From 9ec657cf6e93dcf26206a2be98c2072bb63d6d23 Mon Sep 17 00:00:00 2001
From: felix920506 <felix920506@gmail.com>
Date: Wed, 27 Mar 2024 13:23:10 -0400
Subject: Remove permission check from GHA

Permission check is moved to the script itself
---
 .github/workflows/commands.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/commands.yml b/.github/workflows/commands.yml
index d78f11166c..23636cff64 100644
--- a/.github/workflows/commands.yml
+++ b/.github/workflows/commands.yml
@@ -124,7 +124,7 @@ jobs:
 
   rename:
     name: Rename
-    if: contains(github.event.comment.body, '@jellyfin-bot rename') && github.event.comment.author_association == 'MEMBER'
+    if: contains(github.event.comment.body, '@jellyfin-bot rename')
     runs-on: ubuntu-latest
     steps:
       - name: pull in script
-- 
cgit v1.2.3


From 80365f277afa05b329422362cbef6a4aa92317cd Mon Sep 17 00:00:00 2001
From: Josh Soref <2119212+jsoref@users.noreply.github.com>
Date: Mon, 4 Mar 2024 00:28:41 -0500
Subject: chore(ci): Add permissions grant

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
---
 .github/workflows/ci-codeql-analysis.yml | 4 ++++
 1 file changed, 4 insertions(+)

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-codeql-analysis.yml b/.github/workflows/ci-codeql-analysis.yml
index f7366c7e04..96e72743e6 100644
--- a/.github/workflows/ci-codeql-analysis.yml
+++ b/.github/workflows/ci-codeql-analysis.yml
@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: '24 2 * * 4'
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   analyze:
     name: Analyze
-- 
cgit v1.2.3


From 6b443bb2ec64009f9903388aa87868d30c5c42d7 Mon Sep 17 00:00:00 2001
From: dkanada <dkanada@users.noreply.github.com>
Date: Wed, 25 Mar 2026 15:39:31 +0900
Subject: split openapi workflows between pull request and merge

---
 .github/workflows/ci-openapi.yml           | 230 -----------------------------
 .github/workflows/openapi/__generate.yml   |  44 ++++++
 .github/workflows/openapi/merge.yml        | 140 ++++++++++++++++++
 .github/workflows/openapi/pull-request.yml |  72 +++++++++
 .github/workflows/openapi/workflow-run.yml |  59 ++++++++
 5 files changed, 315 insertions(+), 230 deletions(-)
 delete mode 100644 .github/workflows/ci-openapi.yml
 create mode 100644 .github/workflows/openapi/__generate.yml
 create mode 100644 .github/workflows/openapi/merge.yml
 create mode 100644 .github/workflows/openapi/pull-request.yml
 create mode 100644 .github/workflows/openapi/workflow-run.yml

