fix(ci)!: locate shipyard through shipyard-cmake, not the package registry

.github/workflows/ci.yml

@@ -26,7 +26,8 @@ jobs:
           fetch-depth: 0   # cmake resolves the version from the shipped tags; without them CI would
                            # label every build -mavericks.1 and hide what it is really building
 
-      # shipyard self-registers in the CMake user package registry; consumed via find_package.
+      # Installs the shipyard pkg: shipyard-cmake/-ctest/-cpack land on PATH and SHIPYARD_SCRIPTS is
+      # exported. find_package(MavericksShipyard) resolves inside shipyard-cmake's own prefix.
       - name: Install mavericks-shipyard
         uses: ModernMavericks/shipyard/.github/actions/install@v1
 
@@ -35,8 +36,8 @@ jobs:
       # silently mean no repackage and thinner notes. Fail here instead.
       - name: Guard the ingredient pin declaration
         run: |
-          SCR="$(cat "$HOME/.cmake/packages/MavericksShipyard/"* | head -1)/scripts"
-          sh "$SCR/check-ingredient-pins.sh"
+          . build/msc.sh
+          sh "$SHIPYARD_SCRIPTS/check-ingredient-pins.sh"
 
       # The 10.9-correct Go toolchain (mavericks-golang go126 cross .pkg; its go.env CC wrapper supplies
       # the 10.9 SDK + target flags + legacy shim + -Wl,-U allowances). Cross mode: the root CMakeLists
@@ -83,16 +84,16 @@ jobs:
         env:
           MAVERICKS_SDK_CACHE: ${{ github.workspace }}/.sdk-cache
         run: |
-          cmake --preset cross
-          cmake --build --preset cross
-          ctest --preset cross
+          shipyard-cmake --preset cross
+          shipyard-cmake --build --preset cross
+          shipyard-ctest --preset cross
 
       # Sparkle updater .app: built every run (catches updater breaks). It must NOT link any Tailscale
       # product (self-update circularity); its own binary is TailscaleUpdater, so skip line 1 of otool.
       - name: Build the Sparkle updater (must not link tailscale)
         run: |
-          cmake -S updater -B build/updater -DCMAKE_OBJC_COMPILER=/usr/bin/clang
-          cmake --build build/updater
+          shipyard-cmake -S updater -B build/updater -DCMAKE_OBJC_COMPILER=/usr/bin/clang
+          shipyard-cmake --build build/updater
           BIN=build/updater/TailscaleUpdater.app/Contents/MacOS/TailscaleUpdater
           otool -L "$BIN" | tee /tmp/o.txt
           if otool -L "$BIN" | tail -n +2 | grep -iq tailscale; then

.github/workflows/release.yml

@@ -167,14 +167,14 @@ jobs:
         env:
           MAVERICKS_SDK_CACHE: ${{ github.workspace }}/.sdk-cache
         run: |
-          cmake --preset cross
-          cmake --build --preset cross
-          ctest --preset cross
+          shipyard-cmake --preset cross
+          shipyard-cmake --build --preset cross
+          shipyard-ctest --preset cross
 
       - name: Build the Sparkle updater (must not link tailscale)
         run: |
-          cmake -S updater -B build/updater -DCMAKE_OBJC_COMPILER=/usr/bin/clang
-          cmake --build build/updater
+          shipyard-cmake -S updater -B build/updater -DCMAKE_OBJC_COMPILER=/usr/bin/clang
+          shipyard-cmake --build build/updater
           BIN=build/updater/TailscaleUpdater.app/Contents/MacOS/TailscaleUpdater
           otool -L "$BIN" | tee /tmp/o.txt
           if otool -L "$BIN" | tail -n +2 | grep -iq tailscale; then
@@ -238,16 +238,15 @@ jobs:
         run: |
           # printenv, not [ -n "$SPARKLE_PRIVATE_KEY" ]: the shell never expands the key, so no trace can print it
           printenv SPARKLE_PRIVATE_KEY | grep -q . || { echo "::error::SPARKLE_PRIVATE_KEY secret not set"; exit 1; }
-          SH="$(cat "$HOME/.cmake/packages/MavericksShipyard/"* | head -1)/scripts"
-          [ -d "$SH" ] || { echo "::error::shipyard scripts not found at $SH"; exit 1; }
+          . build/msc.sh
           mkdir -p in dist
           tar -C in -xzf dl/packaging-inputs.tgz          # restores executable bits
           # Wrap the systray binary into the menu-bar .app the package expects.
           sh cmake/make_app.sh in/tailscale-systray "in/Mavericks Tailscale.app" "$VER" "$GITHUB_WORKSPACE/Tailscale.icns"
           PKG="dist/tailscale-$VER.pkg"
 
