Merge commit '6bd7fac875d9e9009915053d8a590abb372c5679' into feature/livekit-upgrade-1.13.1

livekit-server/.github/workflows/buildtest.yaml

@@ -14,6 +14,9 @@
 
 name: Test
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -25,17 +28,17 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: shogo82148/actions-setup-redis@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: shogo82148/actions-setup-redis@2f3253b148c73d7a0682eae73e862b777a4fa74e # v1
         with:
           redis-version: "6.x"
           auto-start: true
       - run: redis-cli ping
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version-file: "go.mod"
+          go-version: "^1.26"
 
       - name: Set up gotestfmt
         run: go install github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@v2.4.1
@@ -45,22 +48,21 @@ jobs:
           go get github.com/sasha-s/go-deadlock
           grep -rl sync.Mutex ./pkg | xargs sed -i 's/sync\.Mutex/deadlock\.Mutex/g'
           grep -rl sync.RWMutex ./pkg | xargs sed -i 's/sync\.RWMutex/deadlock\.RWMutex/g'
-          go install golang.org/x/tools/cmd/goimports
+          go install golang.org/x/tools/cmd/goimports@latest
           grep -rl deadlock.Mutex ./pkg | xargs goimports -w
           grep -rl deadlock.RWMutex ./pkg | xargs goimports -w
           go mod tidy
 
       - name: Mage Build
-        uses: magefile/mage-action@v3
+        uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4
         with:
           version: latest
           args: build
 
-      - name: Static Check
-        uses: amarpal/staticcheck-action@master
+      - name: Lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
-          checks: '["all", "-ST1000", "-ST1003", "-ST1020", "-ST1021", "-ST1022", "-SA1019"]'
-          install-go: false
+          version: v2.11.4
 
       - name: Test
         run: |
@@ -69,7 +71,7 @@ jobs:
 
       # Upload the original go test log as an artifact for later review.
       - name: Upload test log
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: always()
         with:
           name: test-log

livekit-server/.github/workflows/docker.yaml

@@ -14,6 +14,9 @@
 
 name: Release to Docker
 
+permissions:
+  contents: read
+
 # Controls when the action will run.
 on:
   workflow_dispatch:
@@ -26,10 +29,10 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           # list of Docker images to use as base name for tags
           images: |
@@ -41,7 +44,7 @@ jobs:
             type=semver,pattern=v{{major}}.{{minor}}
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: "go.mod"
 
@@ -49,24 +52,24 @@ jobs:
         run: go mod download
 
       - name: Generate code
-        uses: magefile/mage-action@v3
+        uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4
         with:
           version: latest
           args: generate
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push
         id: docker_build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

livekit-server/.github/workflows/release.yaml

@@ -28,17 +28,17 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Fetch all tags
         run: git fetch --force --tags
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: "go.mod"
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
         with:
           distribution: goreleaser
           version: '~> v2'

livekit-server/.github/workflows/slack-notifier.yaml

@@ -0,0 +1,25 @@
+name: PR Slack Notifier
+
+on:
+  pull_request:
+    types: [review_requested, reopened, closed]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+concurrency:
+  group: pr-slack-${{ github.event.pull_request.number }}-${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  notify-devs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: livekit/slack-notifier-action@main
+        with:
+          config_json: ${{ secrets.SLACK_NOTIFY_CONFIG_JSON }}
+          slack_token: ${{ secrets.SLACK_PR_NOTIFIER_TOKEN }}