ruby_raider 4.0.0 → 4.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36caa6e3075d166277f9cafe8073ccd81f9ada8706a3df11ce93a6073b45d130
-  data.tar.gz: 6aeedcccd3623931f16eb8e082635f93f4946e6870ca79a7de9f03478d868034
+  metadata.gz: d516f44eddaa410a882fb64a08755338486c30d9eca4755f97c1716f5b5754ca
+  data.tar.gz: de1a0fd5c654301482a09830072991d89793e117092bd23515b44e3e8f428c90
 SHA512:
-  metadata.gz: 7581c5bb57fd17624148332100f3e4c963323a02f5bff6dfda8aba500b5b478bfbbcb07741f55eb73909beca99e5a88b769a0af437820507c7b9bd3977038038
-  data.tar.gz: 353af9eab7da4783e38bff479bab069a35bbed7fcd57936b22eb525c443fc7b76136c5408371424690082f164d3e76334d93f093c2219c4bbe1cb8e56d49ed0a
+  metadata.gz: f580ff7a46dd54bc6c792d273045e1041e5bd29dceb302468f909661b4f52fbb837786765e3cb65d701526d7c3ab75aacbfa730ae677a0d8443448a292b667c7
+  data.tar.gz: bf9a38d296a6b08ff3f2154e35168d75045431076c65a4a9ea376a4c3a76d928c163d5d5b840dc22ab7444c88e2021a7f66157b2760c84eb40a064a9941b98d6

data/.github/ffmpeg/build.sh

@@ -0,0 +1,208 @@
+#!/usr/bin/env bash
+# Builds the ffmpeg binary that RubyRaider::Ffmpeg downloads for failure videos.
+#
+#   .github/ffmpeg/build.sh <darwin-arm64|darwin-x64|linux-x64|windows-x64> [out_dir]
+#
+# LGPL build (no --enable-gpl, no --enable-nonfree) with only what the generated
+# VideoHelper needs: PNG frames listed in a concat file, scaled, encoded with libvpx
+# (VP8, VP9 kept for later) into WebM. Every source is pinned by SHA-256 or commit.
+# Also writes the license notices for what is linked in and, in <out_dir>/sources/, the complete
+# corresponding source (FFmpeg and zlib tarballs, a git archive of the libvpx commit) for the release.
+# Runs on: macOS (arm64 or x86_64 runner), Alpine Linux (fully static, musl) and
+# MSYS2 MINGW64 on Windows (static libgcc/winpthread). Needs bash, make, a C compiler,
+# curl, tar, xz, git, pkg-config, perl and nasm (x86_64 targets only).
+set -euo pipefail
+
+FFMPEG_VERSION=7.1.5
+FFMPEG_SHA256=de668509caf9e35e3cd162473441fdb29538c6d96ed080292b3cf9e6fc5d558f
+ZLIB_VERSION=1.3.1
+ZLIB_SHA256=9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23
+LIBVPX_TAG=v1.15.2
+LIBVPX_COMMIT=d168454ecd099805c675d4a98c66f4891373302a
+# Only for its license notice: the Linux binary links musl statically (Alpine 3.20 ships musl 1.2.5).
