Squashed 'external/toxcore/c-toxcore/' changes from d9b8fa6098d..81b1e4f6348

81b1e4f6348 chore: Release v0.2.21-rc.1
9303e2e49a1 chore: Update the pkgsrc versions in the update-versions tool
71ec4b3b1e9 chore: Update the version-sync script to work in a post-tox.api.h world
66da842f753 chore: Add version update script compatible with ci-tools.
199878f7660 chore: Use new bazel script for circle ci.
8278e9cda46 chore: Add release issue template and workflow.
a9bb3a1c4d1 chore: Fix alpine-s390x build.
6e0a641272e chore: Add a source tarball deploy workflow.
4adebe4d8b1 chore: Don't upload ios/macos variants in deploy workflows.
18f1d858ccb chore: Move one of the 3 freebsd builds to post-submit.
432ab60c002 feat: Add a Makefile for the single file deploy build.
a86c0011fd5 chore: Add deploy job for single C file library.
2e7495e8f2a docs: Update changelog format to use the new clog-compatible way.
a682da99e84 chore: Export wasmExports from the wasm binary.
12f34cdff27 chore: Add wasm to the nightly binary deploys.
1451029613f chore: Add strict-abi support for macOS/iOS.
c53c30e09d9 chore: Add time option to manual fuzz trigger.
2ccecdc2a1a chore: Add remaining fuzz tests to cflite.
4626c2e230e test: Add a Net_Crypto fuzz test.
b4a0e617c48 refactor: Use IP string length from ip_ntoa instead of strlen.
b85b91f22f6 cleanup: rename getnodes/sendnodes to nodes request/response This change alignes the naming to be closer to the spec and make it less ambiguous. This change also changes the naming of some private/experimental marked APIs. - tox_callback_dht_nodes_response() - tox_dht_nodes_request() - Tox_Event_Dht_Get_Nodes_Response
f1991aaa029 perf: Use stack allocation for strerror rendering.
3984211ccbf cleanup: remove kicked peers from saved peers list
26a991ed2be fix: ip to string function not accepting tcp families
712861f2e6d cleanup: Make websockify output qtox-compatible logging.
01932ea2f73 chore: Add opus and vpx to the toxcore wasm build.
d29c42ef631 refactor: don't fully discard received DHT nodes. This is mostly forward thinking, where we might introduce other ip families, in addition to ipv4, ipv6, tcp_ipv4 etc.
21e2325934f chore: Fix xcframework tarball creation.
b10c8b766ba chore: Fix xcframework checksum creation.
93787a9322e chore: Add ios/macos framework build.
9f723f891d3 fix: run do_gca also in bootstrap nodes
496cc703556 chore: Support arm64 iphone simulator.
aa0e2a8e928 chore: Add support for more iOS architectures.
13ad8e81cbf chore: Add binary deploy workflows.
c8344726378 refactor: Move tox_log_level out into its own file.
8799bea76c3 cleanup: Mark events/dispatch headers as experimental.
d4164edb548 refactor: Remove tox_types.h; use `struct` tags instead.
d408c982090 refactor: Move `Tox_Options` to `tox_options.h`.
5ab42d41209 chore: Move most cirrus jobs to circleci.
463eeae1144 cleanup: Avoid clashing with global define `DEBUG`.
92cc1e91747 refactor: Make Tox_Options own the passed proxy host and savedata.
f276b397226 test: Add some more asserts for I/O and alloc to succeed.
edb4dfc4869 fix: Don't crash on malloc failures in bin_unpack.
be457d5d0b2 cleanup: Use tox memory for bin_unpack and net_strerror.

git-subtree-dir: external/toxcore/c-toxcore
git-subtree-split: 81b1e4f6348124784088591c4fe9ab41e273031d

