mirror of
https://github.com/stablyai/orca.git
synced 2026-10-30 16:47:34 +00:00
fix(daemon): recover lost macOS worker wake-ups in the packaged terminal runtime (#29133)
Builds the macOS terminal host's Node 24.22.1 from pinned source with a libuv patch: idle threadpool workers recheck for queued work every 30 s instead of waiting forever, so a lost Darwin condition-variable wake-up (libuv #5280) no longer strands terminal I/O. Bumps the daemon protocol to v52 so new terminals start on the patched runtime right after an update; older daemons stay attachable. Adds stalled/recovered daemon async-I/O telemetry, and lets release workflows rebuild older refs that predate the source build. Fixes STA-11709, #31926.
This commit is contained in:
@@ -267,8 +267,8 @@ jobs:
|
||||
matrix:
|
||||
arch: [x64, arm64]
|
||||
runs-on: blacksmith-12vcpu-macos-15
|
||||
# Allow 150min for install 3×10 + publish 2×45 + ~25 setup/build/verify; outer timeout would prevent cleanup.
|
||||
timeout-minutes: 150
|
||||
# Allow 360min: 180 for a cold patched-runtime build + 150 for install/publish retries and setup.
|
||||
timeout-minutes: 360
|
||||
env:
|
||||
JOBS: max
|
||||
NODE_OPTIONS: --max-old-space-size=4096
|
||||
@@ -308,7 +308,7 @@ jobs:
|
||||
pnpm-lock.yaml
|
||||
mobile/pnpm-lock.yaml
|
||||
|
||||
# Cache bundled host Node by exact pin, without restore keys, so bumps cannot restore old archives.
|
||||
# Cache the patched host Node by exact pin and patch, without restore keys.
|
||||
- name: Locate the pinned Node runtime cache
|
||||
shell: bash
|
||||
run: echo "ORCA_NODE_RUNTIME_CACHE_DIR=$HOME/Library/Caches/orca-node-runtime" >>"$GITHUB_ENV"
|
||||
@@ -317,7 +317,7 @@ jobs:
|
||||
uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/Library/Caches/orca-node-runtime
|
||||
key: orca-node-runtime-mac-${{ hashFiles('src/shared/node-runtime-pin.ts') }}
|
||||
key: orca-node-runtime-mac-${{ hashFiles('src/shared/node-runtime-pin.ts', 'config/node-runtime-patches/**', 'config/scripts/build-darwin-terminal-node.mjs', 'config/scripts/pinned-node-downloads.mjs', 'config/scripts/update-node-runtime-pin.mjs', 'config/scripts/macos-terminal-host-bundle.cjs') }}
|
||||
|
||||
- name: Cache electron-builder downloads
|
||||
uses: actions/cache@v5
|
||||
@@ -338,6 +338,15 @@ jobs:
|
||||
retry_wait_seconds: 30
|
||||
command: pnpm install --frozen-lockfile --cpu=current,x64,arm64
|
||||
|
||||
# Why: older refs predate the source build and package the pinned download instead.
|
||||
- name: Build and verify the patched terminal runtimes
|
||||
if: hashFiles('config/scripts/build-darwin-terminal-node.mjs') != ''
|
||||
timeout-minutes: 180
|
||||
run: |
|
||||
pnpm run build:packages
|
||||
ORCA_BACKGROUND_LAUNCH=1 node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/verify-darwin-terminal-node.mjs --arch=arm64
|
||||
ORCA_BACKGROUND_LAUNCH=1 node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/verify-darwin-terminal-node.mjs --arch=x64
