From 42fd1fc94458e82a5b4d6a500695cc725ee93a82 Mon Sep 17 00:00:00 2001
From: Cyril Achard <cyril.achard@epfl.ch>
Date: Wed, 8 Apr 2026 16:42:30 +0200
Subject: [PATCH 1/3] Pin Windows FFmpeg build and use literal paths

Pin the Windows FFmpeg installer to a specific monthly BtbN build (FFMPEG_TAG) and switch from the "latest" releases download to the tagged /download/$tag URL. Harden PowerShell file operations by using -LiteralPath for Test-Path, Remove-Item, Get-Content, Get-FileHash, Expand-Archive and Get-ChildItem, add safer Remove-Item handling, and fail if no extracted FFmpeg directory is found. These changes improve reproducibility and make the downloader more robust against path/filename edge cases.
---
 .github/workflows/python-package.yml | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index b9eed63c6f..52183564a3 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -124,16 +124,19 @@ jobs:
           elif [ "$RUNNER_OS" == "macOS" ]; then
             brew install ffmpeg || true
           fi
-      - name: Install ffmpeg (Windows, BtbN latest)
+      - name: Install ffmpeg (Windows, pinned monthly BtbN build)
         if: runner.os == 'Windows'
         shell: pwsh
         env:
+          FFMPEG_TAG: autobuild-2026-03-31-13-11
           FFMPEG_ASSET: ffmpeg-master-latest-win64-gpl-shared.zip
         run: |
           $ErrorActionPreference = "Stop"
 
+          $tag = $env:FFMPEG_TAG
           $asset = $env:FFMPEG_ASSET
-          $baseUrl = "https://github.com/BtbN/FFmpeg-Builds/releases/latest/download"
+
+          $baseUrl = "https://github.com/BtbN/FFmpeg-Builds/releases/download/$tag"
           $url = "$baseUrl/$asset"
           $checksumsUrl = "$baseUrl/checksums.sha256"
 
@@ -142,13 +145,15 @@ jobs:
           $checksums = Join-Path $tmpRoot "checksums.sha256"
           $dest = Join-Path $tmpRoot "ffmpeg"
 
-          if (Test-Path $tmpRoot) { Remove-Item -Recurse -Force $tmpRoot }
+          if (Test-Path -LiteralPath $tmpRoot) {
+            Remove-Item -LiteralPath $tmpRoot -Recurse -Force
+          }
           New-Item -ItemType Directory -Path $tmpRoot | Out-Null
 
           Invoke-WebRequest -Uri $url -OutFile $zip
           Invoke-WebRequest -Uri $checksumsUrl -OutFile $checksums
 
-          $expected = Get-Content -Path $checksums |
+          $expected = Get-Content -LiteralPath $checksums |
             ForEach-Object {
               if ($_ -match '^(?<sha>[0-9A-Fa-f]{64})\s+\*?(?<name>.+)$' -and $matches.name.Trim() -eq $asset) {
                 $matches.sha.ToLowerInvariant()
@@ -160,14 +165,16 @@ jobs:
             throw "Could not find checksum for $asset in $checksums"
           }
 
-          $actual = (Get-FileHash -Path $zip -Algorithm SHA256).Hash.ToLowerInvariant()
+          $actual = (Get-FileHash -LiteralPath $zip -Algorithm SHA256).Hash.ToLowerInvariant()
           if ($actual -ne $expected) {
             throw "FFmpeg checksum mismatch. Expected $expected but got $actual"
           }
 
-          Expand-Archive -Path $zip -DestinationPath $dest -Force
-          $ffdir = Get-ChildItem -Path $dest -Directory | Select-Object -First 1
-          if (-not $ffdir) { throw "Could not find extracted FFmpeg directory." }
+          Expand-Archive -LiteralPath $zip -DestinationPath $dest -Force
+          $ffdir = Get-ChildItem -LiteralPath $dest -Directory | Select-Object -First 1
+          if (-not $ffdir) {
+            throw "Could not find extracted FFmpeg directory."
+          }
 
           $binDir = Join-Path $ffdir.FullName "bin"
           $binDir | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

From 347e545532e73f2c98219cd584bc6f7203d1cc2e Mon Sep 17 00:00:00 2001
From: Cyril Achard <cyril.achard@epfl.ch>
Date: Wed, 8 Apr 2026 16:43:41 +0200
Subject: [PATCH 2/3] Update python-package.yml

---
 .github/workflows/python-package.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index 52183564a3..ff5cf82ea8 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -125,6 +125,8 @@ jobs:
             brew install ffmpeg || true
           fi
       - name: Install ffmpeg (Windows, pinned monthly BtbN build)
+      # NOTE: The pinned version should be retained for ~2 years. This WILL fail if the BtbN release is removed,
+      # so if you are two years in the future and this step fails, please check the builds. Thanks.
         if: runner.os == 'Windows'
         shell: pwsh
         env:

From b93ab9fdcb080cbde01e0950a24ac118dbc198ec Mon Sep 17 00:00:00 2001
From: Cyril Achard <cyril.achard@epfl.ch>
Date: Wed, 8 Apr 2026 17:22:13 +0200
Subject: [PATCH 3/3] Point to proper file for March 26 release

---
 .github/workflows/python-package.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index ff5cf82ea8..f1b01d9a35 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -131,7 +131,7 @@ jobs:
         shell: pwsh
         env:
           FFMPEG_TAG: autobuild-2026-03-31-13-11
-          FFMPEG_ASSET: ffmpeg-master-latest-win64-gpl-shared.zip
+          FFMPEG_ASSET: ffmpeg-N-123777-g53537f6cf5-win64-gpl-shared.zip
         run: |
           $ErrorActionPreference = "Stop"