Improve recording and MIDI workflows; package offline support

.github/workflows/ai-runtime-release.yml

@@ -87,7 +87,7 @@ jobs:
 
   build-macos-runtime-arm64:
     needs: validate-ai-runtime-release
-    runs-on: macos-14
+    runs-on: macos-15
     env:
       VERSION: ${{ needs.validate-ai-runtime-release.outputs.version }}
       AI_RUNTIME_STANDALONE_RELEASE_TAG: ${{ vars.OPENSTUDIO_AI_RUNTIME_STANDALONE_RELEASE_TAG != '' && vars.OPENSTUDIO_AI_RUNTIME_STANDALONE_RELEASE_TAG || '20260325' }}

.github/workflows/certification-access.yml

@@ -0,0 +1,54 @@
+name: Certification access inspection (no publication)
+on:
+  push:
+    branches: ['codex/certification-0.1.09-**']
+    paths:
+      - '.github/workflows/certification-access.yml'
+      - 'tools/check-certification-access.py'
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  apple:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+      - uses: dopplerhq/cli-action@014df23b1329b615816a38eb5f473bb9000700b1
+      - name: Inspect allowlisted credential presence without exposing values
+        env:
+          DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
+          MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+          MACOS_CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
+        run: python3 tools/check-certification-access.py apple --report output/apple-access.json
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: apple-certification-access
+          path: output/apple-access.json
+  store:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment: microsoft-store
+    concurrency:
+      group: openstudio-microsoft-store-submission
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+      - name: Read Store identity and submission state without mutations
+        env:
+          MS_STORE_TENANT_ID: ${{ secrets.MS_STORE_TENANT_ID }}
+          MS_STORE_CLIENT_ID: ${{ secrets.MS_STORE_CLIENT_ID }}
+          MS_STORE_CLIENT_SECRET: ${{ secrets.MS_STORE_CLIENT_SECRET }}
+        run: python3 tools/check-certification-access.py store --report output/store-access.json
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: store-certification-access
+          path: output/store-access.json

.github/workflows/release.yml

@@ -22,6 +22,7 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       notes_file: ${{ steps.notes.outputs.notes_file }}
+      app_version: ${{ steps.normalized.outputs.version }}
     env:
       VERSION: ${{ github.event.inputs.version || github.ref_name }}
       NOTES_FILE: ${{ github.event.inputs.release_notes_file }}
@@ -35,10 +36,19 @@ jobs:
             exit 1
           fi
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - name: Normalize support package version
+        id: normalized
+        run: echo "version=${VERSION#v}" >> "$GITHUB_OUTPUT"
       - name: Validate exact-version release notes before building
         id: notes
         run: python3 tools/validate-release-notes.py --version "$VERSION" --notes-file "$NOTES_FILE" --github-output "$GITHUB_OUTPUT"
 
+  support-packages:
+    needs: validate-release-notes
+    uses: ./.github/workflows/support-qualification.yml
+    with:
+      version: ${{ needs.validate-release-notes.outputs.app_version }}
+
   build-windows:
     needs: validate-release-notes
     runs-on: windows-latest
@@ -139,6 +149,10 @@ jobs:
         if: env.DOPPLER_CONFIGURED == 'true'
         uses: dopplerhq/cli-action@014df23b1329b615816a38eb5f473bb9000700b1 # v3
 
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: '3.13'
+
       - name: Configure CMake
         shell: pwsh
         env:
@@ -193,6 +207,29 @@ jobs:
         shell: pwsh
         run: cmake --build $env:BUILD_DIR --config Release --target OpenStudio
 
