CI

Author: stevschmid

.github/workflows/build-macos.yml

@@ -0,0 +1,75 @@
+name: Build macOS
+
+# Runs on every push and pull request. Produces an ad-hoc-signed .dmg as an
+# artifact for smoke testing. This workflow INTENTIONALLY never reads any
+# repo secrets — that's the "build" side of the build/release split. Signed
+# Developer ID release builds live in a separate workflow that only fires
+# on mac-v* tag pushes and is gated on a GitHub Environment. Keeping the
+# split structural (two files, clean separation of concerns) means a
+# compromised PR or a mistake in this file cannot exfiltrate the signing
+# cert — it doesn't have it in scope at all.
+
+on:
+  push:
+  pull_request:
+
+# Minimal token scope. We don't push, we don't comment, we don't create
+# releases — just a read of the repo to check out code.
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build and ad-hoc sign
+    runs-on: macos-14   # Apple Silicon — our only target
+    timeout-minutes: 90 # first run will be slow (full vcpkg build)
+
+    env:
+      # Route vcpkg binary cache through GitHub Actions cache. First run
+      # populates the cache (slow: ~30-60 min to build ANGLE + LuaJIT +
+      # imaging deps from source). Subsequent runs reuse it and should be
+      # under 10 min.
+      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
+
+    steps:
+      - name: Checkout (with submodules)
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      # vcpkg's x-gha binary cache provider reads ACTIONS_CACHE_URL and
+      # ACTIONS_RUNTIME_TOKEN from the environment. GitHub Actions sets
+      # them inside the runner but they're not exposed to child processes
+      # by default, so we export them explicitly here. (Standard dance
+      # documented in the vcpkg GitHub Actions integration guide.)
+      - name: Export Actions Cache env vars for vcpkg
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
+
+      - name: Configure
+        run: cmake -B build -DCMAKE_BUILD_TYPE=Release
+
+      - name: Build
+        run: cmake --build build
+
+      - name: Install to staging dir
+        run: cmake --install build --prefix "${{ runner.temp }}/pob-install-wrapper"
+
+      - name: Ad-hoc sign
+        run: macos/sign.sh "${{ runner.temp }}/pob-install-wrapper/Path of Building.app"
+
+      - name: Verify signature
+        run: codesign --verify --deep --strict --verbose=2 "${{ runner.temp }}/pob-install-wrapper/Path of Building.app"
+
+      - name: Package DMG
+        run: macos/make-dmg.sh "${{ runner.temp }}/pob-install-wrapper/Path of Building.app" "${{ runner.temp }}/Path of Building.dmg"
+
+      - name: Upload DMG artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: pob-mac-${{ github.sha }}
+          path: ${{ runner.temp }}/Path of Building.dmg
+          if-no-files-found: error