.github/ISSUE_TEMPLATE/release.yml

@@ -0,0 +1,24 @@
+name: 🚀 Release
+description: Build and deploy a new release
+title: Release tracking issue
+labels: [chore]
+type: Task
+body:
+  - type: textarea
+    id: release-notes
+    attributes:
+      label: Release notes
+      description: Write something nice about the new release.
+      placeholder: "Here's our latest awesome release!"
+    validations:
+      required: true
+  - type: dropdown
+    id: production
+    attributes:
+      label: Release type
+      description: Whether this is a production release or a release candidate.
+      options:
+        - Release candidate
+        - Production release
+    validations:
+      required: true

.github/scripts/cmake-android

@@ -1,65 +0,0 @@
-#!/bin/bash
-
-set -eu
-
-# Set up environment
-NDK=$ANDROID_NDK_HOME
-
-ABI=${1:-"armeabi-v7a"}
-
-case $ABI in
-  armeabi-v7a)
-    TARGET=armv7a-linux-androideabi
-    NDK_API=21
-    ;;
-  arm64-v8a)
-    TARGET=aarch64-linux-android
-    NDK_API=21
-    ;;
-  x86)
-    TARGET=i686-linux-android
-    NDK_API=21
-    ;;
-  x86_64)
-    TARGET=x86_64-linux-android
-    NDK_API=21
-    ;;
-  *)
-    exit 1
-    ;;
-esac
-
-rm -rf _android_prefix
-mkdir -p _android_prefix
-PREFIX=$PWD/_android_prefix
-
-TOOLCHAIN=$NDK/toolchains/llvm/prebuilt/linux-x86_64
-SYSROOT=$TOOLCHAIN/sysroot
-
-export CC="$TOOLCHAIN/bin/$TARGET$NDK_API"-clang
-export LDFLAGS=-static-libstdc++
-export PKG_CONFIG_PATH="$PREFIX"/lib/pkgconfig
-
-# Build libsodium
-if [ ! -d libsodium ]; then
-  git clone --branch=1.0.18 https://github.com/jedisct1/libsodium.git
-fi
-cd libsodium
-git clean -ffdx
-autoreconf -fi
-./configure --prefix="$PREFIX" --host="$TARGET" --with-sysroot="$SYSROOT" --disable-shared --disable-pie
-make -j"$(nproc)" install
-cd ..
-
-# Build c-toxcore
-rm -rf _build
-mkdir -p _build
-cd _build
-cmake .. \
-  -DBUILD_TOXAV=OFF \
-  -DBOOTSTRAP_DAEMON=OFF \
-  -DCMAKE_TOOLCHAIN_FILE="$NDK/build/cmake/android.toolchain.cmake" \
-  -DANDROID_ABI="$ABI" \
-  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
-  -DCMAKE_PREFIX_PATH="$PREFIX"
-cmake --build .

.github/scripts/cmake-osx

@@ -9,7 +9,6 @@ brew update
 
 brew install \
   libconfig \
-  libsodium \
   libvpx \
   opus
 

.github/scripts/flags-clang.sh

@@ -69,6 +69,8 @@ add_cxx_flag -Wno-c99-extensions
 add_cxx_flag -Wno-old-style-cast
 # GTest does this.
 add_cxx_flag -Wno-global-constructors
+# Needed for some fuzzers.
+add_cxx_flag -Wno-exit-time-destructors
 
 # Downgrade to warning so we still see it.
 add_flag -Wno-error=unreachable-code

.github/workflows/cflite_batch.yml

@@ -1,11 +1,20 @@
 # Derived from: https://google.github.io/clusterfuzzlite/running-clusterfuzzlite/github-actions/
 
 name: ClusterFuzzLite batch fuzzing
+
 on:
   schedule:
     - cron: '0 6,8 * * *'  # Run twice a day at low activity times
   workflow_dispatch:       # Manual trigger for testing
+    inputs:
+      fuzz-seconds:
+        description: 'Number of seconds to fuzz (total, not per test)'
+        required: false
+        type: number
+        default: 3600
+
 permissions: read-all
+
 jobs:
   BatchFuzzing:
     runs-on: ubuntu-latest
@@ -27,7 +36,8 @@ jobs:
       uses: google/clusterfuzzlite/actions/run_fuzzers@v1
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
-        fuzz-seconds: 3600 # 60min
+        # 1 hour on schedule, configurable on manual trigger.
+        fuzz-seconds: ${{ github.event.inputs.fuzz-seconds || 3600 }}
         mode: 'batch'
         sanitizer: ${{ matrix.sanitizer }}
         # Optional but recommended: For storing certain artifacts from fuzzing.

