Add GitHub Actions workflow for macOS arm64 builds #812
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| # Builds macOS (Apple Silicon / arm64) artifacts on push to main and on manual dispatch. | ||
| name: Build macOS Apple Silicon (arm64) | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| build-arm64: | ||
| name: Build macOS (arm64 / Apple Silicon) | ||
| runs-on: macos-14 | ||
| timeout-minutes: 60 | ||
| env: | ||
| CI: true | ||
| steps: | ||
| - name: Checkout main | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
Comment on lines
+21
to
+24
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
file=".github/workflows/build-macos-arm64.yml"
printf '%s\n' '--- workflow ---'
cat -n "$file"
printf '%s\n' '--- workflow references to checkout credentials and git operations ---'
rg -n -S 'persist-credentials|git (fetch|push|pull|clone)|actions/checkout|GITHUB_TOKEN|github.token|token:' .github scripts package.json 2>/dev/null || true
printf '%s\n' '--- repository workflow permissions ---'
rg -n -A6 -B2 'permissions:' .github/workflows 2>/dev/null || trueRepository: webadderallorg/Recordly Length of output: 9811 🌐 Web query:
💡 Result: The persist-credentials input in the actions/checkout GitHub Action controls whether the repository's authentication token (or SSH key) is configured for use with local git commands within the workflow [1][2]. Key details regarding persist-credentials: Default Behavior: The default value for persist-credentials is true [2][3]. When enabled, the action configures the authentication credentials so that subsequent git commands (e.g., git fetch, git push) executed in your scripts can use them automatically [1][4]. Security and Implementation: - Recent versions of actions/checkout (v6.0.0 and later) have improved credential security by storing these credentials in a temporary file located in the $RUNNER_TEMP directory, rather than directly within the.git/config file as was done in earlier versions [5][6]. - The credentials remain active during the job and are automatically removed by a post-job cleanup step [1][4]. - You can opt out of this behavior by setting persist-credentials: false in your workflow file [1][7]. Compatibility Note: Because the implementation changed to use $RUNNER_TEMP, using persistent credentials inside Docker container actions now requires Actions Runner version 2.329.0 or later to ensure the credentials can be properly accessed [5][6]. For security-sensitive workflows, you may choose to disable this setting if your scripts do not require authenticated git access, although it is worth noting that the underlying GitHub token is generally available to other steps in the workflow regardless of this setting's configuration [8]. Citations:
Disable checkout credential persistence.
🧰 Tools🪛 zizmor (1.29.0)[warning] 21-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '22' | ||
| cache: 'npm' | ||
| cache-dependency-path: package-lock.json | ||
|
|
||
| - name: Setup Python | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: '3.11' | ||
|
Comment on lines
+33
to
+36
Contributor
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/build-macos-arm64.yml
printf '%s\n' '--- setup-python references ---'
rg -n --hidden --glob '!.git/**' 'actions/setup-python@' .
