ci-macos.yml

---
name: CI-macOS
permissions: {}

on:
  workflow_call:
    inputs:
      publish_release:
        required: true
        type: string
      release_commit:
        required: true
        type: string
      release_version:
        required: true
        type: string
    secrets:
      # email address
      APPLE_ID:
        required: false
      # 10-character Team ID
      APPLE_TEAM_ID:
        required: false
      # app-specific password in APPLE_ID's account that must be named "notarytool"
      # https://support.apple.com/en-us/102654
      APPLE_NOTARYTOOL_PASSWORD:
        required: false
      # Developer ID Application: Full Name (TEAMIDHERE)
      APPLE_CODESIGN_IDENTITY:
        required: false
      # pkcs12 export from Xcode in base64
      APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64:
        required: false
      # pkcs12 password added by Xcode export
      APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_P12_PASSWORD:
        required: false

env:
  BRANCH: ${{ github.head_ref || github.ref_name }}
  BUILD_VERSION: ${{ inputs.release_version }}
  COMMIT: ${{ inputs.release_commit }}
  MACOSX_DEPLOYMENT_TARGET: '15.0'  # Match the minimum version required by the prebuilt macOS dependencies.
  PYTHON_VERSION: '3.14'

jobs:
  build_dmg:
    name: ${{ matrix.name }}
    permissions:
      contents: read
    runs-on: ${{ matrix.os }}
    outputs:
      notarytool_submission_id_arm64: ${{ steps.notarize_submit.outputs.submission_id_arm64 }}
      notarytool_submission_id_x86_64: ${{ steps.notarize_submit.outputs.submission_id_x86_64 }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: "macos-15"
            name: "macOS-arm64"
            arch: "arm64"
            build_docs: "ON"
          - os: "macos-15-intel"
            name: "macOS-x86_64"
            arch: "x86_64"
            build_docs: "OFF"
    steps:
      - name: Install Apple certificate
        uses: apple-actions/import-codesign-certs@288b8ec97b82c66b6f2a6baaf7acc8dfbcbe331c  # v7.2.0
        if: inputs.publish_release == 'true'
        with:
          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64 }}
          p12-password: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_P12_PASSWORD }}

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          submodules: recursive

      - name: Install dependencies
        timeout-minutes: 5
        run: |
          brew install --force \
            boost \
            cmake \
            doxygen \
            graphviz \
            node \
            pkgconf \
            icu4c@78 \
            miniupnpc \
            openssl@4 \
            opus \
            qtbase \
            qtsvg

      - name: Configure macOS screen recording
        uses: LizardByte/tray/.github/actions/configure-macos-screen-recording@master

      - name: Setup Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup uv
        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
        with:
          enable-cache: true

      - name: Sync Python tools
        run: |
          uv_sync_args=(
            --locked
            --python "${PYTHON_VERSION}"
            --no-python-downloads
            --no-install-project
          )
          # uv.lock pins external artifacts; the reviewed local lizardbyte-common build hook is required.
          uv sync "${uv_sync_args[@]}"  # NOSONAR(githubactions:S8541, githubactions:S8544)

      - name: Configure
        env:
          APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
        run: |
          icu4c_root="$(brew --prefix icu4c@78 2>/dev/null)"
          export CPPFLAGS="${CPPFLAGS:+${CPPFLAGS} }-I${icu4c_root}/include"
          export LDFLAGS="${LDFLAGS:+${LDFLAGS} }-L${icu4c_root}/lib"
          export LIBRARY_PATH="${icu4c_root}/lib${LIBRARY_PATH:+:${LIBRARY_PATH}}"

          mkdir -p build
          cmake \
            -B build \
            -S . \
            -DBUILD_DOCS="${{ matrix.build_docs }}" \
            -DBUILD_WERROR=ON \
            -DCMAKE_BUILD_TYPE=Release \
            -DICU_ROOT="${icu4c_root}" \
            -DOPENSSL_ROOT_DIR="$(brew --prefix openssl@4 2>/dev/null)" \
            -DOpus_ROOT_DIR="$(brew --prefix opus 2>/dev/null)" \
            -DQt6_DIR="$(brew --prefix qtbase 2>/dev/null)/lib/cmake/Qt6" \
            -DQt6Svg_DIR="$(brew --prefix qtsvg 2>/dev/null)/lib/cmake/Qt6Svg" \
            -DSUNSHINE_PUBLISHER_NAME="${GITHUB_REPOSITORY_OWNER}" \
            -DSUNSHINE_PUBLISHER_WEBSITE="https://app.lizardbyte.dev" \
            -DSUNSHINE_PUBLISHER_ISSUE_URL="https://app.lizardbyte.dev/support" \
            -DAPPLE_CODESIGN_IDENTITY="${APPLE_CODESIGN_IDENTITY}"

      - name: Build
        run: |
          echo "::add-matcher::.github/matchers/gcc.json"
          cmake --build build -j "$(sysctl -n hw.ncpu)"
          echo "::remove-matcher owner=gcc::"

      - name: Package DMG
        env:
          APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
          MATRIX_NAME: ${{ matrix.name }}
          SHOULD_SIGN: ${{ inputs.publish_release }}
        run: |
          # build DMG and sign everything (see cmake/packaging/macos.cmake)
          # cpack can rarely fail with "hdiutil: create failed - Resource busy"
          # so let's allow 1 retry
          if ! cpack -G DragNDrop --config build/CPackConfig.cmake; then
            echo "cpack failed, retrying once with verbose..."
            if ! cpack -G DragNDrop --config build/CPackConfig.cmake --verbose; then
              echo "cpack failed again. Aborting."
              exit 1
            fi
          fi

          mkdir -p artifacts
          cp "build/cpack_artifacts/Sunshine.dmg" "artifacts/Sunshine-${MATRIX_NAME}.dmg"