|
||||
|
||||
# Build required out/mobile-web after installing its React Native/Expo dependencies.
|
||||
- uses: ./.github/actions/install-mobile-dependencies
|
||||
if: needs.release-javascript.outputs.supported != 'true'
|
||||
@@ -423,7 +432,7 @@ jobs:
|
||||
timeout_minutes: 45
|
||||
max_attempts: 2
|
||||
retry_wait_seconds: 30
|
||||
command: node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/pinned-node-downloads.mjs darwin-arm64 darwin-x64 && node config/scripts/ensure-native-runtime.mjs --runtime=electron && ORCA_MAC_ADHOC=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac dmg zip --${{ matrix.arch }} --publish never
|
||||
command: if [ ! -f config/scripts/build-darwin-terminal-node.mjs ]; then node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/pinned-node-downloads.mjs darwin-arm64 darwin-x64; fi && node config/scripts/ensure-native-runtime.mjs --runtime=electron && ORCA_MAC_ADHOC=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac dmg zip --${{ matrix.arch }} --publish never
|
||||
env:
|
||||
ORCA_ADHOC_BUILD_VERSION: ${{ needs.orcad-template-support.outputs.version }}
|
||||
ORCA_BUILD_COMMIT: ${{ needs.orcad-template-support.outputs.commit }}
|
||||
@@ -656,12 +665,12 @@ jobs:
|
||||
fast_release: true
|
||||
javascript_source_sha: ${{ needs.release-javascript.outputs.supported == 'true' && needs.release-javascript.outputs.source_sha || '' }}
|
||||
|
||||
# Prefetch the installer during notarization; the publisher still waits for Mac success.
|
||||
# Wait outside the publisher runner so cold runtime builds cannot exhaust its timeout.
|
||||
publish-adhoc-win:
|
||||
needs: [orcad-template-support, build-adhoc-win]
|
||||
needs: [orcad-template-support, build-adhoc-win, build-adhoc-mac]
|
||||
if: >-
|
||||
!cancelled() && needs.orcad-template-support.result == 'success' &&
|
||||
needs.build-adhoc-win.result == 'success'
|
||||
needs.build-adhoc-win.result == 'success' && needs.build-adhoc-mac.result == 'success'
|
||||
permissions:
|
||||
contents: read
|
||||
actions: read
|
||||
@@ -670,4 +679,3 @@ jobs:
|
||||
with:
|
||||
channel: adhoc
|
||||
tag: v${{ needs.orcad-template-support.outputs.version }}
|
||||
wait_for_mac_job: build-adhoc-mac
|
||||
|
||||
@@ -69,8 +69,8 @@ jobs:
|
||||
head_sha: ${{ steps.freshness.outputs.head_sha }}
|
||||
published: ${{ steps.publish_live.outcome == 'success' && 'true' || 'false' }}
|
||||
runs-on: blacksmith-6vcpu-macos-15
|
||||
# Allow 150min for install 3×10 + publish 2×45 + ~25 setup/build/verify, so outer timeout cannot strand cleanup mid-retry.
|
||||
timeout-minutes: 150
|
||||
# Allow 360min: 180 for a cold patched-runtime build + 150 for install/publish retries and setup.
|
||||
timeout-minutes: 360
|
||||
env:
|
||||
NODE_OPTIONS: --max-old-space-size=4096
|
||||
steps:
|
||||
@@ -143,7 +143,7 @@ jobs:
|
||||
pnpm-lock.yaml
|
||||
mobile/pnpm-lock.yaml
|
||||
|
||||
# Cache bundled host Node by exact pin without restore keys.
|
||||
# Cache the patched host Node by exact pin and patch, without restore keys.
|
||||
- name: Locate the pinned Node runtime cache
|
||||
if: steps.freshness.outputs.should_build == 'true'
|
||||
shell: bash
|
||||
@@ -154,7 +154,7 @@ jobs:
|
||||
uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/Library/Caches/orca-node-runtime
|
||||
key: orca-node-runtime-mac-${{ hashFiles('src/shared/node-runtime-pin.ts') }}
|
||||
key: orca-node-runtime-mac-${{ hashFiles('src/shared/node-runtime-pin.ts', 'config/node-runtime-patches/**', 'config/scripts/build-darwin-terminal-node.mjs', 'config/scripts/pinned-node-downloads.mjs', 'config/scripts/update-node-runtime-pin.mjs', 'config/scripts/macos-terminal-host-bundle.cjs') }}
|
||||
|
||||
- name: Cache electron-builder downloads
|
||||
if: steps.freshness.outputs.should_build == 'true'
|
||||
@@ -177,6 +177,14 @@ jobs:
|
||||
retry_wait_seconds: 30
|
||||
command: pnpm install --frozen-lockfile --cpu=current,x64,arm64
|
||||
|
||||
- name: Build and verify the patched terminal runtimes
|
||||
if: steps.freshness.outputs.should_build == 'true'
|
||||
timeout-minutes: 180
|
||||
run: |
|
||||
pnpm run build:packages
|
||||
ORCA_BACKGROUND_LAUNCH=1 node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/verify-darwin-terminal-node.mjs --arch=arm64
|
||||
ORCA_BACKGROUND_LAUNCH=1 node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/verify-darwin-terminal-node.mjs --arch=x64
