WIRE-291: prevalidate underwriter UIC signatures #322
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "macOS arm64 build & tests" | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| run_sharded_np_lr: | |
| description: "Run macOS nonparallelizable/long-running tests" | |
| type: boolean | |
| default: false | |
| schedule: | |
| # GitHub schedules run from the default branch, providing nightly coverage for origin/master. | |
| - cron: "0 8 * * *" | |
| # NOTE: a `paths:` filter cannot be scoped to one ref pattern within a single | |
| # `push:` block, and a tag push carries no new commits for the filter to match -- | |
| # so a `paths:`-filtered push trigger would silently suppress every `v*` tag run, | |
| # which is exactly the run that produces the macOS release tarball. The filter is | |
| # therefore kept on `pull_request:` only; master pushes now always build macOS. | |
| push: | |
| branches: | |
| - master | |
| tags: | |
| - "v*" | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| paths: | |
| - ".github/workflows/macos_arm64_build.yaml" | |
| - ".github/vcpkg-triplets/**" | |
| - "cmake/**" | |
| - "libraries/**" | |
| - "plugins/**" | |
| - "programs/**" | |
| - "unittests/**" | |
| - "tests/**" | |
| - "CMakeLists.txt" | |
| - "vcpkg.json" | |
| - "vcpkg-configuration.json" | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| parallel-tests: | |
| name: Build and run parallel tests on Apple Silicon | |
| runs-on: macos-26 | |
| timeout-minutes: 300 | |
| env: | |
| BUILD_DIR: build/macos-arm64 | |
| CCACHE_DIR: ${{ github.workspace }}/.ccache | |
| VCPKG_BINARY_SOURCES: "clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite" | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # actions/checkout@v5 | |
| with: | |
| submodules: recursive | |
| - name: Install host tools | |
| run: | | |
| brew install ninja ccache pkgconf autoconf automake libtool | |
| python3 -m venv "$RUNNER_TEMP/python-venv" | |
| "$RUNNER_TEMP/python-venv/bin/python" -m pip install --upgrade pip | |
| "$RUNNER_TEMP/python-venv/bin/python" -m pip install numpy | |
| echo "$RUNNER_TEMP/python-venv/bin" >> "$GITHUB_PATH" | |
| # Split restore/save (not the monolithic actions/cache) -- see the matching | |
| # comment in linux_amd64_build.yaml: the paired save runs immediately after | |
| # the build, and only on an exact-key miss (caches are immutable). | |
| - name: Restore vcpkg binary cache | |
| id: restore-vcpkg | |
| uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # actions/cache/restore@v5 | |
| with: | |
| path: ${{ github.workspace }}/vcpkg-binary-cache | |
| key: vcpkg-binaries-macos-arm64-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', '.github/vcpkg-triplets/arm64-osx-release.cmake') }} | |
| restore-keys: | | |
| vcpkg-binaries-macos-arm64- | |
| - name: Restore ccache | |
| id: restore-ccache | |
| uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # actions/cache/restore@v5 | |
| with: | |
| path: ${{ github.workspace }}/.ccache | |
| key: ccache-macos-arm64-${{ github.sha }} | |
| restore-keys: | | |
| ccache-macos-arm64- | |
| - name: Configure and build | |
| env: | |
| SYSIO_PLATFORM_NAME: macos-arm64 | |
| VCPKG_TARGET_TRIPLET: arm64-osx-release | |
| VCPKG_HOST_TRIPLET: arm64-osx-release | |
| run: | | |
| bash .github/scripts/build-sysio.sh "$(sysctl -n hw.logicalcpu)" | |
| - name: Save vcpkg binary cache | |
| if: ${{ success() && steps.restore-vcpkg.outputs.cache-hit != 'true' }} | |
| uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # actions/cache/save@v5 | |
| with: | |
| path: ${{ github.workspace }}/vcpkg-binary-cache | |
| key: vcpkg-binaries-macos-arm64-${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json', '.github/vcpkg-triplets/arm64-osx-release.cmake') }} | |
| - name: Enable macOS core dumps | |
| run: | | |
| mkdir -p "$RUNNER_TEMP/cores" | |
