chore: sync upstream AetherEngine 7.28.3 into the Silo fork

.github/RELEASE_SETUP.md

@@ -67,6 +67,7 @@ Once all six secrets are set:
 
 1. Make sure a release exists (use the existing `2.0.0` or create a draft tag).
 2. Trigger the workflow manually: [Actions](https://github.com/superuser404notfound/AetherEngine/actions) → `Release .dmg` → `Run workflow` → enter the tag → Run.
+   The job checks out that tag, whatever branch the "Use workflow from" dropdown says, so a tag that predates `Examples/DemoPlayerMac/Scripts/build-dmg.sh` fails loudly instead of building `main`. The log's "Building commit" line names the built SHA.
 3. Watch the job. It should reach "Upload .dmg to release" and finish green in 3-6 minutes.
 4. Confirm the `.dmg` appears under the release's Assets (or got `--clobber`'d over the existing one if you pointed at `2.0.0`).
 

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  # Third-party actions are pinned by commit SHA (audit OPS-2); this keeps the pins moving.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(ci)"

.github/workflows/ci.yml

@@ -12,18 +12,24 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # One toolchain: GitHub's `xcode-27` image (macOS 27.0, default Xcode 27.0 27A266a), the same
+  # Xcode the engine is consumed and released from. The earlier macos-15 lanes resolved
+  # `latest-stable` to Xcode 26.3, whose Swift 6.2 disagreed with 6.4 in both directions (6.4
+  # rejects isolation shapes 6.3 accepted, 2026-09-16; 6.2 timed out type-checking a literal sum
+  # inside #expect, 2026-09-30), and nothing downstream builds with 26.x any more, so the README's
+  # requirement is Xcode 27 and CI tests exactly that. `xcode-27` is still a GitHub preview image.
+  # Its flaky `swift test` runs of mid-September were on a beta macOS 27 base with Xcode 27
+  # beta 6; the image moved to macOS 27 on 2026-09-16. If it turns unstable again, that shows as
+  # a lane red for its image, which is the signal to wait for the GA label, not to lower the bar.
+  # All three macOS jobs use it, which stays within the account's concurrent macOS runners.
   test-macos:
     name: swift test (macOS)
-    runs-on: macos-15
+    runs-on: xcode-27
     timeout-minutes: 30
     env:
       AUTHORIZATION_TEST_SUITES: 'RefreshableHLSAuthorizationTests|RefreshableSubtitleAuthorizationTests|LiveTrustEvaluatorTests'
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: latest-stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Show toolchain
         run: |
@@ -72,23 +78,11 @@ jobs:
         run: swift build --build-tests --package-path Probes/TransportProbe
 
   build-tvos:
-    name: xcodebuild (tvOS Simulator)
-    runs-on: macos-15
+    name: xcodebuild (tvOS + visionOS Simulator)
+    runs-on: xcode-27
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: latest-stable
-
-      - name: Build for tvOS Simulator
-        run: |
-          xcodebuild build \
-            -scheme AetherEngine \
-            -destination 'generic/platform=tvOS Simulator' \
-            -derivedDataPath .build/xcode-tvos \
-            CODE_SIGNING_ALLOWED=NO
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # The test target is the only place a platform gate in TEST code is ever checked. `swift test`
       # on macOS compiles the macOS side of every `#if`, so a gate put around a helper instead of
@@ -98,12 +92,16 @@ jobs:
       #
       # EXCLUDED_ARCHS because a generic simulator destination builds both slices and `libdovi.a`
       # ships arm64 only, so the x86_64 link fails and says nothing about this repo.
+      #
+      # This step also compiles the library, so no separate `xcodebuild build` of the AetherEngine
+      # scheme runs first: that doubled every simulator job's compile, and the x86_64 slice it added
+      # is one no app can link anyway.
       - name: Build the tests for tvOS Simulator
         run: |
           xcodebuild build-for-testing \
             -scheme AetherEngineTests \
             -destination 'generic/platform=tvOS Simulator' \
-            -derivedDataPath .build/xcode-tvos-tests \
+            -derivedDataPath .build/xcode-tvos \
             EXCLUDED_ARCHS=x86_64 \
             CODE_SIGNING_ALLOWED=NO
 