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-openapi.yml b/.github/workflows/ci-openapi.yml
deleted file mode 100644
index f4fd0829b0..0000000000
--- a/.github/workflows/ci-openapi.yml
+++ /dev/null
@@ -1,230 +0,0 @@
-name: OpenAPI
-on:
-  push:
-    branches:
-      - master
-    tags:
-      - 'v*'
-  pull_request:
-
-permissions: {}
-
-jobs:
-  openapi-head:
-    name: OpenAPI - HEAD
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
-        with:
-          dotnet-version: '10.0.x'
-      - name: Generate openapi.json
-        run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter "Jellyfin.Server.Integration.Tests.OpenApiSpecTests"
-
-      - name: Upload openapi.json
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: openapi-head
-          retention-days: 14
-          if-no-files-found: error
-          path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
-
-  openapi-base:
-    name: OpenAPI - BASE
-    if: ${{ github.base_ref != '' }}
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          fetch-depth: 0
-
-      - name: Checkout common ancestor
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-        run: |
-          git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
-          git -c protocol.version=2 fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
-          ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} origin/$HEAD_REF)
-          git checkout --progress --force $ANCESTOR_REF
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
-        with:
-          dotnet-version: '10.0.x'
-      - name: Generate openapi.json
-        run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter "Jellyfin.Server.Integration.Tests.OpenApiSpecTests"
-
-      - name: Upload openapi.json
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: openapi-base
-          retention-days: 14
-          if-no-files-found: error
-          path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
-
-  openapi-diff:
-    permissions:
-      pull-requests: write
-
-    name: OpenAPI - Difference
-    if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    needs:
-      - openapi-head
-      - openapi-base
-    steps:
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-
-      - name: Download openapi-base
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-base
-          path: openapi-base
-
-      - name: Detect OpenAPI changes
-        id: openapi-diff
-        uses: jellyfin/openapi-diff-action@9274f6bda9d01ab091942a4a8334baa53692e8a4 # v1.0.0
-        with:
-          old-spec: openapi-base/openapi.json
-          new-spec: openapi-head/openapi.json
-          markdown: openapi-changelog.md
-          add-pr-comment: true
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-
-  publish-unstable:
-    name: OpenAPI - Publish Unstable Spec
-    if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
-    runs-on: ubuntu-latest
-    needs:
-      - openapi-head
-    steps:
-      - name: Set unstable dated version
-        id: version
-        run: |-
-          echo "JELLYFIN_VERSION=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-      - name: Upload openapi.json (unstable) to repository server
-        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          source: openapi-head/openapi.json
-          strip_components: 1
-          target: "/srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
-      - name: Move openapi.json (unstable) into place
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          debug: false
-          script: |
-            if ! test -d /run/workflows; then
-                sudo mkdir -p /run/workflows
-                sudo chown ${{ secrets.REPO_USER }} /run/workflows
-            fi
-            (
-            flock -x -w 300 200 || exit 1
-            TGT_DIR="/srv/repository/main/openapi"
-            LAST_SPEC="$( ls -lt ${TGT_DIR}/unstable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
-            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
-            if diff /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/${LAST_SPEC} &>/dev/null; then
-                rm -r /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
-                exit 0
-            fi
-            # Move new spec into place
-            sudo mv /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
-            # Delete previous jellyfin-openapi-unstable_previous.json
-            sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            # Move current jellyfin-openapi-unstable.json symlink to jellyfin-openapi-unstable_previous.json
-            sudo mv ${TGT_DIR}/jellyfin-openapi-unstable.json ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            # Create new jellyfin-openapi-unstable.json symlink
-            sudo ln -s unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-unstable.json
-            # Check that the previous openapi unstable spec link is correct
-            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-unstable_previous.json )" != "unstable/${LAST_SPEC}" ]]; then
-                sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-                sudo ln -s unstable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            fi
-            ) 200>/run/workflows/openapi-unstable.lock
-
-  publish-stable:
-    name: OpenAPI - Publish Stable Spec
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
-    runs-on: ubuntu-latest
-    needs:
-      - openapi-head
-    steps:
-      - name: Set version number
-        id: version
-        run: |-
-          echo "JELLYFIN_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-      - name: Upload openapi.json (stable) to repository server
-        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          source: openapi-head/openapi.json
-          strip_components: 1
-          target: "/srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
-      - name: Move openapi.json (stable) into place
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          debug: false
-          script: |
-            if ! test -d /run/workflows; then
-                sudo mkdir -p /run/workflows
-                sudo chown ${{ secrets.REPO_USER }} /run/workflows
-            fi
-            (
-            flock -x -w 300 200 || exit 1
-            TGT_DIR="/srv/repository/main/openapi"
-            LAST_SPEC="$( ls -lt ${TGT_DIR}/stable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
-            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
-            if diff /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/${LAST_SPEC} &>/dev/null; then
-                rm -r /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
-                exit 0
-            fi
-            # Move new spec into place
-            sudo mv /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
-            # Delete previous jellyfin-openapi-stable_previous.json
-            sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            # Move current jellyfin-openapi-stable.json symlink to jellyfin-openapi-stable_previous.json
-            sudo mv ${TGT_DIR}/jellyfin-openapi-stable.json ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            # Create new jellyfin-openapi-stable.json symlink
-            sudo ln -s stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-stable.json
-            # Check that the previous openapi stable spec link is correct
-            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-stable_previous.json )" != "stable/${LAST_SPEC}" ]]; then
-                sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-                sudo ln -s stable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            fi
-            ) 200>/run/workflows/openapi-stable.lock
diff --git a/.github/workflows/openapi/__generate.yml b/.github/workflows/openapi/__generate.yml
new file mode 100644
index 0000000000..255cc49e82
--- /dev/null
+++ b/.github/workflows/openapi/__generate.yml
@@ -0,0 +1,44 @@
+name: OpenAPI Generate
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+      repository:
+        required: true
+        type: string
+      artifact:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  main:
+    name: Main
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }}
+        repository: ${{ inputs.repository }}
+
+    - name: Configure .NET
+      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      with:
+        dotnet-version: '10.0.x'
+
+    - name: Create File
+      run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter Jellyfin.Server.Integration.Tests.OpenApiSpecTests
+
+    - name: Upload Artifact
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: ${{ inputs.artifact }}
+        path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
+        retention-days: 14
+        if-no-files-found: error
diff --git a/.github/workflows/openapi/merge.yml b/.github/workflows/openapi/merge.yml
new file mode 100644
index 0000000000..a996b2da6b
--- /dev/null
+++ b/.github/workflows/openapi/merge.yml
@@ -0,0 +1,140 @@
+name: OpenAPI Publish
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+
+permissions: {}
+
+jobs:
+  publish-openapi:
+    name: OpenAPI - Publish Artifact
+    uses: ./.github/workflows/openapi/__generate.yml
+    with:
+      ref: ${{ github.sha }}
+      repository: ${{ github.repository }}
+      artifact: openapi-head
+
+  publish-unstable:
+    name: OpenAPI - Publish Unstable Spec
+    if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
+    runs-on: ubuntu-latest
+    needs:
+    - publish-openapi
+    steps:
+      - name: Set unstable dated version
+        id: version
+        run: |-