| ulimit -c unlimited || true | |
| sudo sysctl -w "kern.corefile=$RUNNER_TEMP/cores/core.%P" || true | |
| - name: Restore CTest cost data | |
| uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # actions/cache/restore@v5 | |
| with: | |
| # CTest uses this file to schedule higher-cost tests first when running with -j. | |
| path: ${{ env.BUILD_DIR }}/Testing/Temporary/CTestCostData.txt | |
| key: ctest-cost-macos-arm64-${{ github.sha }} | |
| restore-keys: | | |
| ctest-cost-macos-arm64- | |
| - name: Run parallelizable tests | |
| run: | | |
| cd "$BUILD_DIR" | |
| ctest -j "$(sysctl -n hw.logicalcpu)" \ | |
| -LE "(nonparallelizable_tests|long_running_tests)" \ | |
| --output-on-failure --timeout 1000 \ | |
| 2>&1 | tee "$RUNNER_TEMP/macos-arm64-parallel-ctest.log" | |
| - name: Run sharded NP/LR tests | |
| if: ${{ github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.run_sharded_np_lr) }} | |
| run: | | |
| cd "$BUILD_DIR" | |
| test_jobs="$(sysctl -n hw.logicalcpu)" | |
| echo "Running sharded NP/LR tests with ${test_jobs} jobs" | |
| ctest -j "${test_jobs}" \ | |
| -L "(nonparallelizable_tests|long_running_tests)" \ | |
| --timeout 2700 \ | |
| 2>&1 | tee "$RUNNER_TEMP/macos-arm64-np-lr-ctest.log" | |
| - name: Save CTest cost data | |
| if: ${{ always() && hashFiles(format('{0}/Testing/Temporary/CTestCostData.txt', env.BUILD_DIR)) != '' }} | |
| uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # actions/cache/save@v5 | |
| with: | |
| # Caches are immutable, so save each run under a unique key and restore by runner prefix. | |
| path: ${{ env.BUILD_DIR }}/Testing/Temporary/CTestCostData.txt | |
| key: ctest-cost-macos-arm64-${{ github.run_id }}-${{ github.run_attempt }} | |
| - name: Save ccache | |
| if: ${{ always() && github.event_name != 'pull_request' && steps.restore-ccache.outputs.cache-hit != 'true' }} | |
| uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # actions/cache/save@v5 | |
| with: | |
| path: ${{ github.workspace }}/.ccache | |
| key: ccache-macos-arm64-${{ github.sha }} | |
| # macOS ships the portable tarball only -- there is no deb/rpm generator and no | |
| # service payload (cmake/package.cmake gates those install() rules on NOT APPLE). | |
| # WIRE_ARCH_TAG makes the artifact wire-sysio-<version>-macos-arm64.tar.gz, so it | |
| # never collides with the Linux wire-sysio-<version>-x86_64.tar.gz on a release. | |
| - name: Build portable tarball | |
| run: | | |
| cmake --build "$BUILD_DIR" --target package-tgz | |
| - name: Verify portable tarball (S1, no-service) | |
| run: | | |
| set -euo pipefail | |
| tarball="$(find "$BUILD_DIR" -maxdepth 1 -type f -name 'wire-sysio-*-macos-arm64.tar.gz' -print -quit)" | |
| [[ -n "$tarball" ]] || { echo "::error::macOS portable tarball not found in $BUILD_DIR" >&2; exit 1; } | |
| tools/packaging/tests/verify-tgz.sh --no-service "$tarball" | |
| - name: Upload release package set | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # actions/upload-artifact@v6 | |
| with: | |
| name: wire-sysio-packages-macos-arm64 | |
| if-no-files-found: error | |
| path: | | |
| ${{ env.BUILD_DIR }}/wire-sysio-*-macos-arm64.tar.gz | |
| - name: Upload core files from failed tests | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # actions/upload-artifact@v6 | |
| if: failure() | |
| with: | |
| name: macos-arm64-tests-logs | |
| if-no-files-found: warn | |
| path: | | |
| ${{ runner.temp }}/cores/ | |
| ~/Library/Logs/DiagnosticReports/ | |
| ~/Library/Logs/CrashReporter/ | |
| ${{ env.BUILD_DIR }}/Testing/Temporary/ | |
| ${{ env.BUILD_DIR }}/TestLogs/ | |
| ${{ env.BUILD_DIR }}/PerformanceHarnessScenarioRunnerLogs/ | |
| - name: Show diagnostics on failure | |
| if: failure() | |
| run: | | |
| echo "=== vcpkg manifest log ===" | |
| cat "$BUILD_DIR/vcpkg-manifest-install.log" || true | |
| echo "=== ccache statistics ===" | |
| ccache -s || true |