Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
134 changes: 134 additions & 0 deletions .github/workflows/make-release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,134 @@
name: C++ SDK
on:
push:
branches: ["main"]
tags:
- "cpp-sdks/livekit-cpp@*"
workflow_dispatch:
workflow_call:
inputs:
tag:
required: false
type: string

env:
BUILD_TYPE: Release
TAG_NAME: ${{ inputs.tag || github.ref_name }}

jobs:
build:
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
name: linux-x86_64
generator: Ninja
- os: windows-latest
name: windows-x86_64
generator: "Visual Studio 17 2022"
- os: macos-latest
name: macos-arm64
generator: Ninja
macos_arch: "arm64"
# optionally add x86_64 mac build if you need it:
# - os: macos-latest
# name: macos-x86_64
# generator: Ninja
# macos_arch: "x86_64"

name: Build (${{ matrix.name }})
runs-on: ${{ matrix.os }}

steps:
- uses: actions/checkout@v4
with:
submodules: true

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable

- name: Install Protoc
uses: arduino/setup-protoc@v2
with:
version: "25.2"
repo-token: ${{ secrets.GITHUB_TOKEN }}

- name: Install deps (Ubuntu)
if: startsWith(matrix.os, 'ubuntu')
run: |
sudo apt-get update
sudo apt-get install -y ninja-build cmake pkg-config libprotobuf-dev libssl-dev

- name: Install deps (macOS)
if: startsWith(matrix.os, 'macos')
run: |
brew update
brew install ninja cmake protobuf openssl abseil

- name: Install deps (Windows)
if: startsWith(matrix.os, 'windows')
shell: pwsh
run: |
choco install ninja cmake -y

- name: Build + bundle
shell: bash
run: |
chmod +x ./build.sh
args=(release -G "${{ matrix.generator }}" \
--version "${{ steps.ver.outputs.version }}" \
--bundle --prefix "sdk-out/livekit-sdk-${{ matrix.name }}")
if [[ "${{ runner.os }}" == "macOS" && -n "${{ matrix.macos_arch }}" ]]; then
args+=(--macos-arch "${{ matrix.macos_arch }}")
fi
./build.sh "${args[@]}"

- name: Archive (Unix)
if: ${{ !startsWith(matrix.os, 'windows') }}
shell: bash
run: |
tar -czf "livekit-sdk-${{ matrix.name }}.tar.gz" -C sdk-out "livekit-sdk-${{ matrix.name }}"

- name: Archive (Windows)
if: startsWith(matrix.os, 'windows')
shell: pwsh
run: |
Compress-Archive -Path "sdk-out/livekit-sdk-${{ matrix.name }}/*" -DestinationPath "livekit-sdk-${{ matrix.name }}.zip"

- name: Upload build artifact
uses: actions/upload-artifact@v4
with:
name: sdk-builds-${{ matrix.name }}
path: |
livekit-sdk-${{ matrix.name }}.tar.gz
livekit-sdk-${{ matrix.name }}.zip

release:
Comment on lines +20 to +107

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 3 days ago

In general, the problem is fixed by explicitly defining a permissions: block so that the GITHUB_TOKEN is granted only the scopes needed by the workflow/job. For this workflow, the build job needs only read access to the repository contents (for actions/checkout and any token-based access used by other actions), while the release job already declares contents: write because it creates and uploads a GitHub Release.

The least intrusive fix that preserves existing behavior is to add a top-level permissions: block after the on: section, setting contents: read. This establishes a minimal default for all jobs. The release job already overrides this with its own permissions: block, so it will remain unchanged. No other functionality, steps, or actions need to be modified.

Concretely:

  • Edit .github/workflows/make-release.yml.
  • After the on: block (after line 13 in the snippet), add:
permissions:
  contents: read
  • Leave the release job’s existing permissions: block as-is, since it correctly grants contents: write for release creation and uploading assets.

No new imports, methods, or additional definitions are required.

Suggested changeset 1
.github/workflows/make-release.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/make-release.yml b/.github/workflows/make-release.yml
--- a/.github/workflows/make-release.yml
+++ b/.github/workflows/make-release.yml
@@ -11,6 +11,9 @@
         required: false
         type: string
 
+permissions:
+  contents: read
+
 env:
   BUILD_TYPE: Release
   TAG_NAME: ${{ inputs.tag || github.ref_name }}
EOF
@@ -11,6 +11,9 @@
required: false
type: string

permissions:
contents: read

env:
BUILD_TYPE: Release
TAG_NAME: ${{ inputs.tag || github.ref_name }}
Copilot is powered by AI and may make mistakes. Always verify output.
name: Release to GH (Draft)
runs-on: ubuntu-latest
needs: build
permissions:
contents: write
if: startsWith(inputs.tag || github.ref_name, 'cpp-sdks/livekit-cpp@')
env:
GH_TOKEN: ${{ github.token }}
steps:
- uses: actions/checkout@v4

- name: Download artifacts
uses: actions/download-artifact@v4
with:
pattern: sdk-builds-*
merge-multiple: true
path: ${{ github.workspace }}/sdk-builds

- name: Create draft release (idempotent)
run: |
gh release view "${{ env.TAG_NAME }}" >/dev/null 2>&1 || \
gh release create "${{ env.TAG_NAME }}" --draft --title "${{ env.TAG_NAME }}" --generate-notes

- name: Upload assets
run: |
gh release upload "${{ env.TAG_NAME }}" ${{ github.workspace }}/sdk-builds/*.zip ${{ github.workspace }}/sdk-builds/*.tar.gz

Loading
Loading