name: macOS Release Build
permissions:
  contents: read

on:
  workflow_call:
    inputs:
      build-version:
        description: "The version to build"
        required: true
        type: string
      release-branch:
        description: "The branch to build"
        required: true
        type: string
      MOZ_BUILD_DATE:
        type: string
        required: true
        default: ""
      use-sccache:
        description: "Use sccache"
        required: true
        type: boolean
        default: false

jobs:
  mac-build:
    name: Build macOS - ${{ matrix.arch }}
    runs-on: ${{ (inputs.release-branch == 'release') && 'blacksmith-6vcpu-macos-latest' || 'macos-26' }}

    strategy:
      fail-fast: false
      matrix:
        arch: [x86_64, aarch64]
    env:
      SCCACHE_GHA_ENABLED: ${{ inputs.use-sccache && 'true' || 'false' }}
      CARGO_TERM_COLOR: always
      CARGO_INCREMENTAL: 0
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: ".nvmrc"

      - name: Log SDK versions
        run: |
          ls /Library/Developer/CommandLineTools/SDKs/
          xcrun --show-sdk-version
          xcrun --show-sdk-path

      - name: Run sccache-cache
        uses: mozilla-actions/sccache-action@main
        if: ${{ inputs.use-sccache }}
        with:
          disable_annotations: true

      - name: Expose actions cache variables
        uses: actions/github-script@v6
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])

      - name: Setup Python
        uses: actions/setup-python@v5
        # note: This will use the version defined in '.python-version' by default

      - name: Setup Git
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"

      - name: Install system dependencies
        run: |
          brew update
          brew install cairo gnu-tar mercurial
          sudo pip install setuptools

          brew uninstall --ignore-dependencies python3.12 -f

          export PATH="$(python3 -m site --user-base)/bin":$PATH
          python3 -m pip install --user mercurial

          rm '/usr/local/bin/2to3-3.11' '/usr/local/bin/2to3-3.12' '/usr/local/bin/2to3'
          rm '/usr/local/bin/idle3.11' '/usr/local/bin/idle3.12' '/usr/local/bin/idle3'
          rm '/usr/local/bin/pydoc3.11' '/usr/local/bin/pydoc3.12' '/usr/local/bin/pydoc3'
          rm '/usr/local/bin/python3.11' '/usr/local/bin/python3.12' '/usr/local/bin/python3'
          rm '/usr/local/bin/python3.11-config' '/usr/local/bin/python3.12-config' '/usr/local/bin/python3-config'

          brew install watchman

          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain $(cat .rust-toolchain)
          source $HOME/.cargo/env

          if test "${{ matrix.arch }}" = "aarch64"; then
            rustup target add aarch64-apple-darwin
          else
            rustup target add x86_64-apple-darwin
          fi

      - name: Force usage of gnu-tar
        run: |
          echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.bash_profile
          echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.zsh
          source ~/.bash_profile

      - name: Install dependencies
        run: |
          npm ci

      - name: Load surfer CI setup
        run: npm run surfer -- ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}

      - name: Download Firefox source and dependencies
        run: npm run download

      - name: Import
        env:
          SURFER_COMPAT: ${{ matrix.arch }}
          SURFER_CERT_PATCH_ISSUER: ${{ secrets.SURFER_CERT_PATCH_ISSUER }}
          SURFER_CERT_PATCH_NAME: ${{ secrets.SURFER_CERT_PATCH_NAME }}
        run: npm run import

      - name: Bootstrap
        run: |
          cd engine
          export SURFER_PLATFORM="darwin"
          export PATH="$(python3 -m site --user-base)/bin":$PATH
          # Always exist with 0, even if bootstrap fails
          ./mach --no-interactive bootstrap --application-choice browser --exclude macos-sdk || true
          cd ..

      - name: Build language packs
        run: sh scripts/download-language-packs.sh

      - name: Build Zen (PGO stage 1 - generate)
        env:
          SURFER_COMPAT: ${{ matrix.arch }}
          ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
          ZEN_GA_GENERATE_PROFILE: 1
          ZEN_SAFEBROWSING_API_KEY: ${{ secrets.ZEN_SAFEBROWSING_API_KEY }}
          ZEN_MOZILLA_API_KEY: ${{ secrets.ZEN_MOZILLA_API_KEY }}
          ZEN_GOOGLE_LOCATION_SERVICE_API_KEY: ${{ secrets.ZEN_GOOGLE_LOCATION_SERVICE_API_KEY }}
        run: |
          export SURFER_PLATFORM="darwin"
          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
          fi
          bash .github/workflows/src/release-build.sh

      - name: Generate PGO profile data
        env:
          SURFER_COMPAT: ${{ matrix.arch }}
        run: |
          set -x
          export LLVM_PROFDATA="$HOME/.mozbuild/clang/bin/llvm-profdata"
          export JARLOG_FILE=en-US.log
          mkdir -p "$HOME/artifact"
          cd engine
          ./mach python ../scripts/download_pgo_extended_corpus.py
          ./mach package
          ./mach python build/pgo/profileserver.py --extended-corpus ./pgo-extended-corpus
          mv merged.profdata "$HOME/artifact/merged.profdata"
          mv en-US.log "$HOME/artifact/en-US.log"

      - name: Build Zen
        env:
          SURFER_COMPAT: ${{ matrix.arch }}
          ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
          ZEN_SAFEBROWSING_API_KEY: ${{ secrets.ZEN_SAFEBROWSING_API_KEY }}
          ZEN_MOZILLA_API_KEY: ${{ secrets.ZEN_MOZILLA_API_KEY }}
          ZEN_GOOGLE_LOCATION_SERVICE_API_KEY: ${{ secrets.ZEN_GOOGLE_LOCATION_SERVICE_API_KEY }}
        run: |
          export SURFER_PLATFORM="darwin"
          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
          fi
          bash .github/workflows/src/release-build.sh

      - name: Package
        env:
          SURFER_COMPAT: ${{ matrix.arch }}
          ZEN_GA_DISABLE_PGO: true
        run: |
          export SURFER_PLATFORM="darwin"
          export ZEN_RELEASE=1
          npm run package

      - name: Rename artifacts
        run: |
          echo "Tarballing DMG"
          set -ex
          mv ./dist/*.dmg ./zen-${{ matrix.arch }}-apple-darwin-dist.dmg
          mv ./engine/obj-${{ matrix.arch }}-apple-darwin/dist/host/bin/mar ./zen-macos-host-mar
          mv ./engine/obj-${{ matrix.arch }}-apple-darwin/dist/bin/platform.ini ./platform.ini

      - name: Upload dist dmg
        uses: actions/upload-artifact@v4
        with:
          retention-days: 1
          name: zen-${{ matrix.arch }}-apple-darwin-dist.dmg
          path: ./zen-${{ matrix.arch }}-apple-darwin-dist.dmg

      - name: Upload host mar
        uses: actions/upload-artifact@v4
        if: matrix.arch == 'aarch64'
        with:
          retention-days: 1
          name: zen-macos-host-mar
          path: ./zen-macos-host-mar

      - name: Upload platform.ini
        uses: actions/upload-artifact@v4
        if: matrix.arch == 'x86_64'
        with:
          retention-days: 1
          name: platform.ini
          path: ./platform.ini
