release: Kun v0.2.27

.github/workflows/daily-dev-prerelease.yml

@@ -84,6 +84,15 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
 
+      - name: Install host-native FFmpeg
+        run: |
+          brew install ffmpeg-full
+          ffmpeg_bin="$(brew --prefix ffmpeg-full)/bin"
+          "$ffmpeg_bin/ffmpeg" -hide_banner -filters 2>&1 | grep -Eq '[[:space:]]drawtext[[:space:]]'
+          echo "$ffmpeg_bin" >> "$GITHUB_PATH"
+          echo "KUN_FFMPEG_PATH=$ffmpeg_bin/ffmpeg" >> "$GITHUB_ENV"
+          echo "KUN_FFPROBE_PATH=$ffmpeg_bin/ffprobe" >> "$GITHUB_ENV"
+
       - name: Install dependencies
         run: npm ci
 
@@ -99,10 +108,20 @@ jobs:
       - name: Smoke packaged Extension Node runtime (macOS arm64)
         run: npm run smoke:packaged-extensions -- --resources dist/mac-arm64/Kun.app/Contents/Resources
 
+      - name: Smoke host-native FFmpeg broker (fail closed)
+        env:
+          KUN_RUN_MEDIA_SMOKE: '1'
+        run: npm run smoke:extension-native-media
+
+      - name: Smoke packaged Kun Video Editor native workflow
+        run: npm run smoke:packaged-video-editor-native
+
       - name: Smoke packaged Extension desktop Chromium (host-native macOS)
         run: npm run smoke:packaged-extension-desktop
 
       - name: Record commit-bound macOS artifact evidence
+        env:
+          KUN_EVIDENCE_COMMIT: ${{ needs.prepare.outputs.head_sha }}
         run: npm run evidence:extension-native
 
       - name: Upload macOS artifacts
@@ -145,6 +164,19 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
 
+      - name: Install host-native FFmpeg
+        shell: pwsh
+        run: |
+          if (-not (Get-Command ffmpeg.exe -ErrorAction SilentlyContinue) -or -not (Get-Command ffprobe.exe -ErrorAction SilentlyContinue)) {
+            choco install ffmpeg --yes --no-progress
+          }
+          $ffmpegPath = (Get-Command ffmpeg.exe).Source
+          if ((& $ffmpegPath -hide_banner -filters 2>&1 | Out-String) -notmatch '\sdrawtext\s') {
+            throw 'Installed FFmpeg does not provide the required drawtext filter.'
+          }
+          "KUN_FFMPEG_PATH=$ffmpegPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          "KUN_FFPROBE_PATH=$((Get-Command ffprobe.exe).Source)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
       - name: Install dependencies
         run: npm ci
 
@@ -157,10 +189,20 @@ jobs:
       - name: Smoke packaged Extension Node runtime
         run: npm run smoke:packaged-extensions -- --resources dist/win-unpacked/resources
 
+      - name: Smoke host-native FFmpeg broker (fail closed)
+        env:
+          KUN_RUN_MEDIA_SMOKE: '1'
+        run: npm run smoke:extension-native-media
+
+      - name: Smoke packaged Kun Video Editor native workflow
+        run: npm run smoke:packaged-video-editor-native
+
       - name: Smoke packaged Extension desktop Chromium
         run: npm run smoke:packaged-extension-desktop
 
       - name: Record commit-bound Windows artifact evidence
+        env:
+          KUN_EVIDENCE_COMMIT: ${{ needs.prepare.outputs.head_sha }}
         run: npm run evidence:extension-native
 
       - name: Upload Windows artifacts
@@ -205,7 +247,8 @@ jobs:
       - name: Install Linux packaging dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y --no-install-recommends libarchive-tools rpm build-essential python3 xvfb xauth util-linux
+          sudo apt-get install -y --no-install-recommends libarchive-tools rpm build-essential python3 xvfb xauth util-linux ffmpeg
+          ffmpeg -hide_banner -filters 2>&1 | grep -Eq '[[:space:]]drawtext[[:space:]]'
 
       - name: Install dependencies
         run: npm ci
@@ -219,6 +262,19 @@ jobs:
       - name: Smoke packaged Extension Node runtime
         run: npm run smoke:packaged-extensions -- --resources dist/linux-unpacked/resources
 
