Adding mac release

Author: thirtytwobits

.github/workflows/release.yml

@@ -162,27 +162,114 @@ jobs:
           path: dist/
           if-no-files-found: error
 
+  macos:
+    name: Build tarball (macOS ${{ matrix.arch }})
+    needs: stage
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: arm64
+            runner: macos-15
+    steps:
+      - name: Checkout (with submodules)
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install LLVM 22
+        # Homebrew's current `llvm` is the locked major; the configure-time
+        # major check fails loudly if that ever stops being true, so this does
+        # not silently build against the wrong one.
+        run: |
+          set -euo pipefail
+          brew install llvm ninja
+          echo "LLVM_PREFIX=$(brew --prefix llvm)" >> "$GITHUB_ENV"
+
+      - name: Configure, build, and package
+        # LLVMDSDL_VENDOR_LLVM on macOS installs the self-contained bundle rather
+        # than the raw targets: without it the tarball's binaries reference
+        # /opt/homebrew and run only on a machine that already has Homebrew LLVM.
+        run: |
+          set -euo pipefail
+          cmake -S . -B out -G Ninja \
+            -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+            -DLLVM_DIR="${LLVM_PREFIX}/lib/cmake/llvm" \
+            -DMLIR_DIR="${LLVM_PREFIX}/lib/cmake/mlir" \
+            -DLLVMDSDL_VENDOR_LLVM=ON
+          cmake --build out
+          cd out && cpack -G TGZ
+
+      - name: Collect tarball
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          cp out/*.tar.gz dist/
+          cd dist
+          shasum -a 256 -- *.tar.gz > SHA256SUMS
+          ls -la
+
+      - name: Verify the tarball is self-contained
+        # There is no pristine container to install into, and this runner is the
+        # worst possible judge -- it has Homebrew LLVM at exactly the paths a
+        # non-relocated binary would reference. So the check asserts linkage,
+        # not just behaviour.
+        run: |
+          python3 packaging/verify/smoke_macos.py \
+            --tarball "dist/llvm-dsdl-${{ needs.stage.outputs.version }}-darwin-${{ matrix.arch }}.tar.gz" \
+            --expect-version "${{ needs.stage.outputs.version }}"
+
+      - name: Upload tarball
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-${{ matrix.arch }}
+          path: dist/
+          if-no-files-found: error
+
   publish:
     name: Publish release
-    needs: [stage, build]
+    needs: [stage, build, macos]
     if: needs.stage.outputs.publish == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: write        # create the release
       id-token: write        # provenance attestation
       attestations: write
     steps:
-      - name: Download packages
+      # Two steps rather than one brace pattern, and into per-artifact
+      # subdirectories rather than merged: every build job writes its own
+      # SHA256SUMS, and merging would silently leave one overwriting the others.
+      - name: Download Linux artifacts
         uses: actions/download-artifact@v4
         with:
           pattern: deb-*
-          path: dist
-          merge-multiple: true
+          path: staging
+
+      - name: Download macOS artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: macos-*
+          path: staging
+
+      - name: Combine artifacts
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          find staging -type f ! -name SHA256SUMS -exec cp {} dist/ \;
+          # One checksum file covering everything, rebuilt from the artifacts
+          # themselves rather than concatenated, so it cannot disagree with what
+          # is actually attached.
+          cd dist && sha256sum -- * > SHA256SUMS
+          cat SHA256SUMS
 
       - name: Attest build provenance
         uses: actions/attest-build-provenance@v2
         with:
-          subject-path: dist/*.deb
+          subject-path: |
+            dist/*.deb
+            dist/*.tar.gz
 
       - name: Create the release
         uses: softprops/action-gh-release@v2
@@ -192,9 +279,10 @@ jobs:
           draft: true
           files: |
             dist/*.deb
+            dist/*.tar.gz
             dist/SHA256SUMS
           body: |
-            ## Install — Ubuntu 22.04, 24.04, or 26.04
+            ## Ubuntu 22.04, 24.04, or 26.04
 
             Pick the package matching your architecture (`dpkg --print-architecture`):
 
@@ -203,12 +291,32 @@ jobs:
             sudo apt install ./llvm-dsdl_${{ needs.stage.outputs.version }}_arm64.deb
             ```
 
-            No repository to add: the package bundles the LLVM 22 runtime it needs,
-            because no Ubuntu release carries it. Everything else it depends on comes
-            from the stock Ubuntu archive.
-
             `llvm-dsdl-dev` is also attached, for linking against the frontend,
             MLIR dialect, and emitter libraries.
 
