Ensure Bazel is available in self-hosted workflows (#6785)

* Ensure Bazel is available in self-hosted workflows

* Allow Bazel CI to use Command Line Tools

* Set macOS C++ deployment target for Bazel

* Use Bazel macOS minimum OS flags

* Raise macOS Bazel deployment target for filesystem

* Ensure git-lfs is available for CI fetches

* Authenticate CI LFS fetches with workflow token

* Disable stale LFS hooks during CI checkout

* Disable LFS filters during CI checkout

* Prepare Git LFS before persistent checkout

* Harden generated Bazel rc and LFS auth

* Let Xcode sync skip without full Xcode

* Harden Unity build cache markers

* Require full Xcode for mactools sync

.bazelrc

@@ -29,6 +29,10 @@ common --host_cxxopt="--std=c++23"
 
 common --javacopt="-Xlint:-options"
 
+# std::filesystem and other modern C++ deps require macOS 10.15+.
+common:macos --macos_minimum_os=10.15
+common:macos --host_macos_minimum_os=10.15
+
 # suppress warnings due to https://developer.apple.com/forums/thread/733317
 # Use host_linkopt for macOS-specific flags to avoid passing them to Linux cross-compilation
 common:macos --host_linkopt=-Wl,-no_warn_duplicate_libraries
@@ -41,6 +45,11 @@ common:macos --features=-module_maps
 # when Xcode updates in-place. The sync script overrides this for mactools.
 common:macos --repo_env=DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
 
+# Local machine or CI overrides. This lets Bazel-only runners use Command Line
+# Tools without installing full Xcode. This must stay before .bazelrc.xcode so
+# generated mactools Xcode settings win when both files exist.
+try-import %workspace%/.bazelrc.local
+
 # Xcode config for mactools builds only. Generated by scripts/sync_bazel_xcode.sh.
 # Bakes the Xcode build version into action cache keys and sets DEVELOPER_DIR.
 try-import %workspace%/.bazelrc.xcode

.github/workflows/auth_build.yml

@@ -11,6 +11,7 @@ on:
       - 'src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto'
       - 'src/main/resources/net/eagle0/attributions.json'
       - 'ci/BUILD.bazel'
+      - 'ci/github_actions/ensure_bazel_installed.sh'
       - '.bazelrc'
       - '.github/workflows/auth_build.yml'
   workflow_dispatch:
@@ -40,6 +41,9 @@ jobs:
           persist-credentials: false
           lfs: false
 
+      - name: Ensure Bazel installed
+        run: ./ci/github_actions/ensure_bazel_installed.sh
+
       - name: Build Auth Server Docker image
         id: build-auth
         run: |

.github/workflows/bazel_test.yml

@@ -9,6 +9,7 @@ on:
       - 'MODULE.bazel'
       - 'BUILD.bazel'
       - '.bazelrc'
+      - 'ci/github_actions/ensure_bazel_installed.sh'
       - '.github/workflows/bazel_test.yml'
       - '!src/main/csharp/**'
       - '!src/test/csharp/**'
@@ -19,6 +20,7 @@ on:
       - 'MODULE.bazel'
       - 'BUILD.bazel'
       - '.bazelrc'
+      - 'ci/github_actions/ensure_bazel_installed.sh'
       - '.github/workflows/bazel_test.yml'
       - '!src/main/csharp/**'
       - '!src/test/csharp/**'
@@ -68,6 +70,8 @@ jobs:
       with:
         persist-credentials: false
         lfs: false
+    - name: Ensure Bazel installed
+      run: ./ci/github_actions/ensure_bazel_installed.sh
     - name: Run tests
       run: bazel test --build_event_json_file=test.json //src/test/... //src/main/go/...
     - name: Collect failed test logs

.github/workflows/blob_cleanup.yml

@@ -20,6 +20,9 @@ jobs:
           lfs: false
           clean: false
 
+      - name: Ensure Bazel installed
+        run: ./ci/github_actions/ensure_bazel_installed.sh
+
       - name: Clean up unreferenced blobs
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}

.github/workflows/docker_build.yml

@@ -18,6 +18,7 @@ on:
       - '!src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto'
       - 'src/main/resources/**'
       - 'ci/BUILD.bazel'
+      - 'ci/github_actions/ensure_bazel_installed.sh'
       - 'MODULE.bazel'
       - '.bazelrc'
       - 'docker-compose.prod.yml'
@@ -68,15 +69,38 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
 
+      - name: Ensure Git LFS available for checkout
+        if: steps.check-latest.outputs.skip != 'true'
+        run: |
+          COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          export PATH="${COMMON_PATHS}:${PATH}"
+          for path in /opt/homebrew/bin /usr/local/bin; do
+            if [ -d "$path" ]; then
+              echo "$path" >> "$GITHUB_PATH"
+            fi
+          done
+          if ! command -v git-lfs >/dev/null 2>&1; then
+            brew install git-lfs
+          fi
+          git-lfs --version
+
       - name: Checkout repository
         if: steps.check-latest.outputs.skip != 'true'
         uses: actions/checkout@v6
+        env:
+          GIT_LFS_SKIP_SMUDGE: 1
         with:
           persist-credentials: false
           lfs: false
 
+      - name: Ensure Bazel installed
+        if: steps.check-latest.outputs.skip != 'true'
+        run: ./ci/github_actions/ensure_bazel_installed.sh
+
       - name: Fetch LFS files needed for admin server
         if: steps.check-latest.outputs.skip != 'true'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh --include="src/main/go/net/eagle0/admin_server/static/tiles/*"
 
       - name: Build all Docker images
@@ -245,8 +269,24 @@ jobs:
       NOTIFY_SECRET: ${{ secrets.EAGLE_NOTIFY_SECRET }}
       GITHUB_TOKEN_FOR_ADMIN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
     steps:
+      - name: Ensure Git LFS available for checkout
+        run: |
+          COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          export PATH="${COMMON_PATHS}:${PATH}"
+          for path in /opt/homebrew/bin /usr/local/bin; do
+            if [ -d "$path" ]; then
+              echo "$path" >> "$GITHUB_PATH"
+            fi
+          done
+          if ! command -v git-lfs >/dev/null 2>&1; then
+            brew install git-lfs
+          fi
+          git-lfs --version
+
       - name: Checkout repository
         uses: actions/checkout@v6
+        env:
+          GIT_LFS_SKIP_SMUDGE: 1
         with:
           persist-credentials: false
           lfs: false

.github/workflows/eagle_build.yml

@@ -11,6 +11,7 @@ on:
       - 'MODULE.bazel'
       - 'BUILD.bazel'
       - '.bazelrc'
+      - 'ci/github_actions/ensure_bazel_installed.sh'
       - '.github/workflows/eagle_build.yml'
 
 concurrency:
@@ -30,5 +31,7 @@ jobs:
         with:
           persist-credentials: false
           lfs: false
+      - name: Ensure Bazel installed
+        run: ./ci/github_actions/ensure_bazel_installed.sh
       - name: Build Eagle server
         run: bazel build //src/main/scala/net/eagle0/eagle:eagle_server

.github/workflows/installer_build.yml

@@ -5,10 +5,12 @@ on:
     branches: [ "main" ]
     paths:
       - ".github/workflows/installer_build.yml"
+      - "ci/github_actions/ensure_bazel_installed.sh"
       - "src/main/go/net/eagle0/clients/win/installer/**"
   pull_request:
     paths:
       - ".github/workflows/installer_build.yml"
+      - "ci/github_actions/ensure_bazel_installed.sh"
       - "src/main/go/net/eagle0/clients/win/installer/**"
   workflow_dispatch:
 
@@ -27,6 +29,9 @@ jobs:
           lfs: false
           clean: false
 
+      - name: Ensure Bazel installed
+        run: ./ci/github_actions/ensure_bazel_installed.sh
+
       - name: Build Go installer for Windows
         env:
           MANIFEST_PUBLIC_KEY: ${{ secrets.MANIFEST_PUBLIC_KEY }}

.github/workflows/ios_testflight.yml

@@ -122,7 +122,24 @@ jobs:
             git for-each-ref --format='%(refname)' refs/remotes/pull/ 2>/dev/null | \
               xargs -r git update-ref -d 2>/dev/null || true
           fi
+
+      - name: Ensure Git LFS available for checkout
+        run: |
+          COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          export PATH="${COMMON_PATHS}:${PATH}"
+          for path in /opt/homebrew/bin /usr/local/bin; do
+            if [ -d "$path" ]; then
+              echo "$path" >> "$GITHUB_PATH"
+            fi
+          done
+          if ! command -v git-lfs >/dev/null 2>&1; then
+            brew install git-lfs
+          fi
+          git-lfs --version
+
       - uses: actions/checkout@v6
+        env:
+          GIT_LFS_SKIP_SMUDGE: 1
         with:
           persist-credentials: false
           lfs: false  # Fetch LFS after checkout to avoid stale ref issues
@@ -135,6 +152,8 @@ jobs:
           rm -rf src/main/csharp/net/eagle0/clients/unity/eagle0/Library/Bee/
 
       - name: Fetch LFS files
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh
 
       - name: Ensure Unity version installed
@@ -193,7 +212,23 @@ jobs:
     runs-on: [self-hosted, macOS, testflight, halfdan]
 
     steps:
+      - name: Ensure Git LFS available for checkout
+        run: |
+          COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          export PATH="${COMMON_PATHS}:${PATH}"
+          for path in /opt/homebrew/bin /usr/local/bin; do
+            if [ -d "$path" ]; then
+              echo "$path" >> "$GITHUB_PATH"
+            fi
+          done
+          if ! command -v git-lfs >/dev/null 2>&1; then
+            brew install git-lfs
+          fi
+          git-lfs --version
+
       - uses: actions/checkout@v6
+        env:
+          GIT_LFS_SKIP_SMUDGE: 1
         with:
           persist-credentials: false
           lfs: false

.github/workflows/mac_build.yml

@@ -20,6 +20,7 @@ on:
       - "scripts/notarize_wait.sh"
       - "ci/github_actions/build_mac.sh"
       - "ci/github_actions/build_unity_mac.sh"
+      - "ci/github_actions/ensure_bazel_installed.sh"
       - "ci/github_actions/upload_addressables.sh"
       - "ci/github_actions/ensure_unity_installed.sh"
       - "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
@@ -39,6 +40,7 @@ on:
       - "scripts/notarize_wait.sh"
       - "ci/github_actions/build_mac.sh"
       - "ci/github_actions/build_unity_mac.sh"
+      - "ci/github_actions/ensure_bazel_installed.sh"
       - "ci/mac/**"
   workflow_dispatch:
     inputs:
@@ -81,7 +83,24 @@ jobs:
             git for-each-ref --format='%(refname)' refs/remotes/pull/ 2>/dev/null | \
               xargs -r git update-ref -d 2>/dev/null || true
           fi
+
+      - name: Ensure Git LFS available for checkout
+        run: |
+          COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          export PATH="${COMMON_PATHS}:${PATH}"
+          for path in /opt/homebrew/bin /usr/local/bin; do
+            if [ -d "$path" ]; then
+              echo "$path" >> "$GITHUB_PATH"
+            fi
+          done
+          if ! command -v git-lfs >/dev/null 2>&1; then
+            brew install git-lfs
+          fi
+          git-lfs --version
+
       - uses: actions/checkout@v6
+        env:
+          GIT_LFS_SKIP_SMUDGE: 1
         with:
           persist-credentials: false
           lfs: false  # Fetch LFS after checkout to avoid stale ref issues
@@ -110,11 +129,16 @@ jobs:
           fi
 
       - name: Fetch LFS files
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh
 
       - name: Ensure Unity version installed
         run: ./ci/github_actions/ensure_unity_installed.sh mac
 
+      - name: Ensure Bazel installed
+        run: ./ci/github_actions/ensure_bazel_installed.sh
+
       - name: Sync Bazel Xcode config
         run: ./scripts/sync_bazel_xcode.sh
 
@@ -123,7 +147,9 @@ jobs:
 
       - name: Save build SHA for Bee/ cache invalidation
         if: success()
-        run: git rev-parse HEAD > src/main/csharp/net/eagle0/clients/unity/eagle0/Library/.last_built_sha
+        run: |
+          mkdir -p src/main/csharp/net/eagle0/clients/unity/eagle0/Library
+          git rev-parse HEAD > src/main/csharp/net/eagle0/clients/unity/eagle0/Library/.last_built_sha
 
       - name: Upload Addressables to CDN
         if: success() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
@@ -251,7 +277,23 @@ jobs:
     runs-on: [self-hosted, macOS, notarize, halfdan]
 
     steps:
+      - name: Ensure Git LFS available for checkout
+        run: |
+          COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          export PATH="${COMMON_PATHS}:${PATH}"
+          for path in /opt/homebrew/bin /usr/local/bin; do
+            if [ -d "$path" ]; then
+              echo "$path" >> "$GITHUB_PATH"
+            fi
+          done
+          if ! command -v git-lfs >/dev/null 2>&1; then
+            brew install git-lfs
+          fi
+          git-lfs --version
+
       - uses: actions/checkout@v6
+        env:
+          GIT_LFS_SKIP_SMUDGE: 1
         with:
           persist-credentials: false
           sparse-checkout: scripts
@@ -305,7 +347,23 @@ jobs:
       deployed_version: ${{ steps.deploy-mac.outputs.deployed_version }}
 
     steps:
+      - name: Ensure Git LFS available for checkout
+        run: |
+          COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          export PATH="${COMMON_PATHS}:${PATH}"
+          for path in /opt/homebrew/bin /usr/local/bin; do
+            if [ -d "$path" ]; then
+              echo "$path" >> "$GITHUB_PATH"
+            fi
+          done
+          if ! command -v git-lfs >/dev/null 2>&1; then
+            brew install git-lfs
+          fi
+          git-lfs --version
+
       - uses: actions/checkout@v6
+        env:
+          GIT_LFS_SKIP_SMUDGE: 1
         with:
           persist-credentials: false
           fetch-depth: 0  # For version numbering
@@ -325,6 +383,9 @@ jobs:
           ditto -x -k eagle0.app.zip .
           rm eagle0.app.zip
 
+      - name: Ensure Bazel installed
+        run: ./ci/github_actions/ensure_bazel_installed.sh
+
       - name: Sync Bazel Xcode config
         run: ./scripts/sync_bazel_xcode.sh
 

.github/workflows/shardok_arm64_build.yml

@@ -9,6 +9,7 @@ on:
       - 'src/main/protobuf/net/eagle0/common/**'
       - 'src/main/resources/net/eagle0/shardok/**'
       - 'ci/BUILD.bazel'
+      - 'ci/github_actions/ensure_bazel_installed.sh'
       - 'MODULE.bazel'
       - '.bazelrc'
       - '.github/workflows/shardok_arm64_build.yml'
@@ -39,6 +40,9 @@ jobs:
           persist-credentials: false
           lfs: false
 
+      - name: Ensure Bazel installed
+        run: ./ci/github_actions/ensure_bazel_installed.sh
+
       - name: Build Shardok ARM64 binary (cross-compile for Linux ARM64)
         run: |
           set -ex

.github/workflows/shardok_build.yml

@@ -12,6 +12,7 @@ on:
       - 'MODULE.bazel'
       - 'BUILD.bazel'
       - '.bazelrc'
+      - 'ci/github_actions/ensure_bazel_installed.sh'
       - '.github/workflows/shardok_build.yml'
 
 concurrency:
@@ -31,5 +32,7 @@ jobs:
         with:
           persist-credentials: false
           lfs: false
+      - name: Ensure Bazel installed
+        run: ./ci/github_actions/ensure_bazel_installed.sh
       - name: Build Shardok server
         run: bazel build -c opt //src/main/cpp/net/eagle0/shardok:shardok-server

.github/workflows/unity_build.yml

@@ -15,6 +15,7 @@ on:
       - "scripts/build_plugins.sh"
       - "scripts/build_windows_plugin.sh"
       - "ci/github_actions/build_unity.sh"
+      - "ci/github_actions/ensure_bazel_installed.sh"
       - "ci/github_actions/upload_addressables.sh"
       - "ci/github_actions/ensure_unity_installed.sh"
       - "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
@@ -34,6 +35,7 @@ on:
       - "scripts/build_plugins.sh"
       - "scripts/build_windows_plugin.sh"
       - "ci/github_actions/build_unity.sh"
+      - "ci/github_actions/ensure_bazel_installed.sh"
       - "ci/github_actions/upload_addressables.sh"
       - "ci/github_actions/ensure_unity_installed.sh"
       - "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
@@ -69,7 +71,24 @@ jobs:
             git for-each-ref --format='%(refname)' refs/remotes/pull/ 2>/dev/null | \
               xargs -r git update-ref -d 2>/dev/null || true
           fi
+
+      - name: Ensure Git LFS available for checkout
+        run: |
+          COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          export PATH="${COMMON_PATHS}:${PATH}"
+          for path in /opt/homebrew/bin /usr/local/bin; do
+            if [ -d "$path" ]; then
+              echo "$path" >> "$GITHUB_PATH"
+            fi
+          done
+          if ! command -v git-lfs >/dev/null 2>&1; then
+            brew install git-lfs
+          fi
+          git-lfs --version
+
       - uses: actions/checkout@v6
+        env:
+          GIT_LFS_SKIP_SMUDGE: 1
         with:
           persist-credentials: false
           lfs: false  # Fetch LFS after checkout to avoid stale ref issues
@@ -111,19 +130,26 @@ jobs:
           fi
 
       - name: Fetch LFS files
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh
       - name: Ensure Unity version installed
         run: ./ci/github_actions/ensure_unity_installed.sh windows
+      - name: Ensure Bazel installed
+        run: ./ci/github_actions/ensure_bazel_installed.sh
       - name: Build Windows unity
         run: ./ci/github_actions/build_unity.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0WIN"
 
       - name: Save build SHA for Bee/ cache invalidation
         if: success()
-        run: git rev-parse HEAD > src/main/csharp/net/eagle0/clients/unity/eagle0/Library/.last_built_sha
+        run: |
+          mkdir -p src/main/csharp/net/eagle0/clients/unity/eagle0/Library
+          git rev-parse HEAD > src/main/csharp/net/eagle0/clients/unity/eagle0/Library/.last_built_sha
 
       - name: Save Unity version for Library/ cache invalidation
         if: success()
         run: |
+          mkdir -p src/main/csharp/net/eagle0/clients/unity/eagle0/Library
           grep "m_EditorVersion:" src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt | head -1 | sed 's/m_EditorVersion: //' > src/main/csharp/net/eagle0/clients/unity/eagle0/Library/.last_unity_version
 
       - name: Upload Addressables to CDN

.gitignore

@@ -23,6 +23,7 @@ bazel-bin
 bazel-eagle0*
 bazel-out
 bazel-testlogs
+.bazelrc.local
 .bazelrc.xcode
 .ijwb
 .clwb

ci/github_actions/build_mac.sh

@@ -39,6 +39,12 @@ if [ $UNITY_EXIT_CODE -ne 0 ]; then
     exit $UNITY_EXIT_CODE
 fi
 
+if [ ! -f "$LOG_PATH" ]; then
+    echo ""
+    echo "ERROR: Unity exited successfully but did not write an editor log at $LOG_PATH"
+    exit 1
+fi
+
 # Fail the build if any prefab references are broken — this produces a player
 # that launches but has null Inspector fields, which is hard to debug.
 if grep -q "Missing Prefab" "$LOG_PATH"; then

ci/github_actions/build_windows.sh

@@ -39,6 +39,12 @@ if [ $UNITY_EXIT_CODE -ne 0 ]; then
     exit $UNITY_EXIT_CODE
 fi
 
+if [ ! -f "$LOG_PATH" ]; then
+    echo ""
+    echo "ERROR: Unity exited successfully but did not write an editor log at $LOG_PATH"
+    exit 1
+fi
+
 # Fail the build if any prefab references are broken — this produces a player
 # that launches but has null Inspector fields, which is hard to debug.
 if grep -q "Missing Prefab" "$LOG_PATH"; then

ci/github_actions/ensure_bazel_installed.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+export PATH="${COMMON_PATHS}:${PATH}"
+
+write_developer_dir_override() {
+    if [ "$(uname -s)" != "Darwin" ]; then
+        return
+    fi
+
+    local developer_dir=""
+    if [ -d "/Applications/Xcode.app/Contents/Developer" ]; then
+        developer_dir="/Applications/Xcode.app/Contents/Developer"
+    elif [ -d "/Library/Developer/CommandLineTools" ]; then
+        developer_dir="/Library/Developer/CommandLineTools"
+    else
+        developer_dir="$(xcode-select -p 2>/dev/null || true)"
+    fi
+
+    if [ -z "$developer_dir" ] || [ ! -d "$developer_dir" ]; then
+        echo "ERROR: no usable Apple developer directory found"
+        echo "Install Command Line Tools with: xcode-select --install"
+        echo "Full Xcode is only required for workflows that build/sign Apple apps."
+        exit 1
+    fi
+
+    export DEVELOPER_DIR="$developer_dir"
+    if [ -f .bazelrc.local ] && [ -z "${CI:-}" ]; then
+        echo "Keeping existing .bazelrc.local outside CI"
+    else
+        {
+            echo "# Generated by ci/github_actions/ensure_bazel_installed.sh; do not edit."
+            printf 'common:macos --repo_env=DEVELOPER_DIR=%s\n' "$developer_dir"
+        } > .bazelrc.local
+    fi
+
+    if [ -n "${GITHUB_ENV:-}" ]; then
+        echo "DEVELOPER_DIR=$developer_dir" >> "$GITHUB_ENV"
+    fi
+
+    echo "Using Apple developer directory at $developer_dir"
+}
+
+write_developer_dir_override
+
+if [ -n "${GITHUB_PATH:-}" ]; then
+    for path in /opt/homebrew/bin /usr/local/bin; do
+        if [ -d "$path" ]; then
+            echo "$path" >> "$GITHUB_PATH"
+        fi
+    done
+fi
+
+if command -v bazel >/dev/null 2>&1; then
+    echo "Using bazel at $(command -v bazel)"
+    bazel --version
+    exit 0
+fi
+
+if ! command -v bazelisk >/dev/null 2>&1; then
+    if ! command -v brew >/dev/null 2>&1; then
+        echo "ERROR: neither bazel nor bazelisk is on PATH, and Homebrew is unavailable"
+        exit 1
+    fi
+
+    echo "Installing bazelisk with Homebrew"
+    brew install bazelisk
+fi
+
+BAZEL_BIN_DIR="${RUNNER_TEMP:-/tmp}/bazel-bin"
+mkdir -p "$BAZEL_BIN_DIR"
+ln -sf "$(command -v bazelisk)" "$BAZEL_BIN_DIR/bazel"
+
+if [ -n "${GITHUB_PATH:-}" ]; then
+    echo "$BAZEL_BIN_DIR" >> "$GITHUB_PATH"
+fi
+
+export PATH="$BAZEL_BIN_DIR:$PATH"
+echo "Using bazelisk as bazel at $BAZEL_BIN_DIR/bazel"
+bazel --version

ci/github_actions/fetch_lfs.sh

@@ -11,16 +11,46 @@
 
 set -euo pipefail
 
+COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+export PATH="${COMMON_PATHS}:${PATH}"
+
 MAX_ATTEMPTS=5
 RETRY_DELAY=15
 
+if [ -n "${GITHUB_PATH:-}" ]; then
+    for path in /opt/homebrew/bin /usr/local/bin; do
+        if [ -d "$path" ]; then
+            echo "$path" >> "$GITHUB_PATH"
+        fi
+    done
+fi
+
+if ! git lfs version >/dev/null 2>&1; then
+    if ! command -v brew >/dev/null 2>&1; then
+        echo "ERROR: git-lfs is unavailable, and Homebrew is not on PATH"
+        exit 1
+    fi
+
+    echo "Installing git-lfs with Homebrew"
+    brew install git-lfs
+fi
+
+echo "Using git-lfs at $(command -v git-lfs)"
+git lfs version
+
 git lfs install
 
 echo "LFS objects before pull:"
 git lfs ls-files | wc -l
 
+GIT_LFS_PULL=(git lfs pull)
+if [ -n "${GITHUB_TOKEN:-}" ]; then
+    BASIC_AUTH=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')
+    GIT_LFS_PULL=(git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $BASIC_AUTH" lfs pull)
+fi
+
 for i in $(seq 1 $MAX_ATTEMPTS); do
-    if git lfs pull "$@"; then
+    if "${GIT_LFS_PULL[@]}" "$@"; then
         echo "LFS objects after pull:"
         git lfs ls-files | wc -l
         exit 0

scripts/sync_bazel_xcode.sh

@@ -17,14 +17,21 @@
 
 set -euo pipefail
 
-XCODE_BUILD_VERSION=$(xcodebuild -version 2>/dev/null | awk '/Build version/ {print $3}')
+DEVELOPER_DIR=""
-
+if [ -d "/Applications/Xcode.app/Contents/Developer" ]; then
-if [ -z "$XCODE_BUILD_VERSION" ]; then
+    DEVELOPER_DIR="/Applications/Xcode.app/Contents/Developer"
-    echo "Warning: Could not detect Xcode build version, skipping"
+else
-    exit 0
+    DEVELOPER_DIR=$(xcode-select -p 2>/dev/null || true)
 fi
 
-DEVELOPER_DIR=$(xcode-select -p 2>/dev/null)
+XCODE_BUILD_VERSION=$(DEVELOPER_DIR="$DEVELOPER_DIR" xcodebuild -version 2>/dev/null | awk '/Build version/ {print $3}' || true)
+
+if [ -z "$XCODE_BUILD_VERSION" ]; then
+    echo "ERROR: Could not detect full Xcode build version."
+    echo "mactools/Sparkle builds require full Xcode, not just Command Line Tools."
+    echo "Install Xcode at /Applications/Xcode.app or select it with xcode-select."
+    exit 1
+fi
 
 BAZELRC_XCODE=".bazelrc.xcode"
 EXPECTED_LINE="common:mactools --action_env=XCODE_BUILD_VERSION=${XCODE_BUILD_VERSION}"
@@ -51,4 +58,9 @@ cat > "$BAZELRC_XCODE" << EOF
 ${EXPECTED_LINE}
 common:mactools --repo_env=DEVELOPER_DIR=${DEVELOPER_DIR}
 EOF
+
+if [ -n "${GITHUB_ENV:-}" ]; then
+    echo "DEVELOPER_DIR=${DEVELOPER_DIR}" >> "$GITHUB_ENV"
+fi
+
 echo "Updated ${BAZELRC_XCODE} — next mactools build will rebuild with Xcode ${XCODE_BUILD_VERSION}"