ci.yml

# this ci pipeline will build, test and publish (can but currently does not) artifacts for linux, win, macosx

name: CI

on:
  push:
    branches: [ "*-dev-*"]
    tags: [ "v*" ]
  pull_request:
    branches: [ "*" ]

jobs:
  build:
    name: ${{ matrix.name }}

    env:
      CHECK_DOC: "0"
      CCACHE_SIZE: "100M"
      CCACHE_TEMPDIR: /tmp/.ccache-temp
      CCACHE_COMPRESS: "1"
      PYTHON_DEBUG: "1"
      MAC_SDK_URL: https://bitcoincore.org/depends-sources/sdks
      ANDROID_NDK_URL: https://dl.google.com/android/repository/

    strategy:
      fail-fast: false
      matrix:
        name:
          - armhf-linux
          - aarch64-linux
          - aarch64-android
          - x86_64-linux-dbg
          - x86_64-linux-openenclave
          - x86_64-macos
          # - arm64-macos
          - x86_64-win
          - x86_64-win-native
          - i686-win
          - i686-linux
        include:
          - name: armhf-linux
            host: arm-linux-gnueabihf
            os: ubuntu-20.04
            packages: g++-arm-linux-gnueabihf qemu-user-static qemu-user
            dep-opts: "CROSS_COMPILE='yes' SPEED=slow V=1"
            config-opts: "--enable-static --disable-shared --enable-test-passwd"
            run-tests: true
            goal: install
          - name: aarch64-linux
            host: aarch64-linux-gnu
            os: ubuntu-20.04
            packages: g++-aarch64-linux-gnu qemu-user-static qemu-user
            dep-opts: "CROSS_COMPILE='yes' SPEED=slow V=1"
            config-opts: "LIBS='-levent_pthreads' --enable-static --disable-shared --enable-test-passwd"
            run-tests: true
            goal: install
          - name: aarch64-android
            host: aarch64-linux-android
            os: ubuntu-20.04
            packages: unzip
            dep-opts: "CROSS_COMPILE='yes' SPEED=slow V=1"
            config-opts: "--enable-static --disable-shared --enable-test-passwd"
            run-tests: true
            goal: install
            android-ndk: android-ndk-r25c-linux
            android-ndk-shasum: "769ee342ea75f80619d985c2da990c48b3d8eaf45f48783a2d48870d04b46108"
          - name: x86_64-linux-dbg
            host: x86_64-pc-linux-gnu
            os: ubuntu-20.04
            run-tests: true
            packages: python3-dev python3-dbg python
            dep-opts: "DEBUG=1 SPEED=slow V=1"
            config-opts: "--enable-debug --enable-test-passwd"
            goal: install
          - name: x86_64-linux-openenclave
            host: x86_64-pc-linux-gnu
            os: ubuntu-20.04
            run-tests: true
            packages: python3-dev python3-dbg python
            dep-opts: "DEBUG=1 SPEED=slow V=1"
            config-opts: "--enable-debug --enable-openenclave --enable-test-passwd CFLAGS=-U_FORTIFY_SOURCE"
            goal: install
          - name: x86_64-macos
            host: x86_64-apple-darwin15
            os: macos-12
            run-tests: true
            dep-opts: "SPEED=slow V=1"
            config-opts: "--enable-static --disable-shared --enable-test-passwd"
            packages: cmake zlib xorriso
            goal: install
            mac-sdk: 12.2
            mac-sdk-build: 12B45b
            mac-sdk-shasum: "df75d30ecafc429e905134333aeae56ac65fac67cb4182622398fd717df77619"
          # - name: arm64-macos
          #   host: arm64-apple-darwin
          #   os: macos-13-xlarge
          #   run-tests: true
