examples/ -> cpp-example-collection, ci safety (#83)

Author: stephen-derosa

.github/workflows/builds.yml

@@ -6,7 +6,7 @@ on:
     paths:
       - src/**
       - include/**
-      - examples/**
+      - cpp-example-collection/**
       - bridge/**
       - client-sdk-rust/**
       - CMakeLists.txt
@@ -21,7 +21,7 @@ on:
     paths:
       - src/**
       - include/**
-      - examples/**
+      - cpp-example-collection/**
       - bridge/**
       - client-sdk-rust/**
       - CMakeLists.txt
@@ -38,12 +38,22 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  # Pinned commit for cpp-example-collection smoke build (https://github.com/livekit-examples/cpp-example-collection)
+  CPP_EXAMPLE_COLLECTION_REF: f231c0c75028d1dcf13edcecd369d030d2c7c8d4
   # vcpkg binary caching for Windows
   VCPKG_DEFAULT_TRIPLET: x64-windows-static-md
   VCPKG_DEFAULT_HOST_TRIPLET: x64-windows-static-md
   VCPKG_TARGET_TRIPLET: x64-windows-static-md
 
 jobs:
+  license-check:
+    name: License Check
+    uses: ./.github/workflows/license_check.yml
+
+  pin-check:
+    name: Pin Check
+    uses: ./.github/workflows/pin_check.yml
+
   build:
     strategy:
       fail-fast: false
@@ -75,23 +85,23 @@ jobs:
 
     steps:
       - name: Checkout (with submodules)
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           submodules: recursive
           fetch-depth: 0
 
       # ---------- vcpkg caching for Windows ----------
       - name: Export GitHub Actions cache environment variables
         if: runner.os == 'Windows'
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
             core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
 
       - name: Setup vcpkg (Windows only)
         if: runner.os == 'Windows'
-        uses: lukka/run-vcpkg@v11
+        uses: lukka/run-vcpkg@6fe69898af670ac05f4a8427cc5cff4fb361cee5 # v11.5
         with:
           vcpkgGitCommitId: 'fb87e2bb3fe69e16c224989acb5a61349166c782'
 
@@ -123,15 +133,17 @@ jobs:
 
       # ---------- Rust toolchain ----------
       - name: Install Rust (stable)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+        with:
+          toolchain: stable
 
       - name: Install Rust cross-compilation target
         if: matrix.name == 'macos-x64'
         run: rustup target add x86_64-apple-darwin
 
       # ---------- Cache Cargo ----------
       - name: Cache Cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo/registry
@@ -140,7 +152,7 @@ jobs:
           restore-keys: ${{ runner.os }}-${{ matrix.name }}-cargo-reg-
 
       - name: Cache Cargo target
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: client-sdk-rust/target
           key: ${{ runner.os }}-${{ matrix.name }}-cargo-target-${{ hashFiles('**/Cargo.lock') }}
@@ -169,28 +181,46 @@ jobs:
         shell: pwsh
         run: ${{ matrix.build_cmd }}
 