.github/workflows/cflite_cron.yml

@@ -7,6 +7,7 @@ on:
   workflow_dispatch:      # Manual trigger for testing
 
 permissions: read-all
+
 jobs:
   Pruning:
     runs-on: ubuntu-latest
@@ -26,6 +27,7 @@ jobs:
         storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/TokTok/toktok-fuzzer.git
         storage-repo-branch: master   # Optional. Defaults to "main"
         storage-repo-branch-coverage: gh-pages  # Optional. Defaults to "gh-pages".
+
   Coverage:
     runs-on: ubuntu-latest
     steps:
@@ -47,4 +49,3 @@ jobs:
         storage-repo: https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/TokTok/toktok-fuzzer.git
         storage-repo-branch: master   # Optional. Defaults to "main"
         storage-repo-branch-coverage: gh-pages  # Optional. Defaults to "gh-pages".
-

.github/workflows/cflite_pr.yml

@@ -0,0 +1,36 @@
+# Derived from: https://google.github.io/clusterfuzzlite/running-clusterfuzzlite/github-actions/
+
+name: ClusterFuzzLite pull request fuzzing
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  Fuzzing:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer:
+        - address
+        - undefined
+        - memory
+    steps:
+    - name: Build Fuzzers (${{ matrix.sanitizer }})
+      id: build
+      uses: google/clusterfuzzlite/actions/build_fuzzers@v1
+      with:
+        sanitizer: ${{ matrix.sanitizer }}
+    - name: Run Fuzzers (${{ matrix.sanitizer }})
+      id: run
+      uses: google/clusterfuzzlite/actions/run_fuzzers@v1
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        fuzz-seconds: 300 # 5 mins (total time, not per test)
+        mode: 'code-change'
+        sanitizer: ${{ matrix.sanitizer }}
+        # Optional but recommended: For storing certain artifacts from fuzzing.
+        # See later section on "Git repo for storage".
+        storage-repo: https://github.com/TokTok/toktok-fuzzer.git
+        storage-repo-branch: master   # Optional. Defaults to "main"

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        tool: [autotools, clang-tidy, compcert, cppcheck, doxygen, goblint, infer, freebsd, misra, modules, pkgsrc, rpm, slimcc, sparse, tcc, tokstyle]
+        tool: [autotools, clang-tidy, compcert, cppcheck, doxygen, goblint, infer, misra, modules, pkgsrc, rpm, slimcc, sparse, tcc, tokstyle]
     runs-on: ubuntu-22.04
     steps:
       - name: Set up Docker Buildx
@@ -60,17 +60,6 @@ jobs:
       - name: Build, test, and upload coverage
         run: other/docker/coverage/run
 
-  build-android:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-      - run: .github/scripts/cmake-android armeabi-v7a
-      - run: .github/scripts/cmake-android arm64-v8a
-      - run: .github/scripts/cmake-android x86
-      - run: .github/scripts/cmake-android x86_64
-
   build-macos:
     runs-on: macos-latest
     steps:
@@ -132,7 +121,7 @@ jobs:
 
           run: |
             # TODO(iphydf): Investigate NetBSD failures on these tests.
-            sed -Ei -e '/\((TCP|dht_getnodes_api)\)/s/^/#/' auto_tests/CMakeLists.txt
+            sed -Ei -e '/\((TCP|dht_nodes_response_api)\)/s/^/#/' auto_tests/CMakeLists.txt
             cmake . \
               -DMIN_LOGGER_LEVEL=TRACE \
               -DMUST_BUILD_TOXAV=ON \
@@ -171,7 +160,7 @@ jobs:
 