          #   dep-opts: "SPEED=slow V=1"
          #   config-opts: "--enable-static --disable-shared --enable-test-passwd"
          #   packages: cmake zlib xorriso libtool
          #   goal: install
          #   mac-sdk: 12.2
          #   mac-sdk-build: 12B45b
          #   mac-sdk-shasum: "df75d30ecafc429e905134333aeae56ac65fac67cb4182622398fd717df77619"
          - name: x86_64-win
            host: x86_64-w64-mingw32
            arch: i386
            os: ubuntu-20.04
            packages: python3 nsis g++-mingw-w64-x86-64 wine64 wine-stable bc wine-binfmt
            postinstall: |
              sudo dpkg -s mono-runtime && sudo apt-get remove mono-runtime || echo "Very nothing to uninstall."
              sudo update-alternatives --set x86_64-w64-mingw32-gcc  /usr/bin/x86_64-w64-mingw32-gcc-posix
              sudo update-alternatives --set x86_64-w64-mingw32-g++  /usr/bin/x86_64-w64-mingw32-g++-posix
              sudo update-binfmts --import /usr/share/binfmts/wine
            dep-opts: "CROSS_COMPILE='yes' SPEED=slow V=1"
            config-opts: "--enable-test-passwd"
            run-tests: true
          - name: x86_64-win-native
            host: x86_64-pc-windows-msvc
            os: windows-latest
            packages: cmake
            postinstall: |
              choco install visualstudio2019buildtools --package-parameters "--add Microsoft.VisualStudio.Component.VC.Tools.x86.x64"
            dep-opts: "CROSS_COMPILE='no' SPEED=slow V=1"
            config-opts: ""
            run-tests: false
            goal: install
          - name: i686-win
            host: i686-w64-mingw32
            arch: i386
            os: ubuntu-20.04
            packages: python3-pip python3-setuptools nsis g++ g++-mingw-w64-i686 mingw-w64-i686-dev wine-stable winehq-stable bc wine-binfmt binfmt-support
            preinstall: |
              OS_FLAVOR=$(cat /etc/*ease | grep UBUNTU_CODENAME | cut -d "=" -f 2)
              if [ ! -d "/etc/apt/keyrings" ]; then sudo mkdir -pm755 /etc/apt/keyrings; fi
              sudo wget -O /etc/apt/keyrings/winehq-archive.key https://dl.winehq.org/wine-builds/winehq.key
              sudo wget -NP /etc/apt/sources.list.d/ https://dl.winehq.org/wine-builds/ubuntu/dists/$OS_FLAVOR/winehq-$OS_FLAVOR.sources
              sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
              sudo apt-get update -qq
              sudo apt-get install -yqq --allow-downgrades libgd3/focal libpcre2-8-0/focal libpcre2-16-0/focal libpcre2-32-0/focal libpcre2-posix2/focal
              sudo apt-get purge -yqq libmono* moby* mono* php* libgdiplus libpcre2-posix3 libzip4
            postinstall: |
              sudo update-alternatives --set i686-w64-mingw32-gcc /usr/bin/i686-w64-mingw32-gcc-posix
              sudo update-alternatives --set i686-w64-mingw32-g++  /usr/bin/i686-w64-mingw32-g++-posix
              sudo update-binfmts --import /usr/share/binfmts/wine
            dep-opts: "CROSS_COMPILE='yes' SPEED=slow V=1"
            config-opts: "--enable-test-passwd"
            run-tests: true
            goal: install
          - name: i686-linux
            host: i686-pc-linux-gnu
            os: ubuntu-20.04
            packages: g++-multilib bc
            run-tests: true
            dep-opts: "SPEED=slow V=1"
            config-opts: "--enable-static --disable-shared --enable-test-passwd"
            goal: install

