ci: add MacOS build

.devcontainer/devcontainer.json

@@ -2,7 +2,7 @@
     "build": {
         "dockerfile": "Dockerfile",
         "args": {
-            "GEOS_TPL_TAG": "364-1112"
+            "GEOS_TPL_TAG": "370-1138"
         }
     },
     "runArgs": [

.github/workflows/build_and_test.yml

@@ -142,7 +142,7 @@ jobs:
         fetch-depth: 1
 
     - id: 'auth'
-      if: ${{ (inputs.UPLOAD_TO_GCP && inputs.GCP_BUCKET) || (inputs.USE_SCCACHE && !startsWith(inputs.RUNS_ON, 'streak2')) }}
+      if: ${{ (inputs.UPLOAD_TO_GCP && inputs.GCP_BUCKET) || inputs.USE_SCCACHE }}
       uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
       with:
         credentials_json: '${{ secrets.GOOGLE_CLOUD_GCP }}'
@@ -239,6 +239,7 @@ jobs:
                 docker_args+=(-e SCCACHE_CACHE_SIZE)
               fi
               script_args+=(--use-sccache)
+              script_args+=(--sccache-credentials $(basename ${GOOGLE_GHA_CREDS_PATH}))
               ;;
             *)
               script_args+=(--sccache-credentials $(basename ${GOOGLE_GHA_CREDS_PATH}))
@@ -366,15 +367,23 @@ jobs:
         # GHA set `-e` to bash scripts by default to fail asap,
         # but for this precise call, we want to deal with it more precisely
         set +e
+        set -o pipefail
         docker run \
           ${docker_args[@]} \
           -h=`hostname` \
           ${{ inputs.DOCKER_REPOSITORY }}:${{ inputs.DOCKER_IMAGE_TAG }} \
           ${GITHUB_WORKSPACE_MOUNT_POINT}/scripts/ci_build_and_test_in_container.sh \
-          ${script_args[@]}
+          ${script_args[@]} \
+          2>&1 | tee "$RUNNER_TEMP/docker-run.log"
         EXIT_STATUS=$?
+        set +o pipefail
         echo "Received exit status ${EXIT_STATUS} from the build process."
         set -e
+        if [[ "$EXIT_STATUS" -ne 0 ]]; then
+          grep -E 'error:|CMake Error|fatal error|FAIL!|FAIL:' "$RUNNER_TEMP/docker-run.log" | tail -n 12 | while IFS= read -r line; do
+            echo "::error title=Build failed::$line"
+          done || true
+        fi
 
         echo "exit_status=${EXIT_STATUS}" >> "${GITHUB_OUTPUT}"
         echo "data_basename=${DATA_BASENAME}" >> "${GITHUB_OUTPUT}"

.github/workflows/ci_tests.yml

@@ -484,6 +484,41 @@ jobs:
       REQUIRED_LABEL: "ci: run device builds"
     secrets: inherit
 