|
||||
|
||||
# Build required out/mobile-web using mobile’s React Native/Expo install.
|
||||
- uses: ./.github/actions/install-mobile-dependencies
|
||||
if: steps.freshness.outputs.should_build == 'true'
|
||||
@@ -193,12 +201,23 @@ jobs:
|
||||
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
||||
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
||||
|
||||
# Why: App tokens last one hour, and the cold runtime build alone can outlast that.
|
||||
- name: Re-mint daily repo token for versioning
|
||||
id: app_token_version
|
||||
if: steps.freshness.outputs.should_build == 'true'
|
||||
uses: actions/create-github-app-token@v2
|
||||
with:
|
||||
app-id: ${{ secrets.HOURLY_RELEASE_APP_ID }}
|
||||
private-key: ${{ secrets.HOURLY_RELEASE_APP_PRIVATE_KEY }}
|
||||
owner: stablyai
|
||||
repositories: orca-daily
|
||||
|
||||
- name: Compute daily version
|
||||
id: daily
|
||||
if: steps.freshness.outputs.should_build == 'true'
|
||||
shell: bash
|
||||
env:
|
||||
GH_TOKEN: ${{ steps.app_token.outputs.token }}
|
||||
GH_TOKEN: ${{ steps.app_token_version.outputs.token }}
|
||||
MAIN_REPO_TOKEN: ${{ github.token }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
@@ -303,7 +322,7 @@ jobs:
|
||||
timeout_minutes: 45
|
||||
max_attempts: 2
|
||||
retry_wait_seconds: 30
|
||||
command: node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/pinned-node-downloads.mjs darwin-arm64 darwin-x64 && node config/scripts/ensure-native-runtime.mjs --runtime=electron && if [ -f config/scripts/build-mac-notarization-overlap.mjs ]; then ORCA_MAC_DAILY=1 node config/scripts/build-mac-notarization-overlap.mjs --publish always; else ORCA_MAC_DAILY=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac --publish always; fi
|
||||
command: node config/scripts/ensure-native-runtime.mjs --runtime=electron && if [ -f config/scripts/build-mac-notarization-overlap.mjs ]; then ORCA_MAC_DAILY=1 node config/scripts/build-mac-notarization-overlap.mjs --publish always; else ORCA_MAC_DAILY=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac --publish always; fi
|
||||
env:
|
||||
# Give the publisher App write access to its configured orca-daily target.
|
||||
GH_TOKEN: ${{ steps.app_token_publish.outputs.token }}
|
||||
|
||||
@@ -105,8 +105,8 @@ jobs:
|
||||
head_sha: ${{ needs.preflight.outputs.head_sha }}
|
||||
published: ${{ steps.publish_live.outcome == 'success' && 'true' || 'false' }}
|
||||
runs-on: blacksmith-6vcpu-macos-15
|
||||
# Allow 150min for install 3×10 + publish 2×45 + ~25 setup/build/verify; outer timeout otherwise interrupts cleanup.
|
||||
timeout-minutes: 150
|
||||
# Allow 360min: 180 for a cold patched-runtime build + 150 for install/publish retries and setup.
|
||||
timeout-minutes: 360
|
||||
env:
|
||||
NODE_OPTIONS: --max-old-space-size=4096
|
||||
steps:
|
||||
@@ -119,15 +119,6 @@ jobs:
