Use new update names and pinned Bot API image in CI

.github/telegram-bot-api/Dockerfile

@@ -0,0 +1,37 @@
+# Bot API server image for the canary publish job, built from a pinned
+# tdlib/telegram-bot-api ref by canary-bot-api.yml. The publish job hands
+# this container the bot token and the update files, so it must never be
+# replaced by a third-party image.
+
+FROM ubuntu:22.04 AS build
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates cmake g++ git gperf libssl-dev make zlib1g-dev \
+ && rm -rf /var/lib/apt/lists/*
+
+ARG TELEGRAM_BOT_API_REF
+RUN test -n "$TELEGRAM_BOT_API_REF" \
+ && git clone https://github.com/tdlib/telegram-bot-api.git /src \
+ && git -C /src checkout "$TELEGRAM_BOT_API_REF" \
+ && git -C /src submodule update --init --recursive
+
+RUN cmake -S /src -B /build \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_INSTALL_PREFIX=/out \
+ && cmake --build /build --target install --parallel
+
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates libssl3 zlib1g \
+ && rm -rf /var/lib/apt/lists/* \
+ && useradd --system --uid 999 --create-home botapi \
+ && mkdir /data && chown botapi:botapi /data
+
+COPY --from=build /out/bin/telegram-bot-api /usr/local/bin/telegram-bot-api
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+
+USER botapi
+WORKDIR /data
+EXPOSE 8081
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

.github/telegram-bot-api/entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# TELEGRAM_API_ID and TELEGRAM_API_HASH are read by the binary itself,
+# TELEGRAM_LOCAL=1 enables --local (the same environment interface the
+# canary publish job uses).
+set -e
+exec /usr/local/bin/telegram-bot-api \
+	--http-port=8081 \
+	--dir=/data \
+	--temp-dir=/data/temp \
+	${TELEGRAM_LOCAL:+--local} \
+	"$@"

.github/workflows/canary-bot-api.yml

@@ -0,0 +1,50 @@
+# Builds the Bot API server image the canary publish job runs, from a
+# pinned tdlib/telegram-bot-api ref, and pushes it to this org's GHCR.
+# After a run, set the repository variable CANARY_BOT_API_IMAGE to the
+# printed digest-pinned reference. Rebuild deliberately on upgrades,
+# never track a third-party image: the publish job hands this container
+# the bot token and every published update file.
+
+name: Canary Bot API image.
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: tdlib/telegram-bot-api tag or commit to build
+        required: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+
+  build:
+    name: Build and push
+    runs-on: depot-ubuntu-latest-16
+
+    steps:
+      - name: Clone.
+        uses: actions/checkout@v7
+
+      - name: Log in to GHCR.
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push.
+        id: push
+        uses: docker/build-push-action@v7
+        with:
+          context: .github/telegram-bot-api
+          push: true
+          build-args: TELEGRAM_BOT_API_REF=${{ inputs.ref }}
+          tags: ghcr.io/${{ github.repository_owner }}/telegram-bot-api:${{ inputs.ref }}
+
+      - name: Print the reference to pin.
+        run: |
+          echo "Set the repository variable CANARY_BOT_API_IMAGE to:"
+          echo "ghcr.io/${{ github.repository_owner }}/telegram-bot-api@${{ steps.push.outputs.digest }}"

.github/workflows/canary.yml

@@ -36,6 +36,12 @@
 #   secrets.R2_ACCOUNT_ID / secrets.R2_ACCESS_KEY_ID /
 #   secrets.R2_SECRET_ACCESS_KEY / vars.R2_SYMBOLS_BUCKET
 #       Cloudflare R2 bucket for breakpad symbols (upload placeholder).
+#   vars.CANARY_BOT_API_IMAGE
+#       Digest-pinned Bot API server image built from a pinned
+#       tdlib/telegram-bot-api ref by canary-bot-api.yml, e.g.
+#       ghcr.io/<org>/telegram-bot-api@sha256:<digest>. Never point this
+#       at a third-party image: the container handles the bot token and
+#       every published update file.
 #
 # Public repository only:
 #   secrets.CANARY_PUBLIC_CHANNEL_ID
@@ -378,13 +384,13 @@ jobs:
               --az-key "$CANARY_KEY_ID"
             ./Packer.exe -channel canary-${{ needs.version.outputs.channel }} \
               -keys-loc ../../Telegram/Resources/update \
-              -unsigned tv2-win64-$CANARY_TAG-${{ needs.version.outputs.base }}-$CANARY_COUNTER.unsigned \
+              -unsigned update-win-x64-$CANARY_TAG-${{ needs.version.outputs.base }}-$CANARY_COUNTER.unsigned \
               -embed-signatures $CANARY_KEY_ID:canary.sig
           else
             echo "::warning::No publish secrets, keeping the unsigned envelope only."
           fi
           mkdir artifact
-          mv tv2-win64-$CANARY_TAG-* artifact/
+          mv update-win-x64-$CANARY_TAG-* artifact/
           mv Telegram.exe Updater.exe artifact/
 
