ci: harden the release workflow and keep native caches warm

.github/actions/build-macos-x86_64/action.yml

@@ -27,8 +27,13 @@ runs:
       run: echo "WEBRTC_CACHE_BRANCH=$(sed -n 's|.*<webrtc.branch>branch-heads/\([^<]*\)</webrtc.branch>.*|\1|p' webrtc-jni/pom.xml)" >> "$GITHUB_ENV"
       shell: bash
 
-    - name: Set up WebRTC cache
-      uses: actions/cache@v6
+    # Restored here, saved right after the build below: the post step of
+    # actions/cache only saves when the whole job succeeds, so a failing test
+    # would otherwise throw away a WebRTC build that took the better part of an
+    # hour.
+    - id: webrtc-cache
+      name: Restore WebRTC cache
+      uses: actions/cache/restore@v6
       with:
         path: ~/${{ env.WEBRTC_INSTALL_FOLDER }}
         key: webrtc-${{ env.WEBRTC_CACHE_BRANCH }}-${{ inputs.platform-name }}-${{ hashFiles('webrtc-jni/src/main/cpp/dependencies/webrtc/CMakeLists.txt') }}-${{ hashFiles('webrtc-jni/pom.xml') }}
@@ -38,8 +43,9 @@ runs:
       run: echo "FFMPEG_VERSION=$(sed -n 's|.*<ffmpeg.version>\([^<]*\)</ffmpeg.version>.*|\1|p' webrtc-java-media/pom.xml)" >> "$GITHUB_ENV"
       shell: bash
 
-    - name: Set up FFmpeg cache
-      uses: actions/cache@v6
+    - id: ffmpeg-cache
+      name: Restore FFmpeg cache
+      uses: actions/cache/restore@v6
       with:
         path: ~/ffmpeg
         key: ffmpeg-${{ env.FFMPEG_VERSION }}-${{ inputs.platform-name }}-${{ hashFiles('webrtc-java-media/src/main/cpp/dependencies/ffmpeg/CMakeLists.txt') }}-${{ hashFiles('webrtc-java-media/pom.xml') }}
@@ -80,10 +86,34 @@ runs:
       run: mvn package -DskipTests -Pmacos-cross-x86_64
       shell: bash
 
+    - name: Save WebRTC cache
+      if: steps.webrtc-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v6
+      with:
+        path: ~/${{ env.WEBRTC_INSTALL_FOLDER }}
+        key: ${{ steps.webrtc-cache.outputs.cache-primary-key }}
+
+    - name: Save FFmpeg cache
+      if: steps.ffmpeg-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v6
+      with:
+        path: ~/ffmpeg
+        key: ${{ steps.ffmpeg-cache.outputs.cache-primary-key }}
+
     - name: Test
-      run: JAVA_HOME="${{ steps.jdk-x64.outputs.path }}" mvn -B jar:jar surefire:test -Pmacos-cross-x86_64
+      run: JAVA_HOME="${{ steps.jdk-x64.outputs.path }}" mvn -B jar:jar surefire:test -Pmacos-cross-x86_64 -Dsurefire.timeout=1800
       shell: bash
 
+    # What failed, for runners that cannot be reproduced locally.
+    - name: Upload test reports
+      if: failure()
+      uses: actions/upload-artifact@v7
+      with:
+        name: test-reports-${{ inputs.platform-name }}
+        path: '**/target/surefire-reports/'
+        if-no-files-found: ignore
+        retention-days: 7
+
     - name: Deploy
       if: ${{ github.event_name != 'pull_request' && github.repository == 'devopvoid/webrtc-java' }}
       env:

.github/actions/build/action.yml

@@ -27,8 +27,13 @@ runs:
       run: echo "WEBRTC_CACHE_BRANCH=$(sed -n 's|.*<webrtc.branch>branch-heads/\([^<]*\)</webrtc.branch>.*|\1|p' webrtc-jni/pom.xml)" >> "$GITHUB_ENV"
       shell: bash
 
