Merge branch 'develop' into ci/artifact-comment-eta-dropdown

Each build job now nudges artifact-comment.yml via `gh workflow run` when
it finishes, so the PR build-status comment reflects real per-platform
progress (e.g. Android complete while iOS still building) instead of a
single stale snapshot taken when the PR was pushed.

Why this works:
- workflow_dispatch always creates a run even when triggered by the
  GITHUB_TOKEN (unlike most events), so no PAT is needed.
- No dispatch inputs are required: artifact-comment's existing
  workflow_dispatch handler resolves the PR from the dispatched ref's
  head sha (context.sha).
- artifact-comment's concurrency group is keyed by head sha for dispatch
  runs, so cancel-in-progress collapses simultaneous nudges — the comment
  can't be spammed, the latest state always wins.

The dispatch lives in a local composite action
(.github/actions/refresh-pr-comment) so the security-sensitive call sits
in one place; each build job invokes it in a single line. The action is
guarded to same-repo pull_request runs (fork tokens are read-only and
cannot dispatch), is continue-on-error so a nudge never fails a build,
and passes head_ref via an env var (never interpolated into the shell).

Adds `actions: write` to the build jobs for the dispatch call.

.github/actions/refresh-pr-comment/action.yml

@@ -0,0 +1,21 @@
+name: Refresh PR build comment
+description: >-
+  Nudge artifact-comment.yml (via workflow_dispatch) so the PR build-status
+  comment reflects live per-platform progress as each build job finishes.
+
+runs:
+  using: composite
+  steps:
+    # workflow_dispatch fires even when triggered by the GITHUB_TOKEN, and
+    # artifact-comment's concurrency group collapses simultaneous nudges, so
+    # this can't spam the comment. Skipped on forks (their read-only token
+    # cannot dispatch). github.token is used because composite actions cannot
+    # read the secrets context.
+    - if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+      continue-on-error: true
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        HEAD_REF: ${{ github.head_ref }}
+        REPO: ${{ github.repository }}
+      run: gh workflow run artifact-comment.yml --ref "$HEAD_REF" -R "$REPO"

.github/workflows/artifact-comment.yml

@@ -144,7 +144,7 @@ jobs:
               )
               .sort((a, b) => new Date(b.created_at) - new Date(a.created_at));
 
-            console.log(`Found ${buildRuns.length} non-cancelled build workflow runs for this commit`);
+            console.log(`Found ${buildRuns.length} build workflow runs for this commit`);
 
             // Log current status of each build for debugging
             buildRuns.forEach(run => {
@@ -184,21 +184,35 @@ jobs:
             const latestAndroidRun = findBestRun('Android APK Build');
             const latestIOSRun = findBestRun('iOS IPA Build');
 
+            // Map our build targets to their job display names. Exact name is
+            // tried first so a signed target never collides with its
+            // "(Unsigned)" sibling (whose name contains the signed name).
+            const jobMappings = {
+              'Android Phone': ['🤖 Build Android APK (Phone)'],
+              'Android TV': ['🤖 Build Android APK (TV)'],
+              'iOS': ['🍎 Build iOS IPA (Phone)'],
+              'iOS Unsigned': ['🍎 Build iOS IPA (Phone - Unsigned)'],
+              'tvOS': ['🍎 Build tvOS IPA'],
+              'tvOS Unsigned': ['🍎 Build tvOS IPA (Unsigned)']
+            };
+
+            // Prefer an exact name match over a substring match so
+            // '...(Phone)' doesn't swallow '...(Phone - Unsigned)'.
+            const findJobForTarget = (jobs, jobNames) =>
+              jobs.find(j => jobNames.some(name => j.name === name)) ||
+              jobs.find(j => jobNames.some(name => j.name.includes(name)));
+
+            // Format a millisecond duration as "Xm Ys".
+            const fmtDuration = (ms) => {
+              const min = Math.floor(ms / 60000);
+              const sec = Math.floor((ms % 60000) / 1000);
+              return `${min}m ${sec}s`;
+            };
+
             // For the consolidated workflow, get individual job statuses
             if (latestAppsRun) {
               console.log(`Getting individual job statuses for run ${latestAppsRun.id} (status: ${latestAppsRun.status}, conclusion: ${latestAppsRun.conclusion || 'none'})`);
               
-              // Map job names to our build targets. Declared outside the try so
-              // the catch fallback can reuse the same keys.
-              const jobMappings = {
-                'Android Phone': ['🤖 Build Android APK (Phone)', 'build-android-phone'],
-                'Android TV': ['🤖 Build Android APK (TV)', 'build-android-tv'],
-                'iOS': ['🍎 Build iOS IPA (Phone)', 'build-ios-phone'],
-                'iOS Unsigned': ['🍎 Build iOS IPA (Phone - Unsigned)', 'build-ios-phone-unsigned'],
-                'tvOS': ['🍎 Build tvOS IPA', 'build-ios-tv'],
-                'tvOS Unsigned': ['🍎 Build tvOS IPA (Unsigned)', 'build-ios-tv-unsigned']
-              };
-
               try {
                 // Get all jobs for this workflow run
                 const { data: jobs } = await github.rest.actions.listJobsForWorkflowRun({
@@ -229,9 +243,7 @@ jobs:
                 