+      - name: Archive matching native and frontend symbols (windows)
+        run: python tools/build-symbols.py archive --app "$env:BUILD_DIR/OpenStudio_artefacts/Release/OpenStudio.exe" --build-dir $env:BUILD_DIR --output output/symbols
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: windows-debug-symbols
+          path: output/symbols/
+          retention-days: 90
+          if-no-files-found: error
+
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: '3.13'
+
+      - name: Build and qualify standalone support (Windows)
+        shell: pwsh
+        run: |
+          python tools/build-support-tool.py --version $env:VERSION --stage "$env:BUILD_DIR/OpenStudio_artefacts/Release"
+          if ($LASTEXITCODE -ne 0) { throw 'Support build failed.' }
+          ./.venv-support/Scripts/python.exe -m unittest tools.test_openstudio_support -q
+          if ($LASTEXITCODE -ne 0) { throw 'Support regression failed.' }
+          python tools/test-packaged-support.py --bundle "$env:BUILD_DIR/OpenStudio_artefacts/Release"
+          if ($LASTEXITCODE -ne 0) { throw 'Support qualification failed.' }
+
       - name: Verify signed updater (Windows Release)
         shell: pwsh
         run: |
@@ -477,8 +514,8 @@ jobs:
           if-no-files-found: error
 
   build-macos:
-    needs: validate-release-notes
-    runs-on: macos-14
+    needs: [validate-release-notes, support-packages]
+    runs-on: macos-15
     env:
       VERSION: ${{ github.event.inputs.version || github.ref_name }}
       RELEASE_NOTES_FILE: ${{ needs.validate-release-notes.outputs.notes_file }}
@@ -570,6 +607,10 @@ jobs:
           security list-keychains -d user -s "$KEYCHAIN_PATH" $EXISTING_KEYCHAINS
           echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
 
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: '3.13'
+
       - name: Configure CMake
         shell: bash
         env:
@@ -615,6 +656,27 @@ jobs:
         shell: bash
         run: cmake --build "$BUILD_DIR" --config Release --target OpenStudio
 
+      - name: Archive matching native and frontend symbols (macos)
+        run: python tools/build-symbols.py archive --app "$BUILD_DIR/OpenStudio_artefacts/Release/OpenStudio.app" --build-dir "$BUILD_DIR" --output output/symbols
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: macos-debug-symbols
+          path: output/symbols/
+          retention-days: 90
+          if-no-files-found: error
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: support-macos-universal
+          path: output/support-universal
+      - name: Stage universal offline support
+        run: |
+          tar -xzf output/support-universal/support-macos-universal.tgz -C output/support-universal
+          APP="$BUILD_DIR/OpenStudio_artefacts/Release/OpenStudio.app"
+          ditto output/support-universal/OpenStudioSupport.app "$APP/Contents/Helpers/OpenStudioSupport.app"
+          ditto 'output/support-universal/OpenStudio Support.app' "$BUILD_DIR/OpenStudio_artefacts/Release/OpenStudio Support.app"
+          python3 tools/validate-support-tool.py --bundle "$APP" --version "$VERSION"
+
       - name: Verify signed updater (macOS Release)
         shell: bash
         run: |
@@ -708,6 +770,15 @@ jobs:
             -ReportPath "$REPORT_PATH" \
             -TimeoutSeconds 180
 
+      - name: Retain packaged macOS qualification evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: macos-packaged-qualification
+          path: ${{ runner.temp }}/OpenStudio_PackagedWindowLifecycleHarness*
+          if-no-files-found: ignore
+          retention-days: 30
+
       - name: Verify macOS release outputs
         shell: bash
         run: |
@@ -725,7 +796,7 @@ jobs:
           if-no-files-found: error
 
   build-linux:
-    needs: validate-release-notes
+    needs: [validate-release-notes, support-packages]
     runs-on: ubuntu-22.04
     permissions:
       contents: read
@@ -783,6 +854,10 @@ jobs:
         if: env.DOPPLER_CONFIGURED == 'true'
         uses: dopplerhq/cli-action@014df23b1329b615816a38eb5f473bb9000700b1 # v3
 
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: '3.13'
+
       - name: Configure CMake
         env:
           DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
@@ -826,6 +901,25 @@ jobs:
       - name: Build OpenStudio
         run: cmake --build "$BUILD_DIR" --config Release --target OpenStudio
 