+MUSL_VERSION=1.2.5
+MUSL_SHA256=a9a118bbe84d8764da0ea0d28b3ab3fae8477fc7e4085d90102b8596fc7c75e4
+MACOS_MIN=11.0
+
+FFMPEG_URL="https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.xz"
+ZLIB_URL="https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz"
+LIBVPX_REPO=https://chromium.googlesource.com/webm/libvpx
+MUSL_URL="https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz"
+
+target="${1:?usage: build.sh <darwin-arm64|darwin-x64|linux-x64|windows-x64> [out_dir]}"
+here="$(cd "$(dirname "$0")" && pwd)"
+out_dir="$(mkdir -p "${2:-dist}" && cd "${2:-dist}" && pwd)"
+work="${FFMPEG_BUILD_DIR:-$(pwd)/build-ffmpeg-$target}"
+prefix="$work/prefix"
+jobs="$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)"
+
+cflags=""
+ldflags=""
+exe=""
+ffmpeg_flags=(--enable-pthreads)
+zlib_make=()
+case "$target" in
+  darwin-arm64)
+    vpx_target=arm64-darwin20-gcc
+    arch=arm64
+    ;;
+  darwin-x64)
+    vpx_target=x86_64-darwin20-gcc
+    arch=x86_64
+    ;;
+  linux-x64)
+    vpx_target=x86_64-linux-gcc
+    ldflags="-static"
+    ;;
+  windows-x64)
+    vpx_target=x86_64-win64-gcc
+    ldflags="-static"
+    exe=".exe"
+    ffmpeg_flags=(--enable-w32threads)
+    zlib_make=(-f win32/Makefile.gcc)
+    ;;
+  *)
+    echo "unknown target: $target" >&2
+    exit 2
+    ;;
+esac
+
+if [[ "$target" == darwin-* ]]; then
+  if [[ "$(uname -m)" != "$arch" ]]; then
+    echo "build $target on a $arch Mac (this one is $(uname -m))" >&2
+    exit 2
+  fi
+  export MACOSX_DEPLOYMENT_TARGET="$MACOS_MIN"
+  cflags="-mmacosx-version-min=$MACOS_MIN"
+  ldflags="-mmacosx-version-min=$MACOS_MIN"
+fi
+
+sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+}
+
+fetch() { # url sha256 file
+  local url="$1" want="$2" file="$work/src/$3"
+  if [[ ! -f "$file" ]]; then
+    echo "fetching $url"
+    curl --proto '=https' --tlsv1.2 -sSfL --retry 5 --retry-all-errors --retry-delay 10 -o "$file" "$url"
+  fi
+  local got
+  got="$(sha256 "$file")"
+  if [[ "$got" != "$want" ]]; then
+    echo "checksum mismatch for $url: got $got, want $want" >&2
+    rm -f "$file"
+    exit 1
+  fi
+}
+
+mkdir -p "$work/src" "$prefix"
+cd "$work/src"
+
+fetch "$FFMPEG_URL" "$FFMPEG_SHA256" "ffmpeg-${FFMPEG_VERSION}.tar.xz"
+fetch "$ZLIB_URL" "$ZLIB_SHA256" "zlib-${ZLIB_VERSION}.tar.gz"
+rm -rf "ffmpeg-${FFMPEG_VERSION}" "zlib-${ZLIB_VERSION}" libvpx
+tar -xJf "ffmpeg-${FFMPEG_VERSION}.tar.xz"
+tar -xzf "zlib-${ZLIB_VERSION}.tar.gz"
+git -c advice.detachedHead=false clone -q --depth 1 --branch "$LIBVPX_TAG" "$LIBVPX_REPO" libvpx
+got_commit="$(git -C libvpx rev-parse HEAD)"
+if [[ "$got_commit" != "$LIBVPX_COMMIT" ]]; then
+  echo "libvpx $LIBVPX_TAG is $got_commit, want $LIBVPX_COMMIT" >&2
+  exit 1
+fi
+
+echo "== zlib $ZLIB_VERSION"
+(
+  cd "zlib-${ZLIB_VERSION}"
+  if [[ "$target" == windows-x64 ]]; then
+    make -s "${zlib_make[@]}" -j"$jobs" libz.a CFLAGS="-O2"
+    mkdir -p "$prefix/include" "$prefix/lib"
+    cp zlib.h zconf.h "$prefix/include/"
+    cp libz.a "$prefix/lib/"
+  else
+    CFLAGS="-O2 -fPIC $cflags" ./configure --static --prefix="$prefix" >/dev/null
+    make -s -j"$jobs"
+    make -s install >/dev/null
+  fi
+)
+
+echo "== libvpx $LIBVPX_TAG ($vpx_target)"
+(
+  cd libvpx
+  ./configure --prefix="$prefix" --target="$vpx_target" \
+    --enable-static --disable-shared --enable-pic \
+    --enable-vp8 --enable-vp9 --disable-examples --disable-tools --disable-docs \
+    --disable-unit-tests --disable-install-bins --disable-install-docs \
+    ${cflags:+--extra-cflags="$cflags"} >/dev/null
+  make -s -j"$jobs" >/dev/null
