Merge latest from aswf main

Signed-off-by: Philippe Leprince <github.pleprince@gmail.com>
AcademySoftwareFoundation · Apr 2, 2024 · 21c60db · 21c60db
2 parents 6cfc3cc + 509a227
commit 21c60db
Show file tree

Hide file tree

Showing 309 changed files with 13,332 additions and 5,301 deletions.
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
@@ -6,3 +6,5 @@
 
 # initial clang-format run
 2a24ae77ab94f4c06b102eba73feb52e2f90cb46
+# clang-format run 17-Mar-2024
+84f58b85aef7a7844f0d3bfb1301e778eb22e42c
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright (c) Contributors to the OpenEXR Project.
+
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      day: "monday"
+      interval: "weekly"
+
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      day: "monday"
+      interval: "weekly"
diff --git a/.github/workflows/analysis_workflow.yml b/.github/workflows/analysis_workflow.yml
@@ -22,14 +22,14 @@ jobs:
   # ---------------------------------------------------------------------------
 
   linux_sonarcloud:
-    name: 'SonarCloud Linux CentOS 7 VFX CY2022 <GCC 9.3.1>'
+    name: 'SonarCloud Linux CentOS 7 VFX CY2024 <GCC 11.2.1>'
     if: github.repository == 'AcademySoftwareFoundation/openexr'
     # GH-hosted VM. The build runs in CentOS 7 'container' defined below.
     runs-on: ubuntu-latest
     container:
       # DockerHub: https://hub.docker.com/u/aswf
       # Source: https://github.com/AcademySoftwareFoundation/aswf-docker
-      image: aswf/ci-openexr:2022
+      image: aswf/ci-openexr:2024
     env:
       CXX: g++
       CC: gcc
@@ -51,7 +51,7 @@ jobs:
           cmake .. \
                 -DCMAKE_INSTALL_PREFIX=../_install \
                 -DCMAKE_BUILD_TYPE=Release \
-                -DCMAKE_CXX_STANDARD=14 \
+                -DCMAKE_CXX_STANDARD=17 \
                 -DCMAKE_CXX_FLAGS="-g -O0 -fprofile-arcs -ftest-coverage" \
                 -DCMAKE_CXX_OUTPUT_EXTENSION_REPLACE=ON \
                 -DCMAKE_C_FLAGS="-g -O0 -fprofile-arcs -ftest-coverage" \
@@ -92,14 +92,14 @@ jobs:
   #  Valgrind memcheck test
   # ------------------------------------------------------------------------------
   linux_valgrind:
-    name: 'Valgrind Linux CentOS 7 VFX CY2022 <GCC 9.3.1>'
+    name: 'Valgrind Linux CentOS 7 VFX CY2024 <GCC 11.2.1>'
     if: github.repository == 'AcademySoftwareFoundation/openexr'
     # GH-hosted VM. The build runs in CentOS 7 'container' defined below.
     runs-on: ubuntu-latest
     container:
       # DockerHub: https://hub.docker.com/u/aswf
       # Source: https://github.com/AcademySoftwareFoundation/aswf-docker
-      image: aswf/ci-openexr:2022
+      image: aswf/ci-openexr:2024
     env:
       CXX: g++
       CC: gcc
@@ -126,7 +126,7 @@ jobs:
           cmake .. \
                 -DCMAKE_INSTALL_PREFIX=../_install \
                 -DCMAKE_BUILD_TYPE=Release \
-                -DCMAKE_CXX_STANDARD=14 \
+                -DCMAKE_CXX_STANDARD=17 \
                 -DCMAKE_VERBOSE_MAKEFILE:BOOL='OFF' \
                 -DBUILD_SHARED_LIBS='OFF' \
                 -DOPENEXR_BUILD_TOOLS='ON' \
@@ -157,14 +157,14 @@ jobs:
   #  Fuzz test
   # ------------------------------------------------------------------------------
   linux_fuzz:
-    name: 'Fuzz Test ${{ matrix.build-descrip }} Linux CentOS 7 VFX CY2022 <GCC 9.3.1>'
+    name: 'Fuzz Test ${{ matrix.build-descrip }} Linux CentOS 7 VFX CY2024 <GCC 11.2.1>'
     if: github.repository == 'AcademySoftwareFoundation/openexr'
     # GH-hosted VM. The build runs in CentOS 7 'container' defined below.
     runs-on: ubuntu-latest
     container:
       # DockerHub: https://hub.docker.com/u/aswf
       # Source: https://github.com/AcademySoftwareFoundation/aswf-docker
-      image: aswf/ci-openexr:2022
+      image: aswf/ci-openexr:2024
     strategy:
       matrix:
         build: [1, 2]
@@ -201,7 +201,7 @@ jobs:
           cmake .. \
                 -DCMAKE_INSTALL_PREFIX=../_install \
                 -DCMAKE_BUILD_TYPE=Release \
-                -DCMAKE_CXX_STANDARD=14 \
+                -DCMAKE_CXX_STANDARD=17 \
                 -DCMAKE_VERBOSE_MAKEFILE:BOOL='OFF' \
                 -DBUILD_SHARED_LIBS='OFF' \
                 -DOPENEXR_BUILD_TOOLS='ON' \

diff --git a/.github/workflows/ci_workflow.yml b/.github/workflows/ci_workflow.yml
@@ -6,40 +6,35 @@
 
 name: CI
 
-# Skip the run on *.md changes and on changes to the website, *except*
-# for "website/src", since that code needs validation.  There's a
-# separate workflow for with website. Also, no need to run on changes
-# to the bazel setup.
+# Run on all changes except:
+# - doc file changes
+# - changes to the website, *except* for "website/src", since that
+#   code needs validation.  The website has a separate workflow
+# - changes to the bazel config, since it has its own workflow
+# - changes to the python bindings
+# - changes to workflows other than this one
 
