Merge branch 'prebid:master' into master

Author: sebmil-daily

.circleci/config.yml

@@ -5,7 +5,9 @@
 
 	"build": {
 		"dockerfile": "Dockerfile",		
-		"args": { "VARIANT": "12" }
+		"args": {
+			"VARIANT": "18"
+		}
 	},
 
 	"postCreateCommand": "bash .devcontainer/postCreate.sh",

.devcontainer/devcontainer.json

@@ -1,5 +1,8 @@
 echo "Post Create Starting"
 
+export NVM_DIR="/usr/local/share/nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
+
 nvm install
 nvm use
 npm install gulp-cli -g

.devcontainer/postCreate.sh

@@ -0,0 +1,35 @@
+name: Install deb
+description: Download and install a .deb package
+inputs:
+  url:
+    description: URL to the .deb file
+    required: true
+  name:
+    description: A local name for the package. Required if using this action multiple times in the same context.
+    default: package.deb
+    required: false
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore deb
+      id: deb-restore
+      uses: actions/cache/restore@v4
+      with:
+        path: "${{ runner.temp }}/${{ inputs.name }}"
+        key: ${{ inputs.url }}
+    - name: Download deb
+      if: ${{ steps.deb-restore.outputs.cache-hit != 'true'  }}
+      shell: bash
+      run: |
+        wget --no-verbose "${{ inputs.url }}" -O "${{ runner.temp }}/${{ inputs.name }}"
+    - name: Cache deb
+      if: ${{ steps.deb-restore.outputs.cache-hit != 'true' }}
+      uses: actions/cache/save@v4
+      with:
+        path: "${{ runner.temp }}/${{ inputs.name }}"
+        key: ${{ inputs.url }}
+    - name: Install deb
+      shell: bash
+      run: |
+        sudo apt-get install -y --allow-downgrades "${{ runner.temp }}/${{ inputs.name }}"

.github/actions/install-deb/action.yml

@@ -0,0 +1,38 @@
+name: Load working directory
+description: Load working directory saved with "actions/save"
+inputs:
+  name:
+    description: The name used with actions/save
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: '20'
+    - uses: actions/github-script@v8
+      id: platform
+      with:
+        result-encoding: string
+        script: |
+          const os = require('os');
+          return os.platform();
+    - name: 'Clear working directory'
+      shell: bash
+      run: |
+        rm -r "$(pwd)"/*
+
+    - name: Download artifact
+      uses: actions/download-artifact@v5
+      with:
+        path: '${{ runner.temp }}'
+        name: '${{ inputs.name }}'
+
+    - name: 'Untar working directory'
+      shell: bash
+      run: |
+        wdir="$(pwd)"
+        parent="$(dirname "$wdir")"
+        target="$(basename "$wdir")"
+        tar ${{ steps.platform.outputs.result == 'win32' && '--force-local' || '' }} -C "$parent" -xf '${{ runner.temp }}/${{ inputs.name }}.tar' "$target"

.github/actions/load/action.yml

@@ -0,0 +1,23 @@
+name: NPM install
+description: Run npm install and cache dependencies
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore dependencies
+      id: restore-modules
+      uses: actions/cache/restore@v4
+      with:
+        path: "node_modules"
+        key: node_modules-${{ hashFiles('package-lock.json') }}
+    - name: Run npm ci
+      if: ${{ steps.restore-modules.outputs.cache-hit != 'true'  }}
+      shell: bash
+      run: |
+        npm ci
+    - name: Cache dependencies
+      if: ${{ steps.restore-modules.outputs.cache-hit != 'true' }}
+      uses: actions/cache/save@v4
+      with:
+        path: "node_modules"
+        key: node_modules-${{ hashFiles('package-lock.json') }}