           run: |
             # TODO(iphydf): Investigate FreeBSD failures on these tests.
-            sed -Ei -e '/\(dht_getnodes_api\)/s/^/#/' auto_tests/CMakeLists.txt
+            sed -Ei -e '/\(dht_nodes_response_api\)/s/^/#/' auto_tests/CMakeLists.txt
             cmake . \
               -DMIN_LOGGER_LEVEL=TRACE \
               -DMUST_BUILD_TOXAV=ON \

.github/workflows/deploy.yml

@@ -0,0 +1,358 @@
+name: deploy
+
+on:
+  # Allow manual trigger.
+  workflow_dispatch:
+  pull_request:
+    branches: ["master"]
+  push:
+    branches: ["master"]
+    tags: ["v*"]
+
+# Cancel old PR builds when pushing new commits.
+concurrency:
+  group: deploy-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+
+  ################################################################################################
+  # Preparation jobs
+  ################################################################################################
+
+  prepare:
+    name: Prepare
+    uses: TokTok/ci-tools/.github/workflows/deploy-prepare.yml@master
+
+  ################################################################################################
+  # Build and deploy jobs (PR and push)
+  ################################################################################################
+
+  build-linux:
+    name: Linux
+    needs: [prepare]
+    strategy:
+      matrix:
+        arch: [aarch64, x86_64]
+    runs-on: ${{ matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - name: Install build tools
+        run: sudo apt-get install -y --no-install-recommends ninja-build yasm
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: deps-prefix-linux-${{ matrix.arch }}
+          key: ${{ github.job }}-${{ matrix.arch }}-deps
+      - name: Run build
+        run: other/deploy/linux.sh "${{ matrix.arch }}"
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxcore-linux-${{ matrix.arch }}
+          path: toxcore-linux-${{ matrix.arch }}
+          if-no-files-found: error
+      - name: Get tag name for release file name
+        if: contains(github.ref, 'refs/tags/v')
+        id: get_version
+        run: |
+          VERSION="$(echo "$GITHUB_REF" | cut -d / -f 3)"
+          echo "release_tarball=toxcore-$VERSION-linux-${{ matrix.arch }}.tar.gz" >>$GITHUB_OUTPUT
+      - name: Create tarball for release upload
+        if: contains(github.ref, 'refs/tags/v')
+        run: |
+          tar zcf "${{ steps.get_version.outputs.release_tarball }}" toxcore-linux-${{ matrix.arch }}
+          sha256sum "${{ steps.get_version.outputs.release_tarball }}" >"${{ steps.get_version.outputs.release_tarball }}.sha256"
+      - name: Upload to versioned release
+        if: contains(github.ref, 'refs/tags/v')
+        uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          draft: true
+          artifacts: "${{ steps.get_version.outputs.release_tarball }},${{ steps.get_version.outputs.release_tarball }}.sha256"
+      - name: Create tarball for nightly upload
+        run: |
+          tar zcf toxcore-nightly-linux-${{ matrix.arch }}.tar.gz toxcore-linux-${{ matrix.arch }}
+          sha256sum toxcore-nightly-linux-${{ matrix.arch }}.tar.gz >toxcore-nightly-linux-${{ matrix.arch }}.tar.gz.sha256
+      - name: Upload to nightly release
+        uses: ncipollo/release-action@v1
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        with:
+          allowUpdates: true
+          tag: nightly
+          omitBodyDuringUpdate: true
+          omitNameDuringUpdate: true
+          prerelease: true
+          replacesArtifacts: true
+          artifacts: "toxcore-nightly-linux-${{ matrix.arch }}.tar.gz,toxcore-nightly-linux-${{ matrix.arch }}.tar.gz.sha256"
+
+  build-macos:
+    name: macOS
+    needs: [prepare]
+    strategy:
+      matrix:
+        arch: [arm64, x86_64]
+    runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-13' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: deps-prefix-macos-${{ matrix.arch }}
+          key: ${{ github.job }}-${{ matrix.arch }}-deps
+      - name: Run build
+        run: other/deploy/macos.sh "${{ matrix.arch }}"
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxcore-macos-${{ matrix.arch }}
+          path: toxcore-macos-${{ matrix.arch }}
+          if-no-files-found: error
+
+  build-ios:
+    name: iOS