printf '%s\n' '--- actionlint availability ---'
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/build-macos-arm64.yml || true
else
printf '%s\n' 'actionlint not installed'
fiRepository: webadderallorg/Recordly Length of output: 4372 🌐 Web query:
💡 Result: The current version of actions/setup-python is v7.0.0, released on July 20, 2026 [1][2]. Key information regarding the v7 release includes: - Migration: The primary change in v7.0.0 is the migration of the action's internals to ECMAScript Modules (ESM) to ensure compatibility with the latest Citations:
Upgrade
🧰 Tools🪛 actionlint (1.7.12)[error] 34-34: the runner of "actions/setup-python@v4" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| - name: Install dependencies | ||
| run: npm ci --ignore-scripts | ||
|
Comment on lines
+38
to
+39
Contributor
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*' 'package.json' '*electron-builder*' '*electron*' '*forge*' | sed -n '1,160p'
printf '%s\n' '--- macOS ARM64 workflow ---'
cat -n .github/workflows/build-macos-arm64.yml
printf '%s\n' '--- release workflow references ---'
rg -n -C 5 'install-app-deps|npm ci|ignore-scripts|native|electron-builder|package|smoke|normalize' .github/workflows/release.yml .github/workflows 2>/dev/null | sed -n '1,260p'
printf '%s\n' '--- package scripts and Electron Builder configuration ---'
python3 - <<'PY'
import json
from pathlib import Path
p = Path("package.json")
if p.exists():
data = json.loads(p.read_text())
print(json.dumps({
"scripts": data.get("scripts", {}),
"build": data.get("build"),
"devDependencies": data.get("devDependencies", {}),
"dependencies": data.get("dependencies", {}),
}, indent=2))
else:
print("package.json not found")
PY
printf '%s\n' '--- Electron Builder configuration references ---'
rg -n -C 4 'hardenedRuntime|electron-builder|install-app-deps|app-deps|macos|mac:' . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' | sed -n '1,260p'Repository: webadderallorg/Recordly Length of output: 48486 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- postinstall implementation ---'
cat -n scripts/postinstall.mjs
printf '%s\n' '--- native dependency references ---'
rg -n -C 4 'uiohook-napi|`@electron/rebuild`|postinstall|install-app-deps' package.json package-lock.json scripts electron electron-builder.json5 .github/workflows | sed -n '1,280p'
printf '%s\n' '--- relevant workflow ranges ---'
sed -n '150,190p' .github/workflows/release.yml
sed -n '260,296p' .github/workflows/release.yml
sed -n '20,55p' .github/workflows/build.yml
sed -n '95,125p' .github/workflows/build.yml
printf '%s\n' '--- read-only contract verifier ---'
python3 - <<'PY'
import json
from pathlib import Path
pkg = json.loads(Path("package.json").read_text())
postinstall = Path("scripts/postinstall.mjs").read_text()
workflows = {
"macos-arm64-build": Path(".github/workflows/build-macos-arm64.yml").read_text(),
"generic-build": Path(".github/workflows/build.yml").read_text(),
"release": Path(".github/workflows/release.yml").read_text(),
}
print("postinstall_declared:", pkg.get("scripts", {}).get("postinstall"))
print("postinstall_mentions_native_rebuild:",
"`@electron/rebuild`" in postinstall or "rebuild" in postinstall)
print("uiohook_declared_dependency:",
"uiohook-napi" in pkg.get("dependencies", {}) or
"uiohook-napi" in pkg.get("devDependencies", {}))
for name, text in workflows.items():
ci = text.find("npm ci --ignore-scripts")
app = text.find("npx electron-builder install-app-deps", ci + 1)
native = text.find("npm run build:platform-native-helpers", ci + 1)
print(f"{name}: ci={ci >= 0}, app_deps_after_ci={app > ci >= 0}, native_helpers_after_ci={native > ci >= 0}")
PYRepository: webadderallorg/Recordly Length of output: 25339 Install Electron app dependencies before building native helpers.
🤖 Prompt for AI Agents |
||
|
|
||
| - name: Install bundled FFmpeg (best-effort) | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| # repo has scripts/install-ffmpeg-static.mjs used elsewhere; run it but don't let a harmless failure stop the job | ||
| node scripts/install-ffmpeg-static.mjs || true | ||
|
Comment on lines
+41
to
+46
Contributor
