ci(security): add Trivy filesystem scan to code scanning

Streamyfin ships no container image, so this runs a Trivy *filesystem* scan
(vulnerable deps, secrets, misconfig) and uploads SARIF to GitHub code scanning,
complementing CodeQL and dependency-review. Runs on push to develop/master,
weekly, and on demand (not on PRs — fork PRs can't upload SARIF, and
dependency-review already gates PR dependencies). Reports findings (CRITICAL/HIGH,
ignore-unfixed) without failing the build; the Security tab surfaces them.

.gitattributes

@@ -1,28 +1 @@
-# Normalise line endings to LF for everyone. Files are stored as LF in git and
+.modules/vlc-player/Frameworks/*.xcframework filter=lfs diff=lfs merge=lfs -text
-# checked out as LF on every OS, so Windows clones stop producing CRLF churn
-# (no more "LF will be replaced by CRLF" warnings) regardless of core.autocrlf.
-* text=auto eol=lf
-
-# Windows-only scripts must stay CRLF
-*.bat text eol=crlf
-*.cmd text eol=crlf
-
-# Binary assets — never touched / never normalised
-*.png binary
-*.jpg binary
-*.jpeg binary
-*.gif binary
-*.webp binary
-*.ico binary
-*.icns binary
-*.ttf binary
-*.otf binary
-*.woff binary
-*.woff2 binary
-*.mp3 binary
-*.mp4 binary
-*.mov binary
-*.pdf binary
-*.keystore binary
-*.jks binary
-*.p12 binary

.github/workflows/crowdin.yml

@@ -1,51 +1,51 @@
-name: 🌐 Translation Sync
+name: 🌐 Translation Sync
-
+
-on:
+on:
-  push:
+  push:
-    branches: [develop]
+    branches: [develop]
-    paths:
+    paths:
-      - "translations/**"
+      - "translations/**"
-      - "crowdin.yml"
+      - "crowdin.yml"
-      - "i18n.ts"
+      - "i18n.ts"
-      - ".github/workflows/crowdin.yml"
+      - ".github/workflows/crowdin.yml"
-  # Run weekly to pull new translations
+  # Run weekly to pull new translations
-  schedule:
+  schedule:
-    - cron: "0 2 * * 1" # Every Monday at 2 AM UTC
+    - cron: "0 2 * * 1" # Every Monday at 2 AM UTC
-  workflow_dispatch:
+  workflow_dispatch:
-
+
-permissions:
+permissions:
-  contents: write
+  contents: write
-  pull-requests: write
+  pull-requests: write
-
+
-jobs:
+jobs:
-  sync-translations:
+  sync-translations:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
-
+
-    steps:
+    steps:
-      - name: 📥 Checkout Repository
+      - name: 📥 Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
+        with:
-          fetch-depth: 0
+          fetch-depth: 0
-
+
-      - name: 🌐 Sync Translations with Crowdin
+      - name: 🌐 Sync Translations with Crowdin
-        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
+        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
-        with:
+        with:
-          upload_sources: true
+          upload_sources: true
-          upload_translations: true
+          upload_translations: true
-          download_translations: true
+          download_translations: true
-          localization_branch_name: I10n_crowdin_translations
+          localization_branch_name: I10n_crowdin_translations
-          create_pull_request: true
+          create_pull_request: true
-          pull_request_title: "feat: New Crowdin Translations"
+          pull_request_title: "feat: New Crowdin Translations"
-          pull_request_body: "New Crowdin translations by [Crowdin GH Action](https://github.com/crowdin/github-action)"
+          pull_request_body: "New Crowdin translations by [Crowdin GH Action](https://github.com/crowdin/github-action)"
-          pull_request_base_branch_name: "develop"
+          pull_request_base_branch_name: "develop"
-          pull_request_labels: "🌐 translation"
+          pull_request_labels: "🌐 translation"
-          # Quality control options
+          # Quality control options
-          skip_untranslated_strings: false
+          skip_untranslated_strings: false
-          skip_untranslated_files: false
+          skip_untranslated_files: false
-          export_only_approved: false
+          export_only_approved: false
-          # Commit customization
+          # Commit customization
-          commit_message: "feat(i18n): update translations from Crowdin"
+          commit_message: "feat(i18n): update translations from Crowdin"
-        env:
+        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

.github/workflows/trivy-scan.yml

@@ -0,0 +1,62 @@
+name: 🛡️ Trivy Security Scan
+
+# Filesystem scan (Streamyfin ships no container image): finds vulnerable dependencies,
+# leaked secrets and misconfigurations, and reports them to GitHub code scanning.
+# Runs post-merge + weekly (not on PRs — dependency-review already gates PRs, and SARIF
+# upload needs a write token that fork PRs don't get).
+on:
+  push:
+    branches: [develop, master]
+    paths:
+      - "package.json"
+      - "bun.lock"
+      - "**/*.ts"
+      - "**/*.tsx"
+      - "**/*.js"
+      - "**/*.jsx"
+      - ".github/workflows/trivy-scan.yml"
+  schedule:
+    - cron: "50 7 * * 5" # Weekly, Friday 07:50 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: trivy-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trivy:
+    name: 🔎 Filesystem scan
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write # upload SARIF to code scanning
+    steps:
+      - name: 📥 Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: 💾 Cache Trivy vulnerability DB
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cache/trivy
+          key: trivy-db-${{ github.run_id }}
+          restore-keys: trivy-db-
+
+      - name: 🔎 Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          scanners: vuln,secret,misconfig
+          ignore-unfixed: true
+          severity: CRITICAL,HIGH
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: 📤 Upload results to code scanning
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          sarif_file: trivy-results.sarif
+          category: trivy-fs

.gitignore

@@ -1,5 +1,6 @@
 # Dependencies and Package Managers
 node_modules/
+bun.lock
 bun.lockb
 package-lock.json
 
@@ -20,8 +21,10 @@ web-build/
 # Gradle caches (top-level + per-module native projects)
 **/.gradle/
 
-# Native module build outputs (any module)
+# Module-specific Builds
-modules/*/android/build/
+modules/mpv-player/android/build
+modules/player/android
+modules/hls-downloader/android/build
 
 # Generated Applications
 Streamyfin.app
@@ -66,6 +69,10 @@ certs/
 
 # Version and Backup Files
 /version-backup-*
+/modules/sf-player/android/build
+/modules/music-controls/android/build
+modules/background-downloader/android/build/*
+/modules/mpv-player/android/build
 
 # ios:unsigned-build Artifacts
 build/

components/video-player/controls/Controls.tv.tsx

@@ -1254,7 +1254,7 @@ export const Controls: FC<Props> = ({
                 <Text
                   style={[styles.endsAtText, { fontSize: typography.callout }]}
                 >
-                  {t("player.ends_at")} {getFinishTime()}
+                  {t("player.ends_at", { time: getFinishTime() })}
                 </Text>
               </View>
             )}
@@ -1448,7 +1448,7 @@ export const Controls: FC<Props> = ({
                 <Text
                   style={[styles.endsAtText, { fontSize: typography.callout }]}
                 >
-                  {t("player.ends_at")} {getFinishTime()}
+                  {t("player.ends_at", { time: getFinishTime() })}
                 </Text>
               </View>
             )}