+      - name: Smoke host-native FFmpeg broker (fail closed)
+        env:
+          KUN_RUN_MEDIA_SMOKE: '1'
+        run: npm run smoke:extension-native-media
+
+      - name: Build deterministic Kun Video Editor extension package
+        run: npm run pack:kun-video-editor
+
+      - name: Smoke packaged Kun Video Editor native workflow
+        run: >
+          npm run smoke:packaged-video-editor-native --
+          --archive dist/kun-video-editor-0.4.4.kunx
+
       - name: Prepare and verify Linux user namespace sandbox
         run: |
           if [[ -e /proc/sys/kernel/unprivileged_userns_clone ]]; then
@@ -237,6 +293,8 @@ jobs:
         run: npm run smoke:packaged-extension-appimage
 
       - name: Record commit-bound Linux artifact evidence
+        env:
+          KUN_EVIDENCE_COMMIT: ${{ needs.prepare.outputs.head_sha }}
         run: npm run evidence:extension-native
 
       - name: Upload Linux artifacts
@@ -250,6 +308,7 @@ jobs:
             dist/Kun-*-linux-x86_64.AppImage.blockmap
             dist/latest-linux.yml
             dist/extension-native-evidence-linux.json
+            dist/kun-video-editor-*.kunx
 
   publish:
     name: Publish prerelease
@@ -272,6 +331,15 @@ jobs:
           fetch-depth: 0
           ref: ${{ env.HEAD_SHA }}
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
       - name: Download daily dev artifacts
         uses: actions/download-artifact@v4
         with:
@@ -292,6 +360,7 @@ jobs:
             "extension-native-evidence-darwin.json"
             "extension-native-evidence-win32.json"
             "extension-native-evidence-linux.json"
+            "kun-video-editor-0.4.4.kunx"
           )
 
           for file in "${required[@]}"; do
@@ -338,6 +407,17 @@ jobs:
             git push origin "refs/tags/${TAG_NAME}"
           fi
 
+      - name: Verify three-platform native evidence bundle
+        run: >
+          npm run verify:extension-native-evidence --
+          --directory release-artifacts
+          --commit "${HEAD_SHA}"
+          --tag "${TAG_NAME}"
+          --version "${DEV_VERSION}"
+
+      - name: Verify downloadable Kun Video Editor extension package
+        run: npm run verify:kun-video-editor-package -- --input release-artifacts
+
       - name: Create or update GitHub prerelease
         run: |
           set -euo pipefail
@@ -360,7 +440,7 @@ jobs:
           set -euo pipefail
           mapfile -d '' assets < <(
             find release-artifacts -type f \
-              \( -name 'Kun-*' -o -name 'latest*.yml' \) \
+              \( -name 'Kun-*' -o -name 'latest*.yml' -o -name 'extension-native-evidence-*.json' -o -name 'kun-video-editor-*.kunx' \) \
               -print0
           )
 

.github/workflows/pr-checks.yml

@@ -79,7 +79,8 @@ jobs:
       - name: Install Linux packaging dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y --no-install-recommends libarchive-tools rpm build-essential python3 xvfb xauth util-linux
+          sudo apt-get install -y --no-install-recommends libarchive-tools rpm build-essential python3 xvfb xauth util-linux ffmpeg
+          ffmpeg -hide_banner -filters 2>&1 | grep -Eq '[[:space:]]drawtext[[:space:]]'
 
       - name: Install root dependencies
         run: npm ci
@@ -96,6 +97,19 @@ jobs:
       - name: Smoke packaged Extension Node runtime
         run: npm run smoke:packaged-extensions -- --resources dist/linux-unpacked/resources
 
+      - name: Smoke host-native FFmpeg broker (fail closed)
+        env:
+          KUN_RUN_MEDIA_SMOKE: '1'
+        run: npm run smoke:extension-native-media
+
+      - name: Build deterministic Kun Video Editor extension package
+        run: npm run pack:kun-video-editor
+
+      - name: Smoke packaged Kun Video Editor native workflow
+        run: >
+          npm run smoke:packaged-video-editor-native --
+          --archive dist/kun-video-editor-0.4.4.kunx
+
       - name: Prepare and verify Linux user namespace sandbox
         run: |
           if [[ -e /proc/sys/kernel/unprivileged_userns_clone ]]; then
@@ -114,6 +128,8 @@ jobs:
         run: npm run smoke:packaged-extension-appimage
 
