[Agi-Asi]

Description

concatenate_video_files writes an ffmpeg concat demuxer list file into the system temp directory, with entries written verbatim as file '<path>'. Two failure modes fall out of that:

1. Relative input paths silently break. The concat demuxer resolves relative entries against the directory of the list file (the temp folder), not the caller's working directory — so every relative segment path became a dangling reference and av.open failed with FileNotFoundError on files that exist. Reproduced locally by calling concatenate_video_files([Path('tests/data/video.mp4'), ...]) from the repo root.

2. Quotes in paths make entries unparseable. A single quote anywhere in a component (John's slides/…) terminates the quoted entry early. Any user whose project lives under such a directory gets a confusing parse/FileNotFoundError failure from deep inside PyAV.

Fix, in one place (_concat_list_entry): entries are written as absolute (resolved) paths, with single quotes escaped shell-style ('\'') — the quoting ffmpeg's av_get_token() understands.

Today's internal callers happen to always pass absolute paths, which is why the pipeline works — but concatenate_video_files is part of the importable API surface, and both failure modes produce errors that look exactly like the "file vanished mid-render" class of reports (e.g. the Errno 22 Invalid argument family in #540 is being debugged around this same function). Hardening the list-file writing removes two entire failure modes from the suspect list.

Testing

• Two new regression tests: relative CWD-dependent input (via monkeypatch.chdir), and a path containing a single quote — both assert a decodable output. Both fail on main and pass with this change.
• pytest tests/test_utils.py — 4 passed.
• ruff check / ruff format --check clean (the helper moved to module level to stay under the complexity limit).

[codacy-production]

Not up to standards ⛔

🔴 Issues 2 high · 1 minor

Alerts:
⚠ 3 issues (≤ 0 issues of at least minor severity)

Results:
3 new issues

Category	Results
Security	2 high
CodeStyle	1 minor

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.10%. Comparing base (1549ef4) to head (8834128).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #673   +/-   ##
=======================================
  Coverage   79.10%   79.10%           
=======================================
  Files          23       23           
  Lines        2178     2178           
=======================================
  Hits         1723     1723           
  Misses        455      455           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jeertmans]

Hi @Agi-Asi, thanks for your contribution! Could you just check the two comments I left? Except this, it looks all good to me.

[Agi-Asi]

Thanks for the review! I applied the CHANGELOG suggestion and switched to file.resolve().as_posix().

On shlex.quote: I tried it first since it would indeed be fewer lines, but it can't be used here — shlex quotes for POSIX shells (embedded ' becomes '"'"'), while ffmpeg's concat demuxer parses list entries with av_get_token(), which only understands backslash escapes and '\''-style quoting. Empirically (PyAV 15, ffmpeg 7):

# path: /tmp/x/John's slides/video.mp4
f"file '{quote(path)}'\n"   # -> parse fails, FileNotFoundError
f"file {quote(path)}\n"     # -> parse fails too
"file '" + path.replace("'", "'\\''") + "'\n"  # -> works

(The doubled quoting in the first form also breaks plain paths only when they contain quotes, so the failure is silent until a user has a ' in a directory name — the exact case the PR fixes.)

So I kept the av_get_token-compatible escaping with a comment pointing at the ffmpeg quoting rules, but simplified per your suggestion where possible. Happy to adjust further!

[jeertmans]

Thanks for checking, see my latest #673 (comment)

[jeertmans]

Thanks @Agi-Asi! A typo in one of the comments has been reported by the pre-commit codspell check, could you fix it?

[Agi-Asi]

Note on CI: the remaining pre-commit.ci - pr failure is the ty hook failing to download dependencies (dns error / Temporary failure in name resolution fetching wheels from PyPI) on pre-commit.ci's runner — the same failure currently shows on all other open PRs (#675, #671, #668), so it's infrastructure-side rather than related to this change. The codespell finding from the earlier run (unparseable) is fixed in 3056cf5, and all other hooks pass.

[Agi-Asi]

pre-commit.ci run

[jeertmans]

Thanks for your contribution @Agi-Asi!