+    needs: [prepare]
+    strategy:
+      matrix:
+        target: [ios-arm64, ios-armv7, ios-armv7s, iphonesimulator-arm64, iphonesimulator-x86_64]
+    runs-on: 'macos-14'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: deps-prefix-${{ matrix.target }}
+          key: ${{ github.job }}-${{ matrix.target }}-deps
+      - name: Run build
+        run: other/deploy/ios.sh "${{ matrix.target }}"
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxcore-${{ matrix.target }}
+          path: toxcore-${{ matrix.target }}
+          if-no-files-found: error
+
+  build-xcode-framework:
+    name: Xcode Framework
+    needs: [build-ios, build-macos]
+    runs-on: 'macos-14'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - name: Download artifact for ios
+        uses: actions/download-artifact@v4
+        with:
+          pattern: toxcore-ios-*
+      - name: Download artifact for iphonesimulator
+        uses: actions/download-artifact@v4
+        with:
+          pattern: toxcore-iphonesimulator-*
+      - name: Download artifact for macos
+        uses: actions/download-artifact@v4
+        with:
+          pattern: toxcore-macos-*
+      - name: Run build
+        run: |
+          mv toxcore-* other/deploy/apple/
+          other/deploy/apple/make-framework.sh
+          tar -C other/deploy/apple -zcf toxcore-xcframework.tar.gz Tox.xcframework
+          shasum -a 256 toxcore-xcframework.tar.gz >toxcore-xcframework.tar.gz.sha256
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxcore-xcframework
+          path: other/deploy/apple/Tox.xcframework
+          if-no-files-found: error
+      - name: Get tag name for release file name
+        if: contains(github.ref, 'refs/tags/v')
+        id: get_version
+        run: |
+          VERSION="$(echo "$GITHUB_REF" | cut -d / -f 3)"
+          echo "release_tarball=toxcore-$VERSION-xcframework.tar.gz" >>$GITHUB_OUTPUT
+      - name: Create tarball for release upload
+        if: contains(github.ref, 'refs/tags/v')
+        run: |
+          cp toxcore-xcframework.tar.gz        "${{ steps.get_version.outputs.release_tarball }}"
+          cp toxcore-xcframework.tar.gz.sha256 "${{ steps.get_version.outputs.release_tarball }}.sha256"
+      - name: Upload to versioned release
+        if: contains(github.ref, 'refs/tags/v')
+        uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          draft: true
+          artifacts: "${{ steps.get_version.outputs.release_tarball }},${{ steps.get_version.outputs.release_tarball }}.sha256"
+      - name: Create tarball for nightly upload
+        run: |
+          cp toxcore-xcframework.tar.gz        toxcore-nightly-xcframework.tar.gz
+          cp toxcore-xcframework.tar.gz.sha256 toxcore-nightly-xcframework.tar.gz.sha256
+      - name: Upload to nightly release
+        uses: ncipollo/release-action@v1
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        with:
+          allowUpdates: true
+          tag: nightly
+          omitBodyDuringUpdate: true
+          omitNameDuringUpdate: true
+          prerelease: true
+          replacesArtifacts: true
+          artifacts: "toxcore-nightly-xcframework.tar.gz,toxcore-nightly-xcframework.tar.gz.sha256"
+
+  build-android:
+    name: Android
+    needs: [prepare]
+    strategy:
+      matrix:
+        arch: [armeabi-v7a, arm64-v8a, x86, x86_64]
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: deps-prefix-android-${{ matrix.arch }}
+          key: ${{ github.job }}-${{ matrix.arch }}-deps
+      - name: Run build
+        run: other/deploy/android.sh "${{ matrix.arch }}"
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxcore-android-${{ matrix.arch }}
+          path: toxcore-android-${{ matrix.arch }}
+          if-no-files-found: error
+      - name: Get tag name for release file name
+        if: contains(github.ref, 'refs/tags/v')
+        id: get_version
+        run: |
+          VERSION="$(echo "$GITHUB_REF" | cut -d / -f 3)"
+          echo "release_tarball=toxcore-$VERSION-android-${{ matrix.arch }}.tar.gz" >>$GITHUB_OUTPUT
+      - name: Create tarball for release upload
+        if: contains(github.ref, 'refs/tags/v')
+        run: |
+          tar zcf "${{ steps.get_version.outputs.release_tarball }}" toxcore-android-${{ matrix.arch }}