+  # Native macOS build. The TPL install comes from the published image
+  # geosx/macos-26-apple-clang:${GEOS_TPL_TAG}, the same tag the Linux jobs use.
+  # This job currently checks compilation only.
+  macos_builds:
+    name: macOS 26 - Apple Clang (arm64)
+    needs: [is_not_draft_pull_request]
+    runs-on: macos-26
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        submodules: true
+        lfs: false
+        fetch-depth: 1
+    - name: Load TPL image
+      env:
+        DOCKER_IMAGE_TAG: ${{ needs.is_not_draft_pull_request.outputs.DOCKER_IMAGE_TAG }}
+      run: scripts/macos_load_tpl.sh
+    - id: auth
+      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+      with:
+        credentials_json: '${{ secrets.GOOGLE_CLOUD_GCP }}'
+        create_credentials_file: true
+    - name: Build GEOS
+      run: scripts/macos_build.sh
+    - name: Show sccache summary
+      if: always()
+      run: |
+        SCCACHE_STATS_FILE="${GITHUB_WORKSPACE}/.sccache-runtime/stats.txt"
+        if [[ -f "${SCCACHE_STATS_FILE}" ]]; then
+          grep -E '^(Compile requests|Cache hits|Cache misses|Cache timeouts|Cache read errors|Cache write errors|Compilation failures|Cache errors|Non-cacheable compilations|Non-cacheable calls|Cache location|Cache size|Max cache size|Version \(client\))' "${SCCACHE_STATS_FILE}" || cat "${SCCACHE_STATS_FILE}"
+        else
+          echo "No sccache stats file was captured."
+        fi
+
   # Convenience job - passes when all substantive jobs have passed. A
   # submodule-sync failure is an allowed exception when testing submodule branches.
   check_that_all_jobs_succeeded:
@@ -497,6 +532,7 @@ jobs:
     - cuda_builds
     - rocm_builds
     - run_integrated_tests
+    - macos_builds
     if: ${{ always() }}
     steps:
     - run: |
@@ -506,7 +542,8 @@ jobs:
         echo "cpu_builds: ${{needs.cpu_builds.result}}"
         echo "cuda_builds: ${{needs.cuda_builds.result}}"
         echo "rocm_builds: ${{needs.rocm_builds.result}}"
-        echo "run_integrated_tests: ${{needs.run_integrated_tests.result}} "
+        echo "run_integrated_tests: ${{needs.run_integrated_tests.result}}"
+        echo "macos_builds: ${{needs.macos_builds.result}}"
         ${{
           needs.if_not_unassigned_pull_request.result == 'success' &&
           (
@@ -517,5 +554,6 @@ jobs:
           needs.cpu_builds.result == 'success' &&
           needs.cuda_builds.result == 'success' && 
           needs.rocm_builds.result == 'success' &&
-          needs.run_integrated_tests.result == 'success'
+          needs.run_integrated_tests.result == 'success' &&
+          needs.macos_builds.result == 'success'
         }}

host-configs/Stanford/sherlock-gcc10.cmake

@@ -40,7 +40,7 @@ set(ENABLE_VALGRIND OFF CACHE BOOL "")
 set(ENABLE_CALIPER ON CACHE BOOL "")
 set(ENABLE_HYPREDRV ON CACHE BOOL "")
 
-if (DEFINED ENV{GEOSX_TPL_DIR})
-    set(GEOS_TPL_DIR "$ENV{GEOSX_TPL_DIR}" CACHE PATH "" FORCE)
+if (DEFINED ENV{GEOS_TPL_DIR})
+    set(GEOS_TPL_DIR "$ENV{GEOS_TPL_DIR}" CACHE PATH "" FORCE)
 endif()
 include(${CMAKE_CURRENT_LIST_DIR}/../tpls.cmake)

host-configs/environment.cmake

@@ -88,5 +88,5 @@ if(DEFINED ENV{GEOS_BUILD_SHARED_LIBS})
   set(GEOS_BUILD_SHARED_LIBS "$ENV{GEOS_BUILD_SHARED_LIBS}" CACHE BOOL "" FORCE)
 endif()
 
-set(GEOS_TPL_DIR "$ENV{GEOSX_TPL_DIR}" CACHE PATH "" FORCE)
+set(GEOS_TPL_DIR "$ENV{GEOS_TPL_DIR}" CACHE PATH "" FORCE)
 include(${CMAKE_CURRENT_LIST_DIR}/tpls.cmake)

