macos-live-qualification.yml

name: macos-live-qualification

on:
  push:
    branches:
      - "qualify/portability-macos-live"
    paths:
      - ".github/workflows/macos-live-qualification.yml"
      - "scripts/qualify-macos-live.sh"
      - "scripts/validate-macos-launchd-deactivation.mjs"
      - "scripts/macos-evidence-manifest.mjs"
      - "ccm/**"
      - "install.sh"
      - "scripts/package-plugin.sh"
      - "scripts/sync-plugin-dist.sh"
      - "plugin/**"
      - "tests/scripts/test_install_integrity.sh"
      - "tests/scripts/test_macos_evidence_artifact.sh"
      - "tests/content/macos-qualification-workflow.test.mjs"
  # Live Darwin qualification is intentionally opt-in: add `ci:macos-live` to the PR at the
  # revision that needs evidence. Remove/re-add the label after later commits to re-qualify.
  pull_request:
    types: [labeled]
    paths:
      - ".github/workflows/macos-live-qualification.yml"
      - "scripts/qualify-macos-live.sh"
      - "scripts/validate-macos-launchd-deactivation.mjs"
      - "scripts/macos-evidence-manifest.mjs"
      - "ccm/**"
      - "tests/content/macos-qualification-workflow.test.mjs"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  # Unrelated label events get a unique run-id group, so they cannot cancel a real qualification.
  group: ${{ github.workflow }}-${{ github.event.label.name == 'ci:macos-live' && github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.label.name == 'ci:macos-live' }}

jobs:
  build-sea:
    name: build / ${{ matrix.contract }}
    if: ${{ github.event_name != 'pull_request' || github.event.label.name == 'ci:macos-live' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-14
            contract: darwin-arm64
            uname_arch: arm64
            node_arch: arm64
            asset: ccm-darwin-arm64
          - runner: macos-15-intel
            contract: darwin-x64
            uname_arch: x86_64
            node_arch: x64
            asset: ccm-darwin-x64
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - uses: pnpm/action-setup@v4
        with:
          version: 10.22.0
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: ccm/pnpm-lock.yaml
      - name: Assert real runner identity
        shell: bash
        run: |
          set -euo pipefail
          test "$(uname -s)" = Darwin
          test "$(uname -m)" = "${{ matrix.uname_arch }}"
          test "$(node -p 'process.arch')" = "${{ matrix.node_arch }}"
      - name: Install dependencies and build workspace
        shell: bash
        run: |
          set -euo pipefail
          pnpm -C ccm install --frozen-lockfile
          pnpm -C ccm build
      - name: Build and attest SEA
        id: build
        shell: bash
        env:
          ASSET: ${{ matrix.asset }}
        run: |
          set -euo pipefail
          OUT="${RUNNER_TEMP}/macos-sea/${ASSET}"
          EVIDENCE="${RUNNER_TEMP}/macos-sea/build-evidence"
          mkdir -p "$(dirname "${OUT}")" "${EVIDENCE}"
          set +e
          (
            set -euxo pipefail
            {
              printf 'exact_commit=%s\n' "$(git rev-parse HEAD)"
              printf 'exact_tree=%s\n' "$(git rev-parse 'HEAD^{tree}')"
              printf 'runner_label=%s\n' '${{ matrix.runner }}'
              printf 'expected_contract=%s\n' '${{ matrix.contract }}'
              printf 'uname_s=%s\n' "$(uname -s)"
              printf 'uname_m=%s\n' "$(uname -m)"
              printf 'node_arch=%s\n' "$(node -p 'process.arch')"
              uname -a
              sw_vers
              node --version
              pnpm --version
              diskutil info / || true
              mount
            } >"${EVIDENCE}/runner.txt" 2>&1
            CCM_SEA_NODE="$(command -v node)" CCM_SEA_OUT="${OUT}" \
              bash ccm/apps/cli/scripts/build-sea.sh >"${EVIDENCE}/build-sea.log" 2>&1
            if grep -Eq 'fexecve|execveat|/dev/fd|/proc/self/fd' \
              ccm/apps/cli/native/runtime-invoke-helper-darwin.c; then
              printf '%s\n' 'Darwin helper source contains a forbidden fd-exec claim' >&2
              exit 1
            fi
            node - ccm/apps/cli/.native-build/runtime-invoke-helper.json '${{ matrix.node_arch }}' \
              >"${EVIDENCE}/runtime-helper-contract.log" <<'NODE'
          const fs = require('node:fs');
          const [file, expectedArch] = process.argv.slice(2);
          const doc = JSON.parse(fs.readFileSync(file, 'utf8'));
          if (doc.contract !== 'darwin-path-attested-v1') process.exit(2);
          if (doc.platform !== 'darwin' || doc.arch !== expectedArch) process.exit(3);
          process.stdout.write(`${JSON.stringify(doc, null, 2)}\n`);
          NODE
            nm -u ccm/apps/cli/.native-build/runtime-invoke-helper \
              >"${EVIDENCE}/runtime-helper-symbols.log"
            if grep -Eq '_fexecve|_execveat' "${EVIDENCE}/runtime-helper-symbols.log"; then
              printf '%s\n' 'Darwin helper imports a forbidden descriptor-exec symbol' >&2
              exit 1
            fi
            grep -Eq '^[[:space:]]*_execve$' "${EVIDENCE}/runtime-helper-symbols.log"
            chmod 755 "${OUT}"
            "${OUT}" --version >"${EVIDENCE}/sea-version.log" 2>&1
            codesign --verify --strict --verbose=4 "${OUT}" >"${EVIDENCE}/codesign-verify.log" 2>&1
            codesign -dvvv "${OUT}" >"${EVIDENCE}/codesign-display.log" 2>&1
            otool -L "${OUT}" >"${EVIDENCE}/otool.log" 2>&1
            if grep -Eq '/opt/homebrew|/usr/local/(opt|Cellar)|libnode' "${EVIDENCE}/otool.log"; then
              printf '%s\n' 'non-system dynamic dependency found' >&2
              exit 1
            fi
            (
              cd "$(dirname "${OUT}")"
              shasum -a 256 "${ASSET}" >"${ASSET}.sha256"
              shasum -a 256 -c "${ASSET}.sha256"
            ) >"${EVIDENCE}/checksum.log" 2>&1
          ) 2>&1 | tee "${EVIDENCE}/build-attestation.log"
          pipeline_status=("${PIPESTATUS[@]}")
          build_exit_code="${pipeline_status[0]}"
          tee_exit_code="${pipeline_status[1]}"
          if [ "${build_exit_code}" -eq 0 ] && [ "${tee_exit_code}" -ne 0 ]; then
            build_exit_code="${tee_exit_code}"
          fi
          set -e
          printf '{"schema":"ccm/macos-build-result/v1","exit_code":%s,"tee_exit_code":%s}\n' \
            "${build_exit_code}" "${tee_exit_code}" >"${EVIDENCE}/build-result.json"
          printf 'exit_code=%s\n' "${build_exit_code}" >>"${GITHUB_OUTPUT}"
          exit 0
      - name: Upload non-release SEA evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: macos-sea-${{ matrix.contract }}
          path: |
            ${{ runner.temp }}/macos-sea/${{ matrix.asset }}
            ${{ runner.temp }}/macos-sea/${{ matrix.asset }}.sha256
            ${{ runner.temp }}/macos-sea/build-evidence
          if-no-files-found: error
          retention-days: 7
      - name: Enforce build verdict
        if: always()
        shell: bash
        env:
          BUILD_EXIT_CODE: ${{ steps.build.outputs.exit_code }}
        run: |
          set -euo pipefail
          if ! [[ "${BUILD_EXIT_CODE}" =~ ^[0-9]+$ ]] || [ "${BUILD_EXIT_CODE}" -gt 255 ]; then
            printf '%s\n' 'build attestation did not report a valid exit code; inspect the uploaded evidence' >&2
            exit 1
          fi
          if [ "${BUILD_EXIT_CODE}" -ne 0 ]; then
            printf 'build attestation exited %s; inspect the uploaded evidence\n' "${BUILD_EXIT_CODE}" >&2
            exit "${BUILD_EXIT_CODE}"
          fi

