git a/.github/workflows/openapi-pull-request.yml b/.github/workflows/openapi-pull-request.yml
new file mode 100644
index 0000000000..563a0a406f
--- /dev/null
+++ b/.github/workflows/openapi-pull-request.yml
@@ -0,0 +1,80 @@
+name: OpenAPI Check
+on:
+  pull_request:
+
+jobs:
+  ancestor:
+    name: Common Ancestor
+    runs-on: ubuntu-latest
+    outputs:
+      base_ref: ${{ steps.ancestor.outputs.base_ref }}
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        repository: ${{ github.event.pull_request.head.repo.full_name }}
+        fetch-depth: 0
+    - name: Search History
+      id: ancestor
+      run: |
+        git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
+        git fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
+
+        ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} HEAD)
+
+        echo "ref: ${ANCESTOR_REF}"
+
+        echo "base_ref=${ANCESTOR_REF}" >> "$GITHUB_OUTPUT"
+
+  head:
+    name: Head Artifact
+    uses: ./.github/workflows/openapi-generate.yml
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+      repository: ${{ github.event.pull_request.head.repo.full_name }}
+      artifact: openapi-head
+
+  base:
+    name: Base Artifact
+    uses: ./.github/workflows/openapi-generate.yml
+    needs:
+    - ancestor
+    with:
+      ref: ${{ needs.ancestor.outputs.base_ref }}
+      repository: ${{ github.event.pull_request.base.repo.full_name }}
+      artifact: openapi-base
+
+  diff:
+    name: Generate Report
+    runs-on: ubuntu-latest
+    needs:
+    - head
+    - base
+    steps:
+    - name: Download Head
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-head
+        path: openapi-head
+    - name: Download Base
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-base
+        path: openapi-base
+    - name: Detect Changes
+      id: openapi-diff
+      run: |
+        sed -i 's:allOf:oneOf:g' openapi-head/openapi.json
+        sed -i 's:allOf:oneOf:g' openapi-base/openapi.json
+
+        mkdir -p /tmp/openapi-report
+        mv openapi-head/openapi.json /tmp/openapi-report/head.json
+        mv openapi-base/openapi.json /tmp/openapi-report/base.json
+
+        docker run -v /tmp/openapi-report:/data openapitools/openapi-diff:2.1.6 /data/base.json /data/head.json --state -l ERROR --markdown /data/openapi-report.md
+    - name: Upload Artifact
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: openapi-report
+        path: /tmp/openapi-report/openapi-report.md
diff --git a/.github/workflows/openapi-workflow-run.yml b/.github/workflows/openapi-workflow-run.yml
new file mode 100644
index 0000000000..0f9e84e56b
--- /dev/null
+++ b/.github/workflows/openapi-workflow-run.yml
@@ -0,0 +1,59 @@
+name: OpenAPI Report
+
+on:
+  workflow_run:
+    workflows:
+    - OpenAPI Check
+    types:
+    - completed
+
+jobs:
+  metadata:
+    name: Generate Metadata
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    outputs:
+      pr_number: ${{ steps.pr_number.outputs.pr_number }}
+    steps:
+    - name: Get Pull Request Number
+      id: pr_number
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+      run: |
+        API_RESPONSE=$(gh pr list --repo "${GITHUB_REPOSITORY}" --search "${HEAD_SHA}" --state open --json number)
+        PR_NUMBER=$(echo "${API_RESPONSE}" | jq '.[0].number')
+
+        echo "repository: ${GITHUB_REPOSITORY}"
+        echo "sha: ${HEAD_SHA}"
+        echo "response: ${API_RESPONSE}"
+        echo "pr: ${PR_NUMBER}"
+
+        echo "pr_number=${PR_NUMBER}" >> "${GITHUB_OUTPUT}"
+
+  comment:
+    name: Pull Request Comment
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    needs:
+    - metadata
+    permissions:
+      pull-requests: write
+      actions: read
+      contents: read
+    steps:
+    - name: Download OpenAPI Report
+      id: download_report
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-report
+        path: openapi-report
+        run-id: ${{ github.event.workflow_run.id }}
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Push Comment
+      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      with:
+        github-token: ${{ secrets.JF_BOT_TOKEN }}
+        file-path: ${{ steps.download_report.outputs.download-path }}/openapi-report.md
+        pr-number: ${{ needs.metadata.outputs.pr_number }}
+        comment-tag: openapi-report
diff --git a/.github/workflows/release-bump-version.yaml b/.github/workflows/release-bump-version.yaml
index 4c6b6b8e75..963b4a6023 100644
--- a/.github/workflows/release-bump-version.yaml
+++ b/.github/workflows/release-bump-version.yaml
@@ -28,7 +28,7 @@ jobs:
           timeoutSeconds: 3600
 
       - name: Setup YQ
-        uses: chrisdickinson/setup-yq@latest
+        uses: chrisdickinson/setup-yq@fa3192edd79d6eb0e4e12de8dde3a0c26f2b853b # latest
         with:
           yq-version: v4.9.8