fix(cli): sign macOS bundles inside out #529
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| env: | |
| PROTON_NO_UPDATE_CHECK: 1 | |
| PROTON_CEF_CACHE: ${{ github.workspace }}/.proton-global-cache | |
| jobs: | |
| format: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install MoonBit | |
| run: | | |
| curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash -s latest | |
| echo "$HOME/.moon/bin" >> "$GITHUB_PATH" | |
| - name: moon version | |
| run: moon version --all | |
| - name: Format check | |
| run: moon fmt --check | |
| moonbit: | |
| needs: format | |
| strategy: | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - macos-latest | |
| - windows-latest | |
| fail-fast: false | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 45 | |
| continue-on-error: false | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Cache MoonBit packages | |
| uses: actions/cache@v4 | |
| with: | |
| path: .mooncakes | |
| key: ${{ runner.os }}-mooncakes-${{ hashFiles('**/moon.mod') }} | |
| restore-keys: ${{ runner.os }}-mooncakes- | |
| - name: Cache CEF downloads | |
| uses: actions/cache@v4 | |
| with: | |
| path: .proton-global-cache | |
| key: ${{ runner.os }}-cef-global-${{ hashFiles('cli/cef/cef_platform.mbt') }} | |
| - name: Install MoonBit | |
| if: ${{ matrix.os != 'windows-latest' }} | |
| run: | | |
| curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash -s latest | |
| echo "$HOME/.moon/bin" >> $GITHUB_PATH | |
| # moonc v0.10.5 bundles mimalloc in libmoonbitrun.o and interposes the | |
| # malloc family in every native executable, but on Linux the interposed | |
| # set misses the glibc extension malloc_usable_size. Libraries dlopen'd | |
| # by such an executable (libcef.so's bundled sqlite in the doctor deep | |
| # probe tests) then pair mimalloc's malloc() with glibc's | |
| # malloc_usable_size() and segfault. libmoonbitrun.o contains only the | |
| # allocator override, so an empty object restores plain glibc malloc. | |
| # Drop this once the toolchain interposition is fixed upstream. | |
| - name: Disable bundled mimalloc (moonc v0.10.5 Linux interposition bug) | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: | | |
| test -f "$HOME/.moon/lib/libmoonbitrun.o" | |
| cc -c -x c /dev/null -o "$HOME/.moon/lib/libmoonbitrun.o" | |
| - name: Install MoonBit on Windows | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| run: | | |
| Set-ExecutionPolicy RemoteSigned -Scope CurrentUser; irm https://cli.moonbitlang.com/install/powershell.ps1 | iex | |
| "$env:USERPROFILE\.moon\bin" | Out-File -FilePath $env:GITHUB_PATH -Append | |
| - name: Install Linux native dependencies | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y pkg-config libgtk-3-dev libwebkit2gtk-4.1-dev xvfb openbox | |
| - name: moon version | |
| run: | | |
| moon version --all | |
| - name: moon update | |
| run: | | |
| moon update | |
| - name: Setup MSVC | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| uses: ilammy/msvc-dev-cmd@v1 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| - name: Test prebuilt ABI verifier | |
| run: node --test scripts/verify_prebuilt_abi_test.mjs | |
| - name: Test bridge bootstrap JS | |
| run: node --test native/tests/bridge_bootstrap.test.mjs | |
| - name: Verify generated files | |
| run: node scripts/verify_generated.mjs --skip-prebuilt-abi | |
| - name: Verify Linux prebuilt ABI | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: node scripts/verify_prebuilt_abi.mjs linux-x64 | |
| - name: Verify macOS prebuilt ABI | |
| if: ${{ matrix.os == 'macos-latest' }} | |
| run: node scripts/verify_prebuilt_abi.mjs darwin-arm64 | |
