189 行
7.0 KiB
YAML
189 行
7.0 KiB
YAML
name: build-macos
|
||
|
||
on:
|
||
push:
|
||
branches: [ main, master ]
|
||
tags: [ 'v*' ]
|
||
pull_request:
|
||
branches: [ main, master ]
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
build:
|
||
name: Build paze for macOS (${{ matrix.arch }})
|
||
strategy:
|
||
fail-fast: false
|
||
matrix:
|
||
include:
|
||
# macos-13 (x64 runner) 长期排队/不分配，改用 macos-14 (arm64) 交叉编译两个架构。
|
||
# .NET 在 arm64 主机上 `publish -r osx-x64` 产出原生 x64 单文件；x64 产物经 Rosetta 2 可在 arm64 上运行（冒烟测试仍生效）。
|
||
- arch: x64
|
||
runner: macos-14
|
||
rid: osx-x64
|
||
- arch: arm64
|
||
runner: macos-14
|
||
rid: osx-arm64
|
||
runs-on: ${{ matrix.runner }}
|
||
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Setup .NET 10
|
||
uses: actions/setup-dotnet@v4
|
||
with:
|
||
dotnet-version: '10.0.x'
|
||
dotnet-quality: 'preview'
|
||
|
||
- name: Restore
|
||
run: dotnet restore src/PazeE.Compiler/PazeE.Compiler.csproj
|
||
|
||
- name: Determine channel & version
|
||
id: meta
|
||
run: |
|
||
if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
|
||
CHANNEL="release"
|
||
else
|
||
CHANNEL="alpha"
|
||
fi
|
||
VERSION=$(dotnet msbuild src/PazeE.Compiler/PazeE.Compiler.csproj \
|
||
-p:BuildChannel=$CHANNEL \
|
||
-getProperty:Version \
|
||
-nologo)
|
||
echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
|
||
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
||
echo "Channel: $CHANNEL Version: $VERSION"
|
||
|
||
- name: Publish (self-contained, ${{ matrix.rid }})
|
||
run: |
|
||
dotnet publish src/PazeE.Compiler/PazeE.Compiler.csproj \
|
||
-c Release \
|
||
-p:BuildChannel=${{ steps.meta.outputs.channel }} \
|
||
-r ${{ matrix.rid }} \
|
||
--self-contained true \
|
||
-p:PublishSingleFile=true \
|
||
-p:EnableCompressionInSingleFile=true
|
||
|
||
- name: Stage artifacts
|
||
run: |
|
||
STAGE="staging/paze-${{ steps.meta.outputs.version }}-macos-${{ matrix.arch }}"
|
||
mkdir -p "$STAGE/bin"
|
||
cp -v publish/${{ steps.meta.outputs.version }}/bin/* "$STAGE/bin/" 2>/dev/null || true
|
||
# 单文件模式下主程序重命名为 paze 并赋予执行权限
|
||
if [ -f "$STAGE/bin/paze" ]; then
|
||
chmod +x "$STAGE/bin/paze"
|
||
fi
|
||
# 包含测试源文件以便验证
|
||
mkdir -p "$STAGE/tests"
|
||
cp -v tests/*.pe "$STAGE/tests/" 2>/dev/null || true
|
||
# 生成版本说明
|
||
cat > "$STAGE/VERSION.txt" <<EOF
|
||
PazeE Compiler
|
||
Version: ${{ steps.meta.outputs.version }}
|
||
Channel: ${{ steps.meta.outputs.channel }}
|
||
Target: ${{ matrix.rid }} (self-contained .NET 10)
|
||
Commit: ${GITHUB_SHA}
|
||
Built: ${GITHUB_RUN_ID}
|
||
EOF
|
||
# 打包为 tar.gz（macOS 标准归档格式，保留 POSIX 权限）
|
||
cd staging
|
||
tar -czf ../paze-${{ steps.meta.outputs.version }}-macos-${{ matrix.arch }}.tar.gz *
|
||
cd ..