+          echo "JELLYFIN_VERSION=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
+      - name: Download openapi-head
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: openapi-head
+          path: openapi-head
+      - name: Upload openapi.json (unstable) to repository server
+        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
+        with:
+          host: "${{ secrets.REPO_HOST }}"
+          username: "${{ secrets.REPO_USER }}"
+          key: "${{ secrets.REPO_KEY }}"
+          source: openapi-head/openapi.json
+          strip_components: 1
+          target: "/srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
+      - name: Move openapi.json (unstable) into place
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        with:
+          host: "${{ secrets.REPO_HOST }}"
+          username: "${{ secrets.REPO_USER }}"
+          key: "${{ secrets.REPO_KEY }}"
+          debug: false
+          script: |
+            if ! test -d /run/workflows; then
+                sudo mkdir -p /run/workflows
+                sudo chown ${{ secrets.REPO_USER }} /run/workflows
+            fi
+            (
+            flock -x -w 300 200 || exit 1
+            TGT_DIR="/srv/repository/main/openapi"
+            LAST_SPEC="$( ls -lt ${TGT_DIR}/unstable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
+            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
+            if diff /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/${LAST_SPEC} &>/dev/null; then
+                rm -r /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
+                exit 0
+            fi
+            # Move new spec into place
+            sudo mv /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
+            # Delete previous jellyfin-openapi-unstable_previous.json
+            sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
+            # Move current jellyfin-openapi-unstable.json symlink to jellyfin-openapi-unstable_previous.json
+            sudo mv ${TGT_DIR}/jellyfin-openapi-unstable.json ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
+            # Create new jellyfin-openapi-unstable.json symlink
+            sudo ln -s unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-unstable.json
+            # Check that the previous openapi unstable spec link is correct
+            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-unstable_previous.json )" != "unstable/${LAST_SPEC}" ]]; then
+                sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
+                sudo ln -s unstable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
+            fi
+            ) 200>/run/workflows/openapi-unstable.lock
+
+  publish-stable:
+    name: OpenAPI - Publish Stable Spec
+    if: ${{ startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
+    runs-on: ubuntu-latest
+    needs:
+    - publish-openapi
+    steps:
+      - name: Set version number
+        id: version
+        run: |-
+          echo "JELLYFIN_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
+      - name: Download openapi-head
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: openapi-head
+          path: openapi-head
+      - name: Upload openapi.json (stable) to repository server
+        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
+        with:
+          host: "${{ secrets.REPO_HOST }}"
+          username: "${{ secrets.REPO_USER }}"
+          key: "${{ secrets.REPO_KEY }}"
+          source: openapi-head/openapi.json
+          strip_components: 1
+          target: "/srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
+      - name: Move openapi.json (stable) into place
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        with:
+          host: "${{ secrets.REPO_HOST }}"
+          username: "${{ secrets.REPO_USER }}"
+          key: "${{ secrets.REPO_KEY }}"
+          debug: false
+          script: |
+            if ! test -d /run/workflows; then
+                sudo mkdir -p /run/workflows
+                sudo chown ${{ secrets.REPO_USER }} /run/workflows
+            fi
+            (
+            flock -x -w 300 200 || exit 1
+            TGT_DIR="/srv/repository/main/openapi"
+            LAST_SPEC="$( ls -lt ${TGT_DIR}/stable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
+            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
+            if diff /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/${LAST_SPEC} &>/dev/null; then
+                rm -r /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
+                exit 0
+            fi
+            # Move new spec into place
+            sudo mv /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
+            # Delete previous jellyfin-openapi-stable_previous.json
+            sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
+            # Move current jellyfin-openapi-stable.json symlink to jellyfin-openapi-stable_previous.json
+            sudo mv ${TGT_DIR}/jellyfin-openapi-stable.json ${TGT_DIR}/jellyfin-openapi-stable_previous.json
+            # Create new jellyfin-openapi-stable.json symlink
+            sudo ln -s stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-stable.json
+            # Check that the previous openapi stable spec link is correct
+            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-stable_previous.json )" != "stable/${LAST_SPEC}" ]]; then
+                sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
+                sudo ln -s stable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-stable_previous.json
+            fi
+            ) 200>/run/workflows/openapi-stable.lock
diff --git a/.github/workflows/openapi/pull-request.yml b/.github/workflows/openapi/pull-request.yml
new file mode 100644
index 0000000000..3071027823
--- /dev/null
+++ b/.github/workflows/openapi/pull-request.yml
@@ -0,0 +1,72 @@
+name: OpenAPI Check
+on:
+  pull_request:
+
+jobs:
+  ancestor:
+    name: Common Ancestor
+    runs-on: ubuntu-latest
+    outputs:
+      base_ref: ${{ steps.ancestor.outputs.base_ref }}
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        repository: ${{ github.event.pull_request.head.repo.full_name }}
+        fetch-depth: 0
+    - name: Search History
+      id: ancestor
+      run: |
+        git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
+        git fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
+
+        ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} HEAD)
+
+        echo "ref: ${ANCESTOR_REF}"
+
+        echo "base_ref=${ANCESTOR_REF}" >> "$GITHUB_OUTPUT"
+
+  head:
+    name: Head Artifact
+    uses: ./.github/workflows/openapi/__generate.yml
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+      repository: ${{ github.event.pull_request.head.repo.full_name }}
+      artifact: openapi-head
+
+  base:
+    name: Base Artifact
+    uses: ./.github/workflows/openapi/__generate.yml
+    needs:
+    - ancestor
+    with:
+      ref: ${{ needs.ancestor.outputs.base_ref }}
+      repository: ${{ github.event.pull_request.base.repo.full_name }}
+      artifact: openapi-base
+
+  diff:
+    name: Generate Report
+    runs-on: ubuntu-latest
+    needs:
+    - head
+    - base
+    steps:
+    - name: Download Head
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-head
+        path: openapi-head
+    - name: Download Base
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-base
+        path: openapi-base
+    - name: Detect Changes
+      uses: jellyfin/openapi-diff-action@9274f6bda9d01ab091942a4a8334baa53692e8a4 # v1.0.0
+      id: openapi-diff
+      with:
+        old-spec: openapi-base/openapi.json
+        new-spec: openapi-head/openapi.json
+        markdown: openapi-changelog.md
+        github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/openapi/workflow-run.yml b/.github/workflows/openapi/workflow-run.yml
new file mode 100644
index 0000000000..9dbd2c40a0
--- /dev/null
+++ b/.github/workflows/openapi/workflow-run.yml
@@ -0,0 +1,59 @@
+name: OpenAPI Report
+
+on:
+  workflow_run:
+    workflows:
+    - OpenAPI Check
+    types:
+    - completed
+
+jobs:
+  metadata:
+    name: Generate Metadata
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    outputs:
+      pr_number: ${{ steps.pr_number.outputs.pr_number }}
+    steps:
+    - name: Get Pull Request Number
+      id: pr_number
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+      run: |
+        API_RESPONSE=$(gh pr list --repo "${GITHUB_REPOSITORY}" --search "${HEAD_SHA}" --state open --json number)
+        PR_NUMBER=$(echo "${API_RESPONSE}" | jq '.[0].number')
+
+        echo "repository: ${GITHUB_REPOSITORY}"
+        echo "sha: ${HEAD_SHA}"
+        echo "response: ${API_RESPONSE}"
+        echo "pr: ${PR_NUMBER}"
+
+        echo "pr_number=${PR_NUMBER}" >> "${GITHUB_OUTPUT}"
+
+  comment:
+    name: Pull Request Comment
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    needs:
+    - metadata
+    permissions:
+      pull-requests: write
+      actions: read
+      contents: read
+    steps:
+    - name: Download OpenAPI Report
+      id: download_report
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-diff-report
+        path: openapi-diff-report
+        run-id: ${{ github.event.workflow_run.id }}
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Push Comment
+      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      with:
+        github-token: ${{ secrets.JF_BOT_TOKEN }}
+        file-path: ${{ steps.download_report.outputs.download-path }}/openapi-changelog.md
+        pr-number: ${{ needs.metadata.outputs.pr_number }}
+        comment-tag: openapi-report
-- 
cgit v1.2.3