+  make -s install >/dev/null
+)
+
+echo "== ffmpeg $FFMPEG_VERSION"
+configure_args=(
+  --prefix="$prefix"
+  --pkg-config-flags=--static
+  --extra-cflags="-I$prefix/include $cflags"
+  --extra-ldflags="-L$prefix/lib $ldflags"
+  --disable-everything --disable-autodetect
+  --disable-doc --disable-debug --disable-network
+  --disable-ffplay --disable-ffprobe --disable-avdevice --disable-swresample
+  --enable-static --disable-shared
+  "${ffmpeg_flags[@]}"
+  --enable-zlib --enable-libvpx
+  --enable-protocol=file
+  --enable-demuxer=concat,image2,png_pipe
+  --enable-decoder=png
+  --enable-encoder=libvpx_vp8,libvpx_vp9
+  --enable-bsf=vp9_superframe
+  --enable-muxer=webm
+  --enable-filter=scale,format,null
+)
+(
+  cd "ffmpeg-${FFMPEG_VERSION}"
+  PKG_CONFIG_PATH="$prefix/lib/pkgconfig" ./configure "${configure_args[@]}" >"$work/configure.log" 2>&1 ||
+    { tail -40 ffbuild/config.log; exit 1; }
+  make -s -j"$jobs" "ffmpeg$exe" >/dev/null
+  cp "ffmpeg$exe" "$out_dir/ffmpeg-7.1-$target$exe"
+  grep -q '^CONFIG_GPL=yes' ffbuild/config.mak && { echo 'GPL build: refusing' >&2; exit 1; }
+  grep -q '^CONFIG_NONFREE=yes' ffbuild/config.mak && { echo 'nonfree build: refusing' >&2; exit 1; }
+  cp COPYING.LGPLv2.1 "$out_dir/"
+)
+cp libvpx/LICENSE "$out_dir/libvpx-LICENSE"
+cp libvpx/PATENTS "$out_dir/libvpx-PATENTS"
+sed -n '/^Copyright notice:/,$p' "zlib-${ZLIB_VERSION}/README" >"$out_dir/zlib-LICENSE"
+case "$target" in
+  linux-x64)
+    fetch "$MUSL_URL" "$MUSL_SHA256" "musl-${MUSL_VERSION}.tar.gz"
+    tar -xzOf "musl-${MUSL_VERSION}.tar.gz" "musl-${MUSL_VERSION}/COPYRIGHT" >"$out_dir/musl-COPYRIGHT"
+    ;;
+  windows-x64)
+    # Static libgcc, mingw-w64 CRT and winpthreads: copy MSYS2's license files for them.
+    notices="$out_dir/mingw-w64-notices"
+    mkdir -p "$notices"
+    for dir in /mingw64/share/licenses/*; do
+      case "$(basename "$dir")" in
+        *winpthread* | *crt* | *gcc-libs* | *libwinpthread* | *headers*) cp -R "$dir" "$notices/" ;;
+      esac
+    done
+    [[ -n "$(ls -A "$notices")" ]] || { echo 'no mingw-w64 license files found' >&2; exit 1; }
+    ;;
+esac
+mkdir -p "$out_dir/sources"
+cp "ffmpeg-${FFMPEG_VERSION}.tar.xz" "zlib-${ZLIB_VERSION}.tar.gz" "$out_dir/sources/"
+git -C libvpx archive --format=tar.gz --prefix="libvpx-${LIBVPX_TAG#v}/" -o "$out_dir/sources/libvpx-${LIBVPX_TAG#v}.tar.gz" HEAD
+
+binary="$out_dir/ffmpeg-7.1-$target$exe"
+# arm64 macOS will not run an unsigned binary; re-apply the linker's ad-hoc signature.
+[[ "$target" == darwin-* ]] && codesign --force --sign - "$binary"
+
+{
+  echo "target: $target"
+  echo "ffmpeg: $FFMPEG_VERSION $FFMPEG_URL sha256 $FFMPEG_SHA256"
+  echo "zlib: $ZLIB_VERSION $ZLIB_URL sha256 $ZLIB_SHA256"
+  echo "libvpx: $LIBVPX_TAG $LIBVPX_REPO commit $LIBVPX_COMMIT"
+  echo "configure: ${configure_args[*]}" | sed "s#$prefix#\$PREFIX#g"
+  echo "sha256: $(sha256 "$binary")  $(basename "$binary")"
+} >"$out_dir/BUILD-$target.txt"
+cat "$out_dir/BUILD-$target.txt"
+"$here/check.sh" "$binary" "$work/check"

data/.github/ffmpeg/check.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Proves a built ffmpeg does what the generated VideoHelper asks of it:
+#   .github/ffmpeg/check.sh <ffmpeg binary> [work_dir]
+# 1. links only (unless SKIP_LINKAGE is set) to libraries every machine of that OS has;
+# 2. runs VideoHelper#ffmpeg_arguments' exact encode on sample PNG frames;
+# 3. encodes the same frames with libvpx-vp9 too (built for later use);
+# 4. if FFPROBE is set (or ffprobe is on PATH), checks both WebMs (probe.sh).