       - name: Record Linux native validation evidence
+        env:
+          KUN_EVIDENCE_COMMIT: ${{ github.sha }}
         run: npm run evidence:extension-native
 
       - name: Upload Linux package
@@ -126,6 +142,7 @@ jobs:
             dist/Kun-*-linux-x86_64.AppImage
             dist/Kun-*-linux-x86_64.AppImage.blockmap
             dist/extension-native-evidence-linux.json
+            dist/kun-video-editor-*.kunx
 
   package-macos:
     name: Ad-hoc macOS packaged validation (PR)
@@ -149,6 +166,15 @@ jobs:
             package-lock.json
             kun/package-lock.json
 
+      - name: Install host-native FFmpeg
+        run: |
+          brew install ffmpeg-full
+          ffmpeg_bin="$(brew --prefix ffmpeg-full)/bin"
+          "$ffmpeg_bin/ffmpeg" -hide_banner -filters 2>&1 | grep -Eq '[[:space:]]drawtext[[:space:]]'
+          echo "$ffmpeg_bin" >> "$GITHUB_PATH"
+          echo "KUN_FFMPEG_PATH=$ffmpeg_bin/ffmpeg" >> "$GITHUB_ENV"
+          echo "KUN_FFPROBE_PATH=$ffmpeg_bin/ffprobe" >> "$GITHUB_ENV"
+
       - name: Install root dependencies
         run: npm ci
 
@@ -164,10 +190,20 @@ jobs:
       - name: Smoke packaged Extension Node runtime (macOS arm64)
         run: npm run smoke:packaged-extensions -- --resources dist/mac-arm64/Kun.app/Contents/Resources
 
+      - name: Smoke host-native FFmpeg broker (fail closed)
+        env:
+          KUN_RUN_MEDIA_SMOKE: '1'
+        run: npm run smoke:extension-native-media
+
+      - name: Smoke packaged Kun Video Editor native workflow
+        run: npm run smoke:packaged-video-editor-native
+
       - name: Smoke packaged Extension desktop Chromium (host-native macOS)
         run: npm run smoke:packaged-extension-desktop
 
       - name: Record macOS native validation evidence
+        env:
+          KUN_EVIDENCE_COMMIT: ${{ github.sha }}
         run: npm run evidence:extension-native
 
       - name: Upload ad-hoc macOS PR packages
@@ -203,6 +239,19 @@ jobs:
             package-lock.json
             kun/package-lock.json
 
+      - name: Install host-native FFmpeg
+        shell: pwsh
+        run: |
+          if (-not (Get-Command ffmpeg.exe -ErrorAction SilentlyContinue) -or -not (Get-Command ffprobe.exe -ErrorAction SilentlyContinue)) {
+            choco install ffmpeg --yes --no-progress
+          }
+          $ffmpegPath = (Get-Command ffmpeg.exe).Source
+          if ((& $ffmpegPath -hide_banner -filters 2>&1 | Out-String) -notmatch '\sdrawtext\s') {
+            throw 'Installed FFmpeg does not provide the required drawtext filter.'
+          }
+          "KUN_FFMPEG_PATH=$ffmpegPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          "KUN_FFPROBE_PATH=$((Get-Command ffprobe.exe).Source)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
       - name: Install root dependencies
         run: npm ci
 
@@ -215,10 +264,20 @@ jobs:
       - name: Smoke packaged Extension Node runtime (win-unpacked)
         run: npm run smoke:packaged-extensions -- --resources dist/win-unpacked/resources
 
+      - name: Smoke host-native FFmpeg broker (fail closed)
+        env:
+          KUN_RUN_MEDIA_SMOKE: '1'
+        run: npm run smoke:extension-native-media
+
+      - name: Smoke packaged Kun Video Editor native workflow
+        run: npm run smoke:packaged-video-editor-native
+
       - name: Smoke packaged Extension desktop Chromium (host-native Windows)
         run: npm run smoke:packaged-extension-desktop
 
       - name: Record Windows native validation evidence
+        env:
+          KUN_EVIDENCE_COMMIT: ${{ github.sha }}
         run: npm run evidence:extension-native
 
       - name: Upload Windows PR package