  qualify:
    name: qualify / ${{ matrix.contract }}
    needs: build-sea
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-14
            contract: darwin-arm64
            uname_arch: arm64
            node_arch: arm64
            asset: ccm-darwin-arm64
          - runner: macos-15-intel
            contract: darwin-x64
            uname_arch: x86_64
            node_arch: x64
            asset: ccm-darwin-x64
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - uses: pnpm/action-setup@v4
        with:
          version: 10.22.0
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: ccm/pnpm-lock.yaml
      - name: Download SEA as a fresh workflow artifact
        uses: actions/download-artifact@v4
        with:
          name: macos-sea-${{ matrix.contract }}
          path: ${{ runner.temp }}/downloaded-sea
      - name: Bind downloaded SEA to exact checkout
        shell: bash
        run: |
          set -euo pipefail
          expected_commit="$(git rev-parse HEAD)"
          expected_tree="$(git rev-parse 'HEAD^{tree}')"
          build_identity="${RUNNER_TEMP}/downloaded-sea/build-evidence/runner.txt"
          grep -Fx "exact_commit=${expected_commit}" "${build_identity}"
          grep -Fx "exact_tree=${expected_tree}" "${build_identity}"
          qualification_root="${RUNNER_TEMP}/macos-qualification-${{ matrix.contract }}"
          mkdir -p "${qualification_root}"
          cp -R "${RUNNER_TEMP}/downloaded-sea/build-evidence" \
            "${qualification_root}/sea-build-evidence"
      - name: Install qualification dependencies
        shell: bash
        run: |
          set -euo pipefail
          pnpm -C ccm install --frozen-lockfile
          pnpm -C ccm build
          npm install --global @anthropic-ai/claude-code
      - name: Run live qualification
        id: live
        continue-on-error: true
        shell: bash
        env:
          EXPECTED_UNAME_ARCH: ${{ matrix.uname_arch }}
          EXPECTED_NODE_ARCH: ${{ matrix.node_arch }}
        run: |
          chmod 755 "${RUNNER_TEMP}/downloaded-sea/${{ matrix.asset }}"
          bash scripts/qualify-macos-live.sh \
            "${RUNNER_TEMP}/downloaded-sea/${{ matrix.asset }}" \
            '${{ matrix.contract }}' \
            "${RUNNER_TEMP}/macos-qualification-${{ matrix.contract }}"
      - name: Upload raw qualification evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: macos-live-raw-evidence-${{ matrix.contract }}
          path: ${{ runner.temp }}/macos-qualification-${{ matrix.contract }}
          # The isolated RUNNER_TEMP tree intentionally contains runtime state and plugin manifests
          # below dot-directories; it is not the runner's ambient HOME or credential store.
          include-hidden-files: true
          if-no-files-found: error
          overwrite: true
          retention-days: 7
      - name: Enforce qualification verdict
        if: steps.live.outcome != 'success'
        shell: bash
        run: |
          printf '%s\n' 'live qualification reported one or more required failures; inspect the uploaded raw evidence' >&2
          exit 1

