feat(au): complete audio and MIDI support

.github/workflows/build.yml

@@ -11,11 +11,27 @@ on:
       - master
   workflow_dispatch:
 
+# Packaging a commit that has already been superseded wastes a full macOS
+# universal build. Tags get their own group, so release builds are never
+# cancelled by a subsequent branch push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 defaults:
   run:
     # This otherwise gets run under dash which does not support brace expansion
     shell: bash
 
+env:
+  # See the note in `test.yml`: `portable_simd` is unstable and current
+  # nightlies no longer resolve `std::simd::{LaneCount, SupportedLaneCount}`.
+  # Keep this in sync with `test.yml`.
+  NIGHTLY_TOOLCHAIN: nightly-2025-01-01
+
 jobs:
   # We'll only package the plugins with an entry in bundler.toml
   package:
@@ -28,7 +44,7 @@ jobs:
     name: Package plugin binaries
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Fetch all git history
         run: git fetch --force --prune --tags --unshallow
 
@@ -38,29 +54,32 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libasound2-dev libgl-dev libjack-dev libx11-xcb-dev  libxcb1-dev libxcb-dri2-0-dev libxcb-icccm4-dev libxcursor-dev libxkbcommon-dev libxcb-shape0-dev libxcb-xfixes0-dev
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         # FIXME: Caching `target/` causes the Windows runner to blow up after some time
         if: startsWith(matrix.os, 'windows')
         with:
           path: |
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
-      - uses: actions/cache@v4
+          key: package-${{ matrix.name }}-${{ matrix.cross-target }}-${{ env.NIGHTLY_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: package-${{ matrix.name }}-${{ matrix.cross-target }}-${{ env.NIGHTLY_TOOLCHAIN }}-
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         if: "!startsWith(matrix.os, 'windows')"
         with:
           path: |
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
+          key: package-${{ matrix.name }}-${{ matrix.cross-target }}-${{ env.NIGHTLY_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: package-${{ matrix.name }}-${{ matrix.cross-target }}-${{ env.NIGHTLY_TOOLCHAIN }}-
 
       - name: Set up Rust toolchain
         # Needed for SIMD
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
         with:
+          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
           # The macOS AArch64 build is done from an x86_64 macOS CI runner, so
           # it needs to be cross compiled
           targets: ${{ matrix.cross-target }}
@@ -98,7 +117,7 @@ jobs:
           mv target/bundled/* "$ARCHIVE_NAME/$ARCHIVE_NAME"
       - name: Add an OS-specific readme file with installation instructions
         run: cp ".github/workflows/readme-${{ runner.os }}.txt" "$ARCHIVE_NAME/$ARCHIVE_NAME/README.txt"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ env.ARCHIVE_NAME }}
           path: ${{ env.ARCHIVE_NAME }}

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+  schedule:
+    - cron: '23 3 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - actions
+          - rust
+    permissions:
+      contents: read
+      packages: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      # Rust and GitHub Actions support build-mode none. This covers the full
+      # tracked source and workflow tree without duplicating the expensive
+      # build/test jobs.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-and-quality
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        with:
+          category: /language:${{ matrix.language }}

.github/workflows/docs.yml

@@ -5,17 +5,28 @@ on:
     branches:
       - master
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 defaults:
   run:
     # This otherwise gets run under dash which does not support brace expansion
     shell: bash
 
+env:
+  # See the note in `test.yml`. Keep this in sync with the other workflows.
+  NIGHTLY_TOOLCHAIN: nightly-2025-01-01
+
 jobs:
   docs:
     name: Generate and upload docs
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       # Needed for git-describe to do anything useful
       - name: Fetch all git history
         run: git fetch --force --prune --tags --unshallow
@@ -25,29 +36,25 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libasound2-dev libgl-dev libjack-dev libx11-xcb-dev  libxcb1-dev libxcb-dri2-0-dev libxcb-icccm4-dev libxcursor-dev libxkbcommon-dev libxcb-shape0-dev libxcb-xfixes0-dev
 
-      - uses: actions/cache@v4
-        # FIXME: Caching `target/` causes the Windows runner to blow up after some time
-        if: startsWith(matrix.os, 'windows')
-        with:
-          path: |
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
-      - uses: actions/cache@v4
-        if: "!startsWith(matrix.os, 'windows')"
+      # This job has no matrix, but both cache steps were keyed on
+      # `${{ matrix.name }}-${{ matrix.cross-target }}` and gated on
+      # `matrix.os`, so the key was always the literal `-`.
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
+          key: docs-ubuntu-22.04-${{ env.NIGHTLY_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: docs-ubuntu-22.04-${{ env.NIGHTLY_TOOLCHAIN }}-
 
       - name: Set up Rust toolchain
         # Nightly is needed to document the SIMD feature and for the
         # `doc_auto_cfg` feature
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
       - name: Generate documentation for all targets
         # Don't use --all-features here as that will enable a whole bunch of
         # conflicting iced features. We also don't want to use `--workspace`
@@ -68,7 +75,11 @@ jobs:
           <meta http-equiv="refresh" content="0; url=nih_plug">
           EOF
       - name: Deploy to GitHub Pages
-        uses: JamesIves/github-pages-deploy-action@v4.3.0
+        # The deploy target and its SSH key belong to upstream. On a fork this
+        # step can only fail — the secret is not there — so building the docs
+        # stays useful as a check while publishing is skipped.
+        if: github.repository == 'robbert-vdh/nih-plug'
+        uses: JamesIves/github-pages-deploy-action@360c8e75d0ee81732d0a5675c71e51b569df2ee8 # v4.3.0
         with:
           branch: gh-pages
           folder: target/doc