+      - name: Archive matching native and frontend symbols (Linux)
+        run: python tools/build-symbols.py archive --app "$BUILD_DIR/OpenStudio_artefacts/Release/OpenStudio" --build-dir "$BUILD_DIR" --output output/symbols
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: linux-debug-symbols
+          path: output/symbols/
+          retention-days: 90
+          if-no-files-found: error
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: support-linux-x64
+          path: output/support-native
+      - name: Stage offline support
+        run: |
+          tar -xzf output/support-native/support-linux-x64.tgz -C output/support-native
+          cp -a output/support-native/OpenStudioSupport/. "$BUILD_DIR/OpenStudio_artefacts/Release/"
+          python3 tools/validate-support-tool.py --bundle "$BUILD_DIR/OpenStudio_artefacts/Release" --version "$VERSION"
+
       - name: Verify signed updater (Linux Release)
         shell: bash
         run: |
@@ -877,9 +971,10 @@ jobs:
             "dist/linux/OpenStudio-${VERSION}-linux-x86_64.AppImage"
 
       - name: Exercise the finished AppImage launcher
+        # The preceding Openbox report stays in the parent; this suite requires fresh output.
         env:
           APPIMAGE_EXTRACT_AND_RUN: '1'
-        run: xvfb-run -a python3 tools/run-linux-qualification.py --app "dist/linux/OpenStudio-${VERSION}-linux-x86_64.AppImage" --output output/linux-appimage --desktop --render
+        run: xvfb-run -a python3 tools/run-linux-qualification.py --app "dist/linux/OpenStudio-${VERSION}-linux-x86_64.AppImage" --output output/linux-appimage/launcher --desktop --render
 
       - name: Attest Linux installer build provenance
         uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 # v3
@@ -903,6 +998,8 @@ jobs:
           name: linux-release
           path: |
             dist/linux/OpenStudio-*-x86_64.AppImage
+            dist/linux/OpenStudioSupport-*-x86_64.AppImage
+            dist/linux/OpenStudio-*-with-support.tar.gz
             dist/linux/OpenStudio-*-ubuntu-22.04-amd64.deb
           if-no-files-found: error
 
@@ -1153,6 +1250,8 @@ jobs:
             dist/windows/OpenStudio-FFmpeg-8.0.1-complete-corresponding-source.zip
             dist/macos/OpenStudio-macOS.dmg
             dist/linux/OpenStudio-*-x86_64.AppImage
+            dist/linux/OpenStudioSupport-*-x86_64.AppImage
+            dist/linux/OpenStudio-*-with-support.tar.gz
             dist/linux/OpenStudio-*-ubuntu-22.04-amd64.deb
             dist/release-publish-assets/OpenStudio-checksums.txt
             dist/release-publish-assets/OpenStudio-release-latest.json