    runs-on: ${{ matrix.os }}

    steps:
      - name: add architecture
        if: ${{ matrix.arch }}
        run: |
          sudo dpkg --add-architecture ${{ matrix.arch }}

      - name: Pre install
        if: ${{ matrix.preinstall }}
        run: ${{ matrix.preinstall }}

      - name: install packages
        run: |
          if ([ "${{ matrix.name }}" != "x86_64-win-native" ]); then
            if ([ "${{ matrix.name }}" == "x86_64-macos" ] || [ "${{ matrix.name }}" == "arm64-macos" ]); then
                brew update
                brew install automake coreutils ${{ matrix.packages }}
                echo PATH="/usr/local/opt/coreutils/libexec/gnubin:$PATH" >> ~/.bashrc
                source ~/.bashrc
            else
              sudo apt-get update
              DEBIAN_FRONTEND=noninteractive sudo apt-get install -y autoconf automake libtool-bin libevent-dev build-essential curl python3 valgrind ${{ matrix.packages }}
            fi
          fi
        shell: bash

      - name: post install
        if: ${{ matrix.postinstall }}
        run: ${{ matrix.postinstall }}

      - name: checkout
        uses: actions/checkout@v4

      - name: mac sdk cache
        if: ${{ matrix.mac-sdk }}
        uses: actions/cache@v4
        env:
          cache-name: sdk
        with:
          path: ./depends/sdk-sources
          key: ${{ matrix.name }}-${{ env.cache-name }}-${{ hashFiles('.github/workflows/ci.yml') }}

      - name: install mac sdk
        if: ${{ matrix.mac-sdk }}
        env:
          sdk-filename: Xcode-${{ matrix.mac-sdk }}-${{ matrix.mac-sdk-build }}-extracted-SDK-with-libcxx-headers.tar.gz
        run: |
          mkdir -p ./depends/sdk-sources
          mkdir -p ./depends/SDKs
          echo "${{ matrix.mac-sdk-shasum }}  depends/sdk-sources/${{ env.sdk-filename }}" | sha256sum -c || \
          curl --location --fail $MAC_SDK_URL/${{ env.sdk-filename }} -o depends/sdk-sources/${{ env.sdk-filename }} &&\
          echo "${{ matrix.mac-sdk-shasum }}  depends/sdk-sources/${{ env.sdk-filename }}" | sha256sum -c
          tar -C depends/SDKs -xf depends/sdk-sources/${{ env.sdk-filename }}

      - name: android ndk cache
        if: ${{ matrix.android-ndk }}
        uses: actions/cache@v4
        env:
          cache-name: android-ndk
        with:
          path: ./depends/sdk-sources
          key: ${{ matrix.name }}-${{ env.cache-name }}-${{ hashFiles('.github/workflows/ci.yml') }}

      - name: install android ndk
        if: ${{ matrix.android-ndk }}
        env:
          ndk-filename: ${{ matrix.android-ndk }}.zip
        run: |
          mkdir -p ./depends/sdk-sources
          mkdir -p ./depends/SDKs
          echo "${{ matrix.android-ndk-shasum }}  depends/sdk-sources/${{ env.ndk-filename }}" | sha256sum -c || \
          curl --location --fail $ANDROID_NDK_URL/${{ env.ndk-filename }} -o depends/sdk-sources/${{ env.ndk-filename }} &&\
          echo "${{ matrix.android-ndk-shasum }}  depends/sdk-sources/${{ env.ndk-filename }}" | sha256sum -c
          unzip depends/sdk-sources/${{ env.ndk-filename }} -d depends/SDKs

      - name: dependency cache
        uses: actions/cache@v4
        env:
          cache-name: depends
        with:
          path: ./depends/built
          key: ${{ matrix.name }}-${{ env.cache-name }}-${{ hashFiles('depends/packages/*') }}

      - name: build depends
        run: |
          make $MAKEJOBS -C depends HOST=${{ matrix.host }} ${{ matrix.dep-opts }}
        if: matrix.host != 'x86_64-pc-windows-msvc'

      - name: ccache
        uses: actions/cache@v4
        env:
          cache-name: ccache
        with:
          path: ~/.ccache
          key: ${{ matrix.name }}-${{ env.cache-name }}-${{ hashFiles('**/configure.ac') }}

      - name: configure libdogecoin
        run: |
          depends/${{ matrix.host }}/native/bin/ccache --max-size=$CCACHE_SIZE
          ./autogen.sh
          ./configure --prefix=`pwd`/depends/${{ matrix.host }} ${{ matrix.config-opts }} HOST=${{ matrix.host }} || ( cat config.log && false)
        if: matrix.host != 'x86_64-pc-windows-msvc'

