@krx3d/tizentube2 1.14.870 → 1.15.280

package/.github/assets/profiles.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<profiles active="TizenTubeStandalone" version="3.1">
+  <profile name="TizenTubeStandalone">
+    <profileitem
+      ca="$GITHUB_WORKSPACE/tizen-studio/tools/certificate-generator/certificates/developer/tizen-developer-ca.cer"
+      distributor="0"
+      key="$GITHUB_WORKSPACE/tizen-data/keystore/author/author.p12"
+      password="$KEY_PW"
+      rootca=""/>
+    <profileitem
+      ca="$GITHUB_WORKSPACE/tizen-studio/tools/certificate-generator/certificates/distributor/sdk-public/tizen-distributor-ca.cer"
+      distributor="1"
+      key="$GITHUB_WORKSPACE/tizen-studio/tools/certificate-generator/certificates/distributor/sdk-public/tizen-distributor-signer.p12"
+      password="tizenpkcs12passfordsigner"
+      rootca=""/>
+    <profileitem ca="" distributor="2" key="" password="" rootca=""/>
+  </profile>
+</profiles>

package/.github/workflows/build-publish-cleanup.yml

@@ -96,7 +96,7 @@
 # CONFIGURATION
 # -------------
 # - PACKAGE_NAME: Set to your npm package name (e.g., '@krx3d/tizentube')
-# - NODE_VERSION: Node.js version to use (default: '20')
+# - NODE_VERSION: Node.js version to use (default: '24', Active LTS)
 # - UNPUBLISH_WINDOW_HOURS: How long versions can be unpublished (default: '72')
 #
 # -----------------------------------------------------------------------------
@@ -117,6 +117,7 @@ on:
       - '.gitignore'
       - '.npmignore'
       - 'LICENSE'
+      - 'AGENTS.md'
       - 'README.md'
       - 'package.json'
       - 'tizen.log'
@@ -124,6 +125,16 @@ on:
       - 'scripts/**'
   workflow_dispatch:
 
+# Serialize runs so two pushes to main in quick succession can't both read
+# package.json's version before either has committed its own bump — that
+# race produces two runs computing the same "+10" version and the second
+# npm publish failing with "Cannot publish over previously published
+# version". Queue rather than cancel: a bump/publish already in progress
+# must finish (and land its commit) before the next one reads the version.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
 # Allow this workflow to push back changes to the repo
 permissions:
   contents: write
@@ -131,7 +142,7 @@ permissions:
 env:
   PACKAGE_NAME: '@krx3d/tizentube2'
   PACKAGE_NAME_GH: 'KrX3D/TizenTube'
-  NODE_VERSION: '20'
+  NODE_VERSION: '24'
   UNPUBLISH_WINDOW_HOURS: '72'
 
 jobs:

package/.github/workflows/build-standalone-release.yaml

@@ -0,0 +1,298 @@
+# -----------------------------------------------------------------------------
+# Build and release the TizenTube Standalone app (standalone/)
+#
+# WHAT THIS DOES
+# ---------------
+# Builds the userscript + regular DIAL service (needed by the standalone
+# service), then the standalone service itself, then packages and signs
+# standalone/ into a .wgt using Samsung's own Tizen Studio CLI, and publishes
+# it as a GitHub Release.
+#
+# Signing note: this used to sign via tizenjs (an unofficial community
+# packaging tool), which produced a .wgt that installed fine as an *update*
+# to an already-trusted app but was rejected with "invalid certificate
+# chain" on a brand-new app id's *first* install. Comparing against three
+# sibling projects (TizenBrew, TizenBrewInstaller, TizenYouTube) that all
+# install fine as fresh apps: the one thing they share and this build didn't
+# is that they're all packaged with Samsung's own official Tizen Studio CLI
+# (`tizen build-web` + `tizen package`), not tizenjs. TizenYouTube in
+# particular proved this isn't about certificate freshness — it uses the
+# exact same (long-expired) Samsung public sample distributor certificate
+# tizenjs was also falling back to, and still installs fine, because it's
+# packaged with the official tool. So this workflow now matches that same
+# working recipe: install Tizen Studio, configure a certificate profile
+# (author cert from secrets + Samsung's public sample distributor cert,
+# same as TizenYouTube/TizenBrew use), and package with `tizen package`
+# instead of tizenjs.
+#
+# This is entirely separate from build-publish-cleanup.yml (which builds and
+# npm-publishes the regular mod on push to main) — different trigger, no
+# shared state, so it doesn't affect that workflow.
+#
+# WHEN IT RUNS
+# ------------
+# - Automatically, right after "Build, publish and cleanup old npm versions"
+#   (build-publish-cleanup.yml) finishes successfully on main — i.e. once the
+#   userscript's new version has actually been bumped and published to npm.
+#   This keeps the standalone app's version in lockstep with the userscript:
+#   it reads the version build-publish-cleanup.yml just bumped in package.json
+#   and writes that same number into standalone/config.xml before packaging,
+#   rather than tracking its own separate version.
+# - On pushing a tag matching v*.*.* (e.g. v1.0.0)
+# - Manually via "Run workflow" (workflow_dispatch)
+#
+# PREREQUISITES (REQUIRED) — Tizen author certificate
+# -----------------------------------------------------
+# The build needs a Tizen author certificate to sign the .wgt.
+#
+# 1) Install Tizen Studio (or just the Certificate Manager) from
+#    https://developer.tizen.org/development/tizen-studio/download
+#
+# 2) Open Certificate Manager (Tizen Studio → Tools → Certificate Manager,
+#    or run `certificate-manager` directly from the Tizen Studio tools dir).
+#
+# 3) Author tab → "+" → "Create a new author certificate". Fill in a name,
+#    organization/email, and a password — remember this password. This
+#    produces an author.p12 file (Certificate Manager will tell you where
+#    it saved it).
+#
+# 4) Base64-encode the .p12 with NO line wrapping:
+#      Linux/macOS:  base64 -w0 author.p12
+#      Windows (PowerShell):
+#        [Convert]::ToBase64String([IO.File]::ReadAllBytes("author.p12"))
+#
+# 5) Add two repository secrets (GitHub repo → Settings → Secrets and
+#    variables → Actions → New repository secret):
+#      TIZEN_AUTHOR_KEY     = the base64 string from step 4
+#      TIZEN_AUTHOR_KEY_PW  = the certificate password from step 3
+#
+# (The distributor certificate needs no setup — it's Samsung's own public
+# sample certificate, bundled with Tizen Studio and installed automatically
+# by this workflow, same as TizenBrew/TizenYouTube use.)
+#
+# HOW TO TRIGGER A BUILD
+# -----------------------
+# git tag v1.0.0 && git push origin v1.0.0
+# (or use "Run workflow" in the Actions tab for an ad-hoc build)
+# -----------------------------------------------------------------------------
+
+name: Build TizenTube Standalone and Release
+
+on:
+  workflow_run:
+    workflows: ['Build, publish and cleanup old npm versions']
+    types: [completed]
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: 'Release version/tag name (e.g. v1.0.0)'
+        required: false
+
+env:
+  TIZEN_STUDIO_VER: 5.6
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    # Only proceed on a successful npm-publish run that was itself triggered by