@@ -120,52 +118,12 @@ jobs:
             -derivedDataPath .build/xcode-probe \
             CODE_SIGNING_ALLOWED=NO
 
-  build-ios:
-    name: xcodebuild (iOS Simulator)
-    runs-on: macos-15
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: latest-stable
-
-      - name: Build for iOS Simulator
-        run: |
-          xcodebuild build \
-            -scheme AetherEngine \
-            -destination 'generic/platform=iOS Simulator' \
-            -derivedDataPath .build/xcode-ios \
-            CODE_SIGNING_ALLOWED=NO
-
-      # The other half of the gate check above; see the tvOS job for why the test target needs its
-      # own build and why x86_64 is excluded.
-      - name: Build the tests for iOS Simulator
-        run: |
-          xcodebuild build-for-testing \
-            -scheme AetherEngineTests \
-            -destination 'generic/platform=iOS Simulator' \
-            -derivedDataPath .build/xcode-ios-tests \
-            EXCLUDED_ARCHS=x86_64 \
-            CODE_SIGNING_ALLOWED=NO
-
-  # #344: the package has declared visionOS since 6.0.0 and nothing here compiled for it, so an
-  # availability list that named tvOS/iOS/macOS and then fell through to `*` broke the visionOS
-  # build silently. `*` resolves to the declared visionOS floor (1.0), so any API newer than that
-  # is a compile error on visionOS and on no other platform. Nobody here owns a Vision Pro, which
-  # makes this job the only place the platform is exercised at all.
-  build-visionos:
-    name: xcodebuild (visionOS Simulator)
-    runs-on: macos-15
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: latest-stable
-
+      # #344: the package has declared visionOS since 6.0.0 and nothing here compiled for it, so an
+      # availability list that named tvOS/iOS/macOS and then fell through to `*` broke the visionOS
+      # build silently. `*` resolves to the declared visionOS floor (1.0), so any API newer than that
+      # is a compile error on visionOS and on no other platform. Nobody here owns a Vision Pro, which
+      # makes this step the only place the platform is exercised at all. It rides in this job so CI
+      # stays within the account's concurrent macOS runners instead of queueing a sixth job.
       - name: Build for visionOS Simulator
         run: |
           xcodebuild build \
@@ -174,61 +132,30 @@ jobs:
             -derivedDataPath .build/xcode-visionos \
             CODE_SIGNING_ALLOWED=NO
 