  evidence-index:
    name: evidence index
    if: ${{ always() && (github.event_name != 'pull_request' || github.event.label.name == 'ci:macos-live') }}
    needs: qualify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - uses: actions/download-artifact@v4
        with:
          # Keep raw inputs in a namespace that cannot match this job's index from an earlier attempt.
          pattern: macos-live-raw-evidence-*
          path: evidence
          merge-multiple: false
      - name: Verify inner manifests and build the outer index
        shell: bash
        env:
          EXPECTED_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          node <<'NODE'
          const fs = require('node:fs');
          const expected = [
            'macos-live-raw-evidence-darwin-arm64',
            'macos-live-raw-evidence-darwin-x64',
          ];
          const entries = fs.readdirSync('evidence', { withFileTypes: true });
          if (entries.some((entry) => !entry.isDirectory())) {
            throw new Error('evidence download root must contain artifact directories only');
          }
          const actual = entries.map((entry) => entry.name).sort();
          if (JSON.stringify(actual) !== JSON.stringify(expected)) {
            throw new Error(`expected artifact directories ${expected.join(',')}; observed ${actual.join(',')}`);
          }
          NODE

          for artifact in \
            macos-live-raw-evidence-darwin-arm64 \
            macos-live-raw-evidence-darwin-x64; do
            root="evidence/${artifact}"
            node scripts/macos-evidence-manifest.mjs verify "${root}" "${root}/SHA256SUMS"
          done
          node <<'NODE'
          const fs = require('node:fs');
          const artifacts = [
            'macos-live-raw-evidence-darwin-arm64',
            'macos-live-raw-evidence-darwin-x64',
          ];
          const expectedCommit = process.env.EXPECTED_COMMIT;
          if (!/^[0-9a-f]{40}$/.test(expectedCommit || '')) {
            throw new Error('expected commit must be one immutable 40-hex workflow identity');
          }
          function readIdentity(file) {
            const lines = fs.readFileSync(file, 'utf8').split('\n');
            const value = (key) => {
              const prefix = `${key}=`;
              const matches = lines.filter((line) => line.startsWith(prefix));
              if (matches.length !== 1) {
                throw new Error(`${file}: expected exactly one ${key} record`);
              }
              const observed = matches[0].slice(prefix.length);
              if (!/^[0-9a-f]{40}$/.test(observed)) {
                throw new Error(`${file}: ${key} must be 40-hex`);
              }
              return observed;
            };
            return {
              exact_commit: value('exact_commit'),
              exact_tree: value('exact_tree'),
            };
          }
          let commonTree = null;
          for (const artifact of artifacts) {
            const root = `evidence/${artifact}`;
            const summary = readIdentity(`${root}/summary.txt`);
            const build = readIdentity(`${root}/sea-build-evidence/runner.txt`);
            for (const [record, identity] of [['summary', summary], ['build', build]]) {
              if (identity.exact_commit !== expectedCommit) {
                throw new Error(`${artifact}/${record}: expected commit ${expectedCommit}; observed ${identity.exact_commit}`);
              }
            }
            if (summary.exact_tree !== build.exact_tree) {
              throw new Error(`${artifact}: qualification/build tree identity mismatch`);
            }
            if (commonTree !== null && summary.exact_tree !== commonTree) {
              throw new Error(`${artifact}: cross-architecture tree identity mismatch`);
            }
            commonTree = summary.exact_tree;
          }
          NODE
          node scripts/macos-evidence-manifest.mjs write evidence EVIDENCE_SHA256SUMS
          node scripts/macos-evidence-manifest.mjs verify evidence EVIDENCE_SHA256SUMS
          cat EVIDENCE_SHA256SUMS
      - uses: actions/upload-artifact@v4
        with:
          name: macos-live-evidence-index
          path: EVIDENCE_SHA256SUMS
          if-no-files-found: error
          overwrite: true
          retention-days: 7