feat: add macOS arm64 release artifacts alongside x64

- sdk-release action: added mac_artifact_arch input (default x64) to
  parameterize macOS artifact filenames (mac-clang-{arch}-*.zip)
- release-please.yml: use macos-15-large (x64) for existing matrix,
  added separate arm64 jobs + provenance for client, server, server-redis
- manual-sdk-release-artifacts.yml: same pattern for manual releases
- Future releases will include both x64 and arm64 macOS artifacts

Co-Authored-By: rlamb@launchdarkly.com <kingdewman@gmail.com>

Author: devin-ai-integration[bot]

.github/actions/sdk-release/action.yml

@@ -18,6 +18,10 @@ inputs:
     required: true
   sdk_cmake_target:
     description: 'CMake target of the sdk, e.g. launchdarkly-cpp-client.'
+  mac_artifact_arch:
+    description: 'Architecture label for macOS artifacts (x64 or arm64).'
+    required: false
+    default: 'x64'
 outputs:
   hashes-linux:
     description: "base64-encoded sha256 hash of linux build artifacts"
@@ -272,21 +276,21 @@ runs:
         OPENSSL_ROOT_DIR: ${{ steps.install-openssl.outputs.OPENSSL_ROOT_DIR }}
         CURL_ROOT: ${{ steps.install-curl.outputs.CURL_ROOT }}
 
-    - name: Archive Release Mac - AppleClang/x64/Static
+    - name: Archive Release Mac - AppleClang/${{ inputs.mac_artifact_arch }}/Static
       if: runner.os == 'macOS'
       uses: thedoctor0/zip-release@0.7.1
       with:
         path: 'build-static/release'
         type: 'zip'
-        filename: 'mac-clang-x64-static.zip'
+        filename: 'mac-clang-${{ inputs.mac_artifact_arch }}-static.zip'
 
-    - name: Archive Release Mac - AppleClang/x64/Dynamic
+    - name: Archive Release Mac - AppleClang/${{ inputs.mac_artifact_arch }}/Dynamic
       if: runner.os == 'macOS'
       uses: thedoctor0/zip-release@0.7.1
       with:
         path: 'build-dynamic/release'
         type: 'zip'
-        filename: 'mac-clang-x64-dynamic.zip'
+        filename: 'mac-clang-${{ inputs.mac_artifact_arch }}-dynamic.zip'
 
     - name: Determine CURL artifact suffix for server SDK
       if: runner.os == 'macOS'
@@ -299,36 +303,38 @@ runs:
           echo "suffix=" >> $GITHUB_OUTPUT
         fi
 
-    - name: Archive Release Mac - AppleClang/x64/Static/CURL
+    - name: Archive Release Mac - AppleClang/${{ inputs.mac_artifact_arch }}/Static/CURL
       if: runner.os == 'macOS'
       uses: thedoctor0/zip-release@0.7.1
       with:
         path: 'build-static-curl/release'
         type: 'zip'
-        filename: 'mac-clang-x64-static-curl${{ steps.curl-suffix-macos.outputs.suffix }}.zip'
+        filename: 'mac-clang-${{ inputs.mac_artifact_arch }}-static-curl${{ steps.curl-suffix-macos.outputs.suffix }}.zip'
 
-    - name: Archive Release Mac - AppleClang/x64/Dynamic/CURL
+    - name: Archive Release Mac - AppleClang/${{ inputs.mac_artifact_arch }}/Dynamic/CURL
       if: runner.os == 'macOS'
       uses: thedoctor0/zip-release@0.7.1
       with:
         path: 'build-dynamic-curl/release'
         type: 'zip'
-        filename: 'mac-clang-x64-dynamic-curl${{ steps.curl-suffix-macos.outputs.suffix }}.zip'
+        filename: 'mac-clang-${{ inputs.mac_artifact_arch }}-dynamic-curl${{ steps.curl-suffix-macos.outputs.suffix }}.zip'
 
     - name: Hash Mac Build Artifacts for provenance
       if: runner.os == 'macOS'
       shell: bash
       id: hash-macos
       run: |
         CURL_SUFFIX="${{ steps.curl-suffix-macos.outputs.suffix }}"
-        echo "hashes-macos=$(shasum -a 256 mac-clang-x64-static.zip mac-clang-x64-dynamic.zip mac-clang-x64-static-curl${CURL_SUFFIX}.zip mac-clang-x64-dynamic-curl${CURL_SUFFIX}.zip | base64 -b 0)" >> "$GITHUB_OUTPUT"
+        ARCH="${{ inputs.mac_artifact_arch }}"
+        echo "hashes-macos=$(shasum -a 256 mac-clang-${ARCH}-static.zip mac-clang-${ARCH}-dynamic.zip mac-clang-${ARCH}-static-curl${CURL_SUFFIX}.zip mac-clang-${ARCH}-dynamic-curl${CURL_SUFFIX}.zip | base64 -b 0)" >> "$GITHUB_OUTPUT"
 
