.github/workflows/ci-macos-artifacts.yml

# This workflow generates artifacts such as avifenc and avifdec for convenience.

name: CI macOS Release Artifacts
on:
  release:
    types: [created]

permissions:
  contents: write
  id-token: write
  attestations: write
  # artifact-metadata is not needed because push-to-registry is not enabled.

jobs:
  build-macos-artifacts:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest]

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-macos
        with:
          codec-aom: "LOCAL"
          codec-dav1d: "LOCAL"

      - name: Prepare libavif (cmake)
        run: >
          cmake -G Ninja -S . -B build
          -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF
          -DAVIF_CODEC_AOM=LOCAL -DAVIF_CODEC_AOM_ENCODE=ON
          -DAVIF_CODEC_AOM_DECODE=OFF -DAVIF_CODEC_DAV1D=LOCAL
          -DAVIF_LIBSHARPYUV=LOCAL -DAVIF_LIBYUV=LOCAL
          -DAVIF_ZLIBPNG=LOCAL -DAVIF_JPEG=LOCAL
          -DAVIF_BUILD_EXAMPLES=OFF -DAVIF_BUILD_APPS=ON
          -DAVIF_BUILD_TESTS=OFF -DAVIF_ENABLE_WERROR=ON
          -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++
          -DCMAKE_OSX_DEPLOYMENT_TARGET=11
      - name: Build libavif
        run: cmake --build build --config Release --parallel 4
      # TODO: notarize the binaries
      - name: Create README.txt
        run: |
          cat <<'EOF' > build/README.txt
          For security reasons, macOS might prevent these binaries from running.
          If you get a message saying that "Apple cannot check it for malicious software",
          run this command once:
          $ sudo xattr -r -d com.apple.quarantine ./avifenc ./avifdec ./avifgainmaputil
          See also https://github.com/AOMediaCodec/libavif/issues/2460
          EOF
      - name: Archive artifacts
        uses: thedoctor0/zip-release@b57d897cb5d60cb78b51a507f63fa184cfe35554 # 0.7.6
        with:
          type: zip
          filename: ${{ runner.os }}-artifacts.zip
          directory: build
          path: |
            avifenc
            avifdec
            avifgainmaputil
            README.txt
      - name: Attest artifacts
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: build/${{ runner.os }}-artifacts.zip

      - name: Upload artifacts
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: gh release upload "$RELEASE_TAG" "build/${{ runner.os }}-artifacts.zip"

    # Use the following instead of the above to test this workflow outside of a release event.
    # - name: Upload artifacts
    #   uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
    #   with:
    #     name: ${{ runner.os }}-artifacts.zip
    #     path: build/${{ runner.os }}-artifacts.zip