From 6e154de954e088bb47aaa833d51bc05afb6898be Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 19:27:09 +0000
Subject: Pin chrisdickinson/setup-yq action to fa3192e

---
 .github/workflows/release-bump-version.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/release-bump-version.yaml b/.github/workflows/release-bump-version.yaml
index 4c6b6b8e75..963b4a6023 100644
--- a/.github/workflows/release-bump-version.yaml
+++ b/.github/workflows/release-bump-version.yaml
@@ -28,7 +28,7 @@ jobs:
           timeoutSeconds: 3600
 
       - name: Setup YQ
-        uses: chrisdickinson/setup-yq@latest
+        uses: chrisdickinson/setup-yq@fa3192edd79d6eb0e4e12de8dde3a0c26f2b853b # latest
         with:
           yq-version: v4.9.8
 
-- 
cgit v1.2.3


From 40cadfca44f67f243bc18fcd388122ae2e72002e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 17:36:22 +0000
Subject: Update github/codeql-action action to v4.35.1

---
 .github/workflows/ci-codeql-analysis.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-codeql-analysis.yml b/.github/workflows/ci-codeql-analysis.yml
index 0f1463c0f0..5194c7df06 100644
--- a/.github/workflows/ci-codeql-analysis.yml
+++ b/.github/workflows/ci-codeql-analysis.yml
@@ -28,13 +28,13 @@ jobs:
         dotnet-version: '10.0.x'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
       with:
         languages: ${{ matrix.language }}
         queries: +security-extended
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+      uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
-- 
cgit v1.2.3


From c5ee639016f1ed4080e63f8dd6e98d10b56138e1 Mon Sep 17 00:00:00 2001
From: dkanada <dkanada@users.noreply.github.com>
Date: Tue, 31 Mar 2026 01:41:47 +0900
Subject: remove nested directory for openapi workflows