|
||||
# Read this repo without persisted credentials; write orca-hourly via env App token (zizmor: artipacked).
|
||||
persist-credentials: false
|
||||
|
||||
- name: Mint hourly repo token
|
||||
id: app_token
|
||||
uses: actions/create-github-app-token@v2
|
||||
with:
|
||||
app-id: ${{ secrets.HOURLY_RELEASE_APP_ID }}
|
||||
private-key: ${{ secrets.HOURLY_RELEASE_APP_PRIVATE_KEY }}
|
||||
owner: stablyai
|
||||
repositories: orca-hourly
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: ./.github/actions/setup-pnpm
|
||||
|
||||
@@ -141,7 +132,7 @@ jobs:
|
||||
pnpm-lock.yaml
|
||||
mobile/pnpm-lock.yaml
|
||||
|
||||
# Cache bundled host Node by exact pin without restore keys.
|
||||
# Cache the patched host Node by exact pin and patch, without restore keys.
|
||||
- name: Locate the pinned Node runtime cache
|
||||
shell: bash
|
||||
run: echo "ORCA_NODE_RUNTIME_CACHE_DIR=$HOME/Library/Caches/orca-node-runtime" >>"$GITHUB_ENV"
|
||||
@@ -150,7 +141,7 @@ jobs:
|
||||
uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/Library/Caches/orca-node-runtime
|
||||
key: orca-node-runtime-mac-${{ hashFiles('src/shared/node-runtime-pin.ts') }}
|
||||
key: orca-node-runtime-mac-${{ hashFiles('src/shared/node-runtime-pin.ts', 'config/node-runtime-patches/**', 'config/scripts/build-darwin-terminal-node.mjs', 'config/scripts/pinned-node-downloads.mjs', 'config/scripts/update-node-runtime-pin.mjs', 'config/scripts/macos-terminal-host-bundle.cjs') }}
|
||||
|
||||
- name: Cache electron-builder downloads
|
||||
uses: actions/cache@v5
|
||||
@@ -171,6 +162,13 @@ jobs:
|
||||
retry_wait_seconds: 30
|
||||
command: pnpm install --frozen-lockfile --cpu=current,x64,arm64
|
||||
|
||||
- name: Build and verify the patched terminal runtimes
|
||||
timeout-minutes: 180
|
||||
run: |
|
||||
pnpm run build:packages
|
||||
ORCA_BACKGROUND_LAUNCH=1 node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/verify-darwin-terminal-node.mjs --arch=arm64
|
||||
ORCA_BACKGROUND_LAUNCH=1 node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/verify-darwin-terminal-node.mjs --arch=x64
|
||||
|
||||
# Build required out/mobile-web from mobile’s React Native/Expo install.
|
||||
- uses: ./.github/actions/install-mobile-dependencies
|
||||
|
||||
@@ -184,6 +182,16 @@ jobs:
|
||||
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
||||
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
||||
|
||||
# Why here: App tokens last one hour, and the cold runtime build alone can outlast that.
|
||||
- name: Mint hourly repo token
|
||||
id: app_token
|
||||
uses: actions/create-github-app-token@v2
|
||||
with:
|
||||
app-id: ${{ secrets.HOURLY_RELEASE_APP_ID }}
|
||||
private-key: ${{ secrets.HOURLY_RELEASE_APP_PRIVATE_KEY }}
|
||||
owner: stablyai
|
||||
repositories: orca-hourly
|
||||
|
||||
- name: Compute hourly version
|
||||
id: hourly
|
||||
shell: bash
|
||||
@@ -282,7 +290,7 @@ jobs:
|
||||
timeout_minutes: 45
|
||||
max_attempts: 2
|
||||
retry_wait_seconds: 30
|
||||
command: node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/pinned-node-downloads.mjs darwin-arm64 darwin-x64 && node config/scripts/ensure-native-runtime.mjs --runtime=electron && if [ -f config/scripts/build-mac-notarization-overlap.mjs ]; then ORCA_MAC_HOURLY=1 node config/scripts/build-mac-notarization-overlap.mjs --publish always; else ORCA_MAC_HOURLY=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac --publish always; fi
|
||||
command: node config/scripts/ensure-native-runtime.mjs --runtime=electron && if [ -f config/scripts/build-mac-notarization-overlap.mjs ]; then ORCA_MAC_HOURLY=1 node config/scripts/build-mac-notarization-overlap.mjs --publish always; else ORCA_MAC_HOURLY=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac --publish always; fi
|
||||
env:
|
||||
# Give publisher token write access to configured orca-hourly repo.
|
||||
GH_TOKEN: ${{ steps.app_token_publish.outputs.token }}
|
||||
|
||||
@@ -50,6 +50,7 @@ jobs:
|
||||
windows_process_probe: ${{ steps.filter.outputs.windows_process_probe }}
|
||||
package_windows: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.package_windows }}
|
||||
layout_oracle: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.layout_oracle }}
|
||||
darwin_terminal_node: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.darwin_terminal_node }}
|
||||
dependency_isolation: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.dependency_isolation }}
|
||||
e2e_should_run: ${{ steps.e2e_filter.outputs.should_run }}
|
||||
test_files: ${{ steps.e2e_filter.outputs.test_files }}
|
||||
@@ -76,6 +77,7 @@ jobs:
|
||||
/config/.bun-version
|
||||
/config/scripts/check-readme-local-links.mjs
|
||||
/config/scripts/pr-code-change-scope.mjs
|
||||
/config/scripts/pr-darwin-terminal-node-route.mjs
|
||||
/.oxfmtrc.json
|
||||
/config/scripts/pr-package-test-paths.mjs
|
||||
/config/scripts/pr-layout-oracle-route.mjs
|
||||
@@ -1494,6 +1496,34 @@ jobs:
|
||||
*) echo "node_modules/zod is not in the isolated store"; exit 1 ;;
|
||||
esac
|
||||
|
||||
darwin_terminal_node:
|
||||
name: mac terminal worker wakeup (${{ matrix.os }})
|
||||
needs: [code_paths, preflight]
|
||||
if: >-
|
||||
!cancelled() && needs.preflight.result == 'success' &&
|
||||
needs.code_paths.outputs.darwin_terminal_node == 'true'
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
os: [macos-15, macos-15-intel]
|
||||
runs-on: ${{ matrix.os }}
|
||||
timeout-minutes: 180
|
||||
env:
|
||||
ORCA_BACKGROUND_LAUNCH: '1'
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: ./.github/actions/install-node-dependencies
|
||||
with:
|
||||
native-runtime: node
|
||||
- uses: actions/cache@v5
|
||||
with:
|
||||
path: out/node-runtime-cache
|
||||
key: darwin-terminal-node-${{ runner.arch }}-${{ hashFiles('src/shared/node-runtime-pin.ts', 'config/node-runtime-patches/**', 'config/scripts/build-darwin-terminal-node.mjs', 'config/scripts/pinned-node-downloads.mjs', 'config/scripts/update-node-runtime-pin.mjs', 'config/scripts/macos-terminal-host-bundle.cjs') }}
|
||||
- name: Build and verify the shipping terminal runtime
|
||||
run: node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/verify-darwin-terminal-node.mjs
|
||||
|
||||
verify:
|
||||
name: PR checks passed
|
||||
# Publish an explicit result after every required dependency settles.
|
||||
@@ -1511,6 +1541,7 @@ jobs:
|
||||
- managed_hook_node18
|
||||
- package
|
||||
- package_windows
|
||||
- darwin_terminal_node
|
||||
- layout_oracle
|
||||
- dependency_isolation
|
||||
# Report settled results without competing with the GitHub-hosted test queue.
|
||||
@@ -1547,6 +1578,8 @@ jobs:
|
||||
PACKAGE_SHOULD_RUN: ${{ needs.code_paths.outputs.package }}
|
||||
PACKAGE_WINDOWS: ${{ needs.package_windows.result }}
|
||||
PACKAGE_WINDOWS_SHOULD_RUN: ${{ needs.code_paths.outputs.package_windows }}
|
||||
DARWIN_TERMINAL_NODE: ${{ needs.darwin_terminal_node.result }}
|
||||
DARWIN_TERMINAL_NODE_SHOULD_RUN: ${{ needs.code_paths.outputs.darwin_terminal_node }}
|
||||
LAYOUT_ORACLE: ${{ needs.layout_oracle.result }}
|
||||
LAYOUT_ORACLE_SHOULD_RUN: ${{ needs.code_paths.outputs.layout_oracle }}
|
||||
DEPENDENCY_ISOLATION: ${{ needs.dependency_isolation.result }}
|
||||
@@ -1592,6 +1625,7 @@ jobs:
|
||||
check_job managed_hook_node18 "$MANAGED_HOOK_NODE18" "$MANAGED_HOOK_NODE18_SHOULD_RUN"
|
||||
check_job package "$PACKAGE" "$PACKAGE_SHOULD_RUN"
|
||||
check_job package_windows "$PACKAGE_WINDOWS" "$PACKAGE_WINDOWS_SHOULD_RUN"
|
||||
check_job darwin_terminal_node "$DARWIN_TERMINAL_NODE" "$DARWIN_TERMINAL_NODE_SHOULD_RUN"
|
||||
check_job layout_oracle "$LAYOUT_ORACLE" "$LAYOUT_ORACLE_SHOULD_RUN"
|
||||
check_job dependency_isolation "$DEPENDENCY_ISOLATION" "$DEPENDENCY_ISOLATION_SHOULD_RUN"
|
||||
exit "$failed"
|
||||
|
||||
@@ -1071,6 +1071,7 @@ jobs:
|
||||
- release-preflight
|
||||
- release-javascript
|
||||
- build-mac
|
||||
- verify-mac-build
|
||||
# Why not the implicit success(): a tag without the orcad template skips that job on purpose.
|
||||
if: >-
|
||||
!cancelled() &&
|
||||
@@ -1080,6 +1081,7 @@ jobs:
|
||||
needs.release-preflight.result == 'success' &&
|
||||
needs.release-javascript.result == 'success' &&
|
||||
needs.build-mac.result == 'success' &&
|
||||
needs.verify-mac-build.result == 'success' &&
|
||||
(needs.orcad-template.result == 'success' ||
|
||||
(needs.orcad-template.result == 'skipped' && needs.cut.outputs.ships_orcad_template == 'false'))
|
||||
env:
|
||||
@@ -1467,7 +1469,7 @@ jobs:
|
||||
path: signing-stage/**
|
||||
if-no-files-found: error
|
||||
|
||||
# Unsigned packaging overlaps macOS; only successful macOS builds may consume signing quota.
|
||||
# Recheck the exact successful macOS run before consuming signing quota.
|
||||
- name: Require macOS success before Windows signing
|
||||
id: mac-signing-gate
|
||||
if: matrix.platform == 'win' && github.run_attempt == 1
|
||||
@@ -2078,6 +2080,7 @@ jobs:
|
||||
(needs.orcad-template.result == 'skipped' && needs.cut.outputs.ships_orcad_template == 'false'))
|
||||
# Keep every SignPath workflow job GitHub-hosted; separate release-mac-build allows Blacksmith outside Windows provenance.
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 185
|
||||
permissions:
|
||||
actions: write
|
||||
contents: read
|
||||
@@ -2106,20 +2109,20 @@ jobs:
|
||||
RELEASE_MAC_BUILD_JAVASCRIPT_SOURCE_SHA: ${{ needs.release-javascript.outputs.supported == 'true' && needs.release-javascript.outputs.source_sha || '' }}
|
||||
RELEASE_MAC_BUILD_TAG: ${{ needs.cut.outputs.tag }}
|
||||
RELEASE_MAC_BUILD_WORKFLOW: release-mac-build.yml
|
||||
RELEASE_MAC_BUILD_OBSERVE_MINUTES: '180'
|
||||
|
||||
verify-mac-build:
|
||||
needs:
|
||||
- cut
|
||||
- build-mac
|
||||
- build
|
||||
# Qualify macOS even when a sibling build fails; publication still requires every build.
|
||||
# Finish the shared deadline before starting the Windows signing job's six-hour budget.
|
||||
if: >-
|
||||
!cancelled() &&
|
||||
needs.cut.result == 'success' &&
|
||||
needs.cut.outputs.should_release == 'true' &&
|
||||
needs.build-mac.result == 'success'
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 95
|
||||
timeout-minutes: 215
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
|
||||
@@ -49,7 +49,8 @@ jobs:
|
||||
if: ${{ !cancelled() && (!inputs.qualification_only || needs.qualification-template.result == 'success') && github.repository == 'stablyai/orca' }}