 on:
   push:
-    branches-ignore:
-      - RB-2.*
-    tags-ignore:
-      - v1.*
-      - v2.*
     paths:
       - '**'
       - '!**.md'
       - '!website/**'
       - 'website/src/**'
       - '!bazel/**'
       - '!src/wrappers/**'
-      - '!.github/workflows/python-**.yml'
+      - '!.github/workflows/**'
+      - '.github/workflows/ci_workflow.yml'
   pull_request:
-    branches-ignore:
-      - RB-2.*
-    tags-ignore:
-      - v1.*
-      - v2.*
     paths:
       - '**'
       - '!**.md'
       - '!website/**'
       - 'website/src/**'
       - '!bazel/**'
       - '!src/wrappers/**'
-      - '!.github/workflows/python-**.yml'
+      - '!.github/workflows/**'
+      - '.github/workflows/ci_workflow.yml'
 
 permissions:
   contents: read

diff --git a/.github/workflows/release-notice.yml b/.github/workflows/release-notice.yml
@@ -9,6 +9,9 @@ on:
       - published
       # published should cover both 'released' and 'prereleased'
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/release-sign.yml b/.github/workflows/release-sign.yml
@@ -22,33 +22,45 @@ on:
     types: [published]
 
 permissions:
-  contents: write
-  id-token: write
-  repository-projects: write
+  contents: read
 
 jobs:
   release:
     name: Sign & upload release artifacts
     runs-on: ubuntu-latest
 
     env:
-       tarball: openexr-${{ github.ref_name }}.tar.gz
+       TAG: ${{ github.ref_name }}
+    permissions:
+      contents: write
+      id-token: write
+      repository-projects: write
 
     steps:
 
+      - name: Set Prefix
+        # The tag name begins with a 'v', e.g. "v3.2.4", but the prefix
+        # should omit the 'v', so the tarball "openexr-3.2.4.tar.gz"
+        # extracts files into "openexr-v3.2.4/...".  This matches
+        # the GitHub release page autogenerated artifact conventions.
+        run: |
+          echo OPENEXR_PREFIX=openexr-${TAG//v}/ >> $GITHUB_ENV
+          echo OPENEXR_TARBALL=openexr-${TAG//v}.tar.gz >> $GITHUB_ENV
+        shell: bash
+
       - name: Checkout
         uses: actions/checkout@v2
 
       - name: Create archive
-        run: git archive --format=tar.gz -o ${{ env.tarball }} ${{ github.ref_name }}
+        run: git archive --format=tar.gz -o ${OPENEXR_TARBALL} --prefix ${OPENEXR_PREFIX} ${TAG}
 
       - name: Sign archive with Sigstore
         uses: sigstore/gh-action-sigstore-python@v2.1.1
         with:
-          inputs: ${{ env.tarball }}
+          inputs: ${{ env.OPENEXR_TARBALL }}
 
       - name: Upload release archive
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release upload ${{ github.ref_name }} ${{ env.tarball }} ${{ env.tarball }}.sigstore
+        run: gh release upload ${{ github.ref_name }} ${OPENEXR_TARBALL} ${OPENEXR_TARBALL}.sigstore
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
         with:
           results_file: results.sarif
           results_format: sarif

diff --git a/.github/workflows/snyk-scan-cron.yml b/.github/workflows/snyk-scan-cron.yml
@@ -9,9 +9,13 @@ on:
   schedule:
     - cron: "0 4 * * 0"
 
+permissions:
+  contents: read
+
 jobs:
   snyk-scan-pr:
     runs-on: ubuntu-latest
+    if: github.repository == 'AcademySoftwareFoundation/openexr'
     steps:
       - uses: actions/checkout@v4
 

diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
@@ -0,0 +1,72 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright (c) Contributors to the OpenEXR Project.
+#
+# GitHub Actions workflow file
+# https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions
+
+name: Website
+
+# Run only on changes in the "website" directory or workflow file.
+# Skip the release branches, since the website is built from main.
+#
+# Readthedocs builds the website on ubuntu-20.04, so technically
+# that's the only system that requires the website to build properly,
+# but developers contributing to the website may work on Windows or
+# macOS, so this confirms that it builds properly there, too.
+#
+# Note that this does not build the OpenEXR libraries, it only runs
+# doxygen and sphinx to generate the website html.
+#
+
+on:
+
+  push:
+    branches-ignore:
+      - RB-*
+    paths:
+      - 'website/**'
+      - '.github/workflows/website_workflow.yml'
+
+  pull_request:
+    branches-ignore:
+      - RB-*
+    paths:
+      - 'website/**'
+      - '.github/workflows/website_workflow.yml'
+
+permissions:
+  contents: read
+
+jobs:
+
+  Website:
+
+    name: "Website"
+
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-20.04, macos-latest, windows-latest]
+
+    env:
+      # doxygen 1.10 causes sphinx to fail, so pin to 1.9 for now.
+      DOXYGEN_VERSION: 1.9.1
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Create build directory
+        run: mkdir _build
+      - name: Install doxygen
+        run: ./website/scripts/install_doxygen.sh ${DOXYGEN_VERSION} 
+        shell: bash
+      - name: Install sphinx requirements
+        run: pip3 install -r website/requirements.txt
+      - name: Configure
+        run: cmake .. -DBUILD_WEBSITE=ON -DCMAKE_VERBOSE_MAKEFILE=ON
+        working-directory: _build
+      - name: Build
+        run: cmake --build . --target website --config Release
+        working-directory: _build
+
+
diff --git a/.github/workflows/website_workflow.yml b/.github/workflows/website_workflow.yml