---
 .github/workflows/openapi-generate.yml     |  44 +++++++++
 .github/workflows/openapi-merge.yml        | 140 +++++++++++++++++++++++++++++
 .github/workflows/openapi-pull-request.yml |  72 +++++++++++++++
 .github/workflows/openapi-workflow-run.yml |  59 ++++++++++++
 .github/workflows/openapi/__generate.yml   |  44 ---------
 .github/workflows/openapi/merge.yml        | 140 -----------------------------
 .github/workflows/openapi/pull-request.yml |  72 ---------------
 .github/workflows/openapi/workflow-run.yml |  59 ------------
 8 files changed, 315 insertions(+), 315 deletions(-)
 create mode 100644 .github/workflows/openapi-generate.yml
 create mode 100644 .github/workflows/openapi-merge.yml
 create mode 100644 .github/workflows/openapi-pull-request.yml
 create mode 100644 .github/workflows/openapi-workflow-run.yml
 delete mode 100644 .github/workflows/openapi/__generate.yml
 delete mode 100644 .github/workflows/openapi/merge.yml
 delete mode 100644 .github/workflows/openapi/pull-request.yml
 delete mode 100644 .github/workflows/openapi/workflow-run.yml

(limited to '.github/workflows')

diff --git a/.github/workflows/openapi-generate.yml b/.github/workflows/openapi-generate.yml
new file mode 100644
index 0000000000..255cc49e82
--- /dev/null
+++ b/.github/workflows/openapi-generate.yml
@@ -0,0 +1,44 @@
+name: OpenAPI Generate
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+      repository:
+        required: true
+        type: string
+      artifact:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  main:
+    name: Main
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }}
+        repository: ${{ inputs.repository }}
+
+    - name: Configure .NET
+      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      with:
+        dotnet-version: '10.0.x'
+
+    - name: Create File
+      run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter Jellyfin.Server.Integration.Tests.OpenApiSpecTests
+
+    - name: Upload Artifact
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: ${{ inputs.artifact }}
+        path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
+        retention-days: 14
+        if-no-files-found: error
diff --git a/.github/workflows/openapi-merge.yml b/.github/workflows/openapi-merge.yml
new file mode 100644
index 0000000000..cd990cf5f8
--- /dev/null
+++ b/.github/workflows/openapi-merge.yml
@@ -0,0 +1,140 @@
+name: OpenAPI Publish
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+
+permissions: {}
+
+jobs:
+  publish-openapi:
+    name: OpenAPI - Publish Artifact
+    uses: ./.github/workflows/openapi-generate.yml
+    with:
+      ref: ${{ github.sha }}
+      repository: ${{ github.repository }}
+      artifact: openapi-head
+
+  publish-unstable:
+    name: OpenAPI - Publish Unstable Spec
+    if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
+    runs-on: ubuntu-latest
+    needs:
+    - publish-openapi
+    steps:
+      - name: Set unstable dated version
+        id: version
+        run: |-
+          echo "JELLYFIN_VERSION=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
+      - name: Download openapi-head
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: openapi-head
+          path: openapi-head
+      - name: Upload openapi.json (unstable) to repository server
+        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
+        with:
+          host: "${{ secrets.REPO_HOST }}"
+          username: "${{ secrets.REPO_USER }}"
+          key: "${{ secrets.REPO_KEY }}"
+          source: openapi-head/openapi.json
+          strip_components: 1
+          target: "/srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
+      - name: Move openapi.json (unstable) into place
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        with:
+          host: "${{ secrets.REPO_HOST }}"
+          username: "${{ secrets.REPO_USER }}"
+          key: "${{ secrets.REPO_KEY }}"
+          debug: false
+          script: |
+            if ! test -d /run/workflows; then
+                sudo mkdir -p /run/workflows
+                sudo chown ${{ secrets.REPO_USER }} /run/workflows
+            fi
+            (
+            flock -x -w 300 200 || exit 1
+            TGT_DIR="/srv/repository/main/openapi"
+            LAST_SPEC="$( ls -lt ${TGT_DIR}/unstable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
+            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
+            if diff /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/${LAST_SPEC} &>/dev/null; then
+                rm -r /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
+                exit 0
+            fi
+            # Move new spec into place
+            sudo mv /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
+            # Delete previous jellyfin-openapi-unstable_previous.json
+            sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
+            # Move current jellyfin-openapi-unstable.json symlink to jellyfin-openapi-unstable_previous.json
+            sudo mv ${TGT_DIR}/jellyfin-openapi-unstable.json ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
+            # Create new jellyfin-openapi-unstable.json symlink
+            sudo ln -s unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-unstable.json
+            # Check that the previous openapi unstable spec link is correct
+            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-unstable_previous.json )" != "unstable/${LAST_SPEC}" ]]; then
+                sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
+                sudo ln -s unstable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
+            fi
+            ) 200>/run/workflows/openapi-unstable.lock
+
+  publish-stable:
+    name: OpenAPI - Publish Stable Spec
+    if: ${{ startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
+    runs-on: ubuntu-latest
+    needs:
+    - publish-openapi
+    steps:
+      - name: Set version number
+        id: version
+        run: |-
+          echo "JELLYFIN_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
+      - name: Download openapi-head
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: openapi-head
+          path: openapi-head
+      - name: Upload openapi.json (stable) to repository server
+        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
+        with:
+          host: "${{ secrets.REPO_HOST }}"
+          username: "${{ secrets.REPO_USER }}"
+          key: "${{ secrets.REPO_KEY }}"
+          source: openapi-head/openapi.json
+          strip_components: 1
+          target: "/srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
+      - name: Move openapi.json (stable) into place
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        with:
+          host: "${{ secrets.REPO_HOST }}"
+          username: "${{ secrets.REPO_USER }}"
+          key: "${{ secrets.REPO_KEY }}"
+          debug: false
+          script: |
+            if ! test -d /run/workflows; then
+                sudo mkdir -p /run/workflows
+                sudo chown ${{ secrets.REPO_USER }} /run/workflows
+            fi
+            (
+            flock -x -w 300 200 || exit 1
+            TGT_DIR="/srv/repository/main/openapi"
+            LAST_SPEC="$( ls -lt ${TGT_DIR}/stable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
+            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
+            if diff /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/${LAST_SPEC} &>/dev/null; then
+                rm -r /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
+                exit 0
+            fi
+            # Move new spec into place
+            sudo mv /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
+            # Delete previous jellyfin-openapi-stable_previous.json
+            sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
+            # Move current jellyfin-openapi-stable.json symlink to jellyfin-openapi-stable_previous.json
+            sudo mv ${TGT_DIR}/jellyfin-openapi-stable.json ${TGT_DIR}/jellyfin-openapi-stable_previous.json
+            # Create new jellyfin-openapi-stable.json symlink
+            sudo ln -s stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-stable.json
+            # Check that the previous openapi stable spec link is correct
+            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-stable_previous.json )" != "stable/${LAST_SPEC}" ]]; then
+                sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
+                sudo ln -s stable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-stable_previous.json
+            fi
+            ) 200>/run/workflows/openapi-stable.lock
diff --git a/.github/workflows/openapi-pull-request.yml b/.github/workflows/openapi-pull-request.yml
new file mode 100644
index 0000000000..b583fb54d1
--- /dev/null
+++ b/.github/workflows/openapi-pull-request.yml
@@ -0,0 +1,72 @@
+name: OpenAPI Check
+on:
+  pull_request:
+
+jobs:
+  ancestor:
+    name: Common Ancestor
+    runs-on: ubuntu-latest
+    outputs:
+      base_ref: ${{ steps.ancestor.outputs.base_ref }}
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        repository: ${{ github.event.pull_request.head.repo.full_name }}
+        fetch-depth: 0
+    - name: Search History
+      id: ancestor
+      run: |
+        git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
+        git fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
+
+        ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} HEAD)
+
+        echo "ref: ${ANCESTOR_REF}"
+
+        echo "base_ref=${ANCESTOR_REF}" >> "$GITHUB_OUTPUT"
+
+  head:
+    name: Head Artifact
+    uses: ./.github/workflows/openapi-generate.yml
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+      repository: ${{ github.event.pull_request.head.repo.full_name }}
+      artifact: openapi-head
+
+  base:
+    name: Base Artifact
+    uses: ./.github/workflows/openapi-generate.yml
+    needs:
+    - ancestor
+    with:
+      ref: ${{ needs.ancestor.outputs.base_ref }}
+      repository: ${{ github.event.pull_request.base.repo.full_name }}
+      artifact: openapi-base
+
+  diff:
+    name: Generate Report
+    runs-on: ubuntu-latest
+    needs:
+    - head
+    - base
+    steps:
+    - name: Download Head
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-head
+        path: openapi-head
+    - name: Download Base
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-base
+        path: openapi-base
+    - name: Detect Changes
+      uses: jellyfin/openapi-diff-action@9274f6bda9d01ab091942a4a8334baa53692e8a4 # v1.0.0
+      id: openapi-diff
+      with:
+        old-spec: openapi-base/openapi.json
+        new-spec: openapi-head/openapi.json
+        markdown: openapi-changelog.md
+        github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/openapi-workflow-run.yml b/.github/workflows/openapi-workflow-run.yml
new file mode 100644
index 0000000000..9dbd2c40a0
--- /dev/null
+++ b/.github/workflows/openapi-workflow-run.yml
@@ -0,0 +1,59 @@
+name: OpenAPI Report
+
+on:
+  workflow_run:
+    workflows:
+    - OpenAPI Check
+    types:
+    - completed
+
+jobs:
+  metadata:
+    name: Generate Metadata
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    outputs:
+      pr_number: ${{ steps.pr_number.outputs.pr_number }}
+    steps:
+    - name: Get Pull Request Number
+      id: pr_number
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+      run: |
+        API_RESPONSE=$(gh pr list --repo "${GITHUB_REPOSITORY}" --search "${HEAD_SHA}" --state open --json number)
+        PR_NUMBER=$(echo "${API_RESPONSE}" | jq '.[0].number')
+
+        echo "repository: ${GITHUB_REPOSITORY}"
+        echo "sha: ${HEAD_SHA}"
+        echo "response: ${API_RESPONSE}"
+        echo "pr: ${PR_NUMBER}"