+            ## macOS (Apple silicon)
+
+            Extract with `tar`, not by double-clicking:
+
+            ```
+            tar -xzf llvm-dsdl-${{ needs.stage.outputs.version }}-darwin-arm64.tar.gz
+            ./llvm-dsdl-${{ needs.stage.outputs.version }}-darwin-arm64/bin/dsdlc --version
+            ```
+
+            The binaries are ad-hoc signed rather than notarized. Extracting with
+            `tar` keeps them runnable; opening the archive in Finder marks them
+            with macOS's quarantine attribute and Gatekeeper will refuse to run
+            them. Move the extracted directory wherever you like — it is
+            relocatable — and add its `bin/` to your `PATH`.
+
+            ## Both platforms
+
+            No repository or package manager to configure: each package bundles the
+            LLVM 22 runtime it needs, because neither Ubuntu nor a stock macOS
+            carries it. Everything else comes from the platform.
+
+            Verify downloads against `SHA256SUMS`, or check build provenance with
+            `gh attestation verify <file> --repo ${{ github.repository }}`.
+
             Verify the download against `SHA256SUMS`, or check build provenance with
             `gh attestation verify <file> --repo ${{ github.repository }}`.

CMakeLists.txt

@@ -518,6 +518,17 @@ set(LLVMDSDL_INSTALLABLE_LIBRARIES
 
 set(LLVMDSDL_INSTALL_COMPONENT_BIN "bin")
 set(LLVMDSDL_INSTALL_COMPONENT_DEV "dev")
+set(LLVMDSDL_SELF_CONTAINED_TOOL_BUNDLE_DEFAULT OFF)
+if(APPLE OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  set(LLVMDSDL_SELF_CONTAINED_TOOL_BUNDLE_DEFAULT ON)
+endif()
+
+option(LLVMDSDL_ENABLE_SELF_CONTAINED_TOOL_BUNDLE
+       "Enable self-contained tool bundle target (copies the tools with runtime deps)"
+       ${LLVMDSDL_SELF_CONTAINED_TOOL_BUNDLE_DEFAULT})
+
+set(LLVMDSDL_SELF_CONTAINED_TOOLS_DIR "${LLVMDSDL_BINARY_DIR}/self-contained-tools")
+
 
 # Vendoring libLLVM into the package.
 #
@@ -527,23 +538,35 @@ set(LLVMDSDL_INSTALL_COMPONENT_DEV "dev")
 # the library inside the package is what makes `apt install ./llvm-dsdl_*.deb` work
 # on a machine that has never heard of apt.llvm.org.
 #
-# Off by default: a developer's `cmake --install` should not copy a ~100 MB library
+# The same reasoning applies to the macOS tarball: a bare download has no
+# dependency resolver either, and a tree whose binaries reference
+# /opt/homebrew/opt/llvm only runs on a machine that already has Homebrew LLVM.
+#
+# Off by default: a developer's `cmake --install` should not copy a ~150 MB library
 # into the install tree. The release build turns it on explicitly.
 #
 # LLVM is Apache-2.0-WITH-LLVM-exception, so redistribution is fine with
 # attribution -- packaging/deb/copyright carries the licence paragraph, and its
 # Files: stanza must be activated when this is enabled for a published package.
 option(LLVMDSDL_VENDOR_LLVM
-       "Ship libLLVM inside the install tree and point the tools at it via RPATH."
+       "Ship libLLVM inside the install tree so the package runs without a system LLVM."
        OFF)
 
-if(LLVMDSDL_VENDOR_LLVM)
-  if(NOT CMAKE_SYSTEM_NAME STREQUAL "Linux")
-    message(FATAL_ERROR
-      "LLVMDSDL_VENDOR_LLVM is implemented for Linux only (it relies on ELF RPATH). "
-      "macOS distribution goes through Homebrew, which depends on llvm@22 instead.")
-  endif()
+# Linux and macOS reach the same outcome by different mechanisms: ELF RPATH set
+# on the installed binaries, versus Mach-O install names rewritten by the bundle
+# target. The flag means "self-contained" on both; only the plumbing differs.
+set(LLVMDSDL_VENDOR_LLVM_VIA_BUNDLE OFF)
+if(LLVMDSDL_VENDOR_LLVM AND APPLE)
+  set(LLVMDSDL_VENDOR_LLVM_VIA_BUNDLE ON)
+endif()
+
+if(LLVMDSDL_VENDOR_LLVM AND NOT CMAKE_SYSTEM_NAME STREQUAL "Linux" AND NOT APPLE)
+  message(FATAL_ERROR
+    "LLVMDSDL_VENDOR_LLVM is implemented for Linux (ELF RPATH) and macOS "
+    "(Mach-O install names) only.")
+endif()
 
+if(LLVMDSDL_VENDOR_LLVM AND CMAKE_SYSTEM_NAME STREQUAL "Linux")
   # A private directory rather than ${CMAKE_INSTALL_LIBDIR}: this is our copy of
   # someone else's library, and it must never satisfy anything but our own tools.
   set(LLVMDSDL_VENDOR_LLVM_SUBDIR "${CMAKE_INSTALL_LIBDIR}/llvm-dsdl")
@@ -625,10 +648,39 @@ if(LLVMDSDL_VENDOR_LLVM)
     BUILD_WITH_INSTALL_RPATH OFF)
 endif()
 