-  # The Xcode 27 lane. Every job above resolves `latest-stable` on macos-15, which is Xcode 26.3,
-  # while the engine is consumed and released from Xcode 27, and Swift 6.4 rejects isolation shapes
-  # 6.3 accepted (the Sodalite test target stopped compiling on exactly that, 2026-09-16). These two
-  # jobs compile the package and both test targets against the 27 toolchain, for macOS and for the
-  # tvOS 27 SDK.
-  #
-  # They build and do not run the tests, on purpose. `xcode-27` is GitHub's preview image and runs a
-  # BETA macOS 27 (26A5406e) under Xcode 27 beta 6: measured on two attempts of the first run, Vision
-  # text recognition returns nil there and the loopback-origin tests starve (a global-queue block not
-  # scheduled within 30 s, a TLS relay request timing out), a different set of network tests each
-  # time, while all 2983 pass on macOS 27 GA on a Mac. A lane that is red for its image teaches
-  # everyone to ignore red. Run `swift test` here once a GA macOS 27 image ships, and that is also
-  # the point to move to its label; the preview label disappearing fails these jobs loudly first.
-  # This lane replaces the weekly beta SDK watcher, whose one subject (#351) the 7.0 platform floor
-  # closed.
-  build-macos-xcode27:
-    name: swift build --build-tests (macOS, Xcode 27)
-    runs-on: xcode-27
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Show toolchain
-        run: |
-          swift --version
-          xcodebuild -version
-
-      - name: swift build --build-tests
-        run: swift build --build-tests
-
-  build-tvos-xcode27:
-    name: xcodebuild (tvOS Simulator, Xcode 27)
+  build-ios:
+    name: xcodebuild (iOS Simulator) + release aetherctl
     runs-on: xcode-27
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Build for tvOS Simulator
-        run: |
-          xcodebuild build \
-            -scheme AetherEngine \
-            -destination 'generic/platform=tvOS Simulator' \
-            -derivedDataPath .build/xcode-tvos \
-            CODE_SIGNING_ALLOWED=NO
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      # See the tvOS job above for why the test target needs its own build and why x86_64 is excluded.
-      - name: Build the tests for tvOS Simulator
+      # The other half of the gate check above; see the tvOS job for why the test target needs its
+      # own build and why x86_64 is excluded.
+      - name: Build the tests for iOS Simulator
         run: |
           xcodebuild build-for-testing \
             -scheme AetherEngineTests \
-            -destination 'generic/platform=tvOS Simulator' \
-            -derivedDataPath .build/xcode-tvos-tests \
+            -destination 'generic/platform=iOS Simulator' \
+            -derivedDataPath .build/xcode-ios \
             EXCLUDED_ARCHS=x86_64 \
             CODE_SIGNING_ALLOWED=NO
 
+      # Every other Swift step in CI is Debug, and aetherctl is not a product, so no consumer compiles
+      # it either: a DEBUG-only engine hook called without a guard kept Release broken from 7.6.0 to
+      # 7.14.0 without anything noticing (AE#610). Off the `swift test` job's critical path.
+      - name: swift build -c release (aetherctl)
+        run: swift build -c release --product aetherctl
+
   # The docs site (aetherengine-website) validates every heading anchor at build time, but it
   # lives in another repo and only builds AFTER a push to main, so a broken anchor ships first
   # and is found second: `docs/api.md` linked `formats.md#dolby-vision` against a heading that
@@ -240,7 +167,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Validate relative links and heading anchors in the published docs
         run: python3 Scripts/check-doc-links.py

.github/workflows/release-dmg.yml

@@ -49,9 +49,14 @@ jobs:
     runs-on: macos-15
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      # workflow_dispatch checks out the ref picked in "Use workflow from"
+      # (normally main), so the tag is pinned explicitly: the DMG is named,
+      # versioned and uploaded for the tag and must be built from it (audit OPS-101).
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: refs/tags/${{ github.event.release.tag_name || inputs.tag }}
 
-      - uses: maxim-lobanov/setup-xcode@v1
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
         with:
           xcode-version: latest-stable
 
@@ -65,6 +70,7 @@ jobs:
           fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building for tag: $TAG"
+          echo "Building commit: $(git rev-parse HEAD)"
 
       - name: Import Developer ID certificate into temporary keychain
         env:

.github/workflows/used-by-add.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Normalise the issue body
         id: normalise
@@ -62,7 +62,7 @@ jobs:
 
       - name: Parse issue form
         id: parse
-        uses: stefanbuck/github-issue-parser@v3
+        uses: stefanbuck/github-issue-parser@cb6e97157cbf851e3a393ff8d57c93a484cc323f # v3.2.5
         with:
           template-path: .github/ISSUE_TEMPLATE/used-by-submission.yml
           issue-body: ${{ steps.normalise.outputs.body }}
@@ -151,7 +151,7 @@ jobs:
       - name: Open pull request
         if: steps.build.outputs.skip == 'false'
         id: pr
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           # Only the README, so no stray runner file can ride along.
           add-paths: README.md