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/build-macos-arm64.yml | sed -n '1,110p'
printf '%s\n' '--- FFmpeg installer ---'
if [ -f scripts/install-ffmpeg-static.mjs ]; then
cat -n scripts/install-ffmpeg-static.mjs
else
printf '%s\n' 'missing: scripts/install-ffmpeg-static.mjs'
fi
printf '%s\n' '--- release references ---'
rg -n -C 5 'install-ffmpeg-static|ffmpeg-static|FFmpeg|ffmpeg' .github/workflows/release.yml package.json scripts 2>/dev/null || true
printf '%s\n' '--- package metadata ---'
if [ -f package.json ]; then
node - <<'JS'
const fs = require('node:fs');
const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
console.log(JSON.stringify({
scripts: p.scripts,
dependencies: p.dependencies && { 'ffmpeg-static': p.dependencies['ffmpeg-static'] },
devDependencies: p.devDependencies && { 'ffmpeg-static': p.devDependencies['ffmpeg-static'] },
}, null, 2));
JS
fi
printf '%s\n' '--- tracked references to ffmpeg-static ---'
git grep -n -E 'ffmpeg-static|install-ffmpeg-static' -- ':!package-lock.json' || trueRepository: webadderallorg/Recordly Length of output: 30729 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
for name in [
".github/workflows/build-macos-arm64.yml",
".github/workflows/release.yml",
"scripts/install-ffmpeg-static.mjs",
"package.json",
]:
p = Path(name)
print(f"--- {name} ---")
if p.exists():
lines = p.read_text().splitlines()
for i, line in enumerate(lines, 1):
if name.endswith("build-macos-arm64.yml") and 35 <= i <= 52:
print(f"{i}: {line}")
elif name.endswith("release.yml") and ("ffmpeg" in line.lower() or "install" in line.lower()):
lo, hi = max(1, i-3), min(len(lines), i+5)
for j in range(lo, hi+1):
print(f"{j}: {lines[j-1]}")
print()
elif name.endswith("install-ffmpeg-static.mjs"):
print(f"{i}: {line}")
elif name == "package.json" and any(k in line for k in ["ffmpeg-static", '"scripts"', '"dependencies"', '"devDependencies"']):
print(f"{i}: {line}")
else:
print("missing")
PYRepository: webadderallorg/Recordly Length of output: 17209 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- FFmpeg runtime resolution ---'
cat -n electron/ipc/ffmpeg/binary.ts | sed -n '1,155p'
printf '%s\n' '--- packaging and smoke checks ---'
cat -n electron-builder.json5 | sed -n '1,45p'
cat -n scripts/smoke-packaged-binaries.mjs | sed -n '205,238p'
printf '%s\n' '--- macOS release-candidate gate ---'
cat -n .github/workflows/macos-release-candidate.yml | sed -n '104,120p'Repository: webadderallorg/Recordly Length of output: 8491 Do not suppress FFmpeg installation failures.
🤖 Prompt for AI Agents |
||
|
|
||
| - name: Build app inputs | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| npm run build:platform-native-helpers | ||
| npx tsc | ||
| npx vite build --config vite.config.ts | ||
| # these npm scripts exist in repo; tolerant to failure if not required for this build | ||
| npm run normalize:electron-main-cjs || true | ||
| npm run smoke:electron-main-cjs || true | ||
|
Comment on lines
+55
to
+57
Contributor
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/build-macos-arm64.yml | sed -n '1,120p'
printf '%s\n' '--- release references ---'
rg -n -C 5 'normalize:electron-main-cjs|smoke:electron-main-cjs|smoke:packaged-binaries|PACKAGED_SMOKE_ARCH_TAGS|checksum|package' .github/workflows package.json
printf '%s\n' '--- script definitions and implementations ---'
rg -n -C 8 '"(normalize:electron-main-cjs|smoke:electron-main-cjs|smoke:packaged-binaries)"|normalize:electron-main-cjs|smoke:electron-main-cjs|smoke:packaged-binaries' --glob '!node_modules/**' .Repository: webadderallorg/Recordly Length of output: 32917 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- candidate files ---'
git ls-files | rg '(^|/)(package\.json|.*electron.*|.*smoke.*|.*normalize.*)$|^\.github/workflows/'
printf '%s\n' '--- package metadata ---'
if test -f package.json; then
cat -n package.json | sed -n '1,220p'
fi
printf '%s\n' '--- relevant workflow sections ---'
for f in .github/workflows/build-macos-arm64.yml .github/workflows/release.yml; do
if test -f "$f"; then
printf '%s\n' "--- $f ---"
rg -n -C 10 'normalize:electron-main-cjs|smoke:electron-main-cjs|smoke:packaged-binaries|PACKAGED_SMOKE_ARCH_TAGS|checksum|electron-builder|package' "$f"