| - name: Verify Windows prebuilt ABI | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| run: node scripts/verify_prebuilt_abi.mjs win32-x64 | |
| - name: Build active Proton engine runtime on Unix | |
| if: ${{ matrix.os != 'windows-latest' }} | |
| run: | | |
| moon -C cli run . -- -C .. cef setup | |
| runtime="$PWD/$(node -p "require('./.proton/runtime.json').dist")" | |
| cef_root=$(node -p "require('./.proton/runtime.json').cef") | |
| cmake -S native -B native/build-engine \ | |
| -DCMAKE_INSTALL_PREFIX="$runtime" \ | |
| -DPROTON_WITH_ENGINE=ON \ | |
| -DPROTON_ENGINE_ROOT="$cef_root" | |
| cmake --build native/build-engine | |
| cmake --install native/build-engine | |
| if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then | |
| # The overlay titlebar path needs a real window manager for CEF to | |
| # deliver draggable regions; Xvfb alone has none. | |
| xvfb-run -a sh -c 'openbox & sleep 1; ctest --test-dir native/build-engine --output-on-failure' | |
| else | |
| # The raw C smoke is not an app bundle. Exercise the managed macOS | |
| # GUI lifecycle in the bounded example e2e step below instead. | |
| PROTON_TEST_SKIP_MANAGED_APP_RUNNER=1 \ | |
| ctest --test-dir native/build-engine --output-on-failure | |
| fi | |
| node native/scripts/verify_link_config.mjs "$runtime" | |
| echo "PROTON_NATIVE_DIST=$runtime" >> "$GITHUB_ENV" | |
| echo "$runtime/bin" >> "$GITHUB_PATH" | |
| - name: Build active Proton engine runtime on Windows | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| run: | | |
| $ErrorActionPreference = "Stop" | |
| $PSNativeCommandUseErrorActionPreference = $true | |
| moon -C cli run . -- -C .. cef setup | |
| if (!(Test-Path .proton\runtime.json)) { | |
| throw "missing .proton\runtime.json" | |
| } | |
| $manifest = Get-Content .proton\runtime.json | ConvertFrom-Json | |
| $runtime = Join-Path $PWD $manifest.dist | |
| $cefRoot = $manifest.cef | |
| cmake -S native -B native\build-engine ` | |
| "-DCMAKE_INSTALL_PREFIX=$runtime" ` | |
| -DPROTON_WITH_ENGINE=ON ` | |
| "-DPROTON_ENGINE_ROOT=$cefRoot" | |
| cmake --build native\build-engine --config Debug | |
| cmake --install native\build-engine --config Debug | |
| # windows-latest runners have no usable D3D device; force ANGLE's | |
| # SwiftShader path so the engine's GPU process can start at all. | |
| $env:ANGLE_DEFAULT_PLATFORM = "swiftshader" | |
| "ANGLE_DEFAULT_PLATFORM=swiftshader" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append | |
| ctest --test-dir native\build-engine -C Debug --output-on-failure | |
| if (!(Test-Path "$runtime\bin\proton.dll")) { | |
| throw "missing active proton.dll" | |
| } | |
| $runtimePath = (Resolve-Path $runtime).Path | |
| node native\scripts\verify_link_config.mjs $runtimePath | |
| "PROTON_NATIVE_DIST=$runtimePath" | Out-File -FilePath $env:GITHUB_ENV -Append | |
| (Resolve-Path "$runtimePath\bin").Path | Out-File -FilePath $env:GITHUB_PATH -Append | |
| - name: Test native updater in Release mode | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: | | |
| cmake -S native -B native/build-release-tests \ | |
| -DCMAKE_BUILD_TYPE=Release \ | |
| -DPROTON_WITH_ENGINE=OFF | |
| cmake --build native/build-release-tests --target proton_update_test | |
| ctest --test-dir native/build-release-tests \ | |
| --output-on-failure \ | |
| -R '^proton_update_test$' | |
| - name: Check framework modules | |
| if: ${{ matrix.os != 'windows-latest' }} | |
| run: | | |
| moon check --target native --deny-warn | |
| if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then | |
| xvfb-run -a env \ | |