+    # a push to main (build-publish-cleanup.yml's job is skipped entirely for
+    # pull_request runs, which can still report an overall "success" — checking
+    # .workflow_run.event too avoids firing off of those). Tag pushes and
+    # manual dispatch always proceed.
+    if: >
+      github.event_name != 'workflow_run' ||
+      (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
+    permissions:
+      contents: write
+    steps:
+      # No explicit ref: default checkout behavior is already correct for every
+      # trigger — workflow_run checks out the default branch's current tip,
+      # push (tag) checks out the tag, workflow_dispatch checks out the branch
+      # it was run from. Pinning to github.event.workflow_run.head_sha (as an
+      # earlier version of this workflow did) is wrong: that's the commit that
+      # *triggered* build-publish-cleanup.yml, not the version-bump commit it
+      # produces partway through its own run — checking that out meant this
+      # workflow read package.json *before* the bump, one version behind.
+      - name: Clone repo with full history and tags
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Record the commit this build is actually based on
+        run: echo "RELEASE_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+
+      - name: Determine release version (sync with userscript's package.json)
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ github.event.inputs.release_version }}" ]; then
+            RELEASE_VERSION="${{ github.event.inputs.release_version }}"
+          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            RELEASE_VERSION="${GITHUB_REF#refs/tags/}"
+          elif [ -f package.json ]; then
+            PKG_VER=$(node -p "require('./package.json').version")
+            RELEASE_VERSION="${PKG_VER:+v$PKG_VER}"
+          fi
+
+          if [ -z "${RELEASE_VERSION:-}" ]; then
+            CFG_VER=$(sed -n 's/.*<widget[^>]*version="\([^"]*\)".*/\1/p' standalone/config.xml | head -n1)
+            RELEASE_VERSION="${CFG_VER:+v$CFG_VER}"
+            RELEASE_VERSION="${RELEASE_VERSION:-v0.0.0-${GITHUB_SHA:0:7}}"
+          fi
+          echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
+
+      - name: Sync standalone/config.xml version with the userscript's version
+        run: |
+          set -euo pipefail
+          NEW_VER="${RELEASE_VERSION#v}"
+          CUR_VER=$(sed -n 's/.*<widget[^>]*version="\([^"]*\)".*/\1/p' standalone/config.xml | head -n1)
+          if [ -n "$NEW_VER" ] && [ "$NEW_VER" != "$CUR_VER" ]; then
+            sed -i "0,/<widget /s/version=\"${CUR_VER}\"/version=\"${NEW_VER}\"/" standalone/config.xml
+            echo "standalone/config.xml version: ${CUR_VER} -> ${NEW_VER}"
+          else
+            echo "standalone/config.xml version already ${CUR_VER}, nothing to sync"
+          fi
+
+      - name: Determine app metadata for release notes
+        run: |
+          set -euo pipefail
+          APP_ID=$(sed -n 's/.*<tizen:application[^>]*id="\([^"]*\)".*/\1/p' standalone/config.xml | head -n1)
+          APP_NAME=$(echo "$APP_ID" | sed -n 's/^[^.]*\.\(.*\)$/\1/p')
+          echo "APP_ID=${APP_ID:-unknown}" >> $GITHUB_ENV
+          echo "APP_NAME=${APP_NAME:-unknown}" >> $GITHUB_ENV
+
+      # ----------------------------
+      # Build the regular mod + DIAL service — the standalone service wraps
+      # dist/service.js, so it must exist before the standalone service builds.
+      # ----------------------------
+      - name: Build mods (userScript.js)
+        working-directory: mods
+        run: |
+          set -euo pipefail
+          npm ci
+          npx rollup -c
+
+      - name: Build service (service.js)
+        working-directory: service
+        run: |
+          set -euo pipefail
+          npm ci
+          npx rollup -c
+
+      # ----------------------------
+      # Build the standalone service
+      # ----------------------------
+      - name: Build standalone service
+        working-directory: standalone/service
+        run: |
+          set -euo pipefail
+          npm install
+          npm install -g @vercel/ncc
+          npm run build
+          rm -rf node_modules transpiled
+
+      # ----------------------------
+      # Sign and package the standalone app with Tizen Studio
+      # ----------------------------
+      - name: Download Tizen Studio CLI
+        run: |
+          set -euo pipefail
+          curl -fL -o tizen-installer "https://download.tizen.org/sdk/Installer/tizen-studio_${TIZEN_STUDIO_VER}/web-cli_Tizen_Studio_${TIZEN_STUDIO_VER}_ubuntu-64.bin"
