mxc/.github/workflows/Build.MacOS.Job.yml at main · microsoft/mxc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
name: macOS Build

on:
  workflow_call:

jobs:
  build:
    name: arm64
    runs-on: macos-15
    # A wedged PTY child would otherwise hold the runner for the 6-hour cap.
    timeout-minutes: 45
    defaults:
      run:
        working-directory: src
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # actions-rust-lang/setup-rust-toolchain auto-reads rust-toolchain.toml
      # from the repo root only. Surface src/rust-toolchain.toml there so the
      # 1.93 pin is honored without duplicating the version in this workflow.
      - name: Surface toolchain file at repo root
        shell: bash
        working-directory: ${{ github.workspace }}
        run: cp src/rust-toolchain.toml rust-toolchain.toml

      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
        with:
          target: aarch64-apple-darwin
          components: rustfmt, clippy
          override: false
          rustflags: ''

      - name: Point cargo at the MxcDependencies feed
        uses: ./.github/actions/setup-cargo-feed

      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: src -> target
          key: aarch64-apple-darwin-v2
          cache-on-failure: false

      # Mac uses package selection rather than feature selection — the
      # workspace has Windows-only crates that won't compile here.
      # unix_test_proxy and mxc_ffi ship alongside mxc-exec-mac.
      - name: Build
        run: cargo build --locked --release --target aarch64-apple-darwin
             -p mxc_darwin -p mxc-sdk -p unix_test_proxy -p mxc_ffi

      # mxc-sdk includes the Seatbelt executor characterization tests.
      # mxc-exec-mac (built above via -p mxc_darwin) is what they drive; the
      # tests skip via has_platform_exec() if it is missing. sandbox_init needs
      # no elevation, so they run in this standard macOS job.
      - name: Test
        run: |
          cargo test --locked --release --target aarch64-apple-darwin \
            -p mxc_darwin -p mxc-sdk

      - name: Test state-aware SDK boundaries
        shell: bash
        run: |
          set -euo pipefail
          cargo test --locked --release --target aarch64-apple-darwin -p mxc-sdk -p mxc_ffi --lib state_aware
          cargo test --locked --release --target aarch64-apple-darwin -p mxc-sdk --test state_aware

      - name: Test Seatbelt streaming and PTY
        run: cargo test --locked --release --target aarch64-apple-darwin
             -p mxc-sdk --test streaming

      - name: Verify artifact payload
        shell: bash
        run: |
          set -euo pipefail
          bin_dir="target/aarch64-apple-darwin/release"
          for file in mxc-exec-mac unix-test-proxy libmxc_ffi.dylib; do
            if [[ ! -f "$bin_dir/$file" ]]; then
              echo "Missing artifact file: $file" >&2
              exit 1
            fi
          done

      - name: Upload binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mxc-binaries-aarch64-apple-darwin
          path: |
            src/target/aarch64-apple-darwin/release/mxc-exec-mac
            src/target/aarch64-apple-darwin/release/unix-test-proxy
            src/target/aarch64-apple-darwin/release/libmxc_ffi.dylib
          if-no-files-found: error
          retention-days: 1