       - uses: actions/upload-artifact@v7
@@ -553,6 +559,7 @@ jobs:
         run: |
           cd $REPO_NAME/out/Release
           ./Packer -path Telegram.app \
+            -arch universal \
             -version ${{ needs.version.outputs.base }} \
             -channel canary-${{ needs.version.outputs.channel }} \
             -counter $CANARY_COUNTER \
@@ -566,13 +573,13 @@ jobs:
               --az-key "$CANARY_KEY_ID"
             ./Packer -channel canary-${{ needs.version.outputs.channel }} \
               -keys-loc ../../Telegram/Resources/update \
-              -unsigned tv2-mac-$CANARY_TAG-${{ needs.version.outputs.base }}-$CANARY_COUNTER.unsigned \
+              -unsigned update-mac-universal-$CANARY_TAG-${{ needs.version.outputs.base }}-$CANARY_COUNTER.unsigned \
               -embed-signatures $CANARY_KEY_ID:canary.sig
           else
             echo "::warning::No publish secrets, keeping the unsigned envelope only."
           fi
           mkdir artifact
-          mv tv2-mac-$CANARY_TAG-* artifact/
+          mv update-mac-universal-$CANARY_TAG-* artifact/
           mv Telegram.app artifact/
 
       - uses: actions/upload-artifact@v7
@@ -730,13 +737,13 @@ jobs:
               --az-key "$CANARY_KEY_ID"
             ./Packer -channel canary-${{ needs.version.outputs.channel }} \
               -keys-loc ../../Telegram/Resources/update \
-              -unsigned tv2-linux-$CANARY_TAG-${{ needs.version.outputs.base }}-$CANARY_COUNTER.unsigned \
+              -unsigned update-linux-x64-$CANARY_TAG-${{ needs.version.outputs.base }}-$CANARY_COUNTER.unsigned \
               -embed-signatures $CANARY_KEY_ID:canary.sig
           else
             echo "::warning::No publish secrets, keeping the unsigned envelope only."
           fi
           mkdir artifact
-          mv tv2-linux-$CANARY_TAG-* artifact/
+          mv update-linux-x64-$CANARY_TAG-* artifact/
           mv Telegram Updater artifact/
 
       - uses: actions/upload-artifact@v7
@@ -753,8 +760,12 @@ jobs:
     environment: canary
 
     services:
+      # Built from a pinned tdlib/telegram-bot-api ref by the
+      # canary-bot-api.yml workflow and referenced by digest: this
+      # container handles the bot token and the published files, so no
+      # third-party image is acceptable here.
       telegram-bot-api:
-        image: aiogram/telegram-bot-api:latest
+        image: ${{ vars.CANARY_BOT_API_IMAGE }}
         env:
           TELEGRAM_API_ID: ${{ secrets.CANARY_API_ID }}
           TELEGRAM_API_HASH: ${{ secrets.CANARY_API_HASH }}
@@ -831,7 +842,7 @@ jobs:
 
           declare -A POSTS
           for PLATFORM in win64 mac linux; do
-            FILE=$(ls artifacts/canary-$PLATFORM/tv2-* | head -1)
+            FILE=$(ls artifacts/canary-$PLATFORM/update-* | head -1)
             if [[ "$FILE" == *.unsigned ]]; then
               echo "::error::$PLATFORM update is unsigned, refusing to publish."
               exit 1