+          chmod +x tizen-installer
+
+      - name: Install Tizen Studio CLI
+        run: |
+          set -euo pipefail
+          ./tizen-installer --accept-license "${GITHUB_WORKSPACE}/tizen-studio"
+          rm ./tizen-installer
+          echo "${GITHUB_WORKSPACE}/tizen-studio/tools/ide/bin" >> $GITHUB_PATH
+
+      - name: Configure certificate profile
+        env:
+          AUTHOR_P12_B64: ${{ secrets.TIZEN_AUTHOR_KEY }}
+          AUTHOR_P12_PASSWORD: ${{ secrets.TIZEN_AUTHOR_KEY_PW }}
+        run: |
+          set -euo pipefail
+          mkdir -p "${GITHUB_WORKSPACE}/tizen-data/keystore/author"
+          mkdir -p "${GITHUB_WORKSPACE}/tizen-data/profile"
+          echo "$AUTHOR_P12_B64" | base64 -d > "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12"
+
+          echo "Author cert encryption before conversion:"
+          openssl pkcs12 -info -in "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12" -passin env:AUTHOR_P12_PASSWORD -noout 2>&1 | grep -i "pbe\|cipher\|mac" || true
+
+          # Tizen Studio's bundled Java signing tool is old and can fail to read a
+          # PKCS#12 file encrypted with the modern AES-256 cipher OpenSSL 3.x (the
+          # default everywhere since ~2021) uses by default — throwing a generic,
+          # misleading "Invalid password" even when the password is correct. Both
+          # node-forge (what tizenjs used) and modern OpenSSL read AES-256 p12s
+          # fine, so this wouldn't have surfaced until switching to Tizen Studio's
+          # own tooling. Re-encrypt with the older, broadly-compatible cipher
+          # in-place — same password, same cert/key contents, just an older wrapper.
+          openssl pkcs12 -legacy -in "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12" -out /tmp/author-intermediate.pem -nodes -passin env:AUTHOR_P12_PASSWORD
+          openssl pkcs12 -export -legacy -in /tmp/author-intermediate.pem -passout env:AUTHOR_P12_PASSWORD -out "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12" -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -macalg sha1
+          rm -f /tmp/author-intermediate.pem
+
+          echo "Author cert encryption after conversion:"
+          openssl pkcs12 -info -in "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12" -passin env:AUTHOR_P12_PASSWORD -noout 2>&1 | grep -i "pbe\|cipher\|mac" || true
+
+          cp .github/assets/profiles.xml "${GITHUB_WORKSPACE}/tizen-data/profile/profiles.xml"
+          python3 -c "from pathlib import Path; import os; from xml.sax.saxutils import escape; p=Path(os.environ['GITHUB_WORKSPACE'])/'tizen-data/profile/profiles.xml'; t=p.read_text(); t=t.replace('\$GITHUB_WORKSPACE', os.environ['GITHUB_WORKSPACE']).replace('\$KEY_PW', escape(os.environ['AUTHOR_P12_PASSWORD'], {'\"':'&quot;'})); p.write_text(t)"
+
+          tizen cli-config "profiles.path=${GITHUB_WORKSPACE}/tizen-data/profile/profiles.xml"
+
+      - name: Build web app
+        working-directory: standalone
+        run: >
+          tizen build-web
+          -e "service/index.js"
+          -e "service/injector.js"
+          -e "service/bootstrap.js"
+          -e "service/build-service.js"
+          -e "service/package.json"
+          -e "service/package-lock.json"
+          -e "service/node_modules"
+          -e "release"
+
+      - name: Package WGT
+        working-directory: standalone
+        run: |
+          set -euo pipefail
+          tizen package -t wgt -s TizenTubeStandalone -- ./
+          mkdir -p release
+          cp *.wgt release/TizenTube.wgt
+
+      - name: Show Tizen CLI log on failure
+        if: failure()
+        run: |
+          LOG_PATH="${GITHUB_WORKSPACE}/tizen-studio-data/cli/logs/cli.log"
+          if [ -f "$LOG_PATH" ]; then
+            echo "--- tizen cli.log ---"
+            cat "$LOG_PATH"
+          else
+            echo "No cli.log found at $LOG_PATH"
+          fi
+
+      - name: Upload TizenTube Standalone artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: TizenTube-Standalone-${{ env.RELEASE_SHA }}.wgt
+          path: standalone/release/TizenTube.wgt
+
+      - name: Release TizenTube Standalone
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ env.RELEASE_VERSION }}
+          target_commitish: ${{ env.RELEASE_SHA }}
+          body: |
+            TizenTube Standalone build from commit `${{ env.RELEASE_SHA }}`, version-synced with the userscript.
+            TBI_METADATA: {"appId":"${{ env.APP_ID }}","appName":"${{ env.APP_NAME }}"}
+          files: |
+            standalone/release/*