+
+        echo "pr_number=${PR_NUMBER}" >> "${GITHUB_OUTPUT}"
+
+  comment:
+    name: Pull Request Comment
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    needs:
+    - metadata
+    permissions:
+      pull-requests: write
+      actions: read
+      contents: read
+    steps:
+    - name: Download OpenAPI Report
+      id: download_report
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openapi-diff-report
+        path: openapi-diff-report
+        run-id: ${{ github.event.workflow_run.id }}
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Push Comment
+      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      with:
+        github-token: ${{ secrets.JF_BOT_TOKEN }}
+        file-path: ${{ steps.download_report.outputs.download-path }}/openapi-changelog.md
+        pr-number: ${{ needs.metadata.outputs.pr_number }}
+        comment-tag: openapi-report
diff --git a/.github/workflows/openapi/__generate.yml b/.github/workflows/openapi/__generate.yml
deleted file mode 100644
index 255cc49e82..0000000000
--- a/.github/workflows/openapi/__generate.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: OpenAPI Generate
-
-on:
-  workflow_call:
-    inputs:
-      ref:
-        required: true
-        type: string
-      repository:
-        required: true
-        type: string
-      artifact:
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  main:
-    name: Main
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
-        repository: ${{ inputs.repository }}
-
-    - name: Configure .NET
-      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
-      with:
-        dotnet-version: '10.0.x'
-
-    - name: Create File
-      run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter Jellyfin.Server.Integration.Tests.OpenApiSpecTests
-
-    - name: Upload Artifact
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-      with:
-        name: ${{ inputs.artifact }}
-        path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
-        retention-days: 14
-        if-no-files-found: error
diff --git a/.github/workflows/openapi/merge.yml b/.github/workflows/openapi/merge.yml
deleted file mode 100644
index a996b2da6b..0000000000
--- a/.github/workflows/openapi/merge.yml
+++ /dev/null
@@ -1,140 +0,0 @@
-name: OpenAPI Publish
-on:
-  push:
-    branches:
-      - master
-    tags:
-      - 'v*'
-
-permissions: {}
-
-jobs:
-  publish-openapi:
-    name: OpenAPI - Publish Artifact
-    uses: ./.github/workflows/openapi/__generate.yml
-    with:
-      ref: ${{ github.sha }}
-      repository: ${{ github.repository }}
-      artifact: openapi-head
-
-  publish-unstable:
-    name: OpenAPI - Publish Unstable Spec
-    if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
-    runs-on: ubuntu-latest
-    needs:
-    - publish-openapi
-    steps:
-      - name: Set unstable dated version
-        id: version
-        run: |-
-          echo "JELLYFIN_VERSION=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-      - name: Upload openapi.json (unstable) to repository server
-        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          source: openapi-head/openapi.json
-          strip_components: 1
-          target: "/srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
-      - name: Move openapi.json (unstable) into place
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          debug: false
-          script: |
-            if ! test -d /run/workflows; then
-                sudo mkdir -p /run/workflows
-                sudo chown ${{ secrets.REPO_USER }} /run/workflows
-            fi
-            (
-            flock -x -w 300 200 || exit 1
-            TGT_DIR="/srv/repository/main/openapi"
-            LAST_SPEC="$( ls -lt ${TGT_DIR}/unstable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
-            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
-            if diff /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/${LAST_SPEC} &>/dev/null; then
-                rm -r /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
-                exit 0
-            fi
-            # Move new spec into place
-            sudo mv /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
-            # Delete previous jellyfin-openapi-unstable_previous.json
-            sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            # Move current jellyfin-openapi-unstable.json symlink to jellyfin-openapi-unstable_previous.json
-            sudo mv ${TGT_DIR}/jellyfin-openapi-unstable.json ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            # Create new jellyfin-openapi-unstable.json symlink
-            sudo ln -s unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-unstable.json
-            # Check that the previous openapi unstable spec link is correct
-            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-unstable_previous.json )" != "unstable/${LAST_SPEC}" ]]; then
-                sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-                sudo ln -s unstable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            fi
-            ) 200>/run/workflows/openapi-unstable.lock
-
-  publish-stable:
-    name: OpenAPI - Publish Stable Spec
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
-    runs-on: ubuntu-latest
-    needs:
-    - publish-openapi
-    steps:
-      - name: Set version number
-        id: version
-        run: |-
-          echo "JELLYFIN_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-      - name: Upload openapi.json (stable) to repository server
-        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          source: openapi-head/openapi.json
-          strip_components: 1
-          target: "/srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
-      - name: Move openapi.json (stable) into place
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          debug: false
-          script: |
-            if ! test -d /run/workflows; then
-                sudo mkdir -p /run/workflows
-                sudo chown ${{ secrets.REPO_USER }} /run/workflows
-            fi
-            (
-            flock -x -w 300 200 || exit 1
-            TGT_DIR="/srv/repository/main/openapi"
-            LAST_SPEC="$( ls -lt ${TGT_DIR}/stable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
-            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
-            if diff /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/${LAST_SPEC} &>/dev/null; then
-                rm -r /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
-                exit 0
-            fi
-            # Move new spec into place
-            sudo mv /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
-            # Delete previous jellyfin-openapi-stable_previous.json
-            sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            # Move current jellyfin-openapi-stable.json symlink to jellyfin-openapi-stable_previous.json
-            sudo mv ${TGT_DIR}/jellyfin-openapi-stable.json ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            # Create new jellyfin-openapi-stable.json symlink
-            sudo ln -s stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-stable.json
-            # Check that the previous openapi stable spec link is correct
-            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-stable_previous.json )" != "stable/${LAST_SPEC}" ]]; then
-                sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-                sudo ln -s stable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            fi
-            ) 200>/run/workflows/openapi-stable.lock
diff --git a/.github/workflows/openapi/pull-request.yml b/.github/workflows/openapi/pull-request.yml
deleted file mode 100644
index 3071027823..0000000000
--- a/.github/workflows/openapi/pull-request.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-name: OpenAPI Check
-on:
-  pull_request:
-
-jobs:
-  ancestor:
-    name: Common Ancestor
-    runs-on: ubuntu-latest
-    outputs:
-      base_ref: ${{ steps.ancestor.outputs.base_ref }}
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ github.event.pull_request.head.sha }}
-        repository: ${{ github.event.pull_request.head.repo.full_name }}
-        fetch-depth: 0
-    - name: Search History
-      id: ancestor
-      run: |
-        git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
-        git fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
-
-        ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} HEAD)
-
-        echo "ref: ${ANCESTOR_REF}"
-
-        echo "base_ref=${ANCESTOR_REF}" >> "$GITHUB_OUTPUT"
-
-  head:
-    name: Head Artifact
-    uses: ./.github/workflows/openapi/__generate.yml
-    with:
-      ref: ${{ github.event.pull_request.head.sha }}
-      repository: ${{ github.event.pull_request.head.repo.full_name }}
-      artifact: openapi-head
-
-  base:
-    name: Base Artifact
-    uses: ./.github/workflows/openapi/__generate.yml
-    needs:
-    - ancestor
-    with:
-      ref: ${{ needs.ancestor.outputs.base_ref }}
-      repository: ${{ github.event.pull_request.base.repo.full_name }}
-      artifact: openapi-base
-
-  diff:
-    name: Generate Report
-    runs-on: ubuntu-latest
-    needs:
-    - head
-    - base
-    steps:
-    - name: Download Head
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: openapi-head
-        path: openapi-head
-    - name: Download Base
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: openapi-base
-        path: openapi-base
-    - name: Detect Changes
-      uses: jellyfin/openapi-diff-action@9274f6bda9d01ab091942a4a8334baa53692e8a4 # v1.0.0
-      id: openapi-diff
-      with:
-        old-spec: openapi-base/openapi.json
-        new-spec: openapi-head/openapi.json
-        markdown: openapi-changelog.md
-        github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/openapi/workflow-run.yml b/.github/workflows/openapi/workflow-run.yml
deleted file mode 100644
index 9dbd2c40a0..0000000000
--- a/.github/workflows/openapi/workflow-run.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-name: OpenAPI Report
-
-on:
-  workflow_run:
-    workflows:
-    - OpenAPI Check
-    types:
-    - completed
-
-jobs:
-  metadata:
-    name: Generate Metadata
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    outputs:
-      pr_number: ${{ steps.pr_number.outputs.pr_number }}
-    steps:
-    - name: Get Pull Request Number
-      id: pr_number
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-      run: |
-        API_RESPONSE=$(gh pr list --repo "${GITHUB_REPOSITORY}" --search "${HEAD_SHA}" --state open --json number)
-        PR_NUMBER=$(echo "${API_RESPONSE}" | jq '.[0].number')
-
-        echo "repository: ${GITHUB_REPOSITORY}"
-        echo "sha: ${HEAD_SHA}"
-        echo "response: ${API_RESPONSE}"
-        echo "pr: ${PR_NUMBER}"
-
-        echo "pr_number=${PR_NUMBER}" >> "${GITHUB_OUTPUT}"
-
-  comment:
-    name: Pull Request Comment
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    needs:
-    - metadata
-    permissions:
-      pull-requests: write
-      actions: read
-      contents: read
-    steps:
-    - name: Download OpenAPI Report
-      id: download_report
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: openapi-diff-report
-        path: openapi-diff-report
-        run-id: ${{ github.event.workflow_run.id }}
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Push Comment
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
-      with:
-        github-token: ${{ secrets.JF_BOT_TOKEN }}
-        file-path: ${{ steps.download_report.outputs.download-path }}/openapi-changelog.md
-        pr-number: ${{ needs.metadata.outputs.pr_number }}
-        comment-tag: openapi-report
-- 
cgit v1.2.3