-      # ---------- Smoke test examples ----------
+      # ---------- Smoke test cpp-example-collection binaries ----------
+      # Built under cpp-example-collection-build/ (not build-dir/bin). Visual Studio
+      # multi-config places executables in per-target Release/ (or Debug/) subdirs.
       - name: Smoke test examples (Unix)
         if: runner.os != 'Windows'
         shell: bash
         run: |
           set -x
           failed=false
-          for exe in SimpleRoom SimpleRpc SimpleDataStream; do
-            exe_path="${{ matrix.build_dir }}/bin/${exe}"
-            if [[ -x "${exe_path}" ]]; then
-              echo "Testing ${exe}..."
-              output=$("${exe_path}" --help 2>&1) || true
-              if [[ -z "${output}" ]]; then
-                echo "ERROR: ${exe} produced no output"
-                failed=true
-              else
-                echo "${output}"
-                echo "${exe} ran successfully"
-              fi
-            else
-              echo "ERROR: ${exe_path} not found or not executable"
+          examples_base="${{ matrix.build_dir }}/cpp-example-collection-build"
+          resolve_exe() {
+            local dir="$1" name="$2"
+            local p="${examples_base}/${dir}/${name}"
+            if [[ -x "${p}" ]]; then
+              printf '%s' "${p}"
+              return 0
+            fi
+            p="${examples_base}/${dir}/Release/${name}"
+            if [[ -x "${p}" ]]; then
+              printf '%s' "${p}"
+              return 0
+            fi
+            return 1
+          }
+          for pair in "SimpleRoom:simple_room" "SimpleRpc:simple_rpc" "SimpleDataStream:simple_data_stream"; do
+            exe="${pair%%:*}"
+            dir="${pair#*:}"
+            if ! exe_path="$(resolve_exe "${dir}" "${exe}")"; then
+              echo "ERROR: ${exe} not found under ${examples_base}/${dir}/"
+              failed=true
+              continue
+            fi
+            echo "Testing ${exe}..."
+            output=$("${exe_path}" --help 2>&1) || true
+            if [[ -z "${output}" ]]; then
+              echo "ERROR: ${exe} produced no output"
               failed=true
+            else
+              echo "${output}"
+              echo "${exe} ran successfully"
             fi
           done
           if [[ "$failed" == "true" ]]; then exit 1; fi
@@ -200,12 +230,30 @@ jobs:
         shell: pwsh
         run: |
           $ErrorActionPreference = 'Continue'
-          $examples = @('SimpleRoom', 'SimpleRpc', 'SimpleDataStream')
+          $examplesBase = "${{ matrix.build_dir }}/cpp-example-collection-build"
+          $examples = @(
+            @{ Name = 'SimpleRoom'; Dir = 'simple_room' },
+            @{ Name = 'SimpleRpc'; Dir = 'simple_rpc' },
+            @{ Name = 'SimpleDataStream'; Dir = 'simple_data_stream' }
+          )
           $failed = $false
-          foreach ($exe in $examples) {
-            $exePath = "${{ matrix.build_dir }}/bin/${exe}.exe"
-            if (Test-Path $exePath) {
-              Write-Host "Testing ${exe}..."
+          foreach ($ex in $examples) {
+            $name = $ex.Name
+            $dir = $ex.Dir
+            $inDir = Join-Path $examplesBase $dir
+            $candidates = @(
+              (Join-Path $inDir "$name.exe"),
+              (Join-Path (Join-Path $inDir 'Release') "$name.exe")
+            )
+            $exePath = $null
+            foreach ($p in $candidates) {
+              if (Test-Path -LiteralPath $p) {
+                $exePath = $p
+                break
+              }
+            }
+            if ($null -ne $exePath) {
+              Write-Host "Testing ${name}..."
               $pinfo = New-Object System.Diagnostics.ProcessStartInfo
               $pinfo.FileName = $exePath
               $pinfo.Arguments = "--help"
@@ -220,22 +268,22 @@ jobs:
               $p.WaitForExit()
               $output = $stdout + $stderr
               if ([string]::IsNullOrWhiteSpace($output)) {
-                Write-Host "ERROR: ${exe} produced no output"
+                Write-Host "ERROR: ${name} produced no output"
                 $failed = $true
               } else {
                 Write-Host $output
-                Write-Host "${exe} ran successfully"
+                Write-Host "${name} ran successfully"
               }
             } else {
-              Write-Host "ERROR: ${exePath} not found"
+              Write-Host "ERROR: ${name} not found under ${examplesBase}/${dir}/"
               $failed = $true
             }
           }
           if ($failed) { exit 1 } else { exit 0 }
 
       # ---------- Upload artifacts ----------
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: livekit-sdk-${{ matrix.name }}
           path: |
@@ -261,13 +309,13 @@ jobs:
 
     steps:
       - name: Checkout (with submodules)
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           submodules: recursive
           fetch-depth: 0
 
-      - name: Free disk space (GitHub-hosted runner)
-        uses: jlumbroso/free-disk-space@v1.3.1
+      - name: Free disk space
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           tool-cache: false
           android: true
@@ -278,7 +326,7 @@ jobs:
           swap-storage: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Build Docker image
         run: |
@@ -299,7 +347,7 @@ jobs:
           docker save livekit-cpp-sdk-x64:${{ github.sha }} | gzip > livekit-cpp-sdk-x64-docker.tar.gz
 
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: livekit-cpp-sdk-docker-x64
           path: livekit-cpp-sdk-x64-docker.tar.gz
@@ -311,13 +359,13 @@ jobs:
 
     steps:
       - name: Checkout (with submodules)
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           submodules: recursive
           fetch-depth: 0
 