+          sha256sum "${{ steps.get_version.outputs.release_tarball }}" >"${{ steps.get_version.outputs.release_tarball }}.sha256"
+      - name: Upload to versioned release
+        if: contains(github.ref, 'refs/tags/v')
+        uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          draft: true
+          artifacts: "${{ steps.get_version.outputs.release_tarball }},${{ steps.get_version.outputs.release_tarball }}.sha256"
+      - name: Create tarball for nightly upload
+        run: |
+          tar zcf toxcore-nightly-android-${{ matrix.arch }}.tar.gz toxcore-android-${{ matrix.arch }}
+          sha256sum toxcore-nightly-android-${{ matrix.arch }}.tar.gz >toxcore-nightly-android-${{ matrix.arch }}.tar.gz.sha256
+      - name: Upload to nightly release
+        uses: ncipollo/release-action@v1
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        with:
+          allowUpdates: true
+          tag: nightly
+          omitBodyDuringUpdate: true
+          omitNameDuringUpdate: true
+          prerelease: true
+          replacesArtifacts: true
+          artifacts: "toxcore-nightly-android-${{ matrix.arch }}.tar.gz,toxcore-nightly-android-${{ matrix.arch }}.tar.gz.sha256"
+
+  build-wasm:
+    name: WebAssembly
+    needs: [prepare]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to DockerHub
+        if: ${{ github.event_name == 'push' }}
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          file: other/docker/wasm/wasm.Dockerfile
+          push: ${{ github.event_name == 'push' }}
+          tags: toxchat/c-toxcore:wasm
+          cache-from: type=registry,ref=toxchat/c-toxcore:wasm
+          cache-to: type=inline
+          outputs: type=docker
+      - name: Extract wasm build
+        run: docker run --rm --entrypoint tar toxchat/c-toxcore:wasm -C /wasm/bin -c libtoxcore.js libtoxcore.wasm >toxcore-wasm.tar
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxcore-wasm.tar
+          path: toxcore-wasm.tar
+          if-no-files-found: error
+      - name: Compress tarball
+        run: gzip toxcore-wasm.tar
+      - name: Get tag name for release file name
+        if: contains(github.ref, 'refs/tags/v')
+        id: get_version
+        run: |
+          VERSION="$(echo "$GITHUB_REF" | cut -d / -f 3)"
+          echo "release_tarball=toxcore-$VERSION-wasm.tar.gz" >>$GITHUB_OUTPUT
+      - name: Create tarball for release upload
+        if: contains(github.ref, 'refs/tags/v')
+        run: |
+          cp toxcore-wasm.tar.gz "${{ steps.get_version.outputs.release_tarball }}"
+      - name: Upload to versioned release
+        if: contains(github.ref, 'refs/tags/v')
+        uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          draft: true
+          artifacts: "${{ steps.get_version.outputs.release_tarball }}"
+      - name: Create tarball for nightly upload
+        run: |
+          cp toxcore-wasm.tar.gz toxcore-nightly-wasm.tar.gz
+      - name: Upload to nightly release
+        uses: ncipollo/release-action@v1
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        with:
+          allowUpdates: true
+          tag: nightly
+          omitBodyDuringUpdate: true
+          omitNameDuringUpdate: true
+          prerelease: true
+          replacesArtifacts: true
+          artifacts: "toxcore-nightly-wasm.tar.gz"
+
+  build-single-file:
+    name: Single file
+    needs: [prepare]
+    uses: TokTok/ci-tools/.github/workflows/deploy-artifact.yml@master
+    with:
+      project-name: toxcore
+      artifact-source: toxcore-{av,core}.c
+      artifact-versioned: toxcore-$VERSION-{av,core}.c
+      build: single-file
+      run: |
+        other/deploy/single-file/make_single_file -av >toxcore-av.c
+        other/deploy/single-file/make_single_file -core >toxcore-core.c
+
+  build-tarball:
+    name: Source tarball
+    needs: [prepare]
+    uses: TokTok/ci-tools/.github/workflows/deploy-artifact.yml@master
+    with:
+      project-name: toxcore
+      artifact-source: tox-*.tar.{gz,xz}
+      artifact-versioned: $VERSION.tar.{gz,xz}
+      build: tarball
+      run: |
+        sudo apt-get install -y --no-install-recommends libsodium-dev
+        autoreconf -fi
+        ./configure
+        make dist
+        for f in tox-*.tar.gz; do
+          gunzip -c "$f" | xz -z - >"${f%.gz}.xz"
+        done