+# Writes <work_dir>/video.webm and <work_dir>/vp9.webm.
+set -euo pipefail
+
+binary="$1"
+work="${2:-$(mktemp -d)}"
+here="$(cd "$(dirname "$0")" && pwd)"
+rm -rf "$work" && mkdir -p "$work"
+
+echo "== linkage"
+case "${SKIP_LINKAGE:+skip}$(uname -s)" in
+  skip*) echo '(skipped)' ;;
+  Darwin)
+    otool -L "$binary" | tail -n +2 | tee "$work/libs.txt"
+    if grep -v -E '^\s*/(usr/lib|System/Library)/' "$work/libs.txt"; then
+      echo 'links to a non-system library' >&2
+      exit 1
+    fi
+    codesign --verify --verbose "$binary"
+    otool -l "$binary" | grep -A4 -E 'LC_BUILD_VERSION|LC_VERSION_MIN_MACOSX' | grep -E 'minos|version' | head -2
+    ;;
+  Linux)
+    file "$binary"
+    file "$binary" | grep -q 'statically linked' || { echo 'not statically linked' >&2; exit 1; }
+    ;;
+  MINGW* | MSYS* | CYGWIN*)
+    objdump -p "$binary" | grep 'DLL Name' | tee "$work/libs.txt"
+    # Only Windows system DLLs: no libgcc, libwinpthread, libvpx, zlib.
+    if grep -v -i -E 'DLL Name: (KERNEL32|msvcrt|ADVAPI32|USER32|bcrypt|ole32|shell32|api-ms-win-[a-z0-9-]+)\.dll' "$work/libs.txt"; then
+      echo 'links to a non-system DLL' >&2
+      exit 1
+    fi
+    ;;
+esac
+
+echo "== version"
+"$binary" -hide_banner -version | head -3
+if "$binary" -hide_banner -version | grep -q -- '--enable-gpl\|--enable-nonfree'; then
+  echo 'GPL or nonfree build' >&2
+  exit 1
+fi
+"$binary" -hide_banner -encoders 2>/dev/null | grep -E 'libvpx' || { echo 'no libvpx encoder' >&2; exit 1; }
+
+echo "== encode (VideoHelper#ffmpeg_arguments)"
+ruby "$here/frames.rb" "$work"
+# Relative names in list.txt resolve against the list's directory, as in the helper's tmpdir.
+"$binary" -y -loglevel error -f concat -safe 0 -i "$work/list.txt" \
+  -vf "scale='min(1280,iw)':-2" -c:v libvpx -deadline realtime \
+  -b:v 1M -r 5 -pix_fmt yuv420p "$work/video.webm"
+size="$(wc -c <"$work/video.webm" | tr -d ' ')"
+echo "video.webm: $size bytes"
+[[ "$size" -gt 1000 ]] || { echo 'video too small' >&2; exit 1; }
+
+echo "== encode (VP9)"
+"$binary" -y -loglevel error -f concat -safe 0 -i "$work/list.txt" \
+  -vf "scale='min(1280,iw)':-2" -c:v libvpx-vp9 -deadline realtime \
+  -b:v 1M -r 5 -pix_fmt yuv420p "$work/vp9.webm"
+[[ "$(wc -c <"$work/vp9.webm" | tr -d ' ')" -gt 1000 ]] || { echo 'vp9 video too small' >&2; exit 1; }
+
+probe="${FFPROBE:-$(command -v ffprobe || true)}"
+if [[ -n "$probe" ]]; then
+  "$here/probe.sh" "$probe" "$work/video.webm"
+  "$here/probe.sh" "$probe" "$work/vp9.webm" vp9
+else
+  echo "(no ffprobe here: the validate job probes this video)"
+fi

data/.github/ffmpeg/frames.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# Writes sample "screenshots" and the concat list the generated VideoHelper builds:
+#   ruby frames.rb <dir> [width] [height] [count]
+# RGBA PNGs with odd dimensions (so scale='min(1280,iw)':-2 has to round), stdlib only.
