Harden NDI packaging and repository compliance

.github/workflows/central-staging.yml

@@ -3,21 +3,6 @@ name: Maven Central staging
 on:
   workflow_dispatch:
 
-  push:
-    branches:
-      - feature/central-publishing
-    paths:
-      - ".github/workflows/central-staging.yml"
-      - '.github/workflows/g\+\+-faker.py'
-      - "build.gradle.kts"
-      - "settings.gradle.kts"
-      - "gradle/**"
-      - "gradlew"
-      - "gradlew.bat"
-      - "devolay-java/**"
-      - "devolay-natives/**"
-      - "jreleaser.yml"
-
   pull_request:
     paths:
       - ".github/workflows/central-staging.yml"

.github/workflows/g++-faker.py

@@ -1,4 +1,6 @@
 #!/bin/python3
+# This file has been modified from the original WalkerKnapp/devolay version by the vicvalentim/devolay community-maintained fork (2026).
+
 
 import subprocess
 import sys

.github/workflows/gradle.yml

@@ -1,96 +1,162 @@
+# This file has been modified from the original WalkerKnapp/devolay version by the vicvalentim/devolay community-maintained fork (2026).
+
 name: Java CI with Gradle
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+on:
+  push:
+  pull_request:
 
 permissions:
   contents: read
 
-on: [ push, pull_request ]
+concurrency:
+  group: java-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  JAVA_VERSION: "11"
+  NATIVE_JAR: >-
+    devolay-natives/build/tmp/assembleNativeArtifacts/devolay-native-artifacts.jar
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  linux-windows:
+    name: Linux and Windows native build
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: gradle
+
+      - name: Install native toolchains
+        run: |
+          set -euo pipefail
+
+          sudo apt-get update
+          sudo apt-get install -y \
+            gcc-multilib \
+            g++-multilib \
+            mingw-w64 \
+            unzip
+
+          chmod +x gradlew
+          chmod +x .github/workflows/g++-faker.py
+
+          sudo ln -sf \
+            "$GITHUB_WORKSPACE/.github/workflows/g++-faker.py" \
+            /usr/bin/i686-w64-mingw32-g++-faker
+
+          sudo ln -sf \
+            "$GITHUB_WORKSPACE/.github/workflows/g++-faker.py" \
+            /usr/bin/x86_64-w64-mingw32-g++-faker
+
+      - name: Build Linux and Windows natives
+        run: |
+          set -euo pipefail
+
+          ./gradlew \
+            --no-daemon \
+            :devolay-natives:assembleNativeArtifacts \
+            --rerun-tasks
+
+      - name: Validate Linux and Windows natives
+        run: |
+          set -euo pipefail
+
+          test -f "$NATIVE_JAR"
+
+          entries="$(jar tf "$NATIVE_JAR")"
+          printf '%s\n' "$entries"
+
+          expected_directories=(
+            "natives/linux/x86"
+            "natives/linux/x86-64"
+            "natives/windows/x86"
+            "natives/windows/x86-64"
+          )
+
+          for directory in "${expected_directories[@]}"; do
+            if ! grep -Eq \
+              "^${directory}/[^/]+\.(so|dll)$" \
+              <<<"$entries"; then
+              echo "Missing native binary in ${directory}" >&2
+              exit 1
+            fi
+          done
+
+          if grep -Eiq \
+            'libndi|integrated|\.dwarf$|\.debug$' \
+            <<<"$entries"; then
+            echo "Forbidden file found in native artifact." >&2
+            exit 1
+          fi
+
+  macos:
+    name: macOS and Java build
+    runs-on: macos-15
 
