[pull] master from strukturag:master

.clang-tidy

@@ -0,0 +1,13 @@
+---
+Checks: >
+  -clang-analyzer-security.insecureAPI.strcat,
+  -clang-analyzer-security.insecureAPI.strcpy,
+  modernize-shrink-to-fit,
+  modernize-use-default-member-init,
+  modernize-use-equals-default,
+  modernize-use-equals-delete,
+  modernize-use-override,
+  performance-*
+HeaderFilterRegex: .*
+WarningsAsErrors: '*'
+...

.github/FUNDING.yml

@@ -0,0 +1,13 @@
+# These are supported funding model platforms
+
+github: [farindk]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/workflows/build.yml

@@ -12,22 +12,19 @@ jobs:
       matrix:
         env:
           - { NAME: "nothing" }
-          - { NAME: "cmake", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_DAV1D: 1, WITH_RAV1E: 1, WITH_LIBDE265: 1, CMAKE: 1 }
-          - { NAME: "tarball", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_DAV1D: 1, WITH_RAV1E: 1, WITH_LIBDE265: 1, TARBALL: 1 }
+          - { NAME: "tarball", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 1, TARBALL: 1 }
           - { NAME: "graphics", WITH_GRAPHICS: 1 }
           - { NAME: "x265", WITH_X265: 1 }
           - { NAME: "x265 / graphics", WITH_GRAPHICS: 1, WITH_X265: 1 }
           - { NAME: "libde265 (1) / graphics", WITH_GRAPHICS: 1, WITH_LIBDE265: 1 }
-          - { NAME: "libde265 (2) / graphics", WITH_GRAPHICS: 1, WITH_LIBDE265: 2 }
           - { NAME: "libde265 (1) / x265 / graphics", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_LIBDE265: 1 }
-          - { NAME: "libde265 (2) / x265 / graphics", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_LIBDE265: 2 }
           - { NAME: "libde265 (1) / x265 / aom / graphics", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 1 }
           - { NAME: "libde265 (1) / x265 / dav1d / graphics", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_DAV1D: 1, WITH_LIBDE265: 1 }
           - { NAME: "libde265 (1) / x265 / aom / rav1e / graphics", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_RAV1E: 1, WITH_LIBDE265: 1 }
     env: ${{ matrix.env }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - name: Install dependencies
       run: |

.github/workflows/cifuzz.yml

@@ -0,0 +1,47 @@
+name: CIFuzz
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  schedule:
+    - cron: "0 2 * * SUN"
+
+jobs:
+  Fuzzing:
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        architecture: [x86_64, i386]
+        sanitizer: [address, undefined, memory]
+        # Remove combinations not supported by action.
+        exclude:
+          - architecture: i386
+            sanitizer: undefined
+          - architecture: i386
+            sanitizer: memory
+    steps:
+    - name: Build Fuzzers
+      id: build
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'libheif'
+        dry-run: false
+        architecture: ${{ matrix.architecture }}
+        sanitizer: ${{ matrix.sanitizer }}
+    - name: Run Fuzzers
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'libheif'
+        fuzz-seconds: 600
+        dry-run: false
+        sanitizer: ${{ matrix.sanitizer }}
+    - name: Upload Crash
+      uses: actions/upload-artifact@v7
+      if: failure() && steps.build.outcome == 'success'
+      with:
+        name: artifacts-${{ matrix.sanitizer }}-${{ matrix.architecture }}
+        path: ./out/artifacts
+        if-no-files-found: ignore

.github/workflows/clang.yml

@@ -13,11 +13,10 @@ jobs:
         env:
           - { NAME: "nothing" }
           - { NAME: "libde265 (1) / x265 / aom / graphics", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 1 }
-          - { NAME: "libde265 (2) / x265 / aom / graphics", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 2 }
     env: ${{ matrix.env }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - name: Install dependencies
       run: |
@@ -37,3 +36,32 @@ jobs:
         CXX: clang++
       run: |
         ./scripts/run-ci.sh
+
+  tidy:
+    env:
+      WITH_GRAPHICS: 1
+      WITH_X265: 1
+      WITH_AOM: 1
+      WITH_DAV1D: 1
+      WITH_LIBDE265: 1
+      CLANG_TIDY: 1
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Install dependencies
+      run: |
+        ./scripts/install-ci-linux.sh
+        sudo apt install clang-tidy-12
+
+    - name: Prepare CI
+      run: |
+        ./scripts/prepare-ci.sh
+
+    - name: Run tests
+      run: |
+        ./scripts/run-ci.sh
+
+    - name: Run clang-tidy
+      run: |
+        run-clang-tidy-12 -checks=-clang-diagnostic-tautological-compare,-clang-diagnostic-tautological-constant-out-of-range-compare -j$(nproc)

.github/workflows/coverity.yml

@@ -2,26 +2,32 @@ name: coverity
 
 on:
   push:
-    branches: [ coverity ]
+    branches: [ master, coverity ]
 
 jobs:
   scan:
-    runs-on: ubuntu-latest
+    # TEMPORARILY DISABLED: scan.coverity.com is down and the download step
+    # fails before the build can run. Re-enable by removing this `if` line
+    # once the Coverity service is back.
+    if: false
+    runs-on: ubuntu-22.04
     env:
       TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
       WITH_AOM: 1
+      WITH_DAV1D: 1
       WITH_GRAPHICS: 1
       WITH_LIBDE265: 1
+      WITH_RAV1E: 0
       WITH_X265: 1
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - name: Cache Coverity build tool
-      uses: actions/cache@v2
+      uses: actions/cache@v5
       with:
         path: |
           coverity_tool.tar.gz
-        key: ${{ runner.os }}
+        key: coverity_tool-${{ runner.os }}
 