      - name: build libdogecoin
        run: |
          build_dir=./build/libdogecoin-${{ github.sha }}-${{ matrix.name }}
          mkdir -p $build_dir/bin $build_dir/docs $build_dir/examples $build_dir/include $build_dir/lib $build_dir/test/ $build_dir/test/wordlist
          if [ "${{ matrix.host }}" == "x86_64-pc-windows-msvc" ]; then
            cmake -B $build_dir
            cmake --build $build_dir
          else
            make -j"$(getconf _NPROCESSORS_ONLN)" SPEED=slow V=1
            if ([ "${{ matrix.name }}" == "x86_64-win" ] || [ "${{ matrix.name }}" == "i686-win" ]); then
            cp spvnode.exe such.exe sendtx.exe $build_dir/bin/
            else
            cp spvnode such sendtx $build_dir/bin/
            fi
          cp doc/*.md $build_dir/docs/
          cp contrib/examples/example.c $build_dir/examples/
          cp include/dogecoin/dogecoin.h \
              include/dogecoin/libdogecoin.h \
              include/dogecoin/constants.h \
              config/libdogecoin-config.h \
              include/dogecoin/uthash.h $build_dir/include/
          cp test/wordlist/* $build_dir/test/wordlist/
          cp .libs/* $build_dir/lib/
          cp LICENSE $build_dir/
          chmod +x ./build/libdogecoin-${{ github.sha }}-${{ matrix.name }}/*
          fi
        shell: bash

      - name: test libdogecoin
        if: ${{ matrix.run-tests }}
        run: |
            case "${{ matrix.name }}" in
              "armhf-linux")
              qemu-arm -E LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib/ /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 ./tests
              ;;
              "aarch64-linux")
              qemu-aarch64 -E LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib/ /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 ./tests
              ;;
              "x86_64-linux-dbg")
              make check -j"$(getconf _NPROCESSORS_ONLN)" V=1
              python3 tooltests.py
              sudo ./rpctest/fetch.py --host x86_64-linux-gnu
              sudo rm /usr/local/bin/dogecoind
              ;;
              "x86_64-linux-openenclave")
              make check -j"$(getconf _NPROCESSORS_ONLN)" V=1
              python3 tooltests.py
              sudo make install

              echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main' | sudo tee /etc/apt/sources.list.d/intel-sgx.list
              wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -

              echo "deb http://apt.llvm.org/focal/ llvm-toolchain-focal-11 main" | sudo tee /etc/apt/sources.list.d/llvm-toolchain-focal-11.list
              wget -qO - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -

              echo "deb [arch=amd64] https://packages.microsoft.com/ubuntu/20.04/prod focal main" | sudo tee /etc/apt/sources.list.d/msprod.list
              wget -qO - https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -

              sudo apt update

              sudo apt -y install clang-11 libssl-dev gdb libsgx-enclave-common libsgx-quote-ex libprotobuf17 libsgx-dcap-ql libsgx-dcap-ql-dev az-dcap-client open-enclave
              sudo apt -y install dkms
              source /opt/openenclave/share/openenclave/openenclaverc
              cd src/openenclave
              mkdir build
              cd build
              cmake ..
              make
              make simulate
              ;;
              "aarch64-android"):
              wget https://dl.google.com/android/repository/commandlinetools-linux-6858069_latest.zip
              unzip commandlinetools-linux-6858069_latest.zip
              mkdir -p ~/.android-sdk/cmdline-tools/latest
              mv cmdline-tools/* ~/.android-sdk/cmdline-tools/latest
              export ANDROID_SDK_ROOT=~/.android-sdk
              export PATH=$PATH:$ANDROID_SDK_ROOT/cmdline-tools/latest/bin:$ANDROID_SDK_ROOT/platform-tools
              yes | sdkmanager --licenses --sdk_root=$ANDROID_SDK_ROOT
              sdkmanager --update --sdk_root=$ANDROID_SDK_ROOT
              sdkmanager "platform-tools" --sdk_root=$ANDROID_SDK_ROOT
              DOCKER_IMAGE=us-docker.pkg.dev/android-emulator-268719/images/r-google-x64:30.0.23
              PORT=15555
              container_id=$(docker run -d \
                --device /dev/kvm \
                --publish 8554:8554/tcp \
                --publish $PORT:5555/tcp \
                -e TOKEN="$(cat ~/.emulator_console_auth_token)" \
                -e ADBKEY="$(cat ~/.android/adbkey)" \
                $DOCKER_IMAGE)
              echo "The container is running with id: $container_id"
              adb connect localhost:$PORT
              adb wait-for-device
              while [ "$(adb shell getprop sys.boot_completed | tr -d '\r')" != "1" ]; do
                sleep 1
              done
              echo "The device is ready"
              adb push ./tests /data/local/tmp/
              adb shell "mkdir -p /data/local/tmp/test"
              adb push ./test/wordlist /data/local/tmp/test
              adb shell "cd /data/local/tmp/; chmod 755 tests; ./tests"
              echo "docker stop ${container_id}"
              ;;
              *)
              make check -j"$(getconf _NPROCESSORS_ONLN)" V=1
              ;;
            esac