.github/workflows/docker.yml

@@ -98,26 +98,6 @@ jobs:
           cache-from: type=registry,ref=toxchat/c-toxcore:fuzzer
           cache-to: type=inline
 
-  docker-toxcore-js:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Login to DockerHub
-        if: ${{ github.event_name == 'push' }}
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          file: other/emscripten/Dockerfile
-          push: ${{ github.event_name == 'push' }}
-          tags: toxchat/c-toxcore:wasm
-          cache-from: type=registry,ref=toxchat/c-toxcore:wasm
-          cache-to: type=inline
-
   docker-esp32:
     runs-on: ubuntu-latest
     steps:

.github/workflows/draft.yml

@@ -0,0 +1,17 @@
+name: draft
+
+on:
+  push:
+    branches: [master]
+  pull_request_target:
+    branches: [master]
+    types: [opened, reopened, synchronize]
+
+# Cancel old builds when pushing new commits.
+concurrency:
+  group: draft-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release:
+    uses: TokTok/ci-tools/.github/workflows/release-drafter.yml@master

.github/workflows/post-submit.yml

@@ -5,15 +5,19 @@ on:
     branches: [master]
 
 jobs:
-  build-alpine-s390x:
-    runs-on: ubuntu-latest
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        tool: [alpine-s390x, freebsd]
+    runs-on: ubuntu-22.04
     steps:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Docker Build
         uses: docker/build-push-action@v5
         with:
-          file: other/docker/alpine-s390x/Dockerfile
+          file: other/docker/${{ matrix.tool }}/${{ matrix.tool }}.Dockerfile
 
   docker-coverage:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -1,12 +1,18 @@
 name: release
 
 on:
-  push:
-    branches: [master]
-  pull_request_target:
-    branches: [master]
-    types: [opened, reopened, synchronize]
+  issues:
+    types: [assigned]
+
+concurrency:
+  group: release-${{ github.event.issue.number }}
+  cancel-in-progress: true
 
 jobs:
   release:
-    uses: TokTok/ci-tools/.github/workflows/release-drafter.yml@master
+    name: Release
+    uses: TokTok/ci-tools/.github/workflows/release-deploy.yml@master
+    with:
+      production: true
+    secrets:
+      TOKEN_RELEASES: ${{ secrets.TOKEN_RELEASES }}