Integrate the deno workflow and the compile checks

.github/workflows/deno.yml

@@ -0,0 +1,49 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow will install Deno then run:
+# - `deno fmt`
+# - `deno lint`
+# - `deno check`
+# For more information see: https://github.com/denoland/setup-deno
+
+name: Deno
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    branches: ["master"]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Setup repo
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Setup Deno
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: latest
+          cache: true
+
+      - name: Verify formatting
+        run: deno fmt --check
+
+      - name: Run linter
+        run: deno lint
+
+      - name: Check types
+        run: deno check --frozen=true *.ts
+
+      # - name: Run tests
+      #   run: deno test -A

.github/workflows/main.yml

@@ -14,6 +14,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
+      with:
+        submodules: recursive
 
     - name: Log in to GitHub Container Registry
       uses: docker/login-action@v3
@@ -41,4 +43,4 @@ jobs:
         platforms: linux/amd64,linux/arm64
         push: true
         tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
+        labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -1,2 +1 @@
-ejs/
-.vscode/
+.vscode/

Dockerfile

@@ -1,39 +1,42 @@
-FROM denoland/deno:latest AS builder
+ARG XDG_CACHE_HOME
 
-WORKDIR /usr/src/app
-
-RUN apt-get update && apt-get install -y git
-
-RUN git clone https://github.com/yt-dlp/ejs.git
-# Pin to a specific commit
-RUN cd ejs && git checkout 2655b1f55f98e5870d4e124704a21f4d793b4e1c && cd ..
-
-COPY scripts/patch-ejs.ts ./scripts/patch-ejs.ts
-RUN deno run --allow-read --allow-write ./scripts/patch-ejs.ts
+FROM denoland/deno:debian AS builder
 
-RUN rm -rf ./ejs/.git ./ejs/node_modules || true
+WORKDIR /usr/src/app
 
 COPY . .
 
 RUN deno compile \
-    --no-check \
     --output server \
     --allow-net --allow-read --allow-write --allow-env \
     --include worker.ts \
     server.ts
 
-RUN mkdir -p /usr/src/app/player_cache && \
-    chown -R deno:deno /usr/src/app/player_cache
+FROM ghcr.io/tcely/docker-tini:main@sha256:0b16fede939249d3783966eba573bac03cf106721df5a63e3555f6b8b0cef074 AS tini-bin
+FROM scratch AS tini
+ARG TARGETARCH TINI_VERSION="0.19.0"
+COPY --from=tini-bin "/releases/v${TINI_VERSION}/tini-static-${TARGETARCH}" /tini
 
-FROM gcr.io/distroless/cc-debian12
+FROM gcr.io/distroless/cc-debian13:debug
+SHELL ["/busybox/busybox", "sh", "-c"]
 
 WORKDIR /app
 
+COPY --from=tini /tini /tini
 COPY --from=builder /usr/src/app/server /app/server
 
-COPY --from=builder --chown=nonroot:nonroot /usr/src/app/player_cache /app/player_cache
 COPY --from=builder --chown=nonroot:nonroot /usr/src/app/docs /app/docs
 
-USER nonroot
+ARG XDG_CACHE_HOME
+ENV XDG_CACHE_HOME="${XDG_CACHE_HOME}"
+# Create the fall-back cache directories
+RUN install -v -d -o nonroot -g nonroot -m 750 \
+        /app/player_cache /home/nonroot/.cache && \
+    test -z "${XDG_CACHE_HOME}" || install -v -d -m 1777 "${XDG_CACHE_HOME}"
+
 EXPOSE 8001
-ENTRYPOINT ["/app/server"]
+USER nonroot
+ENTRYPOINT ["/tini", "--"]
+# Run the server as nonroot even when /tini runs as root
+# CMD ["/busybox/busybox", "su", "-s", "/app/server", "nonroot"]
+CMD ["/app/server"]

README.md

@@ -39,19 +39,16 @@ docker compose up
 
 If you have Deno installed, you can run the service directly.
 
-Clone the repository and patch the `ejs` dependency:
+Clone the repository:
 
 ```bash
 git clone https://github.com/kikkia/yt-cipher.git
-cd yt-cipher
-git clone https://github.com/yt-dlp/ejs.git
-cd ejs
-git checkout 5d7bf090bb9a2a8f3e2dd13ded4a21a009224f87
-cd ..
-deno run --allow-read --allow-write ./scripts/patch-ejs.ts
 ```
 
+Run the server:
+
 ```bash
+cd yt-cipher && \
 deno run --allow-net --allow-read --allow-write --allow-env server.ts
 ```
 NOTE: If using an `.env` file then also add the `--env` flag

deno.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "lib": [ "deno.worker" ]
+  },
+  "fmt": {
+    "include": ["src/", "*.ts"],
+    "indentWidth": 4
+  },
+  "imports": {
+    "@std/cache": "jsr:@std/cache@^0.2.1",
+    "@std/crypto": "jsr:@std/crypto@^0.224.0",
+    "@std/fs": "jsr:@std/fs@^0.224.0",
+    "@std/http": "jsr:@std/http@0.224.5",
+    "@std/path": "jsr:@std/path@^0.224.0",
+    "ejs/": "https://esm.sh/gh/yt-dlp/ejs@0.3.2&standalone/",
+    "ts_prometheus/": "https://esm.sh/gh/marcopacini/ts_prometheus@v0.3.0/"
+  },
+  "lint": {
+    "include": ["src/", "*.ts"]
+  }
+}