Fix #39: x64 macOS deps + app target Monterey (12.0)

.github/workflows/build-deps-macos.yml

@@ -62,11 +62,15 @@ jobs:
 
   build-x64:
     if: ${{ inputs.arch == 'x64' || inputs.arch == 'both' }}
-    runs-on: macos-15-intel  # native Intel image (last one, available until ~Aug 2027)
+    runs-on: macos-15-intel  # only hosted Intel image (macos-13 retired; last one until ~Aug 2027)
     steps:
       - uses: actions/checkout@v4
 
       - name: Build dependencies (x64, native)
+        # STRICT_MIN_OS=1: fail the build if any bundled Mach-O targets newer than
+        # the macOS 12 floor (issue #39) instead of silently shipping it.
+        env:
+          STRICT_MIN_OS: "1"
         run: ./Scripts/download-deps-macos.sh --force
 
       - name: Package dependencies

.github/workflows/build-macos.yml

@@ -21,6 +21,11 @@ on:
           - arm64
           - x64
         default: universal
+      notarize:
+        description: 'Notarize with Apple (needs valid developer agreements; off = signed-only, fine for local testing)'
+        required: false
+        type: boolean
+        default: true
 
 jobs:
   # Expand the arch choice into a matrix the build job fans out over.
@@ -42,6 +47,11 @@ jobs:
   build:
     needs: setup
     runs-on: macos-15  # Apple Silicon; x64 cross-compiles via ARCHS=x86_64
+    # Pin the macOS deployment target to 12.0 (issue #39): rustc reads this for
+    # the worker, and it matches the Xcode project / Podfile so the app shell and
+    # worker load on Monterey — consistent with the 12.0-targeted x64 deps.
+    env:
+      MACOSX_DEPLOYMENT_TARGET: "12.0"
     strategy:
       fail-fast: false
       matrix:
@@ -220,7 +230,9 @@ jobs:
           NOTARY_PASSWORD: ${{ secrets.MACOS_NOTARY_PASSWORD }}
           NOTARY_TEAM_ID: ${{ secrets.MACOS_NOTARY_TEAM_ID }}
         run: |
-          ./Scripts/package-macos.sh --version "${{ inputs.version }}" --arch ${{ matrix.arch }} --skip-build --notarize
+          ARGS=(--version "${{ inputs.version }}" --arch ${{ matrix.arch }} --skip-build)
+          if [ "${{ inputs.notarize }}" = "true" ]; then ARGS+=(--notarize); fi
+          ./Scripts/package-macos.sh "${ARGS[@]}"
 
       - name: Clean up signing keychain
         if: always()

.github/workflows/nightly.yml

@@ -10,6 +10,16 @@ on:
   schedule:
     - cron: '0 7 * * *'  # 07:00 UTC daily
   workflow_dispatch:
+    inputs:
+      platform:
+        description: 'Which platforms to run (manual dispatch only)'
+        type: choice
+        options:
+          - all
+          - macos
+          - windows
+          - linux
+        default: all
 
 concurrency:
   group: nightly-${{ github.ref }}
@@ -20,6 +30,7 @@ env:
 
 jobs:
   macos:
+    if: ${{ github.event_name == 'schedule' || inputs.platform == 'all' || inputs.platform == 'macos' }}
     strategy:
       fail-fast: false
       matrix:
@@ -93,6 +104,7 @@ jobs:
         run: cd app && flutter test --tags heavy
 
   windows:
+    if: ${{ github.event_name == 'schedule' || inputs.platform == 'all' || inputs.platform == 'windows' }}
     runs-on: windows-latest
     env:
       VAPOURBOX_DEPS_DIR: ${{ github.workspace }}/deps/windows-x64
@@ -162,6 +174,7 @@ jobs:
         run: cd app && flutter test --tags heavy
 
   linux:
+    if: ${{ github.event_name == 'schedule' || inputs.platform == 'all' || inputs.platform == 'linux' }}
     runs-on: ubuntu-22.04
     env:
       VAPOURBOX_DEPS_DIR: ${{ github.workspace }}/deps/linux-x64

CLAUDE.md

@@ -565,6 +565,7 @@ The `download-deps-windows.ps1` and `download-deps-macos.sh` scripts apply these
 - Worker sets: `PYTHONHOME`, `PYTHONPATH`, `VAPOURSYNTH_CONF_PATH`, `DYLD_LIBRARY_PATH`
 - `vspipe` is a wrapper script that generates config dynamically (needed because `VAPOURSYNTH_PLUGIN_PATH` is additive, not a replacement)
 - **FFmpeg** is sourced pre-built as a static binary that links only system frameworks: **x64** from evermeet.cx, **arm64** from martin-riedl.de (Homebrew's arm64 ffmpeg is dynamically linked to ~17 Homebrew dylibs and is NOT self-contained, so it can't be bundled). **x64 plugins** build from source under Rosetta, except `tmedian`/`bestsource` which come pre-built from Stefan-Olt/vs-plugin-build.
+- **x64 minimum macOS = 12.0 (Monterey), issue #39**: the only hosted Intel runner is `macos-15-intel` (`macos-13` was retired), so Homebrew bottles come out `minos 14/15` and won't load on 12. The x64 build therefore exports `MACOSX_DEPLOYMENT_TARGET=12.0` and **builds the bundled support libs from source** (zimg, fftw, libdvdread, xz, boost) so they target 12; the OpenCL plugins (`nnedi3cl`/`knlmeanscl`) are compiled against that source boost (`BOOST_ROOT="$SRCLIB"`) for ABI match. vspipe's `doubleToString` is patched off `std::to_chars` (needs 13.3+ libc++). A `minos` verification pass at the end fails the build under `STRICT_MIN_OS=1` (set in `build-deps-macos.yml`) if any bundled Mach-O exceeds 12.0. **arm64 is unchanged (still `minos 15`)** — it has no old runner and the prebuilt arm64 plugins are >12; the app/worker deployment target is pinned to 12.0 for both arches (`build-macos.yml`, Runner.xcodeproj, Podfile).
 - **Code signing**: After `install_name_tool` modifications, binaries must be re-signed: `codesign -s - -f <binary>` (exit code 137 = SIGKILL means invalid signature)
 - Quarantine removal: `xattr -cr` on deps after download
 - Show in Folder: `open -R <path>`