-    - name: Set up WebRTC cache
-      uses: actions/cache@v6
+    # Restored here, saved right after the build below: the post step of
+    # actions/cache only saves when the whole job succeeds, so a failing test
+    # would otherwise throw away a WebRTC build that took the better part of an
+    # hour.
+    - id: webrtc-cache
+      name: Restore WebRTC cache
+      uses: actions/cache/restore@v6
       with:
         path: ~/${{ env.WEBRTC_INSTALL_FOLDER }}
         key: webrtc-${{ env.WEBRTC_CACHE_BRANCH }}-${{ inputs.platform-name }}-${{ hashFiles('webrtc-jni/src/main/cpp/dependencies/webrtc/CMakeLists.txt') }}-${{ hashFiles('webrtc-jni/pom.xml') }}
@@ -38,8 +43,9 @@ runs:
       run: echo "FFMPEG_VERSION=$(sed -n 's|.*<ffmpeg.version>\([^<]*\)</ffmpeg.version>.*|\1|p' webrtc-java-media/pom.xml)" >> "$GITHUB_ENV"
       shell: bash
 
-    - name: Set up FFmpeg cache
-      uses: actions/cache@v6
+    - id: ffmpeg-cache
+      name: Restore FFmpeg cache
+      uses: actions/cache/restore@v6
       with:
         path: ~/ffmpeg
         key: ffmpeg-${{ env.FFMPEG_VERSION }}-${{ inputs.platform-name }}-${{ hashFiles('webrtc-java-media/src/main/cpp/dependencies/ffmpeg/CMakeLists.txt') }}-${{ hashFiles('webrtc-java-media/pom.xml') }}
@@ -74,11 +80,35 @@ runs:
         fi
       shell: bash
 
+    - name: Save WebRTC cache
+      if: steps.webrtc-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v6
+      with:
+        path: ~/${{ env.WEBRTC_INSTALL_FOLDER }}
+        key: ${{ steps.webrtc-cache.outputs.cache-primary-key }}
+
+    - name: Save FFmpeg cache
+      if: steps.ffmpeg-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v6
+      with:
+        path: ~/ffmpeg
+        key: ${{ steps.ffmpeg-cache.outputs.cache-primary-key }}
+
     - name: Test
       if: ${{ inputs.platform-name != 'linux_arm' && inputs.platform-name != 'linux_arm64' && inputs.platform-name != 'windows_arm64' }}
-      run: mvn -B jar:jar surefire:test
+      run: mvn -B jar:jar surefire:test -Dsurefire.timeout=1800
       shell: bash
 
+    # What failed, for runners that cannot be reproduced locally.
+    - name: Upload test reports
+      if: failure()
+      uses: actions/upload-artifact@v7
+      with:
+        name: test-reports-${{ inputs.platform-name }}
+        path: '**/target/surefire-reports/'
+        if-no-files-found: ignore
+        retention-days: 7
+
     - name: Deploy
       if: ${{ github.event_name != 'pull_request' && github.repository == 'devopvoid/webrtc-java' }}
       env:

.github/actions/prepare-linux/action.yml

@@ -30,20 +30,35 @@ runs:
 
     - name: Install required packages
       run: |
-        sudo apt update
+        sudo apt-get update -q
         # nasm is what FFmpeg assembles its x86 code with.
-        sudo apt install -y binutils cmake git locales lsb-release nasm ninja-build pipewire pipewire-pulse pkg-config python3 python3-setuptools rsync unzip wget xz-utils
+        sudo apt-get install -y -q binutils cmake git locales lsb-release nasm ninja-build pipewire pipewire-pulse pkg-config python3 python3-setuptools rsync unzip wget xz-utils
+      shell: bash
+
+    # Chromium Clang to be used with the clang toolchain file. The JNI code
+    # compiles against the libc++ headers of the WebRTC build, which only
+    # support the Clang that WebRTC branch ships with, so this must be the
+    # package pinned by CLANG_REVISION and CLANG_SUB_REVISION in
+    # tools/clang/scripts/update.py of the webrtc.branch set in
+    # webrtc-jni/pom.xml. Update it whenever that branch changes.
+    - name: Select the Chromium Clang package
+      run: echo "CLANG_PACKAGE=clang-llvmorg-23-init-19482-g53d18800-1.tar.xz" >> "$GITHUB_ENV"
+      shell: bash
 