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: libdogecoin-${{ github.sha }}-${{ matrix.name }}
          path: |
            ${{ github.workspace }}/build/libdogecoin-${{ github.sha }}-${{ matrix.name }}

  sign-x86_64-win:
    needs: build
    runs-on: windows-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: libdogecoin-${{ github.sha }}-x86_64-win

      - name: Import certificate (x86_64-win)
        run: |
          $certData = "${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}"
          $certBytes = [Convert]::FromBase64String($certData)
          [IO.File]::WriteAllBytes("./mycert.pfx", $certBytes)
          $password = ConvertTo-SecureString -String "${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}" -Force -AsPlainText
          Import-PfxCertificate -FilePath ./mycert.pfx -CertStoreLocation Cert:\LocalMachine\Root -Password $password
          Remove-Item ./mycert.pfx
        shell: pwsh

      - name: Sign spvnode.exe (x86_64-win)
        uses: lando/code-sign-action@v2
        with:
          file: bin/spvnode.exe
          certificate-data: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}
          certificate-password: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}

      - name: Sign such.exe (x86_64-win)
        uses: lando/code-sign-action@v2
        with:
          file: bin/such.exe
          certificate-data: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}
          certificate-password: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}

      - name: Sign sendtx.exe (x86_64-win)
        uses: lando/code-sign-action@v2
        with:
          file: bin/sendtx.exe
          certificate-data: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}
          certificate-password: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}

      - name: Upload artifacts (x86_64-win)
        uses: actions/upload-artifact@v4
        with:
          name: libdogecoin-${{ github.sha }}-x86_64-win-signed
          path: |
            bin/**
            docs/**
            examples/**
            include/**
            lib/**
            test/**
            LICENSE

  sign-x86_64-win-native:
    needs: build
    runs-on: windows-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: libdogecoin-${{ github.sha }}-x86_64-win-native

      - name: Import certificate (x86_64-win)
        run: |
          $certData = "${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}"
          $certBytes = [Convert]::FromBase64String($certData)
          [IO.File]::WriteAllBytes("./mycert.pfx", $certBytes)
          $password = ConvertTo-SecureString -String "${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}" -Force -AsPlainText
          Import-PfxCertificate -FilePath ./mycert.pfx -CertStoreLocation Cert:\LocalMachine\Root -Password $password
          Remove-Item ./mycert.pfx
        shell: pwsh

      - name: Sign spvnode.exe (x86_64-win-native)
        uses: lando/code-sign-action@v2
        with:
          file: Debug/spvnode.exe
          certificate-data: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}
          certificate-password: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}

      - name: Sign such.exe (x86_64-win-native)
        uses: lando/code-sign-action@v2
        with:
          file: Debug/such.exe
          certificate-data: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}
          certificate-password: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}

      - name: Sign sendtx.exe (x86_64-win-native)
        uses: lando/code-sign-action@v2
        with:
          file: Debug/sendtx.exe
          certificate-data: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}
          certificate-password: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}

      - name: Upload artifacts (x86_64-win-native)
        uses: actions/upload-artifact@v4
        with:
          name: libdogecoin-${{ github.sha }}-x86_64-win-native-signed
          path: |
            Debug/**
            test/**

  sign-i686-win:
    needs: build
    runs-on: windows-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: libdogecoin-${{ github.sha }}-i686-win

      - name: Import certificate (i686-win)
        run: |
          $certData = "${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}"
          $certBytes = [Convert]::FromBase64String($certData)
          [IO.File]::WriteAllBytes("./mycert.pfx", $certBytes)
          $password = ConvertTo-SecureString -String "${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}" -Force -AsPlainText
          Import-PfxCertificate -FilePath ./mycert.pfx -CertStoreLocation Cert:\LocalMachine\Root -Password $password
          Remove-Item ./mycert.pfx
        shell: pwsh