.github/actions/npm-ci/action.yml

@@ -0,0 +1,41 @@
+name: Save working directory
+description: Save working directory, preserving permissions
+inputs:
+  prefix:
+    description: Prefix to use for autogenerated names
+    required: false
+  name:
+    description: a name to reference with actions/load
+    required: false
+outputs:
+  name:
+    description: a name to reference with actions/load
+    value: ${{ fromJSON(steps.platform.outputs.result).name }}
+
+runs:
+  using: 'composite'
+  steps:
+    - uses: actions/github-script@v8
+      id: platform
+      with:
+        script: |
+          const os = require('os');
+          const crypto = require("crypto");
+          const id = crypto.randomBytes(16).toString("hex");          
+          return {       
+             name: ${{ inputs.name && format('"{0}"', inputs.name) || format('"{0}" + id', inputs.prefix || '') }},
+             platform: os.platform(),
+          }
+    - name: Tar working directory
+      shell: bash
+      run: |
+        wdir="$(pwd)"
+        parent="$(dirname "$wdir")"
+        target="$(basename "$wdir")"
+        tar ${{ fromJSON(steps.platform.outputs.result).platform == 'win32' && '--force-local' || '' }} -C "$parent" -cf "${{ runner.temp }}/${{ fromJSON(steps.platform.outputs.result).name }}.tar" "$target"
+    - name: Upload artifact
+      uses: actions/upload-artifact@v4
+      with:
+        path: '${{ runner.temp }}/${{ fromJSON(steps.platform.outputs.result).name }}.tar'
+        name: ${{ fromJSON(steps.platform.outputs.result).name }}
+        overwrite: true

.github/actions/save/action.yml

@@ -0,0 +1,27 @@
+name: Wait for browserstack sessions
+description: Wait until enough browserstack sessions have become available
+inputs:
+  sessions:
+    description: Number of sessions needed to continue
+    default: "6"
+runs:
+  using: 'composite'
+  steps:
+    - shell: bash
+      run: |
+        while            
+          status=$(curl -u "${BROWSERSTACK_USERNAME}:${BROWSERSTACK_ACCESS_KEY}" \
+            -X GET "https://api-cloud.browserstack.com/automate/plan.json" 2> /dev/null);
+          running=$(jq '.parallel_sessions_running' <<< $status)
+          max_running=$(jq '.parallel_sessions_max_allowed' <<< $status)
+          queued=$(jq '.queued_sessions' <<< $status)
+          max_queued=$(jq '.queued_sessions_max_allowed' <<< $status)
+          spare=$(( ${max_running} + ${max_queued} - ${running} - ${queued} ))
+          required=${{ inputs.sessions }}
+          echo "Browserstack status: ${running} sessions running, ${queued} queued, ${spare} free"
+          (( ${required} > ${spare} ))
+        do
+          delay=$(( 60 + $(shuf -i 1-60 -n 1) ))
+          echo "Waiting for ${required} sessions to free up, checking again in ${delay}s"
+          sleep $delay
+        done

.github/actions/wait-for-browserstack/action.yml

@@ -0,0 +1,23 @@
+// this file is autogenerated, see fingerprintApis.mjs
+
+class DOMMethod extends string {
+
+  float weight; 
+  string type; 
+  
+  DOMMethod() {
+      
+      ( this = "toDataURL"  and weight = 23.69  and type = "HTMLCanvasElement" )
+       or 
+      ( this = "getChannelData"  and weight = 731.69  and type = "AudioBuffer" )
+  }  
+
+  float getWeight() {
+    result = weight
+  }
+  
+  string getType() {
+    result = type
+  }
+  
+} 

.github/codeql/queries/autogen_fpDOMMethod.qll

@@ -0,0 +1,35 @@
+// this file is autogenerated, see fingerprintApis.mjs
+
+class EventProperty extends string {
+
+  float weight; 
+  string event; 
+  
+  EventProperty() {
+      
+      ( this = "candidate"  and weight = 68.42  and event = "icecandidate" )
+       or 
+      ( this = "acceleration"  and weight = 67.02  and event = "devicemotion" )
+       or 
+      ( this = "rotationRate"  and weight = 66.54  and event = "devicemotion" )
+       or 
+      ( this = "accelerationIncludingGravity"  and weight = 184.27  and event = "devicemotion" )
+       or 
+      ( this = "alpha"  and weight = 355.23  and event = "deviceorientation" )
+       or 
+      ( this = "beta"  and weight = 768.94  and event = "deviceorientation" )
+       or 
+      ( this = "gamma"  and weight = 350.62  and event = "deviceorientation" )
+       or 
+      ( this = "absolute"  and weight = 235.6  and event = "deviceorientation" )
+  }  
+
+  float getWeight() {
+    result = weight
+  }
+  
+  string getEvent() {
+    result = event
+  }
+  
+}