| LD_LIBRARY_PATH="$PROTON_NATIVE_DIST/bin:$PROTON_NATIVE_DIST/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" \ | |
| LD_PRELOAD="libcef.so${LD_PRELOAD:+:$LD_PRELOAD}" \ | |
| moon -C proton test native --target native --diagnostic-limit 80 | |
| xvfb-run -a moon -C cli test -p moonbit-community/proton_cli \ | |
| moonbit-community/proton_cli/arguments moonbit-community/proton_cli/build_cmd \ | |
| moonbit-community/proton_cli/cef moonbit-community/proton_cli/codegen \ | |
| moonbit-community/proton_cli/dev moonbit-community/proton_cli/doctor \ | |
| moonbit-community/proton_cli/fsutil moonbit-community/proton_cli/new \ | |
| moonbit-community/proton_cli/output moonbit-community/proton_cli/package \ | |
| --target native --no-parallelize --diagnostic-limit 80 | |
| else | |
| moon -C proton test native --target native --diagnostic-limit 80 | |
| moon -C cli test -p moonbit-community/proton_cli \ | |
| moonbit-community/proton_cli/arguments moonbit-community/proton_cli/build_cmd \ | |
| moonbit-community/proton_cli/cef moonbit-community/proton_cli/codegen \ | |
| moonbit-community/proton_cli/dev moonbit-community/proton_cli/doctor \ | |
| moonbit-community/proton_cli/fsutil moonbit-community/proton_cli/new \ | |
| moonbit-community/proton_cli/output moonbit-community/proton_cli/package \ | |
| --target native --no-parallelize --diagnostic-limit 80 | |
| fi | |
| moon -C e2e build --target native --diagnostic-limit 80 | |
| - name: Check framework modules on Windows | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| env: | |
| _CL_: /utf-8 | |
| run: | | |
| $ErrorActionPreference = "Stop" | |
| $PSNativeCommandUseErrorActionPreference = $true | |
| moon check --target native --deny-warn | |
| moon -C proton test native --target native --diagnostic-limit 80 | |
| moon -C cli test -p moonbit-community/proton_cli moonbit-community/proton_cli/arguments moonbit-community/proton_cli/build_cmd moonbit-community/proton_cli/cef moonbit-community/proton_cli/codegen moonbit-community/proton_cli/dev moonbit-community/proton_cli/doctor moonbit-community/proton_cli/fsutil moonbit-community/proton_cli/new moonbit-community/proton_cli/output moonbit-community/proton_cli/package --target native --no-parallelize --diagnostic-limit 80 | |
| moon -C e2e build --target native --diagnostic-limit 80 | |
| - name: Test extensions on Unix | |
| if: ${{ matrix.os != 'windows-latest' }} | |
| run: | | |
| if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then | |
| xvfb-run -a moon -C extensions test -p moonbit-community/proton_ext \ | |
| moonbit-community/proton_ext/auto_launch moonbit-community/proton_ext/clipboard \ | |
| moonbit-community/proton_ext/dialog moonbit-community/proton_ext/fs \ | |
| moonbit-community/proton_ext/global_hotkey moonbit-community/proton_ext/keepawake \ | |
| moonbit-community/proton_ext/metadata_check moonbit-community/proton_ext/microphone \ | |
| moonbit-community/proton_ext/notification moonbit-community/proton_ext/path \ | |
| moonbit-community/proton_ext/shell moonbit-community/proton_ext/tray \ | |
| --target native | |
| xvfb-run -a moon test -p moonbit-community/proton_auto_launch moonbit-community/proton_clipboard \ | |
| moonbit-community/proton_global_hotkey moonbit-community/proton_keepawake moonbit-community/proton_microphone \ | |
| moonbit-community/proton_tray --target native | |
| else | |
| moon -C extensions test -p moonbit-community/proton_ext \ | |
| moonbit-community/proton_ext/auto_launch moonbit-community/proton_ext/clipboard \ | |
| moonbit-community/proton_ext/dialog moonbit-community/proton_ext/fs \ | |