     steps:
-    - name: Install Dependencies
-      run: sudo apt update && sudo apt install -y mingw-w64 bison flex texinfo unzip help2man libtool-bin libncurses5-dev libncursesw5-dev p7zip-full cmake python3
-
-    - name: Install innoextract
-      run: wget https://constexpr.org/innoextract/files/innoextract-1.9-linux.tar.xz && sudo tar --directory=/opt -xvf innoextract-1.9-linux.tar.xz
-
-    - name: Set up JDK 17
-      uses: actions/setup-java@v5
-      with:
-        java-version: '17'
-        distribution: 'temurin'
-
-    - name: Setup Android NDK
-      id: setup-ndk
-      uses: nttld/setup-ndk@v1
-      with:
-        ndk-version: r25c
-        link-to-sdk: true
-        local-cache: true
-
-    - name: Finish NDK Setup
-      run: |
-        cd "$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin"
-        rm llvm-strip
-        ln -s llvm-objcopy llvm-strip
-        rm ld
-        ln -s lld ld
-      env:
-        ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
-
-    - name: Set up JDK 11
-      uses: actions/setup-java@v5
-      with:
-        java-version: '11'
-        distribution: 'temurin'
-
-    - uses: actions/checkout@v7
-
-    - name: Create dummy mingw
-      run: |
-        sudo ln -sf "$(pwd)/.github/workflows/g++-faker.py" "/usr/bin/i686-w64-mingw32-g++-faker"
-        sudo ln -sf "$(pwd)/.github/workflows/g++-faker.py" "/usr/bin/x86_64-w64-mingw32-g++-faker"
-
-    - uses: actions/cache@v4
-      id: cachetoolchain
-      with:
-        path: osxcross
-        key: ${{ runner.os }}-osxtoolchain
-
-    # Setup osxcross, as detailed here: https://github.com/andrew-d/docker-osxcross/blob/master/Dockerfile
-    - name: Setup OSXCross
-      if: steps.cachetoolchain.outputs.cache-hit != 'true'
-      run: |
-        git clone -n https://github.com/tpoechtrager/osxcross.git
-        cd osxcross
-        git checkout 364703ca0962c4a12688daf8758802a5df9e3221
-        sudo apt update
-        sudo ./tools/get_dependencies.sh
-        curl -L -o ./tarballs/MacOSX10.15.sdk.tar.xz https://github.com/xorrior/osxsdk/raw/master/MacOSX10.15.sdk.tar.xz
-        PORTABLE=true UNATTENDED=true ./build.sh
-        PORTABLE=true UNATTENDED=true ./build_binutils.sh
-    - name: Add OSXCross to path
-      run: |
-        export PATH=$PATH:./osxcross/target/bin
-
-    - name: Grant execute permission for gradlew
-      run: chmod +x gradlew
-    - name: Build with Gradle
-      run: ./gradlew publishToMavenLocal "-DandroidNdk=$ANDROID_NDK_HOME"
-      env:
-        PGP_KEY: ${{ secrets.PGP_KEY }}
-        PGP_KEY_ID: ${{ secrets.PGP_KEY_ID }}
-        PGP_PASSWORD: ${{ secrets.PGP_PASSWORD }}
-        ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
-
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v7
-      with:
-        name: build-artifacts
-        path: devolay-java/build/libs
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: gradle
+
+      - name: Build
+        run: |
+          set -euo pipefail
+
+          chmod +x gradlew
+
+          ./gradlew \
+            --no-daemon \
+            clean \
+            build \
+            2>&1 | tee build.log
+
+      - name: Verify runtime-separated build
+        run: |
+          set -euo pipefail
+
+          if grep -Eq \
+            'Adding NDI lib|Could not find NDI lib|No NDI path specified' \
+            build.log; then
+            echo "Unexpected integrated NDI activity in normal build." >&2
+            exit 1
+          fi
+
+          test -f "$NATIVE_JAR"
+
+          entries="$(jar tf "$NATIVE_JAR")"
+          printf '%s\n' "$entries"
+
+          expected_directories=(
+            "natives/macos/x86-64"
+            "natives/macos/aarch64"
+          )
+
+          for directory in "${expected_directories[@]}"; do
+            if ! grep -Eq \
+              "^${directory}/[^/]+\.dylib$" \
+              <<<"$entries"; then
+              echo "Missing native binary in ${directory}" >&2
+              exit 1
+            fi
+          done
+
+          if grep -Eiq \
+            'libndi|integrated|\.dwarf$|\.debug$' \
+            <<<"$entries"; then
+            echo "Forbidden file found in native artifact." >&2
+            exit 1
+          fi

.gitignore

@@ -1,3 +1,5 @@
+# This file has been modified from the original WalkerKnapp/devolay version by the vicvalentim/devolay community-maintained fork (2026).
+
 */build/
 /.gradle/
 /.idea/