|
||
ls -lh paze-*.tar.gz
|
||
|
||
- name: Smoke test — compile hello.pe
|
||
env:
|
||
ARCH_FLAG: ${{ matrix.arch == 'arm64' && '--arch arm' || '' }}
|
||
run: |
|
||
set +e
|
||
BIN="staging/paze-${{ steps.meta.outputs.version }}-macos-${{ matrix.arch }}/bin"
|
||
PAZE="$BIN/paze"
|
||
if [ -f "$BIN/paze.dll" ] && [ ! -f "$PAZE" ]; then PAZE="dotnet $BIN/paze.dll"; fi
|
||
if [ -z "$PAZE" ] || [ ! -f "$BIN/paze" ]; then
|
||
echo "WARN: paze binary not found, listing bin/:"; ls -la "$BIN"; exit 0
|
||
fi
|
||
$PAZE tests/hello.pe --target macos $ARCH_FLAG -o /tmp/hello.macos
|
||
file /tmp/hello.macos
|
||
chmod +x /tmp/hello.macos
|
||
|
||
echo "=== codesign display (paze-generated) ==="
|
||
codesign -dv --verbose=4 /tmp/hello.macos 2>&1 || true
|
||
echo "=== codesign verify (paze-generated) ==="
|
||
codesign --verify --deep --strict /tmp/hello.macos 2>&1 && echo "SIGNATURE OK" || echo "SIGNATURE FAILED"
|
||
|
||
echo "=== try run (paze-generated signature) ==="
|
||
/tmp/hello.macos 2>&1; echo "exit code: $?"
|
||
|
||
# 对照实验：用系统 codesign -s - 重新签名，排除 paze 签名生成器的问题
|
||
echo "=== re-sign with system codesign -s - ==="
|
||
cp /tmp/hello.macos /tmp/hello_resigned.macos
|
||
chmod +x /tmp/hello_resigned.macos
|
||
codesign -s - --force /tmp/hello_resigned.macos 2>&1 || true
|
||
codesign -dv --verbose=4 /tmp/hello_resigned.macos 2>&1 || true
|
||
echo "=== try run (system re-signed) ==="
|
||
/tmp/hello_resigned.macos 2>&1; echo "exit code: $?"
|
||
|
||
# 对比两次签名的差异
|
||
echo "=== signature size comparison ==="
|
||
echo "paze-generated:"; codesign -d /tmp/hello.macos 2>&1 || true
|
||
echo "system-signed:"; codesign -d /tmp/hello_resigned.macos 2>&1 || true
|
||
|
||
# 空 main 测试：排除 printf/外部符号问题
|
||
echo "=== empty main test (no externals) ==="
|
||
$PAZE tests/empty.pe --target macos $ARCH_FLAG -o /tmp/empty.macos
|
||
file /tmp/empty.macos
|
||
chmod +x /tmp/empty.macos
|
||
/tmp/empty.macos 2>&1; echo "empty exit code: $?"
|
||
|
||
# AMFI 内核日志
|
||
echo "=== AMFI kernel log (last 30s) ==="
|
||
log show --predicate 'sender == "amfid" OR sender == "AppleMobileFileIntegrity"' --last 30s 2>&1 | tail -20 || true
|
||
|
||
# dyld 调试输出
|
||
echo "=== dyld debug (hello.macos) ==="
|
||
DYLD_PRINT_LIBRARIES=1 DYLD_PRINT_BINDINGS=1 /tmp/hello.macos 2>&1 | head -20; echo "dyld exit: $?"
|
||
|
||
exit 0
|
||
|
||
- name: Dump Mach-O load commands
|
||
if: always()
|
||
run: |
|
||
echo "=== otool -L (dylib deps) ==="
|
||
otool -L /tmp/hello.macos 2>&1 || true
|
||
echo "=== otool -l (load commands) ==="
|
||
otool -l /tmp/hello.macos 2>&1 | head -150 || true
|
||
echo "=== dyld_info ==="
|
||
dyld_info /tmp/hello.macos 2>&1 || true
|
||
echo "=== dyld_info symbols ==="
|
||
dyld_info -symbols /tmp/hello.macos 2>&1 || true
|
||
|
||
- name: Upload artifact
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: paze-${{ steps.meta.outputs.version }}-macos-${{ matrix.arch }}
|
||
path: paze-${{ steps.meta.outputs.version }}-macos-${{ matrix.arch }}.tar.gz
|
||
if-no-files-found: error
|
||
|
||
release:
|
||
name: Publish GitHub Release (macOS)
|
||
needs: build
|
||
if: startsWith(github.ref, 'refs/tags/v')
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
contents: write
|
||
|
||
steps:
|
||
- name: Download artifacts
|
||
uses: actions/download-artifact@v4
|
||
with:
|
||
path: artifacts
|
||
|
||
- name: Create release
|
||
uses: softprops/action-gh-release@v2
|
||
with:
|
||
name: PazeE ${{ github.ref_name }}
|
||
tag_name: ${{ github.ref_name }}
|
||
generate_release_notes: true
|
||
files: |
|
||
artifacts/**/*.tar.gz
|