buzz/.github/workflows/_ci-desktop-macos.yml

name: CI / Desktop macOS
on:
  workflow_call:
    inputs:
      rust:
        required: true
        type: boolean
      desktop:
        required: true
        type: boolean
      desktop_rust:
        required: true
        type: boolean
    outputs:
      desktop_macos_result:
        value: ${{ jobs.results.outputs.desktop_macos_result }}

env:
  CARGO_TERM_COLOR: always
  BUZZ_TEST_POSTGRES_PASSWORD: buzz_dev
  PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.cache/ms-playwright

jobs:
  desktop-build-macos:
    name: Desktop Build (macOS)
    runs-on: macos-latest
    timeout-minutes: 45
    if: github.event_name == 'push' || inputs.desktop || inputs.desktop_rust || inputs.rust
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
      - name: Fetch Hermit tools
        run: scripts/ci-hermit-retry.sh ./bin/just --version
      - name: Verify macOS icon representations
        run: scripts/macos-icon.sh --check
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
        with:
          workspaces: desktop/src-tauri
          save-if: ${{ github.event_name != 'pull_request' }}
      - name: Install desktop dependencies
        run: just desktop-install-ci
      - name: Create sidecar placeholders
        run: |
          TARGET=$(rustc -vV | sed -n 's|host: ||p')
          mkdir -p desktop/src-tauri/binaries
          touch "desktop/src-tauri/binaries/buzz-acp-$TARGET"
          touch "desktop/src-tauri/binaries/buzz-agent-$TARGET"
          touch "desktop/src-tauri/binaries/buzz-backend-kubernetes-$TARGET"
          touch "desktop/src-tauri/binaries/buzz-dev-mcp-$TARGET"
          touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET"
          touch "desktop/src-tauri/binaries/buzz-$TARGET"
      # Mesh rev is derived from Cargo.lock so a dependency bump needs no
      # lockstep edit here; the cache key tracks it automatically.
      - name: Resolve mesh-llm rev
        id: mesh_rev
        run: |
          set -euo pipefail
          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from Cargo.lock"; exit 1; }
          echo "rev=$REV" >> "$GITHUB_OUTPUT"
          echo "short=${REV:0:7}" >> "$GITHUB_OUTPUT"
      - name: Restore mesh llama build cache
        id: llama_cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: ${{ github.workspace }}/.cache/mesh-llama
          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
      - name: Build mesh llama native libraries
        if: steps.llama_cache.outputs.cache-hit != 'true'
        env:
          MESH_REV_SHORT: ${{ steps.mesh_rev.outputs.short }}
        run: |
          set -euo pipefail
          cargo fetch --manifest-path desktop/src-tauri/Cargo.toml
          SHORT="$MESH_REV_SHORT"
          MESH_ROOT=$(find "${CARGO_HOME:-$HOME/.cargo}/git/checkouts" -path "*/$SHORT" -type d -name "$SHORT" | head -1)
          if [[ -z "$MESH_ROOT" ]]; then
            echo "::error::mesh-llm checkout for $SHORT not found after cargo fetch"
            exit 1
          fi
          export LLAMA_STAGE_BACKEND=metal
          export LLAMA_STAGE_BUILD_DIR="$GITHUB_WORKSPACE/.cache/mesh-llama/build-stage-abi-metal"
          export CMAKE_OSX_DEPLOYMENT_TARGET=10.15
          "$MESH_ROOT/scripts/prepare-llama.sh" pinned
          "$MESH_ROOT/scripts/build-llama.sh" -DCMAKE_OSX_DEPLOYMENT_TARGET=10.15
      - name: Save mesh llama build cache
        if: steps.llama_cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: ${{ github.workspace }}/.cache/mesh-llama
          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
      - name: Build Tauri app
        run: cd desktop && pnpm tauri build
        env:
          CMAKE_POLICY_VERSION_MINIMUM: "3.5"
          MACOSX_DEPLOYMENT_TARGET: "10.15"
          CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
          LLAMA_STAGE_BACKEND: metal
          LLAMA_STAGE_BUILD_DIR: ${{ github.workspace }}/.cache/mesh-llama/build-stage-abi-metal
          SKIPPY_LLAMA_AUTO_BUILD: "0"

  results:
    name: Results
    if: ${{ always() }}
    needs: [desktop-build-macos]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions: {}
    outputs:
      desktop_macos_result: ${{ needs.desktop-build-macos.result }}
    steps:
      - run: echo "Captured Desktop Build (macOS) result"