scripts/ci_build_and_test_in_container.sh

@@ -344,7 +344,7 @@ do
     --enable-trilinos)       ENABLE_TRILINOS=$2;         shift 2;;
     --exchange-dir)          DATA_EXCHANGE_DIR=$2;       shift 2;;
     --host-config)           HOST_CONFIG=$2;             shift 2;;
-    --install-dir-basename)  GEOS_DIR=${GEOSX_TPL_DIR}/../$2; shift 2;;
+    --install-dir-basename)  GEOS_DIR=${GEOS_TPL_DIR}/../$2; shift 2;;
     --makefile)              BUILD_GENERATOR="";         shift;;
     --no-install-schema)     GEOS_INSTALL_SCHEMA=false; shift;;
     --no-run-unit-tests)     RUN_UNIT_TESTS=false;       shift;;
@@ -416,7 +416,7 @@ print_crypto_diagnostics
 # Always pass the requested state so a host-config cannot silently enable
 # hypredrive when the CI job requested OFF. Do not pass -DHYPREDRV_DIR:
 # TPL images install hypredrive under a compiler-prefixed hashed path, which
-# /spack-generated.cmake already sets. ${GEOSX_TPL_DIR}/hypredrive does not
+# /spack-generated.cmake already sets. ${GEOS_TPL_DIR}/hypredrive does not
 # exist and would override that host-config value (CMake -D wins over -C
 # set(... CACHE ...) without FORCE).
 HYPREDRV_CMAKE_ARGS=(-DENABLE_HYPREDRV=${ENABLE_HYPREDRV})
@@ -434,6 +434,7 @@ if [[ "${USE_SCCACHE}" == true ]]; then
     # We use this file since it's managed by the 'google-github-actions/auth' actions.
     or_die mkdir -p ${HOME}/.config/sccache
     or_die cat <<EOT >> ${HOME}/.config/sccache/config
+basedirs = ["${GEOS_SRC_DIR}"]
 [cache.gcs]
 rw_mode = "READ_WRITE"
 cred_path = "${GEOS_SRC_DIR}/${SCCACHE_CREDS}"
@@ -453,6 +454,19 @@ EOT
   fi
 
   # Backend-specific credentials and endpoints are injected through the environment and/or config file.
+  # streak2 Ubuntu containers set OPENSSL_CONF so OpenSSL can start without a
+  # FIPS provider. sccache then rejects the Google token endpoint certificate
+  # as too weak and the server never starts. Launch sccache without that config.
+  sccache_real="${SCCACHE_BIN}"
+  SCCACHE_BIN=/tmp/sccache-launch
+  or_die cat > "${SCCACHE_BIN}" <<EOF
+#!/bin/bash
+unset OPENSSL_CONF
+unset OPENSSL_FORCE_FIPS_MODE
+exec ${sccache_real} "\$@"
+EOF
+  or_die chmod +x "${SCCACHE_BIN}"
+
   SCCACHE_CMAKE_ARGS="-DCMAKE_C_COMPILER_LAUNCHER=${SCCACHE_BIN} -DCMAKE_CXX_COMPILER_LAUNCHER=${SCCACHE_BIN} -DCMAKE_CUDA_COMPILER_LAUNCHER=${SCCACHE_BIN}"
 
   if [[ -f /certs/ca-bundle.crt ]]; then
@@ -497,6 +511,9 @@ if [[ "${ENABLE_HYPRE_DEVICE}" == "HIP" ]]; then
   if [[ -n "${HIP_CMAKE_COMPILER}" && -x "${HIP_CMAKE_COMPILER}" ]]; then
     echo "Using direct HIP compiler: ${HIP_CMAKE_COMPILER}"
     CMAKE_HIP_COMPILER_ARGS+=("-DCMAKE_HIP_COMPILER=${HIP_CMAKE_COMPILER}")
+    if [[ -n "${SCCACHE_BIN}" ]]; then
+      SCCACHE_CMAKE_ARGS+=" -DCMAKE_HIP_COMPILER_LAUNCHER=${SCCACHE_BIN}"
+    fi
   fi
 fi
 