                 // Create individual status for each job
                 for (const [platform, jobNames] of Object.entries(jobMappings)) {
-                  const job = jobs.jobs.find(j => 
+                  const job = findJobForTarget(jobs.jobs, jobNames);
-                    jobNames.some(name => j.name.includes(name) || j.name === name)
-                  );
 
                   if (job) {
                     buildStatuses[platform] = {
@@ -358,6 +370,43 @@ jobs:
               console.log(`- Artifact: ${artifact.name} (from run ${artifact.workflow_run.id})`);
             });
 
+            // Pull per-job durations from the latest successful develop build so
+            // in-progress / queued targets can show a realistic ETA instead of
+            // an open-ended spinner. Best-effort: any failure just drops the ETA.
+            let referenceDurations = {};
+            try {
+              const { data: devRuns } = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'build-apps.yml',
+                branch: 'develop',
+                status: 'success',
+                per_page: 1
+              });
+
+              if (devRuns.workflow_runs.length > 0) {
+                const refRun = devRuns.workflow_runs[0];
+                const { data: refJobs } = await github.rest.actions.listJobsForWorkflowRun({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  run_id: refRun.id
+                });
+
+                for (const [platform, jobNames] of Object.entries(jobMappings)) {
+                  const job = findJobForTarget(refJobs.jobs, jobNames);
+                  if (job && job.conclusion === 'success' && job.started_at && job.completed_at) {
+                    referenceDurations[platform] = new Date(job.completed_at) - new Date(job.started_at);
+                  }
+                }
+                console.log(`Reference durations from develop run ${refRun.id}:`,
+                  Object.fromEntries(Object.entries(referenceDurations).map(([k, v]) => [k, fmtDuration(v)])));
+              } else {
+                console.log('No successful develop build found for ETA reference');
+              }
+            } catch (error) {
+              console.log('Failed to fetch develop reference durations:', error.message);
+            }
+
             // Build comment body with progressive status for individual builds
             let commentBody = `## 🔧 Build Status for PR #${pr.number}\n\n`;
             commentBody += `🔗 **Commit**: [\`${targetCommitSha.substring(0, 7)}\`](https://github.com/${context.repo.owner}/${context.repo.repo}/commit/${targetCommitSha})\n\n`;            // Progressive build status and downloads table
@@ -369,9 +418,9 @@ jobs:
             const buildTargets = [
               { name: 'Android Phone', platform: '🤖', device: '📱 Phone', statusKey: 'Android Phone', artifactPattern: /android.*phone/i },
               { name: 'Android TV', platform: '🤖', device: '📺 TV', statusKey: 'Android TV', artifactPattern: /android.*tv/i },
-              { name: 'iOS', platform: '🍎', device: '📱 Phone', statusKey: 'iOS', artifactPattern: /ios.*phone.*ipa(?!.*unsigned)/i },
+              { name: 'iOS', platform: '🍎', device: '📱 Phone', statusKey: 'iOS', artifactPattern: /^(?!.*unsigned).*ios.*phone.*ipa/i },
               { name: 'iOS Unsigned', platform: '🍎', device: '📱 Phone Unsigned', statusKey: 'iOS Unsigned', artifactPattern: /ios.*phone.*unsigned/i },
-              { name: 'tvOS', platform: '🍎', device: '📺 TV', statusKey: 'tvOS', artifactPattern: /ios.*tv.*ipa(?!.*unsigned)/i },
+              { name: 'tvOS', platform: '🍎', device: '📺 TV', statusKey: 'tvOS', artifactPattern: /^(?!.*unsigned).*ios.*tv.*ipa/i },
               { name: 'tvOS Unsigned', platform: '🍎', device: '📺 TV Unsigned', statusKey: 'tvOS Unsigned', artifactPattern: /ios.*tv.*unsigned/i }
             ];
 
@@ -407,9 +456,7 @@ jobs:
                   let durationInfo = '';
                   if (matchingStatus.started_at && matchingStatus.completed_at) {
                     const durationMs = new Date(matchingStatus.completed_at) - new Date(matchingStatus.started_at);
-                    const durationMin = Math.floor(durationMs / 60000);
+                    durationInfo = ` - ${fmtDuration(durationMs)}`;
-                    const durationSec = Math.floor((durationMs % 60000) / 1000);
-                    durationInfo = ` - ${durationMin}m ${durationSec}s`;
                   }
 