|
||||
# Keep Blacksmith mac notarization outside SignPath’s GitHub-hosted Windows provenance.
|
||||
runs-on: blacksmith-6vcpu-macos-15
|
||||
timeout-minutes: 60
|
||||
# Includes the 180-minute cold runtime build and the existing packaging retry budget.
|
||||
timeout-minutes: 360
|
||||
# actions: read fetches the release-cut run's artifacts.
|
||||
permissions:
|
||||
actions: read
|
||||
@@ -95,7 +96,7 @@ jobs:
|
||||
pnpm-lock.yaml
|
||||
mobile/pnpm-lock.yaml
|
||||
|
||||
# Cache bundled host Node by exact pin, without restore keys.
|
||||
# Cache the patched host Node by exact pin and patch, without restore keys.
|
||||
- name: Locate the pinned Node runtime cache
|
||||
shell: bash
|
||||
run: echo "ORCA_NODE_RUNTIME_CACHE_DIR=$HOME/Library/Caches/orca-node-runtime" >>"$GITHUB_ENV"
|
||||
@@ -104,7 +105,7 @@ jobs:
|
||||
uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/Library/Caches/orca-node-runtime
|
||||
key: orca-node-runtime-mac-${{ hashFiles('src/shared/node-runtime-pin.ts') }}
|
||||
key: orca-node-runtime-mac-${{ hashFiles('src/shared/node-runtime-pin.ts', 'config/node-runtime-patches/**', 'config/scripts/build-darwin-terminal-node.mjs', 'config/scripts/pinned-node-downloads.mjs', 'config/scripts/update-node-runtime-pin.mjs', 'config/scripts/macos-terminal-host-bundle.cjs') }}
|
||||
|
||||
# Cache Electron/builder tool downloads to save ~30–90s.
|
||||
- name: Cache electron-builder downloads
|
||||
@@ -126,6 +127,15 @@ jobs:
|
||||
retry_wait_seconds: 30
|
||||
command: pnpm install --frozen-lockfile --cpu=current,x64,arm64
|
||||
|
||||
# Why: older refs predate the source build and package the pinned download instead.
|
||||
- name: Build and verify the patched terminal runtimes
|
||||
if: hashFiles('config/scripts/build-darwin-terminal-node.mjs') != ''
|
||||
timeout-minutes: 180
|
||||
run: |
|
||||
pnpm run build:packages
|
||||
ORCA_BACKGROUND_LAUNCH=1 node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/verify-darwin-terminal-node.mjs --arch=arm64
|
||||
ORCA_BACKGROUND_LAUNCH=1 node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/verify-darwin-terminal-node.mjs --arch=x64
|
||||
|
||||
# Build required out/mobile-web using mobile’s React Native/Expo install.
|
||||
- uses: ./.github/actions/install-mobile-dependencies
|
||||
|
||||
@@ -225,7 +235,7 @@ jobs:
|
||||
timeout_minutes: 45
|
||||
max_attempts: 3
|
||||
retry_wait_seconds: 30
|
||||
command: node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/pinned-node-downloads.mjs darwin-arm64 darwin-x64 && node config/scripts/ensure-native-runtime.mjs --runtime=electron && if [ -f config/scripts/build-mac-notarization-overlap.mjs ]; then ORCA_MAC_RELEASE=1 node config/scripts/build-mac-notarization-overlap.mjs --publish "$ORCA_MAC_PUBLISH" --draft; else ORCA_MAC_RELEASE=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac --publish "$ORCA_MAC_PUBLISH" -c.publish.releaseType=draft; fi
|
||||
command: if [ ! -f config/scripts/build-darwin-terminal-node.mjs ]; then node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/pinned-node-downloads.mjs darwin-arm64 darwin-x64; fi && node config/scripts/ensure-native-runtime.mjs --runtime=electron && if [ -f config/scripts/build-mac-notarization-overlap.mjs ]; then ORCA_MAC_RELEASE=1 node config/scripts/build-mac-notarization-overlap.mjs --publish "$ORCA_MAC_PUBLISH" --draft; else ORCA_MAC_RELEASE=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac --publish "$ORCA_MAC_PUBLISH" -c.publish.releaseType=draft; fi
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
ORCA_REQUIRE_ORCAD_TEMPLATE: '1'
|
||||
|
||||
Reference in New Issue
Block a user