From 87c8349c6bcb5fe7b1c31cbaba2ef29b4b9a15f6 Mon Sep 17 00:00:00 2001
From: dkanada <dkanada@users.noreply.github.com>
Date: Fri, 3 Apr 2026 19:52:37 +0900
Subject: fix openapi report and publish workflows

---
 .github/workflows/openapi-merge.yml        |  4 +++-
 .github/workflows/openapi-pull-request.yml | 18 +++++++++++++++---
 .github/workflows/openapi-workflow-run.yml |  6 +++---
 3 files changed, 21 insertions(+), 7 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/openapi-merge.yml b/.github/workflows/openapi-merge.yml
index cd990cf5f8..954a835b41 100644
--- a/.github/workflows/openapi-merge.yml
+++ b/.github/workflows/openapi-merge.yml
@@ -6,7 +6,9 @@ on:
     tags:
       - 'v*'
 
-permissions: {}
+permissions:
+  contents: read
+  actions: read
 
 jobs:
   publish-openapi:
diff --git a/.github/workflows/openapi-pull-request.yml b/.github/workflows/openapi-pull-request.yml
index b583fb54d1..dc8ba3ab3e 100644
--- a/.github/workflows/openapi-pull-request.yml
+++ b/.github/workflows/openapi-pull-request.yml
@@ -63,10 +63,22 @@ jobs:
         name: openapi-base
         path: openapi-base
     - name: Detect Changes
-      uses: jellyfin/openapi-diff-action@9274f6bda9d01ab091942a4a8334baa53692e8a4 # v1.0.0
+      runs-on: ubuntu-latest
       id: openapi-diff
       with:
         old-spec: openapi-base/openapi.json
         new-spec: openapi-head/openapi.json
-        markdown: openapi-changelog.md
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        sed 's:allOf:oneOf:g' openapi-head/openapi.json
+        sed 's:allOf:oneOf:g' openapi-base/openapi.json
+
+        mkdir -p /tmp/openapi-report
+        mv openapi-head/openapi.json /tmp/openapi-report/head.json
+        mv openapi-base/openapi.json /tmp/openapi-report/base.json
+
+        docker run -v /tmp/openapi-report:/data openapitools/openapi-diff:2.1.6 /data/base.json /data/head.json --state -l ERROR --markdown /data/openapi-report.md
+    - name: Upload Artifact
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: openapi-report
+        path: /tmp/openapi-report/openapi-report.md
diff --git a/.github/workflows/openapi-workflow-run.yml b/.github/workflows/openapi-workflow-run.yml
index 9dbd2c40a0..0f9e84e56b 100644
--- a/.github/workflows/openapi-workflow-run.yml
+++ b/.github/workflows/openapi-workflow-run.yml
@@ -46,14 +46,14 @@ jobs:
       id: download_report
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: openapi-diff-report
-        path: openapi-diff-report
+        name: openapi-report
+        path: openapi-report
         run-id: ${{ github.event.workflow_run.id }}
         github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Push Comment
       uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
       with:
         github-token: ${{ secrets.JF_BOT_TOKEN }}
-        file-path: ${{ steps.download_report.outputs.download-path }}/openapi-changelog.md
+        file-path: ${{ steps.download_report.outputs.download-path }}/openapi-report.md
         pr-number: ${{ needs.metadata.outputs.pr_number }}
         comment-tag: openapi-report
-- 
cgit v1.2.3


From da4d06c5abf2fcbc1addcf64d456ee88ea100f3c Mon Sep 17 00:00:00 2001
From: dkanada <dkanada@users.noreply.github.com>
Date: Fri, 3 Apr 2026 20:17:31 +0900
Subject: move permissions block to publish job

---
 .github/workflows/openapi-merge.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/openapi-merge.yml b/.github/workflows/openapi-merge.yml
index 954a835b41..2421c09ad7 100644
--- a/.github/workflows/openapi-merge.yml
+++ b/.github/workflows/openapi-merge.yml
@@ -6,14 +6,12 @@ on:
     tags:
       - 'v*'
 
-permissions:
-  contents: read
-  actions: read
-
 jobs:
   publish-openapi:
     name: OpenAPI - Publish Artifact
     uses: ./.github/workflows/openapi-generate.yml
+    permissions:
+      contents: read
     with:
       ref: ${{ github.sha }}
       repository: ${{ github.repository }}
-- 
cgit v1.2.3


From 5d2a529fb3f74429f69959363960e99b14427334 Mon Sep 17 00:00:00 2001
From: dkanada <dkanada@users.noreply.github.com>
Date: Sat, 4 Apr 2026 17:39:15 +0900
Subject: fix invalid workflow on openapi report job

---
 .github/workflows/openapi-pull-request.yml | 4 ----
 1 file changed, 4 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/openapi-pull-request.yml b/.github/workflows/openapi-pull-request.yml
index dc8ba3ab3e..c7ecb7ecfb 100644
--- a/.github/workflows/openapi-pull-request.yml
+++ b/.github/workflows/openapi-pull-request.yml
@@ -63,11 +63,7 @@ jobs:
         name: openapi-base
         path: openapi-base
     - name: Detect Changes
-      runs-on: ubuntu-latest
       id: openapi-diff
-      with:
-        old-spec: openapi-base/openapi.json
-        new-spec: openapi-head/openapi.json
       run: |
         sed 's:allOf:oneOf:g' openapi-head/openapi.json
         sed 's:allOf:oneOf:g' openapi-base/openapi.json
-- 
cgit v1.2.3


From 97a1feb16dfd694e00cd5ec75f582387c97120f9 Mon Sep 17 00:00:00 2001
From: dkanada <dkanada@users.noreply.github.com>
Date: Sun, 5 Apr 2026 15:19:10 +0900
Subject: edit openapi files in place with sed

---
 .github/workflows/openapi-pull-request.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/openapi-pull-request.yml b/.github/workflows/openapi-pull-request.yml
index c7ecb7ecfb..563a0a406f 100644
--- a/.github/workflows/openapi-pull-request.yml
+++ b/.github/workflows/openapi-pull-request.yml
@@ -65,8 +65,8 @@ jobs:
     - name: Detect Changes
       id: openapi-diff
       run: |
-        sed 's:allOf:oneOf:g' openapi-head/openapi.json
-        sed 's:allOf:oneOf:g' openapi-base/openapi.json
+        sed -i 's:allOf:oneOf:g' openapi-head/openapi.json
+        sed -i 's:allOf:oneOf:g' openapi-base/openapi.json
 
         mkdir -p /tmp/openapi-report
         mv openapi-head/openapi.json /tmp/openapi-report/head.json
-- 
cgit v1.2.3


From 29d11f6ecb529ca091f6538ea3dc6c9a0fd6d4c3 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 10 Apr 2026 19:09:15 +0000
Subject: Update actions/upload-artifact action to v7.0.1

---
 .github/workflows/ci-compat.yml            | 4 ++--
 .github/workflows/openapi-generate.yml     | 2 +-
 .github/workflows/openapi-pull-request.yml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-compat.yml b/.github/workflows/ci-compat.yml
index f9e2fbc3a6..dd48209a1f 100644
--- a/.github/workflows/ci-compat.yml
+++ b/.github/workflows/ci-compat.yml
@@ -26,7 +26,7 @@ jobs:
           dotnet build Jellyfin.Server -o ./out
 