.github/workflows/test.yml

@@ -6,11 +6,29 @@ on:
     branches:
       - master
 
+# A push that supersedes an in-flight run makes that run's result worthless, and
+# the macOS jobs here are slow enough that queued-but-stale runs delay the ones
+# somebody is actually waiting on.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 defaults:
   run:
     # This otherwise gets run under dash which does not support brace expansion
     shell: bash
 
+env:
+  # `simd` requires a nightly compiler, and `portable_simd` is not a stable API:
+  # `std::simd::{LaneCount, SupportedLaneCount}` no longer resolve on current
+  # nightlies, which broke every job in this workflow. Pin the toolchain so the
+  # build is reproducible, and bump this deliberately once the SIMD adapters in
+  # `src/buffer/` have been ported to the newer API.
+  NIGHTLY_TOOLCHAIN: nightly-2025-01-01
+
 jobs:
   test:
     strategy:
@@ -19,7 +37,7 @@ jobs:
     name: Build and test all components
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       # Needed for git-describe to do anything useful
       - name: Fetch all git history
         run: git fetch --force --prune --tags --unshallow
@@ -30,40 +48,72 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libasound2-dev libgl-dev libjack-dev libx11-xcb-dev  libxcb1-dev libxcb-dri2-0-dev libxcb-icccm4-dev libxcursor-dev libxkbcommon-dev libxcb-shape0-dev libxcb-xfixes0-dev
 
-      - uses: actions/cache@v4
+      # The cache key used to be `${{ matrix.name }}-${{ matrix.cross-target }}`,
+      # neither of which exists in this workflow's matrix, so all three runners
+      # shared the single key `-` and kept overwriting each other's caches with
+      # artifacts for the wrong platform.
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         # FIXME: Caching `target/` causes the Windows runner to blow up after some time
         if: startsWith(matrix.os, 'windows')
         with:
           path: |
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
-      - uses: actions/cache@v4
+          key: test-${{ matrix.os }}-${{ env.NIGHTLY_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: test-${{ matrix.os }}-${{ env.NIGHTLY_TOOLCHAIN }}-
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         if: "!startsWith(matrix.os, 'windows')"
         with:
           path: |
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-          key: ${{ matrix.name }}-${{ matrix.cross-target }}
+          key: test-${{ matrix.os }}-${{ env.NIGHTLY_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: test-${{ matrix.os }}-${{ env.NIGHTLY_TOOLCHAIN }}-
 
       - name: Set up Rust toolchain
         # Needed for SIMD
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
       - name: Run the tests
         # Don't use --all-features as that will enable a whole bunch of
         # conflicting iced features. `--locked` ensures that the lockfile is up
         # to date. We only really need this in one of the builds.
         run: cargo test --locked --workspace --features "simd,standalone,zstd"
 
+      # The Audio Unit wrapper is macOS-only, so the workspace run above never
+      # compiles it. Without this step the AU code — the part of this fork that
+      # upstream does not have — has no CI coverage at all.
+      - name: Test the Audio Unit wrapper
+        if: startsWith(matrix.os, 'macos')
+        run: cargo test --locked --features "au,vst3,zstd"
+
+      # Unit tests cover the selector and packet conversion edge cases. This
+      # also loads the generated aumu through AudioComponent, sends MIDI into
+      # it, renders non-silent audio, and receives the MIDI output callback.
+      - name: Run the Audio Unit MIDI host smoke test
+        if: startsWith(matrix.os, 'macos')
+        run: scripts/au_midi_smoke.sh
+
+      # `nih_debug_assert!` becomes a panicking `debug_assert!` under `cfg(test)`,
+      # so the release behaviour of contract-violating paths is only reachable
+      # from `#[cfg(not(debug_assertions))]` tests. A different set of tests runs
+      # here than in the debug run above; that asymmetry is intentional.
+      - name: Run the release-only tests
+        # These tests are platform-independent. Running them on every matrix
+        # member tripled their cost without increasing coverage.
+        if: startsWith(matrix.os, 'ubuntu')
+        run: cargo test --locked --release --lib --features "standalone,zstd"
+
   # This makes sure that NIH-plug can be compiled without VST3 support
   build-without-vst3:
     name: Build NIH-plug without VST3 support
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Fetch all git history
         run: git fetch --force --prune --tags --unshallow
 
@@ -72,17 +122,20 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libasound2-dev libgl-dev libjack-dev libx11-xcb-dev  libxcb1-dev libxcb-dri2-0-dev libxcb-icccm4-dev libxcursor-dev libxkbcommon-dev libxcb-shape0-dev libxcb-xfixes0-dev
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-          key: build-without-vst3-ubuntu
+          key: build-without-vst3-ubuntu-${{ env.NIGHTLY_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: build-without-vst3-ubuntu-${{ env.NIGHTLY_TOOLCHAIN }}-
 
       - name: Set up Rust toolchain
         # Needed for SIMD
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
       - name: Run the tests
         run: cargo build --no-default-features