ci(seeds): add dev-seeds build and seed tests workflows

.github/workflows/dev_seeds_release.yml

@@ -0,0 +1,198 @@
+name: Dev Seeds build
+
+# Builds the Go backend from the advanced-transfer-seeds work and publishes the
+# compressed binaries to the `dev-seeds` branch, so testers can download a
+# ready-to-run build without cutting a release.
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref (branch, tag or SHA) to build
+        required: true
+        default: feat/advanced-transfer-seeds
+      with_frontend:
+        description: Embed the rolling frontend into the binary
+        type: boolean
+        default: true
+      publish:
+        description: Publish the artifacts to the dev-seeds branch
+        type: boolean
+        default: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+env:
+  GO_VERSION: "1.27.1"
+  TARGET_BRANCH: dev-seeds
+
+jobs:
+  build:
+    name: Build ${{ matrix.target }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: linux-amd64-musl
+            hash: md5-linux-amd64-musl
+            flags: "-ldflags=-linkmode external -extldflags '-static -fpic'"
+            musl: true
+          - target: linux-arm64-musl
+            hash: md5-linux-arm64-musl
+            flags: "-ldflags=-linkmode external -extldflags '-static -fpic'"
+            musl: true
+          - target: windows-amd64
+            hash: md5-windows-amd64
+            flags: "-ldflags="
+            musl: false
+          - target: darwin-arm64
+            hash: md5-darwin-arm64
+            flags: "-ldflags="
+            musl: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Setup web
+        if: ${{ inputs.with_frontend }}
+        run: bash build.sh dev web
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          FRONTEND_REPO: ${{ vars.FRONTEND_REPO }}
+
+      - name: Build
+        uses: OpenListTeam/cgo-actions@d760a8ec1a6be1f8ec181229e11cb2671797f9e0 # v1.3.0
+        with:
+          targets: ${{ matrix.target }}
+          flags: ${{ matrix.flags }}
+          static-link-for-musl: true
+          musl-target-format: $os-$musl-$arch
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          out-dir: build
+          output: openlist-$target$ext
+          musl-base-url: "https://github.com/OpenListTeam/musl-compilers/releases/latest/download/"
+          x-flags: |
+            github.com/OpenListTeam/OpenList/v4/internal/conf.BuiltAt=$built_at
+            github.com/OpenListTeam/OpenList/v4/internal/conf.GitAuthor=The OpenList Projects Contributors <noreply@oplist.org>
+            github.com/OpenListTeam/OpenList/v4/internal/conf.GitCommit=$git_commit
+            github.com/OpenListTeam/OpenList/v4/internal/conf.Version=dev-seeds
+            github.com/OpenListTeam/OpenList/v4/internal/conf.WebVersion=rolling
+
+      - name: Verify musl binary is static
+        if: matrix.musl
+        run: |
+          set -euo pipefail
+          binary="$(find build -maxdepth 1 -type f -name 'openlist-linux-*' | head -n 1)"
+          if [ -z "$binary" ]; then
+            echo "No musl binary found"
+            exit 1
+          fi
+          if readelf -l "$binary" | grep -q "Requesting program interpreter"; then
+            echo "Dynamic binary detected: $binary"
+            readelf -l "$binary" | grep "Requesting program interpreter" || true
+            exit 1
+          fi
+
+      - name: Compress
+        run: bash build.sh zip ${{ matrix.hash }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Write build metadata
+        run: |
+          set -euo pipefail
+          cat > "build/compress/BUILD_INFO-${{ matrix.target }}.txt" <<EOF
+          ref: ${{ inputs.ref }}
+          target: ${{ matrix.target }}
+          commit: $(git rev-parse HEAD)
+          built_at: $(date -u +%Y-%m-%dT%H:%M:%SZ)
+          frontend_embedded: ${{ inputs.with_frontend }}
+          run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          EOF
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: dev-seeds-${{ matrix.target }}
+          path: build/compress/*
+          compression-level: 0
+          if-no-files-found: error
+
+  publish:
+    name: Publish to dev-seeds
+    needs: build
+    if: ${{ inputs.publish }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source metadata
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 1
+          path: .source
+
+      - name: Download artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Publish to branch
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REF: ${{ inputs.ref }}
+          TARGET_BRANCH: dev-seeds
+        run: |
+          set -euo pipefail
+
+          SOURCE_SHA="$(git -C .source rev-parse HEAD)"
+          PUBLISH_DIR="$RUNNER_TEMP/dev-seeds"
+          rm -rf "$PUBLISH_DIR"
+          mkdir -p "$PUBLISH_DIR"
+          cd "$PUBLISH_DIR"
+
+          git init -q
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          if [ -z "$(find "$GITHUB_WORKSPACE/artifacts" -type f -print -quit)" ]; then
+            echo "No artifacts to publish"
+            exit 1
+          fi
+          cp -R "$GITHUB_WORKSPACE/artifacts/." .
+
+          {
+            echo "ref: ${REF}"
+            echo "commit: ${SOURCE_SHA}"
+            echo "built_at: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+            echo "frontend_embedded: ${{ inputs.with_frontend }}"
+            echo "workflow_run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            echo
+            echo "Contents are generated by .github/workflows/dev_seeds_release.yml."
+            echo "Download the archive for your platform; checksums are in the md5-*.txt files."
+          } > BUILD_INFO.txt
+
+          git symbolic-ref HEAD "refs/heads/$TARGET_BRANCH"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No changes to publish"
+            exit 0
+          fi
+          git commit -q -m "dev-seeds: ${REF} @ ${SOURCE_SHA:0:12}"
+          git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git push --force origin "$TARGET_BRANCH"
+
+          echo "Published ${TARGET_BRANCH} at ${SOURCE_SHA}"

.github/workflows/seed-tests.yml

@@ -0,0 +1,59 @@
+name: Seed tests
+
+# Focused regression pipeline for the advanced transfer seed feature:
+# codec/security tests, handler-level seed tests, vet and a full build.
+on:
+  pull_request:
+    paths:
+      - "pkg/torrent/**"
+      - "server/handles/torrent*.go"
+      - "internal/fs/seed_generate.go"
+      - "internal/driver/seed_stream.go"
+      - "drivers/*/seed_rapid.go"
+      - ".github/workflows/seed-tests.yml"
+  push:
+    branches:
+      - main
+      - feat/advanced-transfer-seeds
+    paths:
+      - "pkg/torrent/**"
+      - "server/handles/torrent*.go"
+      - "internal/fs/seed_generate.go"
+      - "internal/driver/seed_stream.go"
+      - "drivers/*/seed_rapid.go"
+      - ".github/workflows/seed-tests.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: seed-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  go-seed-tests:
+    name: Go seed tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version: "1.27.1"
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Test torrent codec and security
+        run: go test ./pkg/torrent/... -count=1 -race -shuffle=on
+
+      - name: Test seed handlers
+        run: go test ./server/handles/ -run 'Seed|Torrent' -count=1 -v
+
+      - name: Vet seed packages
+        run: go vet ./pkg/torrent/... ./server/handles/
+
+      - name: Build backend
+        run: go build ./...