      - name: Sign spvnode.exe (i686-win)
        uses: lando/code-sign-action@v2
        with:
          file: bin/spvnode.exe
          certificate-data: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}
          certificate-password: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}

      - name: Sign such.exe (i686-win)
        uses: lando/code-sign-action@v2
        with:
          file: bin/such.exe
          certificate-data: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}
          certificate-password: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}

      - name: Sign sendtx.exe (i686-win)
        uses: lando/code-sign-action@v2
        with:
          file: bin/sendtx.exe
          certificate-data: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_DATA }}
          certificate-password: ${{ secrets.LIBDOGECOIN_DEV_WINDOWS_CERT_PASSWORD }}

      - name: Upload artifacts (i686-win)
        uses: actions/upload-artifact@v4
        with:
          name: libdogecoin-${{ github.sha }}-i686-win-signed
          path: |
            bin/**
            docs/**
            examples/**
            include/**
            lib/**
            test/**
            LICENSE

  sign-x86_64-macos:
    needs: build
    runs-on: macos-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: libdogecoin-${{ github.sha }}-x86_64-macos

      - name: Import certificate to keychain (x86_64-macos)
        env:
          LIBDOGECOIN_DEV_MACOS_CERT_DATA: ${{ secrets.LIBDOGECOIN_DEV_MACOS_CERT_DATA }}
          LIBDOGECOIN_DEV_MACOS_CERT_PASS: ${{ secrets.LIBDOGECOIN_DEV_MACOS_CERT_PASSWORD }}
        run: |
          echo $LIBDOGECOIN_DEV_MACOS_CERT_DATA | base64 --decode > certificate.p12
          security create-keychain -p $LIBDOGECOIN_DEV_MACOS_CERT_PASS ~/Library/Keychains/build.keychain
          security default-keychain -s ~/Library/Keychains/build.keychain
          security unlock-keychain -p $LIBDOGECOIN_DEV_MACOS_CERT_PASS ~/Library/Keychains/build.keychain
          security import certificate.p12 -k ~/Library/Keychains/build.keychain -P $LIBDOGECOIN_DEV_MACOS_CERT_PASS -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $LIBDOGECOIN_DEV_MACOS_CERT_PASS ~/Library/Keychains/build.keychain

      - name: Sign spvnode (x86_64-macos)
        env:
          MACOS_CODE_CERT_TEAM_ID: ${{ secrets.LIBDOGECOIN_DEV_APPLE_TEAM_ID }}
          MACOS_EXECUTABLE_PATH: bin/spvnode
        run: |
          /usr/bin/codesign --force --keychain ~/Library/Keychains/build.keychain -s $MACOS_CODE_CERT_TEAM_ID --deep --options=runtime --verbose "$MACOS_EXECUTABLE_PATH"

      - name: Sign such (x86_64-macos)
        env:
          MACOS_CODE_CERT_TEAM_ID: ${{ secrets.LIBDOGECOIN_DEV_APPLE_TEAM_ID }}
          MACOS_EXECUTABLE_PATH: bin/such
        run: |
          /usr/bin/codesign --force --keychain ~/Library/Keychains/build.keychain -s $MACOS_CODE_CERT_TEAM_ID --deep --options=runtime --verbose "$MACOS_EXECUTABLE_PATH"

      - name: Sign sendtx (x86_64-macos)
        env:
          MACOS_CODE_CERT_TEAM_ID: ${{ secrets.LIBDOGECOIN_DEV_APPLE_TEAM_ID }}
          MACOS_EXECUTABLE_PATH: bin/sendtx
        run: |
          /usr/bin/codesign --force --keychain ~/Library/Keychains/build.keychain -s $MACOS_CODE_CERT_TEAM_ID --deep --options=runtime --verbose "$MACOS_EXECUTABLE_PATH"

      - name: Upload artifacts (x86_64-macos)
        uses: actions/upload-artifact@v4
        with:
          name: libdogecoin-${{ github.sha }}-x86_64-macos-signed
          path: |
            bin/**
            docs/**
            examples/**
            include/**
            lib/**
            test/**
            LICENSE