openhuman/.github/workflows/macos-arm64-build.yml

# Standalone macOS Apple Silicon (aarch64) Tauri build — no prepare-release / tagging.
#
# GitHub: workflow_dispatch checks out the ref. Local act: ACT=true skips checkout (use -b bind + run
# ./scripts/run-macos-arm64-build.sh so submodules are initialized before act copies the tree).
name: macOS ARM64 build

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-macos-arm64:
    name: Build macOS aarch64 (signed)
    runs-on: macos-latest
    env:
      GITHUB_TOKEN: ${{ secrets.XGH_TOKEN || github.token }}
    steps:
      - name: Checkout repository
        if: ${{ env.ACT != 'true' }}
        uses: actions/checkout@v4

      - name: Set Xcode version
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable

      - name: Setup Node.js 24.x
        uses: actions/setup-node@v4
        with:
          node-version: 24.x
          cache: yarn

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin

      - name: Cargo.lock fingerprint (deps only)
        id: cargo-lock-fingerprint
        shell: bash
        run: |
          echo "hash=$(tail -n +8 src-tauri/Cargo.lock | openssl dgst -sha256 | awk '{print $2}')" >> "$GITHUB_OUTPUT"

      - name: Cache Cargo registry and git sources
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-registry-${{ steps.cargo-lock-fingerprint.outputs.hash }}
          restore-keys: |
            ${{ runner.os }}-cargo-registry-

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Install skills dependencies
        run: cd skills && yarn install --frozen-lockfile

      - name: Build skills
        run: cd skills && yarn build

      - name: Define Tauri configuration overrides
        id: config-overrides
        uses: actions/github-script@v7
        env:
          BASE_URL: ${{ vars.BASE_URL }}
          UPDATER_PUBLIC_KEY: ${{ secrets.UPDATER_PUBLIC_KEY }}
          WITH_UPDATER: 'true'
        with:
          github-token: ${{ secrets.XGH_TOKEN || github.token }}
          script: |
            const workspacePath = process.env.GITHUB_WORKSPACE.replace(/\\/g, '/');
            const prefix = workspacePath.startsWith('/') ? 'file://' : 'file:///';
            const moduleUrl = `${prefix}${workspacePath}/scripts/prepareTauriConfig.js`;
            const { default: prepareTauriConfig } = await import(moduleUrl);
            const config = prepareTauriConfig();
            core.setOutput('json', JSON.stringify(config));

      - name: Build frontend
        run: yarn build
        env:
          NODE_ENV: production
          VITE_BACKEND_URL: ${{ vars.VITE_BACKEND_URL }}
          VITE_SENTRY_DSN: ${{ vars.VITE_SENTRY_DSN }}
          VITE_DEBUG: ${{ vars.VITE_DEBUG }}

      - name: Build sidecar core binary
        shell: bash
        run: |
          cargo build \
            --manifest-path rust-core/Cargo.toml \
            --release \
            --target aarch64-apple-darwin \
            --bin openhuman-core

      - name: Stage sidecar for Tauri bundler
        shell: bash
        run: |
          mkdir -p src-tauri/binaries
          cp rust-core/target/aarch64-apple-darwin/release/openhuman-core \
            src-tauri/binaries/openhuman-core-aarch64-apple-darwin
          chmod +x src-tauri/binaries/openhuman-core-aarch64-apple-darwin

      - name: Build, package (no GitHub release upload)
        uses: tauri-apps/tauri-action@v0.6.2
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          BASE_URL: ${{ vars.BASE_URL }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          WITH_UPDATER: 'true'
          MACOSX_DEPLOYMENT_TARGET: '10.15'
        with:
          args: -c ${{ steps.config-overrides.outputs.json }} --target aarch64-apple-darwin -- -- --bin OpenHuman
          includeDebug: false
          includeRelease: true
          includeUpdaterJson: false