-        # Chromium Clang to be used with the clang toolchain file. The JNI code
-        # compiles against the libc++ headers of the WebRTC build, which only
-        # support the Clang that WebRTC branch ships with, so this must be the
-        # package pinned by CLANG_REVISION and CLANG_SUB_REVISION in
-        # tools/clang/scripts/update.py of the webrtc.branch set in
-        # webrtc-jni/pom.xml. Update it whenever that branch changes.
-        CLANG_PACKAGE=clang-llvmorg-23-init-19482-g53d18800-1.tar.xz
+    - name: Cache the Chromium Clang package
+      uses: actions/cache@v6
+      with:
+        path: ~/.cache/chromium-clang
+        key: chromium-clang-${{ env.CLANG_PACKAGE }}
+
+    - name: Install Chromium Clang
+      run: |
+        mkdir -p ~/.cache/chromium-clang
+        if [ ! -f ~/.cache/chromium-clang/$CLANG_PACKAGE ]; then
+          wget -q -O ~/.cache/chromium-clang/$CLANG_PACKAGE             https://commondatastorage.googleapis.com/chromium-browser-clang/Linux_x64/$CLANG_PACKAGE
+        fi
         sudo mkdir -p /opt/clang
-        wget https://commondatastorage.googleapis.com/chromium-browser-clang/Linux_x64/$CLANG_PACKAGE
-        sudo tar -xvf $CLANG_PACKAGE -C /opt/clang
+        sudo tar -xf ~/.cache/chromium-clang/$CLANG_PACKAGE -C /opt/clang
       shell: bash
 
     - name: Install required packages for x86-64

.github/actions/prepare-macos/action.yml

@@ -5,7 +5,11 @@ description: 'Installs required packages for macOS builds.'
 runs:
   using: "composite"
   steps:
+    # No Homebrew self-update: it takes minutes and neither package needs it.
     - name: Install required packages
+      env:
+        HOMEBREW_NO_AUTO_UPDATE: '1'
+        HOMEBREW_NO_INSTALL_CLEANUP: '1'
       run: |
         # Required on macos-14
         brew install python-setuptools

.github/actions/prepare-windows/action.yml

@@ -5,35 +5,6 @@ description: 'Frees up disk space and installs required packages for Windows bui
 runs:
   using: "composite"
   steps:
-    - name: Set up Python 3.11
-      if: false
-      uses: actions/setup-python@v7
-      with:
-        python-version: "3.11"
-
-    - name: Disk cleanup
-      if: false
-      run: |
-        Get-PSDrive
-        # Docker Images
-        docker rmi $(docker images -q -a)
-        # Android SDK
-        if ($Env:ANDROID_HOME) {
-          Remove-Item -Recurse -Force $Env:ANDROID_HOME -ErrorAction Ignore
-        }
-        if ($Env:ANDROID_NDK_HOME) {
-          Remove-Item -Recurse -Force $Env:ANDROID_NDK_HOME -ErrorAction Ignore
-        }
-        # JVM
-        if ($Env:JAVA_HOME_11_X64) {
-          Remove-Item -Recurse -Force $Env:JAVA_HOME_11_X64 -ErrorAction Ignore
-        }
-        if ($Env:JAVA_HOME_8_X64) {
-          Remove-Item -Recurse -Force $Env:JAVA_HOME_8_X64 -ErrorAction Ignore
-        }
-        Get-PSDrive
-      shell: powershell
-
     - name: Install required packages
       run: |
         choco install ninja