     - name: Download Coverity build tool
       run: |
@@ -39,10 +45,13 @@ jobs:
 
     - name: Build with Coverity build tool
       run: |
-        export PATH=`pwd`/coverity_tool/bin:$PATH
-        cov-build --dir cov-int make
+        export PATH=$(pwd)/coverity_tool/bin:$PATH
+        export PKG_CONFIG_PATH="$(pwd)/libde265/dist/lib/pkgconfig/:$(pwd)/third-party/rav1e/dist/lib/pkgconfig/:$(pwd)/third-party/dav1d/dist/lib/x86_64-linux-gnu/pkgconfig/"
+        cmake --preset=develop .
+        cov-build --dir cov-int make -j$(nproc)
 
     - name: Submit build result to Coverity Scan
+      if: github.ref == 'refs/heads/coverity'
       run: |
         tar czvf libheif.tar.gz cov-int
         curl --form token=$TOKEN \

.github/workflows/diagram.yml

@@ -6,10 +6,10 @@ on:
       - main
 jobs:
   get_data:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@master
+        uses: actions/checkout@v6
       - name: Update diagram
         uses: githubocto/repo-visualizer@main
         with:

.github/workflows/emscripten.yml

@@ -9,10 +9,10 @@ on:
 jobs:
   emscripten:
     env:
-      EMSCRIPTEN_VERSION: 1.37.26
-    runs-on: ubuntu-latest
+      EMSCRIPTEN_VERSION: 3.1.61
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - name: Install emscripten
       run: |

.github/workflows/fuzzer.yml

@@ -14,9 +14,9 @@ jobs:
       WITH_LIBDE265: 1
       WITH_X265: 1
       FUZZER: 1
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - name: Install dependencies
       run: |

.github/workflows/gcc-versions.yml

@@ -0,0 +1,44 @@
+name: gcc-versions
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        env:
+          - { NAME: "gcc-10", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 3, GCC: 10 }
+          - { NAME: "gcc-11", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 3, GCC: 11 }
+          - { NAME: "gcc-12", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 3, GCC: 12 }
+          - { NAME: "gcc-13", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 3, GCC: 13 }
+          - { NAME: "gcc-14", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 3, GCC: 14 }
+          - { NAME: "gcc-15", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 3, GCC: 15 }
+    env: ${{ matrix.env }}
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Install dependencies
+      run: |
+        ./scripts/install-ci-linux.sh
+        # gcc-15 is not in the noble main archives yet; pull it from the
+        # ubuntu-toolchain-r/test PPA. The line is harmless for older GCCs.
+        sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
+        sudo apt update
+        sudo apt install gcc-${GCC} g++-${GCC}
+
+    - name: Prepare CI
+      env:
+        CC: gcc-${{matrix.env.GCC}}
+        CXX: g++-${{matrix.env.GCC}}
+      run: |
+        ./scripts/prepare-ci.sh
+
+    - name: Run tests
+      env:
+        CC: gcc-${{matrix.env.GCC}}
+        CXX: g++-${{matrix.env.GCC}}
+      run: |
+        ./scripts/run-ci.sh

.github/workflows/go.yml

@@ -12,17 +12,16 @@ jobs:
       matrix:
         libde265-version:
           - "1"
-          - "2"
     env:
       WITH_LIBDE265: ${{ matrix.libde265-version }}
       WITH_X265: 1
       WITH_GRAPHICS: 1
       GO: 1
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
-    - uses: actions/setup-go@v2
+    - uses: actions/setup-go@v6
       with:
         go-version: "1.10"
 

.github/workflows/lint.yml

@@ -10,9 +10,9 @@ jobs:
   cpplint:
     env:
       CPPLINT: 1
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - name: Install dependencies
       run: |
@@ -26,12 +26,40 @@ jobs:
       run: |
         ./scripts/run-ci.sh
 
+  c-api-headers:
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Install compilers
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y gcc clang
+
+    - name: Check that public headers are valid C
+      run: |
+        ./scripts/check-c-headers.sh
+
+  api-symbols:
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Install build tools
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y cmake g++
+
+    - name: Check that all declared API functions are defined in the library
+      run: |
+        ./scripts/check-api-symbols.sh
+
   licenses:
     env:
       CHECK_LICENSES: 1
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - name: Install dependencies
       run: |

.github/workflows/mingw.yml

@@ -14,9 +14,9 @@ jobs:
           - { MINGW: 32 }
           - { MINGW: 64 }
     env: ${{ matrix.env }}
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - name: Install dependencies
       run: |

.github/workflows/osx.yml

@@ -10,15 +10,15 @@ jobs:
   build:
     strategy:
       matrix:
+        runner: [ macos-15, macos-15-intel ]
         env:
           - { NAME: "nothing" }
-          - { NAME: "cmake", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 1, CMAKE: 1 }
+          - { NAME: "cmake", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_AOM: 1, WITH_LIBDE265: 1 }
           - { NAME: "libde265 (1) / x265 / graphics", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_LIBDE265: 1 }
-          - { NAME: "libde265 (2) / x265 / graphics", WITH_GRAPHICS: 1, WITH_X265: 1, WITH_LIBDE265: 2 }
     env: ${{ matrix.env }}
-    runs-on: macos-10.15
+    runs-on: ${{ matrix.runner }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - name: Install dependencies
       run: |