      - name: Submit for notarization
        id: notarize_submit
        if: inputs.publish_release == 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_NOTARYTOOL_PASSWORD: ${{ secrets.APPLE_NOTARYTOOL_PASSWORD }}
          MATRIX_ARCH: ${{ matrix.arch }}
        run: |
          # Notarizing allows the signed .app to run on any Mac with no prompts.
          # If you don't notarize, users must jump through the "Open Anyway" hoop as well as run
          # `xattr -cr /Applications/Sunshine.app` to remove quarantine.
          if [[ -n "${APPLE_NOTARYTOOL_PASSWORD}" ]]; then
            submission_id=$(xcrun notarytool submit build/cpack_artifacts/Sunshine.dmg \
              --apple-id "${APPLE_ID}" \
              --team-id "${APPLE_TEAM_ID}" \
              --password "${APPLE_NOTARYTOOL_PASSWORD}" \
              --output-format json \
              | jq -r '.id')
            echo "Submission ID: ${submission_id}"
            echo "submission_id_${MATRIX_ARCH}=${submission_id}" >> "${GITHUB_OUTPUT}"
          fi

      - name: Test
        id: test
        working-directory: build/tests
        run: ./test_sunshine --gtest_color=yes --gtest_output=xml:test_results.xml

      - name: Upload system tray screenshots
        if: >-
          always() &&
          (steps.test.outcome == 'success' || steps.test.outcome == 'failure')
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: sunshine-screenshots-${{ matrix.name }}
          path: build/tests/screenshots
          if-no-files-found: error

      - name: Generate gcov report
        id: test_report
        # any except canceled or skipped
        if: >-
          always() &&
          (steps.test.outcome == 'success' || steps.test.outcome == 'failure')
        working-directory: build
        run: |
          uv run --project .. --locked --no-sync gcovr . -r ../src \
            --exclude-noncode-lines \
            --exclude-throw-branches \
            --exclude-unreachable-branches \
            --xml-pretty \
            -j "$(sysctl -n hw.ncpu)" \
            -o coverage.xml

      - name: Upload coverage artifact
        if: >-
          always() &&
          (steps.test_report.outcome == 'success')
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: coverage-${{ matrix.name }}
          path: |
            build/coverage.xml
            build/tests/test_results.xml
          if-no-files-found: error

      - name: Set artifact prefix
        id: artifact_prefix
        env:
          INPUTS_PUBLISH_RELEASE: ${{ inputs.publish_release }}
        run: |
          if [[ "${INPUTS_PUBLISH_RELEASE}" == "true" ]]; then
            echo "prefix=unsigned" >> "${GITHUB_OUTPUT}"
          else
            echo "prefix=build" >> "${GITHUB_OUTPUT}"
          fi

      - name: Upload Artifacts
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: ${{ steps.artifact_prefix.outputs.prefix }}-${{ matrix.name }}
          path: artifacts/
          if-no-files-found: error

  notarize_dmg:
    name: Notarize ${{ matrix.name }}
    needs: build_dmg
    if: inputs.publish_release == 'true'
    permissions:
      contents: read
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: "macos-15"
            name: "macOS-arm64"
            arch: "arm64"
          - os: "macos-15-intel"
            name: "macOS-x86_64"
            arch: "x86_64"
    steps:
      - name: Install Apple certificate
        uses: apple-actions/import-codesign-certs@288b8ec97b82c66b6f2a6baaf7acc8dfbcbe331c  # v7.2.0
        with:
          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64 }}
          p12-password: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_P12_PASSWORD }}

      - name: Download DMG artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
        with:
          name: unsigned-${{ matrix.name }}
          path: artifacts

      - name: Wait for notarization and staple
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_NOTARYTOOL_PASSWORD: ${{ secrets.APPLE_NOTARYTOOL_PASSWORD }}
          MATRIX_NAME: ${{ matrix.name }}
          SUBMISSION_ID: ${{ matrix.arch == 'arm64'
            && needs.build_dmg.outputs.notarytool_submission_id_arm64
            || needs.build_dmg.outputs.notarytool_submission_id_x86_64 }}
        run: |
          if [[ -z "${SUBMISSION_ID}" ]]; then
            echo "No submission ID found; skipping notarization wait."
            exit 0
          fi

          echo "Polling notarization status for submission: ${SUBMISSION_ID}"
          while true; do
            status=$(xcrun notarytool info "${SUBMISSION_ID}" \
              --apple-id "${APPLE_ID}" \
              --team-id "${APPLE_TEAM_ID}" \
              --password "${APPLE_NOTARYTOOL_PASSWORD}" \
              --output-format json \
              | jq -r '.status')
            echo "Current status: ${status}"
            if [[ "${status}" == "Accepted" ]]; then
              echo "Notarization accepted."
              break
            elif [[ "${status}" == "Invalid" || "${status}" == "Rejected" ]]; then
              echo "Notarization failed with status: ${status}"
              # Print the full log for debugging
              xcrun notarytool log "${SUBMISSION_ID}" \
                --apple-id "${APPLE_ID}" \
                --team-id "${APPLE_TEAM_ID}" \
                --password "${APPLE_NOTARYTOOL_PASSWORD}"
              exit 1
            fi
            echo "Status is '${status}', waiting 30 seconds before retrying..."
            sleep 30
          done

          xcrun stapler staple -v "artifacts/Sunshine-${MATRIX_NAME}.dmg"

      - name: Upload stapled artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: build-${{ matrix.name }}
          path: artifacts/
          if-no-files-found: error