buzz/.github/workflows/macos-intel-canary.yml

name: macOS Intel Canary

# Produces an unsigned Intel DMG from trusted main. Its release-equivalent
# Cargo state warms the distinct x86_64 release target without signing or
# publishing anything.
on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: Build macOS Intel canary
    if: github.repository == 'block/buzz'
    runs-on: macos-latest
    timeout-minutes: 60
    env:
      TARGET: x86_64-apple-darwin
    steps:
      - name: Require main
        env:
          SOURCE_REF: ${{ github.ref }}
        run: |
          if [[ "$SOURCE_REF" != "refs/heads/main" ]]; then
            echo "::error::Canary builds must run from main; got $SOURCE_REF"
            exit 1
          fi

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1

      - name: Add Rust target
        run: rustup target add "$TARGET"

      - name: Install desktop dependencies
        run: just desktop-install-ci

      - name: Derive and patch canary version
        run: |
          BASE_VERSION=$(node -p "require('./desktop/package.json').version")
          VERSION="${BASE_VERSION%%-*}-intel-test.${GITHUB_RUN_NUMBER}"
          cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
          cd src-tauri && cargo update --workspace

      - name: Resolve native toolchain identity
        id: native_toolchain
        run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT"

      - name: Compute exact release cache key
        id: rust_cache_key
        env:
          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
        run: |
          KEY=$(scripts/desktop-release-cache-key.py \
            --platform "$RUNNER_OS" \
            --target "$TARGET" \
            --features default \
            --native-inputs "$NATIVE_TOOLCHAIN_ID")
          echo "key=$KEY" >> "$GITHUB_OUTPUT"
          echo "Release cache key: $KEY"

      - name: Restore exact release Cargo cache
        id: rust_cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            desktop/src-tauri/target
            !desktop/src-tauri/target/**/release/bundle
          key: ${{ steps.rust_cache_key.outputs.key }}

      - name: Generate non-updating bundle config
        run: |
          cat > desktop/src-tauri/tauri.canary.conf.json <<'JSON'
          {"bundle":{"createUpdaterArtifacts":false,"macOS":{"minimumSystemVersion":"10.15"}}}
          JSON

      - name: Build Intel sidecars
        run: |
          cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
          ./scripts/bundle-sidecars.sh "$TARGET"

      - name: Build unsigned Intel DMG
        run: cd desktop && pnpm tauri build --verbose --no-sign --target "$TARGET" --bundles dmg --config src-tauri/tauri.canary.conf.json
        env:
          CMAKE_POLICY_VERSION_MINIMUM: "3.5"
          MACOSX_DEPLOYMENT_TARGET: "10.15"
          CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
          TAURI_BUNDLER_DMG_IGNORE_CI: "true"

      - name: Locate fresh Intel DMG
        id: artifact
        run: |
          DMG=$(find "desktop/src-tauri/target/${TARGET}/release/bundle/dmg" -name '*.dmg' -type f | head -1)
          [[ -n "$DMG" ]] || { echo "::error::No Intel DMG found"; exit 1; }
          echo "dmg=$DMG" >> "$GITHUB_OUTPUT"

      - name: Upload Intel canary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: buzz-macos-intel-canary-${{ github.sha }}
          path: ${{ steps.artifact.outputs.dmg }}
          if-no-files-found: error
          retention-days: 7

      - name: Measure release Cargo cache inputs
        if: always()
        run: du -sh ~/.cargo/registry ~/.cargo/git target desktop/src-tauri/target 2>/dev/null || true

      - name: Save exact release Cargo cache
        if: steps.rust_cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            desktop/src-tauri/target
            !desktop/src-tauri/target/**/release/bundle
          key: ${{ steps.rust_cache_key.outputs.key }}