The package workflows' publish steps ran easingthemes/ssh-deploy@main with
the zmrepo SSH key in its environment, and imported the package signing key
with crazy-max/ghaction-import-gpg@v7. A branch or tag is resolved when the
workflow runs, so whoever could move it upstream could run code with those
keys on our next push to master or release-1.38, and publish packages to the
apt and rpm repositories.
Pin each `uses:` to the commit its ref names today, with the ref as a comment
so dependabot keeps updating them. ssh-deploy is pinned to v6.0.1, which main
differs from only in release metadata. GitHub's own actions are pinned too.
utils/check-pinned-actions.py and the CI Pinned Actions workflow fail when a
workflow uses an action by anything but a full commit SHA.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nothing links or dlopens libvlc any more, so the dev package is no
longer a build requirement anywhere: the debian, beowulf, ubuntu and
split-package control files, the podman Containerfile, the redhat and
opensuse specs, the centos CI image, and the five workflows that
installed libvlc-dev. The redhat spec also required vlc-core at
runtime, which was the dlopen target.
Documentation follows: the libVLC source tab section, the macos note
about libVLC not being found, and the WEB_FILTER_SOURCE source-type
list.
Two stale statements nearby are corrected while the files are open. The
Remote source tab still said its RTSP method "may be removed in the
future"; it was removed earlier on this branch. AGENTS.md still listed
RemoteCameraRTSP and LibVLCCamera among the camera classes, both of
which are now gone.
All workflow yaml parses, the three edited rst files render, and the
debian control field structure is unchanged apart from the removed
entries.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Y6FieTwEXuLhhR4e2yiax
Nothing in CI built tests/ at all. The packaging workflows and the -Werror job
all configure with BUILD_TEST_SUITE off, which is why the two Catch2 v2 leftovers
fixed in the previous commit sat there breaking the build unnoticed.
Pinned to ubuntu-24.04 rather than ubuntu-latest because the suite needs Catch2
v3 and noble is what packages it.
Runs the binary rather than ctest. catch_discover_tests does not carry Catch2
tags through as ctest labels, so ctest cannot skip the [notCI] cases that want a
reachable database or a listening socket, and zm_font.cpp loads its fixtures by
relative path so the working directory has to be the one the build copied
tests/data into.
Verified with a fresh out-of-source configure and build using the same commands
as the workflow: 144 test cases, 12480 assertions, exit 0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