.github/actions/release-macos-x86_64/action.yml

@@ -19,8 +19,13 @@ runs:
       run: echo "WEBRTC_CACHE_BRANCH=$(sed -n 's|.*<webrtc.branch>branch-heads/\([^<]*\)</webrtc.branch>.*|\1|p' webrtc-jni/pom.xml)" >> "$GITHUB_ENV"
       shell: bash
 
-    - name: Set up WebRTC cache
-      uses: actions/cache@v6
+    # Restored here, saved right after the build below: the post step of
+    # actions/cache only saves when the whole job succeeds, so a failing test
+    # would otherwise throw away a WebRTC build that took the better part of an
+    # hour.
+    - id: webrtc-cache
+      name: Restore WebRTC cache
+      uses: actions/cache/restore@v6
       with:
         path: ~/${{ env.WEBRTC_INSTALL_FOLDER }}
         key: webrtc-${{ env.WEBRTC_CACHE_BRANCH }}-${{ inputs.platform-name }}-${{ hashFiles('webrtc-jni/src/main/cpp/dependencies/webrtc/CMakeLists.txt') }}-${{ hashFiles('webrtc-jni/pom.xml') }}
@@ -30,8 +35,9 @@ runs:
       run: echo "FFMPEG_VERSION=$(sed -n 's|.*<ffmpeg.version>\([^<]*\)</ffmpeg.version>.*|\1|p' webrtc-java-media/pom.xml)" >> "$GITHUB_ENV"
       shell: bash
 
-    - name: Set up FFmpeg cache
-      uses: actions/cache@v6
+    - id: ffmpeg-cache
+      name: Restore FFmpeg cache
+      uses: actions/cache/restore@v6
       with:
         path: ~/ffmpeg
         key: ffmpeg-${{ env.FFMPEG_VERSION }}-${{ inputs.platform-name }}-${{ hashFiles('webrtc-java-media/src/main/cpp/dependencies/ffmpeg/CMakeLists.txt') }}-${{ hashFiles('webrtc-java-media/pom.xml') }}
@@ -67,10 +73,34 @@ runs:
       run: mvn package -DskipTests -Pmacos-cross-x86_64
       shell: bash
 
+    - name: Save WebRTC cache
+      if: steps.webrtc-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v6
+      with:
+        path: ~/${{ env.WEBRTC_INSTALL_FOLDER }}
+        key: ${{ steps.webrtc-cache.outputs.cache-primary-key }}
+
+    - name: Save FFmpeg cache
+      if: steps.ffmpeg-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v6
+      with:
+        path: ~/ffmpeg
+        key: ${{ steps.ffmpeg-cache.outputs.cache-primary-key }}
+
     - name: Test
-      run: JAVA_HOME="${{ steps.jdk-x64.outputs.path }}" mvn -B jar:jar surefire:test -Pmacos-cross-x86_64
+      run: JAVA_HOME="${{ steps.jdk-x64.outputs.path }}" mvn -B jar:jar surefire:test -Pmacos-cross-x86_64 -Dsurefire.timeout=1800
       shell: bash
 
+    # What failed, for runners that cannot be reproduced locally.
+    - name: Upload test reports
+      if: failure()
+      uses: actions/upload-artifact@v7
+      with:
+        name: test-reports-${{ inputs.platform-name }}
+        path: '**/target/surefire-reports/'
+        if-no-files-found: ignore
+        retention-days: 7
+
     # Maven Central publishes a version as one atomic bundle, so this job must not
     # deploy. The native library jar is handed to the aggregating publish-central
     # job instead, which attaches every platform to a single deployment.