-      - name: Free disk space (GitHub-hosted runner)
-        uses: jlumbroso/free-disk-space@v1.3.1
+      - name: Free disk space
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           tool-cache: false
           android: true
@@ -328,7 +376,7 @@ jobs:
           swap-storage: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Build Docker image
         run: |
@@ -349,7 +397,7 @@ jobs:
           docker save livekit-cpp-sdk:${{ github.sha }} | gzip > livekit-cpp-sdk-arm64-docker.tar.gz
 
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: livekit-cpp-sdk-docker-arm64
           path: livekit-cpp-sdk-arm64-docker.tar.gz
@@ -362,7 +410,7 @@ jobs:
 
     steps:
       - name: Download Docker image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: livekit-cpp-sdk-docker-arm64
 
@@ -371,11 +419,12 @@ jobs:
 
       - name: Build cpp-example-collection against installed SDK
         run: |
-          docker run --rm livekit-cpp-sdk:${{ github.sha }} bash -lc '
+          docker run -e CPP_EX_REF="${{ env.CPP_EXAMPLE_COLLECTION_REF }}" --rm livekit-cpp-sdk:${{ github.sha }} bash -lc '
             set -euxo pipefail
             git clone https://github.com/livekit-examples/cpp-example-collection.git /tmp/cpp-example-collection
             cd /tmp/cpp-example-collection
-            git checkout f231c0c75028d1dcf13edcecd369d030d2c7c8d4
+            git fetch --depth 1 origin "$CPP_EX_REF"
+            git checkout "$CPP_EX_REF"
             cmake -S . -B build -DLIVEKIT_LOCAL_SDK_DIR=/opt/livekit-sdk
             cmake --build build --parallel
           '
@@ -387,7 +436,7 @@ jobs:
 
     steps:
       - name: Download Docker image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: livekit-cpp-sdk-docker-x64
 
@@ -396,11 +445,12 @@ jobs:
 
       - name: Build cpp-example-collection against installed SDK
         run: |
-          docker run --rm livekit-cpp-sdk-x64:${{ github.sha }} bash -lc '
+          docker run -e CPP_EX_REF="${{ env.CPP_EXAMPLE_COLLECTION_REF }}" --rm livekit-cpp-sdk-x64:${{ github.sha }} bash -lc '
             set -euxo pipefail
             git clone https://github.com/livekit-examples/cpp-example-collection.git /tmp/cpp-example-collection
             cd /tmp/cpp-example-collection
-            git checkout f231c0c75028d1dcf13edcecd369d030d2c7c8d4
+            git fetch --depth 1 origin "$CPP_EX_REF"
+            git checkout "$CPP_EX_REF"
             cmake -S . -B build -DLIVEKIT_LOCAL_SDK_DIR=/opt/livekit-sdk
             cmake --build build --parallel
           '

.github/workflows/license_check.yml

@@ -0,0 +1,50 @@
+name: License Check
+on:
+  workflow_call: {}
+  workflow_dispatch: {}
+
+jobs:
+  license-check:
+    name: License Check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Check License Headers
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          search_dirs=()
+          for dir in src include bridge cpp-example-collection; do
+            if [[ -d "$dir" ]]; then
+              search_dirs+=("$dir")
+            fi
+          done
+
+          if [[ ${#search_dirs[@]} -eq 0 ]]; then
+            echo "No source directories found to validate."
+            exit 1
+          fi
+
+          mapfile -t files < <(find "${search_dirs[@]}" -type f \( -name '*.cpp' -o -name '*.h' -o -name '*.hpp' \) | LC_ALL=C sort)
+          if [[ ${#files[@]} -eq 0 ]]; then
+            echo "No source files found to validate."
+            exit 1
+          fi
+
+          failed=0
+          for file in "${files[@]}"; do
+            if ! grep -Eq 'Copyright [0-9]{4}(-[0-9]{4})? LiveKit(, Inc\.)?$' "$file"; then
+              echo "Missing or unexpected copyright header in $file"
+              failed=1
+            fi
+            if ! grep -Fq 'Licensed under the Apache License, Version 2.0' "$file"; then
+              echo "Missing Apache 2.0 header in $file"
+              failed=1
+            fi
+          done
+
+          exit "$failed"