@@ -646,8 +663,6 @@ else
     echo "DATA_EXCHANGE_DIR=${DATA_EXCHANGE_DIR}"
     echo "DATA_BASENAME_WE=${DATA_BASENAME_WE}"
     echo "GEOS_TPL_DIR=${GEOS_TPL_DIR}"
-    echo "GEOSX_TPL_DIR=${GEOSX_TPL_DIR}"
-    GEOS_TPL_DIR=${GEOSX_TPL_DIR}
     echo tar czf ${DATA_EXCHANGE_DIR}/${DATA_BASENAME_WE}.tar.gz --directory=${GEOS_TPL_DIR}/.. --transform "s|^./|${DATA_BASENAME_WE}/|" .
     or_die tar czf ${DATA_EXCHANGE_DIR}/${DATA_BASENAME_WE}.tar.gz --directory=${GEOS_TPL_DIR}/.. --transform "s|^./|${DATA_BASENAME_WE}/|" .
   fi

scripts/macos_build.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# Run from the repository root in the macOS CI job.
+
+set -euo pipefail
+brew install cmake open-mpi openblas python@3.14 binutils
+python_bin="$(brew --prefix python@3.14)/bin/python3.14"
+curl -fsSL -o "$RUNNER_TEMP/sccache.tgz" \
+  https://github.com/mozilla/sccache/releases/download/v0.17.0/sccache-v0.17.0-aarch64-apple-darwin.tar.gz
+tar -xzf "$RUNNER_TEMP/sccache.tgz" -C "$RUNNER_TEMP" --strip-components=1 \
+  sccache-v0.17.0-aarch64-apple-darwin/sccache
+chmod +x "$RUNNER_TEMP/sccache"
+xattr -d com.apple.quarantine "$RUNNER_TEMP/sccache" 2>/dev/null || true
+# sccache reads SCCACHE_CONF first. On macOS the default is
+# ~/Library/Application Support, so a Linux-style ~/.config file is ignored
+# and the cache stays on the runner's local disk.
+export SCCACHE_CONF="${HOME}/.config/sccache/config"
+mkdir -p "$(dirname "$SCCACHE_CONF")"
+cat > "$SCCACHE_CONF" <<EOF
+basedirs = ["${GITHUB_WORKSPACE}"]
+[cache.gcs]
+rw_mode = "READ_WRITE"
+cred_path = "${GOOGLE_GHA_CREDS_PATH}"
+bucket = "geos-dev"
+key_prefix = "sccache"
+EOF
+"$RUNNER_TEMP/sccache" --show-stats || true
+"$python_bin" -m pip install --upgrade --break-system-packages virtualenv
+# Caliper records the Open MPI Cellar path from the TPL build. Homebrew on this
+# runner may install a different version, so point that path at the one just installed.
+if [[ ! -d /opt/homebrew/Cellar/open-mpi/5.0.11 ]]; then
+  sudo mkdir -p /opt/homebrew/Cellar/open-mpi
+  sudo ln -sfn "$(readlink -f /opt/homebrew/opt/open-mpi)" /opt/homebrew/Cellar/open-mpi/5.0.11
+fi
+# Apple Clang rejects -mtune=native, which the host-config adds for every Clang.
+sed -i '' 's/ -march=native -mtune=native//' /opt/GEOS/spack-generated.cmake
+log="$RUNNER_TEMP/geos-build.log"
+set +e
+set -o pipefail
+{
+  "$python_bin" scripts/config-build.py \
+    -hc /opt/GEOS/spack-generated.cmake \
+    -bt Release \
+    --buildpath "$RUNNER_TEMP/geos-build" \
+    -DPython3_EXECUTABLE="$python_bin" \
+    -DCMAKE_C_COMPILER_LAUNCHER="$RUNNER_TEMP/sccache" \
+    -DCMAKE_CXX_COMPILER_LAUNCHER="$RUNNER_TEMP/sccache"
+  cmake --build "$RUNNER_TEMP/geos-build" -j 2 --target geosx
+} 2>&1 | tee "$log"
+status=$?
+set +o pipefail
+mkdir -p "${GITHUB_WORKSPACE}/.sccache-runtime"
+"$RUNNER_TEMP/sccache" --show-adv-stats > "${GITHUB_WORKSPACE}/.sccache-runtime/stats.txt" || true
+if [[ "$status" -ne 0 ]]; then
+  grep -E 'error:|CMake Error' "$log" | tail -n 8 | while IFS= read -r line; do
+    echo "::error title=Build GEOS::$line"
+  done || true
+  exit "$status"
+fi