fi
doneRepository: webadderallorg/Recordly Length of output: 25821 🏁 Script executed: #!/bin/bash
set -eu
for f in scripts/normalize-electron-main-cjs.mjs scripts/smoke-electron-main-cjs.mjs scripts/smoke-packaged-binaries.mjs scripts/write-release-checksums.mjs electron-builder.json5; do
printf '%s\n' "--- $f ---"
wc -l "$f"
cat -n "$f"
doneRepository: webadderallorg/Recordly Length of output: 32109 Make Electron validation a required gate. Remove 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Build macOS (arm64) package (unsigned) | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| # Force code signing off so the build runs without Apple signing secrets. | ||
| npx electron-builder \ | ||
| --mac dir dmg zip \ | ||
| --arm64 \ | ||
| --publish never \ | ||
| -c.mac.forceCodeSigning=false \ | ||
| -c.mac.identity=null | ||
|
|
||
| - name: Generate checksums (if repo has a script) | ||
| if: always() | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| # If project provides checksum helper, run it; ignore if missing | ||
| npm run checksums:release -- SHA256SUMS-macos-arm64.txt || true | ||
|
Comment on lines
+71
to
+77
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/build-macos-arm64.yml | sed -n '55,95p'
printf '%s\n' '--- release references ---'
rg -n -C 5 'checksums:release|SHA256SUMS-macos-arm64|upload-artifact|if-no-files-found' .github package.json package-lock.json 2>/dev/null || true
printf '%s\n' '--- checksum script definitions ---'
rg -n -C 8 '"checksums:release"|checksums:release|SHA256SUMS' --glob 'package.json' --glob '*.js' --glob '*.cjs' --glob '*.mjs' --glob '*.ts' . 2>/dev/null || trueRepository: webadderallorg/Recordly Length of output: 22088 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- checksum implementation ---'
cat -n scripts/write-release-checksums.mjs | sed -n '1,180p'
printf '%s\n' '--- macOS arm64 workflow context ---'
cat -n .github/workflows/build-macos-arm64.yml | sed -n '1,100p'
printf '%s\n' '--- release workflow checksum context ---'
cat -n .github/workflows/release.yml | sed -n '280,315p'Repository: webadderallorg/Recordly Length of output: 7305 🌐 Web query:
💡 Result: In GitHub Actions Citations:
Make checksum generation required. Remove 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Upload artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: macos-arm64-build | ||
| path: | | ||
| release/*.dmg | ||
| release/*.zip | ||
| release/*.blockmap | ||
| release/latest-mac.yml | ||
| release/SHA256SUMS-macos-arm64.txt | ||
| if-no-files-found: error | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: webadderallorg/Recordly
Length of output: 4982
🌐 Web query:
GitHub Actions runner-images macos-14 deprecation July 6 2026 November 2 2026 macos-15 arm64 support💡 Result:
GitHub Actions runner images based on macOS 14 (Sonoma) are currently undergoing a deprecation process [1][2]. Key dates for the macOS 14 image deprecation: - Deprecation start date: July 6, 2026 [1][2]. - Full retirement (unsupported): November 2, 2026 [1][2]. During the period leading up to the final retirement, a series of scheduled brownouts are in place, during which jobs using the macOS 14 images will fail [1][2]. These brownouts are scheduled for October 2026 on the following dates and times (all UTC) [1][2]: - October 5, 14:00 – October 6, 00:00 - October 12, 14:00 – October 13, 00:00 - October 16, 14:00 – October 17, 00:00 - October 19, 14:00 – October 20, 00:00 - October 23, 14:00 – October 24, 00:00 - October 26, 14:00 – October 27, 00:00 - October 29, 14:00 – October 30, 00:00 - October 30, 14:00 – October 31, 00:00 Regarding macOS 15 support, the macOS 15 (Sequoia) runner images are generally available and fully support ARM64 architecture [3][4]. Customers are advised to migrate their pipelines to
macos-15ormacos-latestprior to the November 2, 2026, retirement date to avoid service disruptions [2][5].Citations:
Move this workflow to
macos-15before merge. GitHub will retiremacos-14on November 2, 2026, with brownouts beginning in October.macos-15supports ARM64.🤖 Prompt for AI Agents