feat: add workflow to update build-deps submodule

Author: ReenigneArcher

.github/workflows/__update-build-deps.yml

@@ -0,0 +1,145 @@
+---
+# Update a repository's build-deps submodule to the latest tag and refresh related prebuilt dependencies.
+
+name: Update build-deps
+permissions: {}
+
+on:
+  workflow_dispatch:
+    inputs:
+      repo:
+        description: 'Repository to update.'
+        required: true
+        type: choice
+        options:
+          - Sunshine
+
+jobs:
+  update-build-deps:
+    name: Update build-deps - ${{ inputs.repo }}
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          repository: ${{ github.repository_owner }}/${{ inputs.repo }}
+          token: ${{ secrets.GH_BOT_TOKEN }}
+          fetch-depth: 0
+          path: repo
+
+      - name: Update build-deps
+        id: update-build-deps
+        working-directory: repo
+        run: |
+          git submodule update --init third-party/build-deps
+          git -C third-party/build-deps fetch --force --tags origin
+
+          current_commit=$(git -C third-party/build-deps rev-parse HEAD)
+          latest_tag=$(git -C third-party/build-deps tag --sort=-version:refname | sed -n '1p')
+
+          if [ -z "${latest_tag}" ]; then
+            echo "No build-deps tags were found."
+            exit 1
+          fi
+
+          latest_commit=$(git -C third-party/build-deps rev-list -n 1 "${latest_tag}")
+          echo "version=${latest_tag}" >> "${GITHUB_OUTPUT}"
+
+          if [ "${current_commit}" = "${latest_commit}" ]; then
+            echo "build-deps is already at ${latest_tag}."
+            echo "updated=false" >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+
+          git -C third-party/build-deps checkout --detach "${latest_tag}"
+          echo "updated=true" >> "${GITHUB_OUTPUT}"
+
+      - name: Get build-deps release
+        id: get-release
+        if: steps.update-build-deps.outputs.updated == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        env:
+          BUILD_DEPS_VERSION: ${{ steps.update-build-deps.outputs.version }}
+        with:
+          github-token: ${{ secrets.GH_BOT_TOKEN }}
+          script: |
+            const release = await github.rest.repos.getReleaseByTag({
+              owner: context.repo.owner,
+              repo: 'build-deps',
+              tag: process.env.BUILD_DEPS_VERSION
+            });
+
+            core.setOutput('body', release.data.body || '');
+
+      - name: Update Flatpak FFmpeg prebuilts
+        if: steps.update-build-deps.outputs.updated == 'true'
+        env:
+          BUILD_DEPS_VERSION: ${{ steps.update-build-deps.outputs.version }}
+        working-directory: repo
+        run: |
+          module=packaging/linux/flatpak/modules/ffmpeg.json
+          release_url="https://github.com/LizardByte/build-deps/releases/download/${BUILD_DEPS_VERSION}"
+
+          if [ ! -f "${module}" ]; then
+            echo "Flatpak FFmpeg module not found at ${module}."
+            exit 1
+          fi
+
+          for arch in x86_64 aarch64; do
+            matches=$(jq --arg arch "${arch}" \
+              '[.sources[] | select(.["only-arches"] == [$arch])] | length' "${module}")
+            if [ "${matches}" -ne 1 ]; then
+              echo "Expected one Flatpak FFmpeg source for ${arch}, found ${matches}."
+              exit 1
+            fi
+          done
+
+          x86_64_url="${release_url}/Linux-x86_64-ffmpeg.tar.gz"
+          aarch64_url="${release_url}/Linux-aarch64-ffmpeg.tar.gz"
+
+          download_and_hash() {
+            local arch="$1"
+            local url="$2"
+            local output="${RUNNER_TEMP}/Linux-${arch}-ffmpeg.tar.gz"
+
+            curl --fail --location --silent --show-error --retry 3 "${url}" --output "${output}"
+            sha256sum "${output}" | awk '{print $1}'
+          }
+
+          x86_64_sha=$(download_and_hash x86_64 "${x86_64_url}")
+          aarch64_sha=$(download_and_hash aarch64 "${aarch64_url}")
+
+          jq \
+            --arg x86_64_url "${x86_64_url}" \
+            --arg x86_64_sha "${x86_64_sha}" \
+            --arg aarch64_url "${aarch64_url}" \
+            --arg aarch64_sha "${aarch64_sha}" \
+            '
+              .sources |= map(
+                if .["only-arches"] == ["x86_64"] then
+                  .url = $x86_64_url | .sha256 = $x86_64_sha
+                elif .["only-arches"] == ["aarch64"] then
+                  .url = $aarch64_url | .sha256 = $aarch64_sha
+                else
+                  .
+                end
+              )
+            ' "${module}" > "${RUNNER_TEMP}/ffmpeg.json"
+          mv "${RUNNER_TEMP}/ffmpeg.json" "${module}"
+
+      - name: Create/Update Pull Request
+        id: create-pr
+        if: steps.update-build-deps.outputs.updated == 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
+        with:
+          author: "${{ vars.GH_BOT_NAME }} <${{ secrets.GH_BOT_EMAIL }}>"
+          committer: "${{ vars.GH_BOT_NAME }} <${{ secrets.GH_BOT_EMAIL }}>"
+          path: "repo"
+          token: ${{ secrets.GH_BOT_TOKEN }}
+          commit-message: "chore(deps): Update build-deps to ${{ steps.update-build-deps.outputs.version }}"
+          branch: bot/bump-build-deps-${{ steps.update-build-deps.outputs.version }}
+          delete-branch: true
+          title: "chore(deps): Update build-deps to ${{ steps.update-build-deps.outputs.version }}"
+          body: ${{ steps.get-release.outputs.body }}
+          labels: dependencies