macos.yml

name: MacOS

on:
  push:
    branches:
      - master
      - 'Stable*'
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
    paths-ignore:
      - 'docs/**'
  pull_request:
  merge_group:
  workflow_dispatch:
    inputs:
      debug_runner:
        description: 'Open an actor-only SSH session after a failure (up to 15 minutes, branches only)'
        type: boolean
        default: false

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

permissions:
  contents: read
  actions: read

jobs:
  changes:
    uses: ./.github/workflows/_detect-changes.yml
    with:
      platform: macos

  build:
    needs: changes
    if: needs.changes.outputs.should_build == 'true'
    runs-on: macos-15
    timeout-minutes: 120

    # id-token/attestations scoped here: only the attestation upload step needs them.
    permissions:
      contents: read
      actions: read
      id-token: write
      attestations: write

    strategy:
      fail-fast: false
      matrix:
        # Release packages and uploads the DMG; Debug has test hooks and runs the Unit and Integration suites.
        build_type: [Release, Debug]

    defaults:
      run:
        shell: bash

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - name: Record build timeline
        uses: Kesin11/actions-timeline@v3
        continue-on-error: true
        with:
          show-waiting-runner: true

      - name: Checkout repo
        uses: actions/checkout@v7
        with:
          fetch-depth: ${{ github.event_name == 'pull_request' && 1 || 0 }}
          persist-credentials: false

      - name: Build Setup
        id: setup
        uses: ./.github/actions/build-setup
        with:
          qt-host: mac
          qt-arch: clang_64
          build-type: ${{ matrix.build_type }}

      - name: Install Dependencies
        uses: ./.github/actions/install-dependencies

      - name: CMake configure
        uses: ./.github/actions/cmake-configure
        with:
          build-dir: ${{ runner.temp }}/build
          build-type: ${{ matrix.build_type }}
          preset: ${{ matrix.build_type == 'Debug' && 'macOS-debug' || 'macOS' }}
          extra-args: >-
            -DQGC_BUILD_PORTABLE_TESTS=${{ matrix.build_type == 'Release' && 'ON' || 'OFF' }}
            -DQGC_MACOS_SIGN_WITH_IDENTITY=${{ github.event_name != 'pull_request' && matrix.build_type == 'Release' && 'ON' || 'OFF' }}
            -DQGC_MACOS_UNIVERSAL_BUILD=ON

      - name: Build
        id: build
        uses: ./.github/actions/cmake-build
        with:
          build-dir: ${{ runner.temp }}/build
          build-type: ${{ matrix.build_type }}

      - name: Run portable tests
        id: portable
        if: ${{ !cancelled() && steps.build.outcome == 'success' && matrix.build_type == 'Release' }}
        uses: ./.github/actions/run-unit-tests
        with:
          build-dir: ${{ runner.temp }}/build
          build-type: ${{ matrix.build_type }}
          include-labels: Portable
          junit-output: junit-portable.xml
          ctest-output: portable-output.txt

      - name: Report portable tests
        if: ${{ !cancelled() && steps.portable.outcome != 'skipped' && steps.portable.outcome != '' }}
        uses: ./.github/actions/test-report
        with:
          name: Portable tests (macos)
          build-dir: ${{ runner.temp }}/build
          junit-file: junit-portable.xml
          output-file: portable-output.txt
          artifact-name: test-results-portable-macos

      - name: Run and report tests
        if: ${{ !cancelled() && steps.build.outcome == 'success' && matrix.build_type == 'Debug' }}
        uses: ./.github/actions/test-phase
        with:
          build-dir: ${{ runner.temp }}/build
          suite: macos

      - name: Verify dev build executable
        uses: ./.github/actions/verify-executable
        with:
          binary-path: ${{ runner.temp }}/build/${{ matrix.build_type }}/QGroundControl.app/Contents/MacOS/QGroundControl
          build-dir: ${{ runner.temp }}/build
          expect-archs: x86_64h arm64

      - name: Import Code Signing Certificate
        if: github.event_name != 'pull_request' && matrix.build_type == 'Release'
        uses: apple-actions/import-codesign-certs@v7
        with:
          p12-file-base64: ${{ secrets.MACOS_CERT_P12_BASE64 }}
          p12-password: ${{ secrets.MACOS_CERT_P12_PASSWORD }}

      # PRs configure with QGC_MACOS_SIGN_WITH_IDENTITY=OFF, so the signing env vars are unused there — leaving them resolved-but-empty is harmless and lets us avoid duplicating the install step.
      - name: Create app bundle
        if: matrix.build_type == 'Release'
        uses: ./.github/actions/cmake-install
        with:
          build-dir: ${{ runner.temp }}/build
          build-type: ${{ matrix.build_type }}
        env:
          QGC_MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
          QGC_MACOS_NOTARIZATION_USERNAME: ${{ secrets.MACOS_NOTARIZATION_USERNAME }}
          QGC_MACOS_NOTARIZATION_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }}
          QGC_MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}

      - name: Mount DMG
        if: matrix.build_type == 'Release'
        working-directory: ${{ runner.temp }}/build
        run: |
          if ! hdiutil attach QGroundControl.dmg; then
            echo "::error::Failed to mount DMG"
            ls -la QGroundControl.dmg 2>/dev/null || echo "DMG file not found"
            exit 1
          fi

      - name: Verify DMG executable
        if: matrix.build_type == 'Release'
        uses: ./.github/actions/verify-executable
        with:
          binary-path: /Volumes/QGroundControl/QGroundControl.app/Contents/MacOS/QGroundControl
          expect-archs: x86_64h arm64

      - name: Attest and Upload
        if: matrix.build_type == 'Release'
        uses: ./.github/actions/attest-and-upload
        with:
          artifact-name: QGroundControl.dmg
          package-name: QGroundControl
          subject-name: QGroundControl-macos
          aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
          aws-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-distribution-id: ${{ secrets.AWS_DISTRIBUTION_ID }}

      - name: Debug failed runner
        if: ${{ failure() && !cancelled() && github.event_name == 'workflow_dispatch' && inputs.debug_runner && github.ref_type == 'branch' }}
        timeout-minutes: 15
        uses: ./.github/actions/debug-runner