.github/workflows/support-qualification.yml

@@ -0,0 +1,118 @@
+name: Offline support qualification
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        default: '0.0.0'
+  push:
+    branches: ['codex/support-packaging-qa-**']
+permissions:
+  contents: read
+jobs:
+  native:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {os: windows-latest, platform: windows, arch: x64}
+          - {os: ubuntu-22.04, platform: linux, arch: x64}
+          - {os: macos-15, platform: macos, arch: arm64}
+          - {os: macos-15-intel, platform: macos, arch: x86_64}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      SUPPORT_VERSION: ${{ inputs.version || '0.0.0' }}
+      MACOSX_DEPLOYMENT_TARGET: '11.0'
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version-file: frontend/.nvmrc
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548
+        with:
+          python-version: '3.13'
+      - name: Linux desktop build dependencies
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y python3-tk xvfb xauth desktop-file-utils dpkg-dev rpm
+      - run: npm --prefix frontend ci
+      - name: Build native support
+        shell: bash
+        run: python tools/build-support-tool.py --version "$SUPPORT_VERSION"
+      - name: Windows installed support tests
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          ./.venv-support/Scripts/python.exe -m unittest tools.test_openstudio_support tests.test_support_identity -q
+          if ($LASTEXITCODE -ne 0) { throw 'Support tests failed' }
+          $env:OPENSTUDIO_SUPPORT_TEST_BUNDLE = "$PWD/output/support-package/OpenStudioSupport"
+          python tests/test_windows_installer.py --require-tools
+          if ($LASTEXITCODE -ne 0) { throw 'Installer regression failed' }
+          python tools/test-packaged-support.py --bundle $env:OPENSTUDIO_SUPPORT_TEST_BUNDLE
+          if ($LASTEXITCODE -ne 0) { throw 'Frozen support failed' }
+          ./tools/test-support-msix.ps1 -BundlePath $env:OPENSTUDIO_SUPPORT_TEST_BUNDLE -OutputDir output/support-msix-qa
+      - name: macOS support tests
+        if: runner.os == 'macOS'
+        timeout-minutes: 6
+        run: |
+          .venv-support/bin/python -c "import faulthandler, unittest; faulthandler.dump_traceback_later(180, exit=True); unittest.main(module=None, argv=['unittest', 'tools.test_openstudio_support', 'tests.test_support_identity', '-v'])"
+          python tools/test-packaged-support.py --bundle output/support-package/OpenStudioSupport.app
+          codesign --verify --deep --strict output/support-package/OpenStudioSupport.app
+      - name: Linux support tests and native packaging
+        if: runner.os == 'Linux'
+        run: |
+          xvfb-run -a .venv-support/bin/python -m unittest tools.test_openstudio_support tests.test_support_identity -q
+          python -m unittest tests.test_linux_native_packaging tests.test_linux_abi tests.test_release_notes -q
+          xvfb-run -a python tools/test-packaged-support.py --bundle output/support-package/OpenStudioSupport
+          xvfb-run -a python tools/test-support-linux.py --bundle output/support-package/OpenStudioSupport --version "$SUPPORT_VERSION"
+          python tools/validate-linux-abi.py --root output/support-package/OpenStudioSupport --report output/support-distribution/abi.json --max-glibc 2.35 --require-os ubuntu:22.04
+      - name: Archive native payload preserving executable modes and links
+        shell: bash
+        run: tar -czf support-${{ matrix.platform }}-${{ matrix.arch }}.tgz -C output/support-package .
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: support-${{ matrix.platform }}-${{ matrix.arch }}
+          path: |
+            support-*.tgz
+            output/support-distribution/*.AppImage
+            output/support-distribution/abi.json
+          if-no-files-found: error
+  universal-macos:
+    needs: native
+    if: ${{ !cancelled() }}
+    runs-on: macos-15
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          pattern: support-macos-*
+          path: output/native
+      - name: Assemble both native runtimes and Finder launcher
+        run: |
+          mkdir -p output/arm64 output/x86_64
+          tar -xzf output/native/support-macos-arm64/support-macos-arm64.tgz -C output/arm64
+          tar -xzf output/native/support-macos-x86_64/support-macos-x86_64.tgz -C output/x86_64
+          python3 tools/assemble-macos-support.py --arm64 output/arm64/OpenStudioSupport.app --x86-64 output/x86_64/OpenStudioSupport.app --version '${{ inputs.version || '0.0.0' }}' --output output/universal
+          python3 tools/sign-macos-support.py output/universal/OpenStudioSupport.app --identity - --no-timestamp
+          python3 tools/test-macos-support-package.py --bundle output/universal --version '${{ inputs.version || '0.0.0' }}'
+          tar -czf support-macos-universal.tgz -C output/universal .
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: support-macos-universal
+          path: support-macos-universal.tgz
+  universal-macos-intel:
+    needs: universal-macos
+    runs-on: macos-15-intel
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: support-macos-universal
+          path: output/universal
+      - name: Qualify universal launcher and mounted DMG on Intel
+        run: |
+          tar -xzf output/universal/support-macos-universal.tgz -C output/universal
+          python3 tools/test-macos-support-package.py --bundle output/universal --version '${{ inputs.version || '0.0.0' }}'