scripts/macos_extract_tpl.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""Extract a macOS TPL image archive into the given directory."""
+
+import inspect
+import os
+import sys
+import tarfile
+
+def relocate(name):
+    name = name[2:] if name.startswith("./") else name
+    if name in ("", "."):
+        return None
+    if name == "spack-generated.cmake":
+        return name
+    prefix = "opt/GEOS/"
+    if name.startswith(prefix):
+        return name[len(prefix):]
+    return None
+
+root = sys.argv[2]
+with tarfile.open(sys.argv[1]) as tar:
+    members = tar.getmembers()
+    kwargs = {}
+    if "filter" in inspect.signature(tar.extractall).parameters:
+        kwargs["filter"] = "fully_trusted"
+    files = []
+    for member in members:
+        if member.islnk():
+            continue
+        relocated = relocate(member.name)
+        if relocated is None:
+            continue
+        member.name = relocated
+        files.append(member)
+    try:
+        tar.extractall(root, members=files, **kwargs)
+    except OSError as exc:
+        sys.stderr.write("EXTRACT_ERROR %s: %s\n" % (type(exc).__name__, exc))
+        sys.exit(1)
+    for member in members:
+        if not member.islnk():
+            continue
+        relocated = relocate(member.name)
+        link = relocate(member.linkname)
+        if relocated is None or link is None:
+            continue
+        destination = os.path.join(root, relocated)
+        source = os.path.join(root, link)
+        os.makedirs(os.path.dirname(destination), exist_ok=True)
+        if os.path.lexists(destination):
+            os.unlink(destination)
+        os.link(source, destination)

scripts/macos_load_tpl.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Run from the repository root in the macOS CI job.
+
+set -euo pipefail
+log="$RUNNER_TEMP/load-tpl.log"
+set +e
+{
+  curl -fsSL -o "$RUNNER_TEMP/crane.tgz" \
+    https://github.com/google/go-containerregistry/releases/download/v0.20.6/go-containerregistry_Darwin_arm64.tar.gz
+  tar -xzf "$RUNNER_TEMP/crane.tgz" -C "$RUNNER_TEMP" crane
+  chmod +x "$RUNNER_TEMP/crane"
+  xattr -d com.apple.quarantine "$RUNNER_TEMP/crane" 2>/dev/null || true
+  image="geosx/macos-26-apple-clang:${DOCKER_IMAGE_TAG}"
+  "$RUNNER_TEMP/crane" export "$image" "$RUNNER_TEMP/tpl.tar"
+  sudo mkdir -p /opt/GEOS
+  sudo /usr/bin/python3 scripts/macos_extract_tpl.py "$RUNNER_TEMP/tpl.tar" /opt/GEOS
+  test -f /opt/GEOS/spack-generated.cmake
+  sudo chown -R "$(id -un)" /opt/GEOS
+} >"$log" 2>&1
+status=$?
+set -e
+if [[ "$status" -ne 0 ]]; then
+  tail -n 40 "$log" | while IFS= read -r line; do
+    echo "::error title=Load TPL image::$line"
+  done
+  exit "$status"
+fi

src/docs/sphinx/buildGuide/BuildProcess.rst

@@ -15,7 +15,7 @@ Build steps
   This can be done in one of two ways:
 
   * Provide each path via a separate CMake variable (see :ref:`Dependencies` for path variable names).
-  * If you built TPLs from the ``tplMirror`` repository, you can set ``GEOSX_TPL_DIR`` variable in your host-config to point to the TPL installation path, and
+  * If you built TPLs from the ``tplMirror`` repository, you can set ``GEOS_TPL_DIR`` variable in your host-config to point to the TPL installation path, and
 
     .. code-block:: cmake