.github/actions/release/action.yml

@@ -18,8 +18,13 @@ runs:
       run: echo "WEBRTC_CACHE_BRANCH=$(sed -n 's|.*<webrtc.branch>branch-heads/\([^<]*\)</webrtc.branch>.*|\1|p' webrtc-jni/pom.xml)" >> "$GITHUB_ENV"
       shell: bash
 
-    - name: Set up WebRTC cache
-      uses: actions/cache@v6
+    # Restored here, saved right after the build below: the post step of
+    # actions/cache only saves when the whole job succeeds, so a failing test
+    # would otherwise throw away a WebRTC build that took the better part of an
+    # hour.
+    - id: webrtc-cache
+      name: Restore WebRTC cache
+      uses: actions/cache/restore@v6
       with:
         path: ~/${{ env.WEBRTC_INSTALL_FOLDER }}
         key: webrtc-${{ env.WEBRTC_CACHE_BRANCH }}-${{ inputs.platform-name }}-${{ hashFiles('webrtc-jni/src/main/cpp/dependencies/webrtc/CMakeLists.txt') }}-${{ hashFiles('webrtc-jni/pom.xml') }}
@@ -29,8 +34,9 @@ runs:
       run: echo "FFMPEG_VERSION=$(sed -n 's|.*<ffmpeg.version>\([^<]*\)</ffmpeg.version>.*|\1|p' webrtc-java-media/pom.xml)" >> "$GITHUB_ENV"
       shell: bash
 
-    - name: Set up FFmpeg cache
-      uses: actions/cache@v6
+    - id: ffmpeg-cache
+      name: Restore FFmpeg cache
+      uses: actions/cache/restore@v6
       with:
         path: ~/ffmpeg
         key: ffmpeg-${{ env.FFMPEG_VERSION }}-${{ inputs.platform-name }}-${{ hashFiles('webrtc-java-media/src/main/cpp/dependencies/ffmpeg/CMakeLists.txt') }}-${{ hashFiles('webrtc-java-media/pom.xml') }}
@@ -62,11 +68,35 @@ runs:
         fi
       shell: bash
 
+    - name: Save WebRTC cache
+      if: steps.webrtc-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v6
+      with:
+        path: ~/${{ env.WEBRTC_INSTALL_FOLDER }}
+        key: ${{ steps.webrtc-cache.outputs.cache-primary-key }}
+
+    - name: Save FFmpeg cache
+      if: steps.ffmpeg-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v6
+      with:
+        path: ~/ffmpeg
+        key: ${{ steps.ffmpeg-cache.outputs.cache-primary-key }}
+
     - name: Test
       if: ${{ inputs.platform-name != 'linux_arm' && inputs.platform-name != 'linux_arm64' && inputs.platform-name != 'windows_arm64' }}
-      run: mvn -B jar:jar surefire:test
+      run: mvn -B jar:jar surefire:test -Dsurefire.timeout=1800
       shell: bash
 
+    # What failed, for runners that cannot be reproduced locally.
+    - name: Upload test reports
+      if: failure()
+      uses: actions/upload-artifact@v7
+      with:
+        name: test-reports-${{ inputs.platform-name }}
+        path: '**/target/surefire-reports/'
+        if-no-files-found: ignore
+        retention-days: 7
+
     # Maven Central publishes a version as one atomic bundle, so this job must not
     # deploy. The native library jar is handed to the aggregating publish-central
     # job instead, which attaches every platform to a single deployment.

.github/actions/test-natives/action.yml

@@ -121,5 +121,15 @@ runs:
     # The native build is off: these natives were cross compiled by another
     # job, and this runner is here to run them, not to build them again.
     - name: Test
-      run: mvn -B -pl webrtc,webrtc-java-media test -DskipNativeBuild -P${{ inputs.profile }}
+      run: mvn -B -pl webrtc,webrtc-java-media test -DskipNativeBuild -P${{ inputs.profile }} -Dsurefire.timeout=1800
       shell: bash
+
+    # What failed, for runners that cannot be reproduced locally.
+    - name: Upload test reports
+      if: failure()
+      uses: actions/upload-artifact@v7
+      with:
+        name: test-reports-native-${{ inputs.platform-name }}
+        path: '**/target/surefire-reports/'
+        if-no-files-found: ignore
+        retention-days: 7