                   downloadLink = `[📥 Download ${fileType}](${directLink}) ${sizeInfo}${durationInfo}`;
@@ -421,10 +468,16 @@ jobs:
                   downloadLink = '*Build cancelled*';
                 } else if (matchingStatus.status === 'in_progress') {
                   status = `🔄 [Building...](${matchingStatus.url})`;
-                  downloadLink = '*Build in progress...*';
+                  const ref = referenceDurations[target.statusKey];
+                  downloadLink = ref
+                    ? `*Building… ~${fmtDuration(ref)} (avg on develop)*`
+                    : '*Build in progress...*';
                 } else if (matchingStatus.status === 'queued') {
                   status = `⏳ [Queued](${matchingStatus.url})`;
-                  downloadLink = '*Waiting to start...*';
+                  const ref = referenceDurations[target.statusKey];
+                  downloadLink = ref
+                    ? `*Waiting to start… ~${fmtDuration(ref)} once running (avg on develop)*`
+                    : '*Waiting to start...*';
                 } else if (matchingStatus.status === 'completed' && !matchingStatus.conclusion) {
                   // Workflow completed but conclusion not yet available (rare edge case)
                   status = `🔄 [Finishing...](${matchingStatus.url})`;
@@ -445,15 +498,9 @@ jobs:
 
             commentBody += `\n`;
 
-            // Show installation instructions if we have any artifacts
+            // Static rundown of the build optimisations + what each artifact
-            if (allArtifacts.length > 0) {
+            // installs on. Always shown (even mid-build) so testers know what
-              commentBody += `### 🔧 Installation Instructions\n\n`;
+            // to expect before downloads are ready.
-              commentBody += `- **Android APK**: Download and install directly on your device (enable "Install from unknown sources")\n`;
-              commentBody += `- **iOS IPA**: Install using [AltStore](https://altstore.io/), [Sideloadly](https://sideloadly.io/), or Xcode\n\n`;
-              commentBody += `> ⚠️ **Note**: Artifacts expire in 7 days from build date\n\n`;
-
-              // Collapsible rundown of the build optimisations + what each
-              // artifact actually installs on, so testers grab the right file.
             commentBody += `<details>\n`;
             commentBody += `<summary>📦 Build details &amp; device compatibility</summary>\n\n`;
             commentBody += `These CI builds are trimmed for size and speed. What that means for installing them:\n\n`;
@@ -465,6 +512,13 @@ jobs:
             commentBody += `**Why no x86_64?** That slice only runs on Android emulators / Chromebooks, never a real phone or TV box — dropping it shrinks the APK and speeds up the build. Local \`bun run android\` is unaffected (it still builds x86_64 from \`app.json\`).\n\n`;
             commentBody += `**Runners:** Android on \`ubuntu-26.04\`; iOS / tvOS on Apple Silicon (\`macos-26\`). The size/speed win comes from the ABI trim above, not the runner.\n`;
             commentBody += `</details>\n\n`;
+
+            // Installation instructions only matter once something is downloadable.
+            if (allArtifacts.length > 0) {
+              commentBody += `### 🔧 Installation Instructions\n\n`;
+              commentBody += `- **Android APK**: Download and install directly on your device (enable "Install from unknown sources")\n`;
+              commentBody += `- **iOS IPA**: Install using [AltStore](https://altstore.io/), [Sideloadly](https://sideloadly.io/), or Xcode\n\n`;
+              commentBody += `> ⚠️ **Note**: Artifacts expire in 7 days from build date\n\n`;
             } else {
               commentBody += `⏳ **Builds are starting up...** This comment will update automatically as each build completes.\n\n`;
             }

.github/workflows/build-apps.yml

@@ -27,6 +27,7 @@ jobs:
     name: 🤖 Build Android APK (Phone)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 🗑️ Free Disk Space
@@ -117,12 +118,16 @@ jobs:
             android/app/build/outputs/apk/release/*.apk
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-android-tv:
     if: (!contains(github.event.head_commit.message, '[skip ci]'))
     runs-on: ubuntu-26.04
     name: 🤖 Build Android APK (TV)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 🗑️ Free Disk Space
@@ -212,12 +217,16 @@ jobs:
             android/app/build/outputs/apk/release/*.apk
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-ios-phone:
     if: (!contains(github.event.head_commit.message, '[skip ci]') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'streamyfin/streamyfin'))
     runs-on: macos-26
     name: 🍎 Build iOS IPA (Phone)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -280,12 +289,16 @@ jobs:
           path: build-*.ipa
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-ios-phone-unsigned:
     if: (!contains(github.event.head_commit.message, '[skip ci]'))
     runs-on: macos-26
     name: 🍎 Build iOS IPA (Phone - Unsigned)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -339,6 +352,9 @@ jobs:
           path: build/*.ipa
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-ios-tv:
     # Disabled: EAS has no provisioning profiles / distribution cert for the tvOS
     # targets (app + StreamyfinTopShelf extension), so non-interactive signed
@@ -349,6 +365,7 @@ jobs:
     name: 🍎 Build tvOS IPA
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -418,6 +435,7 @@ jobs:
     name: 🍎 Build tvOS IPA (Unsigned)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -470,3 +488,6 @@ jobs:
           name: streamyfin-ios-tv-unsigned-ipa-${{ env.DATE_TAG }}
           path: build/*.ipa
           retention-days: 7
+
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment