ci: use macOS 26 SDK for release artifacts

.github/workflows/build.yml

@@ -136,19 +136,20 @@ jobs:
     runs-on: ${{ matrix.runner }}
     env:
       MACOSX_DEPLOYMENT_TARGET: "14.0"
+      EXPECTED_MACOS_SDK: "26.5"
     strategy:
       matrix:
         include:
           - arch: x64
             binary_arch: x86_64
-            runner: macos-15-intel
-            cache-key: intel-macos14
+            runner: macos-26-intel
+            cache-key: intel-macos26-xcode26.6-min14
             out-dir: ./build/macosx/x86_64/release/crossdesk
             package_script: ./scripts/macosx/pkg_x64.sh
           - arch: arm64
             binary_arch: arm64
-            runner: macos-14
-            cache-key: arm-macos14
+            runner: macos-26
+            cache-key: arm-macos26-xcode26.6-min14
             out-dir: ./build/macosx/arm64/release/crossdesk
             package_script: ./scripts/macosx/pkg_arm64.sh
 
@@ -193,6 +194,17 @@ jobs:
           echo "BUILD_DATE=${BUILD_DATE}" >> $GITHUB_ENV
           echo "PATCH_NUMBER=${PATCH_NUMBER}" >> $GITHUB_ENV
 
+      - name: Select Xcode 26.6
+        shell: bash
+        run: |
+          sudo xcode-select -s /Applications/Xcode_26.6.app/Contents/Developer
+          xcodebuild -version
+          SDK_VERSION="$(xcrun --sdk macosx --show-sdk-version)"
+          if [[ "${SDK_VERSION}" != "${EXPECTED_MACOS_SDK}" ]]; then
+            echo "Unexpected macOS SDK: expected ${EXPECTED_MACOS_SDK}, got ${SDK_VERSION}" >&2
+            exit 1
+          fi
+
       - name: Cache xmake dependencies
         uses: actions/cache@v5
         with:
@@ -237,7 +249,7 @@ jobs:
             exit 1
           fi
 
-          ./scripts/macosx/verify_app.sh "${APP_PATH}" "${{ matrix.binary_arch }}"
+          ./scripts/macosx/verify_app.sh "${APP_PATH}" "${{ matrix.binary_arch }}" "${EXPECTED_MACOS_SDK}"
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@v6
@@ -424,8 +436,7 @@ jobs:
   release:
     name: Publish Release
     if: startsWith(github.ref, 'refs/tags/v')
-    needs:
-      [build-linux, build-macos, build-windows-x64]
+    needs: [build-linux, build-macos, build-windows-x64]
     runs-on: ubuntu-latest
 
     steps:

scripts/macosx/verify_app.sh

@@ -1,13 +1,14 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-if [[ $# -ne 2 ]]; then
-    echo "Usage: $0 <app-bundle> <expected-architecture>" >&2
+if [[ $# -lt 2 || $# -gt 3 ]]; then
+    echo "Usage: $0 <app-bundle> <expected-architecture> [expected-sdk-version]" >&2
     exit 2
 fi
 
 APP_BUNDLE="$1"
 EXPECTED_ARCH="$2"
+EXPECTED_SDK_VERSION="${3:-}"
 APP_EXECUTABLE="$APP_BUNDLE/Contents/MacOS/CrossDesk"
 FRAMEWORKS_DIR="$APP_BUNDLE/Contents/Frameworks"
 INFO_PLIST="$APP_BUNDLE/Contents/Info.plist"
@@ -94,6 +95,23 @@ if [[ -z "$BINARY_MIN_VERSION" || "$PLIST_MIN_VERSION" != "$BINARY_MIN_VERSION"
     exit 1
 fi
 
+if [[ -n "$EXPECTED_SDK_VERSION" ]]; then
+    verify_sdk_version() {
+        local macho="$1"
+        local actual_sdk=""
+        actual_sdk="$(otool -l "$macho" | awk '
+            $1 == "cmd" { build_version = ($2 == "LC_BUILD_VERSION"); next }
+            build_version && $1 == "sdk" { print $2; exit }')"
+        if [[ "$actual_sdk" != "$EXPECTED_SDK_VERSION" ]]; then
+            echo "Unexpected macOS SDK in $macho: expected $EXPECTED_SDK_VERSION, got ${actual_sdk:-unknown}" >&2
+            return 1
+        fi
+    }
+
+    verify_sdk_version "$APP_EXECUTABLE"
+    verify_sdk_version "$SLINT_LIBRARY"
+fi
+
 codesign --verify --deep --strict --verbose=2 "$APP_BUNDLE"
 
 echo "Verified $APP_BUNDLE ($EXPECTED_ARCH, macOS $BINARY_MIN_VERSION+)"