+require 'zlib'
+
+dir, width, height, count = ARGV
+width = (width || 1366).to_i
+height = (height || 657).to_i
+count = (count || 12).to_i
+
+def chunk(type, data)
+  [data.bytesize].pack('N') + type + data + [Zlib.crc32(type + data)].pack('N')
+end
+
+def png(width, height, shift)
+  rows = Array.new(height) do |y|
+    row = Array.new(width) do |x|
+      [(x + shift * 20) % 256, (y + shift * 7) % 256, (x ^ y) % 256, 255].pack('C4')
+    end
+    "\x00#{row.join}"
+  end
+  "\x89PNG\r\n\x1A\n".b +
+    chunk('IHDR', [width, height, 8, 6, 0, 0, 0].pack('NNCCCCC')) +
+    chunk('IDAT', Zlib::Deflate.deflate(rows.join, 1)) +
+    chunk('IEND', '')
+end
+
+# Same shape as VideoHelper#concat_list: each frame lasts until the next, clamped to [1/fps, 2.0].
+names = Array.new(count) { |i| format('frame-%06d.png', i + 1) }
+names.each_with_index { |name, i| File.binwrite(File.join(dir, name), png(width, height, i)) }
+lines = names.each_with_index.flat_map { |name, i| ["file '#{name}'", format('duration %.3f', i.even? ? 0.2 : 1.1)] }
+File.write(File.join(dir, 'list.txt'), (lines << "file '#{names.last}'").join("\n") << "\n")

data/.github/ffmpeg/probe.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# probe.sh <ffprobe> <video.webm> [codec, default vp8]: one video stream of that codec, 1280x616 (1366x657 scaled to an even height),
+# about 8 s long, and the whole file decodes without errors.
+set -euo pipefail
+
+probe="$1"
+video="$2"
+codec="${3:-vp8}"
+stream="$("$probe" -v error -select_streams v -show_entries stream=codec_name,width,height,pix_fmt -of csv=p=0 "$video")"
+format="$("$probe" -v error -show_entries format=format_name -of default=nw=1:nk=1 "$video")"
+duration="$("$probe" -v error -show_entries format=duration -of default=nw=1:nk=1 "$video")"
+echo "$(basename "$video"): stream $stream; format $format; duration $duration"
+[[ "$stream" == "$codec,1280,616,yuv420p" ]] || { echo "unexpected stream: $stream" >&2; exit 1; }
+[[ "$format" == "matroska,webm" ]] || { echo "unexpected format: $format" >&2; exit 1; }
+awk -v d="$duration" 'BEGIN { exit !(d > 7 && d < 9) }' || { echo "unexpected duration: $duration" >&2; exit 1; }
+errors="$("${probe%probe}mpeg" -v error -i "$video" -f null - 2>&1 || true)"
+[[ -z "$errors" ]] || { echo "decode errors: $errors" >&2; exit 1; }

data/.github/workflows/ffmpeg.yml

@@ -0,0 +1,160 @@
+name: ffmpeg build
+
+# Builds the four ffmpeg binaries that RubyRaider::Ffmpeg downloads for failure videos
+# (.github/ffmpeg/build.sh), tests each one on a second runner, and uploads them as
+# workflow artifacts. It never publishes: the ffmpeg-7.1 release is created by hand from
+# the downloaded artifacts of one run, so the release bytes are the bytes MANIFEST pins.
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/ffmpeg/**
+      - .github/workflows/ffmpeg.yml
+      # check.sh repeats VideoHelper#ffmpeg_arguments: a new filter or codec there needs a rebuild.