     - name: Upload Mac Build Artifacts
       if: runner.os == 'macOS'
       shell: bash
       run: |
         ls
         CURL_SUFFIX="${{ steps.curl-suffix-macos.outputs.suffix }}"
-        gh release upload ${{ inputs.tag_name }} mac-clang-x64-static.zip mac-clang-x64-dynamic.zip mac-clang-x64-static-curl${CURL_SUFFIX}.zip mac-clang-x64-dynamic-curl${CURL_SUFFIX}.zip --clobber
+        ARCH="${{ inputs.mac_artifact_arch }}"
+        gh release upload ${{ inputs.tag_name }} mac-clang-${ARCH}-static.zip mac-clang-${ARCH}-dynamic.zip mac-clang-${ARCH}-static-curl${CURL_SUFFIX}.zip mac-clang-${ARCH}-dynamic-curl${CURL_SUFFIX}.zip --clobber
       env:
         GH_TOKEN: ${{ inputs.github_token }}

.github/workflows/manual-sdk-release-artifacts.yml

@@ -38,7 +38,7 @@ jobs:
     strategy:
       matrix:
         # Each of the platforms for which release-artifacts need generated.
-        os: [ ubuntu-22.04, windows-2022, macos-15 ]
+        os: [ ubuntu-22.04, windows-2022, macos-15-large ]
     runs-on: ${{ matrix.os }}
     outputs:
       hashes-linux: ${{ steps.release-sdk.outputs.hashes-linux }}
@@ -58,6 +58,27 @@ jobs:
           github_token: ${{secrets.GITHUB_TOKEN}}
           sdk_path: ${{ needs.split-input.outputs.sdk_path}}
           sdk_cmake_target: ${{ needs.split-input.outputs.sdk_cmake_target}}
+
+  release-sdk-mac-arm64:
+    needs: split-input
+    runs-on: macos-15
+    outputs:
+      hashes-macos-arm64: ${{ steps.release-sdk.outputs.hashes-macos }}
+    steps:
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+        with:
+          ref: ${{ inputs.tag }}
+      - id: release-sdk
+        name: Full release of ${{ needs.split-input.outputs.sdk_path }} (macOS arm64)
+        uses: ./.github/actions/sdk-release
+        with:
+          tag_name: ${{ inputs.tag }}
+          github_token: ${{secrets.GITHUB_TOKEN}}
+          sdk_path: ${{ needs.split-input.outputs.sdk_path}}
+          sdk_cmake_target: ${{ needs.split-input.outputs.sdk_cmake_target}}
+          mac_artifact_arch: 'arm64'
+
   release-sdk-provenance:
     needs: [ 'release-sdk' ]
     strategy:
@@ -74,3 +95,16 @@ jobs:
       upload-assets: true
       upload-tag-name: ${{ inputs.tag }}
       provenance-name: ${{ format('{0}-multiple-provenance.intoto.jsonl', matrix.os) }}
+
+  release-sdk-mac-arm64-provenance:
+    needs: [ 'release-sdk-mac-arm64' ]
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    with:
+      base64-subjects: "${{ needs.release-sdk-mac-arm64.outputs.hashes-macos-arm64 }}"
+      upload-assets: true
+      upload-tag-name: ${{ inputs.tag }}
+      provenance-name: 'macos-arm64-multiple-provenance.intoto.jsonl'

.github/workflows/release-please.yml

@@ -27,7 +27,7 @@ jobs:
     strategy:
       matrix:
         # Each of the platforms for which release-artifacts need generated.
-        os: [ ubuntu-22.04, windows-2022, macos-15 ]
+        os: [ ubuntu-22.04, windows-2022, macos-15-large ]
     runs-on: ${{ matrix.os }}
     needs: [ 'release-please' ]
     if: ${{ needs.release-please.outputs.package-client-released == 'true'}}
@@ -48,11 +48,30 @@ jobs:
           sdk_path: 'libs/client-sdk'
           sdk_cmake_target: 'launchdarkly-cpp-client'
 
+  release-client-mac-arm64:
+    runs-on: macos-15
+    needs: [ 'release-please' ]
+    if: ${{ needs.release-please.outputs.package-client-released == 'true'}}
+    outputs:
+      hashes-macos-arm64: ${{ steps.release-client.outputs.hashes-macos }}
+    steps:
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      - id: release-client
+        name: Full release of libs/client-sdk (macOS arm64)
+        uses: ./.github/actions/sdk-release
+        with:
+          tag_name: ${{ needs.release-please.outputs.package-client-tag }}
+          github_token: ${{secrets.GITHUB_TOKEN}}
+          sdk_path: 'libs/client-sdk'
+          sdk_cmake_target: 'launchdarkly-cpp-client'
+          mac_artifact_arch: 'arm64'
+
   release-server:
     strategy:
       matrix:
         # Each of the platforms for which release-artifacts need generated.
-        os: [ ubuntu-22.04, windows-2022, macos-15 ]
+        os: [ ubuntu-22.04, windows-2022, macos-15-large ]
     runs-on: ${{ matrix.os }}
     needs: [ 'release-please' ]
     if: ${{ needs.release-please.outputs.package-server-released == 'true'}}
@@ -73,11 +92,30 @@ jobs:
           sdk_path: 'libs/server-sdk'
           sdk_cmake_target: 'launchdarkly-cpp-server'
 
+  release-server-mac-arm64:
+    runs-on: macos-15
+    needs: [ 'release-please' ]
+    if: ${{ needs.release-please.outputs.package-server-released == 'true'}}
+    outputs:
+      hashes-macos-arm64: ${{ steps.release-server.outputs.hashes-macos }}
+    steps:
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      - id: release-server
+        name: Full release of libs/server-sdk (macOS arm64)
+        uses: ./.github/actions/sdk-release
+        with:
+          tag_name: ${{ needs.release-please.outputs.package-server-tag }}
+          github_token: ${{secrets.GITHUB_TOKEN}}
+          sdk_path: 'libs/server-sdk'
+          sdk_cmake_target: 'launchdarkly-cpp-server'
+          mac_artifact_arch: 'arm64'
+
   release-server-redis:
     strategy:
       matrix:
         # Each of the platforms for which release-artifacts need generated.
-        os: [ ubuntu-22.04, windows-2022, macos-15 ]
+        os: [ ubuntu-22.04, windows-2022, macos-15-large ]
     runs-on: ${{ matrix.os }}
     needs: [ 'release-please' ]
     if: ${{ needs.release-please.outputs.package-server-redis-released  == 'true'}}
@@ -98,6 +136,25 @@ jobs:
           sdk_path: 'libs/server-sdk-redis-source'
           sdk_cmake_target: 'launchdarkly-cpp-server-redis-source'
 
+  release-server-redis-mac-arm64:
+    runs-on: macos-15
+    needs: [ 'release-please' ]
+    if: ${{ needs.release-please.outputs.package-server-redis-released  == 'true'}}
+    outputs:
+      hashes-macos-arm64: ${{ steps.release-server-redis.outputs.hashes-macos }}
+    steps:
+      # https://github.com/actions/checkout/releases/tag/v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+      - id: release-server-redis
+        name: Full release of libs/server-sdk-redis-source (macOS arm64)
+        uses: ./.github/actions/sdk-release
+        with:
+          tag_name: ${{ needs.release-please.outputs.package-server-redis-tag }}
+          github_token: ${{secrets.GITHUB_TOKEN}}
+          sdk_path: 'libs/server-sdk-redis-source'
+          sdk_cmake_target: 'launchdarkly-cpp-server-redis-source'
+          mac_artifact_arch: 'arm64'
+
   release-client-provenance:
     needs: [ 'release-please', 'release-client' ]
     strategy:
@@ -115,6 +172,19 @@ jobs:
       upload-tag-name: ${{ needs.release-please.outputs.package-client-tag }}
       provenance-name: ${{ format('{0}-client-multiple-provenance.intoto.jsonl', matrix.os) }}
 
+  release-client-mac-arm64-provenance:
+    needs: [ 'release-please', 'release-client-mac-arm64' ]
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    with:
+      base64-subjects: "${{ needs.release-client-mac-arm64.outputs.hashes-macos-arm64 }}"
+      upload-assets: true
+      upload-tag-name: ${{ needs.release-please.outputs.package-client-tag }}
+      provenance-name: 'macos-arm64-client-multiple-provenance.intoto.jsonl'
+
   release-server-provenance:
     needs: [ 'release-please', 'release-server' ]
     strategy:
@@ -132,6 +202,19 @@ jobs:
       upload-tag-name: ${{ needs.release-please.outputs.package-server-tag }}
       provenance-name: ${{ format('{0}-server-multiple-provenance.intoto.jsonl', matrix.os) }}
 
+  release-server-mac-arm64-provenance:
+    needs: [ 'release-please', 'release-server-mac-arm64' ]
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    with:
+      base64-subjects: "${{ needs.release-server-mac-arm64.outputs.hashes-macos-arm64 }}"
+      upload-assets: true
+      upload-tag-name: ${{ needs.release-please.outputs.package-server-tag }}
+      provenance-name: 'macos-arm64-server-multiple-provenance.intoto.jsonl'
+
   release-server-redis-provenance:
     needs: [ 'release-please', 'release-server-redis' ]
     strategy:
@@ -149,3 +232,15 @@ jobs:
       upload-tag-name: ${{ needs.release-please.outputs.package-server-redis-tag }}
       provenance-name: ${{ format('{0}-server-redis-multiple-provenance.intoto.jsonl', matrix.os) }}
 
+  release-server-redis-mac-arm64-provenance:
+    needs: [ 'release-please', 'release-server-redis-mac-arm64' ]
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    with:
+      base64-subjects: "${{ needs.release-server-redis-mac-arm64.outputs.hashes-macos-arm64 }}"
+      upload-assets: true
+      upload-tag-name: ${{ needs.release-please.outputs.package-server-redis-tag }}
+      provenance-name: 'macos-arm64-server-redis-multiple-provenance.intoto.jsonl'