| moonbit-community/proton_ext/global_hotkey moonbit-community/proton_ext/keepawake \ | |
| moonbit-community/proton_ext/metadata_check moonbit-community/proton_ext/microphone \ | |
| moonbit-community/proton_ext/notification moonbit-community/proton_ext/path \ | |
| moonbit-community/proton_ext/shell moonbit-community/proton_ext/tray \ | |
| --target native | |
| moon test -p moonbit-community/proton_auto_launch moonbit-community/proton_clipboard \ | |
| moonbit-community/proton_global_hotkey moonbit-community/proton_keepawake moonbit-community/proton_microphone \ | |
| moonbit-community/proton_tray --target native | |
| fi | |
| - name: Test extensions on Windows | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| env: | |
| _CL_: /utf-8 | |
| PATH: ${{ github.workspace }}\lib;${{ env.PATH }} | |
| run: | | |
| $ErrorActionPreference = "Stop" | |
| $PSNativeCommandUseErrorActionPreference = $true | |
| $extensionPackages = @( | |
| "moonbit-community/proton_ext" | |
| "moonbit-community/proton_ext/auto_launch" | |
| "moonbit-community/proton_ext/clipboard" | |
| "moonbit-community/proton_ext/dialog" | |
| "moonbit-community/proton_ext/fs" | |
| "moonbit-community/proton_ext/global_hotkey" | |
| "moonbit-community/proton_ext/keepawake" | |
| "moonbit-community/proton_ext/metadata_check" | |
| "moonbit-community/proton_ext/microphone" | |
| "moonbit-community/proton_ext/notification" | |
| "moonbit-community/proton_ext/path" | |
| "moonbit-community/proton_ext/shell" | |
| "moonbit-community/proton_ext/tray" | |
| ) | |
| moon -C extensions test -p $extensionPackages --target native | |
| $sysPackages = @( | |
| "moonbit-community/proton_auto_launch" | |
| "moonbit-community/proton_clipboard" | |
| "moonbit-community/proton_global_hotkey" | |
| "moonbit-community/proton_keepawake" | |
| "moonbit-community/proton_microphone" | |
| "moonbit-community/proton_tray" | |
| ) | |
| moon test -p $sysPackages --target native | |
| - name: Build examples | |
| if: ${{ matrix.os != 'windows-latest' }} | |
| run: | | |
| moon -C examples build --target native | |
| - name: Build examples on Windows | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| env: | |
| _CL_: /utf-8 | |
| run: | | |
| $ErrorActionPreference = "Stop" | |
| $PSNativeCommandUseErrorActionPreference = $true | |
| moon -C examples build --target native | |
| - name: List Windows example binaries | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| run: Get-ChildItem -Path ".\examples\target" -Recurse -Filter "*.exe" | ForEach-Object { "{0} ({1} bytes)" -f $_.FullName, $_.Length } | |
| - name: Run MoonBit CDP e2e on Windows | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| timeout-minutes: 10 | |
| env: | |
| _CL_: /utf-8 | |
| PROTON_BRIDGE_E2E_TIMEOUT_MS: 60000 | |
| run: | | |
| $ErrorActionPreference = "Stop" | |
| $PSNativeCommandUseErrorActionPreference = $true | |
| moon -C e2e test -p moonbit-community/proton/e2e/test --target native --no-parallelize --diagnostic-limit 200 | |
| - name: Run MoonBit CDP e2e on Unix | |
| if: ${{ matrix.os != 'windows-latest' }} | |
| timeout-minutes: 10 | |
| env: | |
| PROTON_BRIDGE_E2E_TIMEOUT_MS: 60000 | |
| run: | | |
| if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then | |
| xvfb-run -a moon -C e2e test -p moonbit-community/proton/e2e/test \ | |
| --target native --no-parallelize --diagnostic-limit 200 | |
| else | |
| moon -C e2e test -p moonbit-community/proton/e2e/test \ | |
| --target native --no-parallelize --diagnostic-limit 200 | |
| fi | |
| - name: List Unix example binaries | |
| if: ${{ matrix.os != 'windows-latest' }} | |
| run: find ./examples/target -type f | xargs ls -lh |