-install(
-  TARGETS ${LLVMDSDL_INSTALLABLE_TOOLS}
-  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
-  COMPONENT ${LLVMDSDL_INSTALL_COMPONENT_BIN})
+if(LLVMDSDL_VENDOR_LLVM_VIA_BUNDLE)
+  # macOS gets its self-contained tree from the bundle target, which rewrites
+  # Mach-O install names in place. Installing the bundle rather than the raw
+  # targets is the whole point: the raw binaries reference
+  # /opt/homebrew/opt/llvm and only run where Homebrew LLVM is already present,
+  # which is exactly the trap a downloadable tarball must not contain.
+  #
+  # The bundle's layout is bin/ + lib/ and its install names are
+  # @executable_path/../lib, so it must land at the prefix root unchanged --
+  # relocating lib/ elsewhere would break every reference in it.
+  if(NOT LLVMDSDL_ENABLE_SELF_CONTAINED_TOOL_BUNDLE)
+    message(FATAL_ERROR
+      "LLVMDSDL_VENDOR_LLVM on macOS is implemented via the self-contained bundle, "
+      "but LLVMDSDL_ENABLE_SELF_CONTAINED_TOOL_BUNDLE is OFF.")
+  endif()
+
+  install(
+    DIRECTORY "${LLVMDSDL_SELF_CONTAINED_TOOLS_DIR}/bin/"
+    DESTINATION "${CMAKE_INSTALL_BINDIR}"
+    COMPONENT ${LLVMDSDL_INSTALL_COMPONENT_BIN}
+    USE_SOURCE_PERMISSIONS)
+
+  install(
+    DIRECTORY "${LLVMDSDL_SELF_CONTAINED_TOOLS_DIR}/lib/"
+    DESTINATION "${CMAKE_INSTALL_LIBDIR}"
+    COMPONENT ${LLVMDSDL_INSTALL_COMPONENT_BIN}
+    USE_SOURCE_PERMISSIONS)
+else()
+  install(
+    TARGETS ${LLVMDSDL_INSTALLABLE_TOOLS}
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+    COMPONENT ${LLVMDSDL_INSTALL_COMPONENT_BIN})
+endif()
 
 install(
   TARGETS ${LLVMDSDL_INSTALLABLE_LIBRARIES}
@@ -921,27 +973,27 @@ if(LLVMDSDL_ENABLE_PYTHON_ACCELERATOR)
   )
 endif()
 
-set(LLVMDSDL_SELF_CONTAINED_TOOL_BUNDLE_DEFAULT OFF)
-if(APPLE OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  set(LLVMDSDL_SELF_CONTAINED_TOOL_BUNDLE_DEFAULT ON)
-endif()
-
-option(LLVMDSDL_ENABLE_SELF_CONTAINED_TOOL_BUNDLE
-       "Enable self-contained tool bundle target (copies dsdlc/dsdl-opt with runtime deps)"
-       ${LLVMDSDL_SELF_CONTAINED_TOOL_BUNDLE_DEFAULT})
-
 if(LLVMDSDL_ENABLE_SELF_CONTAINED_TOOL_BUNDLE)
-  set(LLVMDSDL_SELF_CONTAINED_TOOLS_DIR
-      "${LLVMDSDL_BINARY_DIR}/self-contained-tools")
-  add_custom_target(bundle-tools-self-contained
+  # All three tools, not just the two that generate code: the macOS release
+  # tarball ships this tree, and a package missing the language server would be
+  # a strange thing to hand someone.
+  #
+  # Part of ALL only when the install rules consume it (macOS vendoring), because
+  # then `cmake --install` must find it already built. Otherwise it stays opt-in:
+  # it copies and re-signs ~150 MB of LLVM, which no ordinary build should pay for.
+  set(LLVMDSDL_BUNDLE_IN_ALL "")
+  if(LLVMDSDL_VENDOR_LLVM_VIA_BUNDLE)
+    set(LLVMDSDL_BUNDLE_IN_ALL ALL)
+  endif()
+
+  add_custom_target(bundle-tools-self-contained ${LLVMDSDL_BUNDLE_IN_ALL}
     COMMAND
       ${CMAKE_COMMAND}
-        -DTOOL_DSDLC=$<TARGET_FILE:dsdlc>
-        -DTOOL_DSDLOPT=$<TARGET_FILE:dsdl-opt>
+        "-DTOOLS=$<TARGET_FILE:dsdlc>;$<TARGET_FILE:dsdl-opt>;$<TARGET_FILE:dsdld>"
         -DOUTPUT_DIR=${LLVMDSDL_SELF_CONTAINED_TOOLS_DIR}
         -DLLVMDSDL_SOURCE_DIR=${LLVMDSDL_SOURCE_DIR}
         -P ${LLVMDSDL_SOURCE_DIR}/cmake/BundleSelfContainedTools.cmake
-    DEPENDS dsdlc dsdl-opt
+    DEPENDS ${LLVMDSDL_INSTALLABLE_TOOLS}
     USES_TERMINAL
     VERBATIM
     COMMENT