+      - lib/generators/templates/helpers/video_helper.tt
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ffmpeg-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { target: darwin-arm64, os: macos-15 }
+          - { target: darwin-x64, os: macos-15-intel }
+          - { target: linux-x64, os: ubuntu-24.04 }
+          - { target: windows-x64, os: windows-2022 }
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - name: Build (macOS)
+        if: runner.os == 'macOS'
+        run: |
+          brew install nasm pkgconf
+          .github/ffmpeg/build.sh ${{ matrix.target }} dist
+
+      # Alpine/musl gives a fully static binary that runs on any x86_64 Linux.
+      - name: Build (Linux, Alpine container)
+        if: runner.os == 'Linux'
+        run: |
+          docker run --rm -v "$PWD:/w" -w /w alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc sh -c '
+            apk add --no-cache bash build-base nasm perl pkgconf git curl xz tar diffutils file ruby &&
+            .github/ffmpeg/build.sh linux-x64 dist'
+
+      - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
+        if: runner.os == 'Windows'
+        with:
+          msystem: MINGW64
+          update: false
+          install: >-
+            make diffutils git tar xz curl perl
+            mingw-w64-x86_64-gcc mingw-w64-x86_64-nasm mingw-w64-x86_64-pkgconf mingw-w64-x86_64-ruby
+
+      - name: Build (Windows, MSYS2 MINGW64)
+        if: runner.os == 'Windows'
+        shell: msys2 {0}
+        run: .github/ffmpeg/build.sh windows-x64 dist
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ffmpeg-7.1-${{ matrix.target }}
+          path: |
+            dist/ffmpeg-7.1-*
+            dist/BUILD-*.txt
+            dist/COPYING.LGPLv2.1
+            dist/libvpx-LICENSE
+            dist/libvpx-PATENTS
+            dist/zlib-LICENSE
+            dist/musl-COPYRIGHT
+            dist/mingw-w64-notices/
+          if-no-files-found: error
+          retention-days: 90
+
+      # The complete corresponding source, once (every target builds from the same pinned sources).
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: matrix.target == 'linux-x64'
+        with:
+          name: ffmpeg-7.1-sources
+          path: dist/sources/
+          if-no-files-found: error
+          retention-days: 90
+
+  # Each binary on a fresh runner (another macOS version, older glibc Linux, newer Windows; darwin-x64
+  # only has the macos-15-intel label), running VideoHelper's exact encode.
+  test:
+    name: test ${{ matrix.target }} on ${{ matrix.os }}
+    needs: build
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { target: darwin-arm64, os: macos-26 }
+          - { target: darwin-x64, os: macos-15-intel }
+          - { target: linux-x64, os: ubuntu-22.04 }
+          - { target: windows-x64, os: windows-2025 }
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: ffmpeg-7.1-${{ matrix.target }}
+          path: dist
+      - name: Encode like VideoHelper
+        run: |
+          bin="dist/ffmpeg-7.1-${{ matrix.target }}"
+          [ "${{ runner.os }}" = Windows ] && bin="$bin.exe"
+          chmod +x "$bin"
+          # Linkage was audited in the build job, where the toolchain's tools are.
+          SKIP_LINKAGE=1 .github/ffmpeg/check.sh "$bin" "$RUNNER_TEMP/check"
+          mv "$RUNNER_TEMP/check/video.webm" "video-${{ matrix.target }}.webm"
+          mv "$RUNNER_TEMP/check/vp9.webm" "vp9-${{ matrix.target }}.webm"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: video-${{ matrix.target }}
+          path: |
+            video-${{ matrix.target }}.webm
+            vp9-${{ matrix.target }}.webm
+          retention-days: 14
+
+  validate:
+    name: validate videos and print checksums
+    needs: test
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          path: artifacts
+          pattern: '{ffmpeg-7.1-*,video-*}'
+      - name: Probe every video with a reference ffprobe
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg >/dev/null
+          for video in artifacts/video-*/video-*.webm; do .github/ffmpeg/probe.sh "$(command -v ffprobe)" "$video"; done
+          for video in artifacts/video-*/vp9-*.webm; do .github/ffmpeg/probe.sh "$(command -v ffprobe)" "$video" vp9; done
+      - name: Checksums for MANIFEST
+        run: |
+          {
+            echo '### ffmpeg-7.1 assets'
+            echo '```'
+            cd artifacts && sha256sum ffmpeg-7.1-*/ffmpeg-7.1-*
+            echo '```'
+          } | tee -a "$GITHUB_STEP_SUMMARY"