           # dist/ in the repo holds the LaunchDaemon/Agent plists + pre/postinstall scripts.
-          SHIPYARD_SCRIPTS="$SH" sh cmake/package_pkg.sh --out "$PKG" --version "$VER" \
+          sh cmake/package_pkg.sh --out "$PKG" --version "$VER" \
             --tailscaled in/tailscaled --tailscale in/tailscale \
             --systray-app "in/Mavericks Tailscale.app" --updater-app in/TailscaleUpdater.app \
             --daemon-plist "$GITHUB_WORKSPACE/dist/com.tailscale.tailscaled.plist" \
@@ -263,7 +262,7 @@ jobs:
           # enclosure points at the versioned release asset; the client /latest/ feed resolves to this
           # full release immediately, so Sparkle clients pick it up right away.
           URL="https://github.com/${GITHUB_REPOSITORY}/releases/download/$VER/$(basename "$PKG")"
-          sh "$SH/sign_and_appcast.sh" \
+          sh "$SHIPYARD_SCRIPTS/sign_and_appcast.sh" \
             --channel-title "Tailscale for Mavericks" \
             --version "$VER" --pkg-url "$URL" --min-os 10.9.5 \
             --notes-file dist/RELEASE_NOTES.md --pkg "$PKG" > dist/appcast.xml

.gitignore

@@ -5,7 +5,7 @@ build-cross/
 /UPSTREAM_VERSION
 
 # In-tree CMake output. release.yml configures the Sparkle updater as
-# `cmake -S updater -B build/updater`, so a local reproduction of that step drops a
+# `shipyard-cmake -S updater -B build/updater`, so a local reproduction of that step drops a
 # whole build tree here -- 7.4MB of it, with the installed shipyard's absolute paths
 # baked into CMakeCache.txt. Untracked and unignored is the bad combination: one
 # `git add -A` commits it, and the cache goes stale the moment shipyard moves (it

build/msc.sh

@@ -0,0 +1,25 @@
+#   usage: . build/msc.sh
+#          Sourced by a ModernMavericks product's build scripts: locates shipyard's scripts as
+#          $SHIPYARD and exports SHIPYARD_SCRIPTS. In CI, install@v1 has already exported
+#          SHIPYARD_SCRIPTS; anywhere else this asks shipyard-cmake -- the only cmake that configures
+#          against shipyard -- where find_package(MavericksShipyard) lands, so a CMAKE_PREFIX_PATH
+#          dev override moves the scripts together with the modules. About 2 s, exported so children
+#          skip it. CANONICAL COPY: shipyard's scripts/templates/msc.sh; conventions check 17
+#          requires every product's copy to match it byte for byte, so change it there, not here.
+SHIPYARD="${SHIPYARD_SCRIPTS:-}"
+if [ ! -d "$SHIPYARD" ]; then
+  _msc_probe="$(mktemp -d "${TMPDIR:-/tmp}/shipyard-probe.XXXXXX")"
+  printf '%s\n' 'cmake_minimum_required(VERSION 3.16)' 'project(shipyard_probe NONE)' \
+    'find_package(MavericksShipyard REQUIRED)' 'message(STATUS "SHIPYARD_DIR=${MavericksShipyard_DIR}")' \
+    > "$_msc_probe/CMakeLists.txt"
+  # platform: appending /scripts to the substitution directly made a failed probe (no
+  #           shipyard-cmake, a refused configure) yield the literal "/scripts" -- an absolute path,
+  #           plausible-looking, and the error below would then complain about the wrong thing. So
+  #           assign the probe's answer first and append only if there was one.
+  _msc_dir="$(shipyard-cmake -S "$_msc_probe" -B "$_msc_probe/b" 2>/dev/null | sed -n 's/^-- SHIPYARD_DIR=//p')"
+  if [ -n "$_msc_dir" ]; then SHIPYARD="$_msc_dir/scripts"; fi
+  rm -rf "$_msc_probe"; unset _msc_probe _msc_dir
+fi
+[ -d "$SHIPYARD" ] || { echo "msc.sh: cannot locate shipyard -- install the shipyard pkg (it provides shipyard-cmake), or set SHIPYARD_SCRIPTS" >&2; return 1 2>/dev/null || exit 1; }
+SHIPYARD_SCRIPTS="$SHIPYARD"
+export SHIPYARD SHIPYARD_SCRIPTS

updater/CMakeLists.txt

@@ -1,9 +1,9 @@
 cmake_minimum_required(VERSION 3.16)
 # Cocoa/Sparkle auto-updater .app for the Tailscale product. A SEPARATE project from the Go build
 # (the repo root is project(... LANGUAGES NONE) and requires a preset); build it on its own with
-# `cmake -S updater -B build/updater`. Native only: the product .pkg installs on the real 10.9 box,
-# so the updater is x86_64 / min-10.9. It links Sparkle + Cocoa and NOTHING from Tailscale (a Sparkle
-# host carries no product code) -- the release workflow asserts that.
+# `shipyard-cmake -S updater -B build/updater`. Native only: the product .pkg installs on the real
+# 10.9 box, so the updater is x86_64 / min-10.9. It links Sparkle + Cocoa and NOTHING from Tailscale
+# (a Sparkle host carries no product code) -- the release workflow asserts that.
 set(CMAKE_OSX_DEPLOYMENT_TARGET 10.9 CACHE STRING "updater runs on the 10.9 box")
 set(CMAKE_OSX_ARCHITECTURES x86_64 CACHE STRING "Intel-only (10.9)")
 project(TailscaleUpdater LANGUAGES OBJC)