       - name: Upload Head
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: abi-head
           retention-days: 14
@@ -65,7 +65,7 @@ jobs:
           dotnet build Jellyfin.Server -o ./out
 
       - name: Upload Head
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: abi-base
           retention-days: 14
diff --git a/.github/workflows/openapi-generate.yml b/.github/workflows/openapi-generate.yml
index 255cc49e82..dbfaf9d30b 100644
--- a/.github/workflows/openapi-generate.yml
+++ b/.github/workflows/openapi-generate.yml
@@ -36,7 +36,7 @@ jobs:
       run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter Jellyfin.Server.Integration.Tests.OpenApiSpecTests
 
     - name: Upload Artifact
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{ inputs.artifact }}
         path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
diff --git a/.github/workflows/openapi-pull-request.yml b/.github/workflows/openapi-pull-request.yml
index 563a0a406f..4acd0f4d4f 100644
--- a/.github/workflows/openapi-pull-request.yml
+++ b/.github/workflows/openapi-pull-request.yml
@@ -74,7 +74,7 @@ jobs:
 
         docker run -v /tmp/openapi-report:/data openapitools/openapi-diff:2.1.6 /data/base.json /data/head.json --state -l ERROR --markdown /data/openapi-report.md
     - name: Upload Artifact
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: openapi-report
         path: /tmp/openapi-report/openapi-report.md
-- 
cgit v1.2.3


From eb6c0e093552974d09476135ce95501ef01f5c46 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 15 Apr 2026 19:46:47 +0200
Subject: Update github/codeql-action action to v4.35.2 (#16639)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/ci-codeql-analysis.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-codeql-analysis.yml b/.github/workflows/ci-codeql-analysis.yml
index f6f9a26d06..442114dd80 100644
--- a/.github/workflows/ci-codeql-analysis.yml
+++ b/.github/workflows/ci-codeql-analysis.yml
@@ -32,13 +32,13 @@ jobs:
         dotnet-version: '10.0.x'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
       with:
         languages: ${{ matrix.language }}
         queries: +security-extended
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+      uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
-- 
cgit v1.2.3


From d8c55a29bb0f3fe04ba083bb338ca80cf7f1601e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 16 Apr 2026 04:59:35 +0000
Subject: Update danielpalme/ReportGenerator-GitHub-Action action to v5.5.5

---
 .github/workflows/ci-tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index fc32cc884d..9fdcaedf97 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -35,7 +35,7 @@ jobs:
           --verbosity minimal
 
       - name: Merge code coverage results
-        uses: danielpalme/ReportGenerator-GitHub-Action@cf6fe1b38ed5becc89ffe056c1f240825993be5b # v5.5.4
+        uses: danielpalme/ReportGenerator-GitHub-Action@7ae927204961589fcb0b0be245c51fbbc87cbca2 # v5.5.5
         with:
           reports: "**/coverage.cobertura.xml"
           targetdir: "merged/"
-- 
cgit v1.2.3


From 2df0b9d8210fdf3e799a9444191b355c7ee4379a Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 20 Apr 2026 23:38:25 +0000
Subject: Update danielpalme/ReportGenerator-GitHub-Action action to v5.5.6

---
 .github/workflows/ci-tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index 9fdcaedf97..81f218b893 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -35,7 +35,7 @@ jobs:
           --verbosity minimal
 
       - name: Merge code coverage results
-        uses: danielpalme/ReportGenerator-GitHub-Action@7ae927204961589fcb0b0be245c51fbbc87cbca2 # v5.5.5
+        uses: danielpalme/ReportGenerator-GitHub-Action@ee3806a36b8b2eb9594cb3e5fae045af7e5ead10 # v5.5.6
         with:
           reports: "**/coverage.cobertura.xml"
           targetdir: "merged/"
-- 
cgit v1.2.3


From 035d8f06cc4c7f3bd1703620ac1cdcf9a319eb0f Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 20:36:46 +0000
Subject: Update danielpalme/ReportGenerator-GitHub-Action action to v5.5.7

---
 .github/workflows/ci-tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index 81f218b893..f0ecb166b4 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -35,7 +35,7 @@ jobs:
           --verbosity minimal
 
       - name: Merge code coverage results
-        uses: danielpalme/ReportGenerator-GitHub-Action@ee3806a36b8b2eb9594cb3e5fae045af7e5ead10 # v5.5.6
+        uses: danielpalme/ReportGenerator-GitHub-Action@a003c8fb9ac008fd0fffd5faa4f7d3ecb52e0675 # v5.5.7
         with:
           reports: "**/coverage.cobertura.xml"
           targetdir: "merged/"
-- 
cgit v1.2.3


From fd80a9d9163fd49073155cb4a576feea3244ec5d Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 2 May 2026 14:52:19 +0000
Subject: Update CI dependencies

---
 .github/workflows/ci-codeql-analysis.yml | 6 +++---
 .github/workflows/ci-tests.yml           | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-codeql-analysis.yml b/.github/workflows/ci-codeql-analysis.yml
index 442114dd80..65752af977 100644
--- a/.github/workflows/ci-codeql-analysis.yml
+++ b/.github/workflows/ci-codeql-analysis.yml
@@ -32,13 +32,13 @@ jobs:
         dotnet-version: '10.0.x'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
       with:
         languages: ${{ matrix.language }}
         queries: +security-extended
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index f0ecb166b4..da66575095 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -35,7 +35,7 @@ jobs:
           --verbosity minimal
 
       - name: Merge code coverage results
-        uses: danielpalme/ReportGenerator-GitHub-Action@a003c8fb9ac008fd0fffd5faa4f7d3ecb52e0675 # v5.5.7
+        uses: danielpalme/ReportGenerator-GitHub-Action@76a32cbf3ab76fe59d9fe2fe4d76b3f48afa6199 # v5.5.8
         with:
           reports: "**/coverage.cobertura.xml"
           targetdir: "merged/"
-- 
cgit v1.2.3


From 4e94c3e28bbb9094c1552740531962ebf3834648 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 2 May 2026 18:49:55 +0000
Subject: Update danielpalme/ReportGenerator-GitHub-Action action to v5.5.9

---
 .github/workflows/ci-tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index da66575095..2a26bf15a4 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -35,7 +35,7 @@ jobs:
           --verbosity minimal
 
       - name: Merge code coverage results
-        uses: danielpalme/ReportGenerator-GitHub-Action@76a32cbf3ab76fe59d9fe2fe4d76b3f48afa6199 # v5.5.8
+        uses: danielpalme/ReportGenerator-GitHub-Action@c31aa4ed4f12f147061186cf2a029f307b5c3636 # v5.5.9
         with:
           reports: "**/coverage.cobertura.xml"
           targetdir: "merged/"
-- 
cgit v1.2.3