Add macOS dylib headerpad validation to nightly and release workflows

Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>

.github/workflows/nightly-validation.yml

@@ -672,3 +672,111 @@ jobs:
           $wheel = Get-ChildItem wheels/*.whl | Select-Object -First 1
           pip install $wheel.FullName
           python -c "import z3; x = z3.Int('x'); s = z3.Solver(); s.add(x > 0); print('Result:', s.check()); print('Model:', s.model())"
+
+  # ============================================================================
+  # MACOS DYLIB HEADERPAD VALIDATION
+  # ============================================================================
+
+  validate-macos-headerpad-x64:
+    name: "Validate macOS x64 dylib headerpad"
+    runs-on: macos-13
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6.0.2
+      
+      - name: Download macOS x64 build from release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ github.event.inputs.release_tag }}"
+          if [ -z "$TAG" ]; then
+            TAG="Nightly"
+          fi
+          gh release download $TAG --pattern "*x64-osx*.zip" --dir downloads
+      
+      - name: Extract build
+        run: |
+          cd downloads
+          unzip *x64-osx*.zip
+          Z3_DIR=$(find . -maxdepth 1 -type d -name "z3-*" | head -n 1)
+          echo "Z3_DIR=$Z3_DIR" >> $GITHUB_ENV
+      
+      - name: Test install_name_tool with headerpad
+        run: |
+          cd downloads/$Z3_DIR/bin
+          
+          # Get the original install name
+          ORIGINAL_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "Original install name: $ORIGINAL_NAME"
+          
+          # Create a test path with same length as typical setup-z3 usage
+          # This simulates what setup-z3 does: changing to absolute path
+          TEST_PATH="/Users/runner/hostedtoolcache/z3/latest/x64/z3-4.15.5-x64-osx-15.7.3/bin/libz3.dylib"
+          
+          # Try to change the install name - this will fail if headerpad is insufficient
+          install_name_tool -id "$TEST_PATH" -change libz3.dylib "$TEST_PATH" libz3.dylib
+          
+          # Verify the change was successful
+          NEW_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "New install name: $NEW_NAME"
+          
+          if [ "$NEW_NAME" = "$TEST_PATH" ]; then
+            echo "✓ install_name_tool succeeded - headerpad is sufficient"
+          else
+            echo "✗ install_name_tool failed to update install name"
+            exit 1
+          fi
+
+  validate-macos-headerpad-arm64:
+    name: "Validate macOS ARM64 dylib headerpad"
+    runs-on: macos-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6.0.2
+      
+      - name: Download macOS ARM64 build from release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ github.event.inputs.release_tag }}"
+          if [ -z "$TAG" ]; then
+            TAG="Nightly"
+          fi
+          gh release download $TAG --pattern "*arm64-osx*.zip" --dir downloads
+      
+      - name: Extract build
+        run: |
+          cd downloads
+          unzip *arm64-osx*.zip
+          Z3_DIR=$(find . -maxdepth 1 -type d -name "z3-*" | head -n 1)
+          echo "Z3_DIR=$Z3_DIR" >> $GITHUB_ENV
+      
+      - name: Test install_name_tool with headerpad
+        run: |
+          cd downloads/$Z3_DIR/bin
+          
+          # Get the original install name
+          ORIGINAL_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "Original install name: $ORIGINAL_NAME"
+          
+          # Create a test path with same length as typical setup-z3 usage
+          # This simulates what setup-z3 does: changing to absolute path
+          TEST_PATH="/Users/runner/hostedtoolcache/z3/latest/arm64/z3-4.15.5-arm64-osx-15.7.3/bin/libz3.dylib"
+          
+          # Try to change the install name - this will fail if headerpad is insufficient
+          install_name_tool -id "$TEST_PATH" -change libz3.dylib "$TEST_PATH" libz3.dylib
+          
+          # Verify the change was successful
+          NEW_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "New install name: $NEW_NAME"
+          
+          if [ "$NEW_NAME" = "$TEST_PATH" ]; then
+            echo "✓ install_name_tool succeeded - headerpad is sufficient"
+          else
+            echo "✗ install_name_tool failed to update install name"
+            exit 1
+          fi

.github/workflows/nightly.yml

@@ -70,6 +70,106 @@ jobs:
           path: dist/*.zip
           retention-days: 2
 
+  # ============================================================================
+  # VALIDATION STAGE
+  # ============================================================================
+
+  validate-macos-headerpad-x64:
+    name: "Validate macOS x64 dylib headerpad"
+    needs: [mac-build-x64]
+    runs-on: macos-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6.0.2
+      
+      - name: Download macOS x64 Build
+        uses: actions/download-artifact@v7.0.0
+        with:
+          name: macOsBuild
+          path: artifacts
+      
+      - name: Extract build
+        run: |
+          cd artifacts
+          unzip z3-*-x64-osx*.zip
+          Z3_DIR=$(find . -maxdepth 1 -type d -name "z3-*" | head -n 1)
+          echo "Z3_DIR=$Z3_DIR" >> $GITHUB_ENV
+      
+      - name: Test install_name_tool with headerpad
+        run: |
+          cd artifacts/$Z3_DIR/bin
+          
+          # Get the original install name
+          ORIGINAL_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "Original install name: $ORIGINAL_NAME"
+          
+          # Create a test path with same length as typical setup-z3 usage
+          # This simulates what setup-z3 does: changing to absolute path
+          TEST_PATH="/Users/runner/hostedtoolcache/z3/latest/x64/z3-test-dir/bin/libz3.dylib"
+          
+          # Try to change the install name - this will fail if headerpad is insufficient
+          install_name_tool -id "$TEST_PATH" -change libz3.dylib "$TEST_PATH" libz3.dylib
+          
+          # Verify the change was successful
+          NEW_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "New install name: $NEW_NAME"
+          
+          if [ "$NEW_NAME" = "$TEST_PATH" ]; then
+            echo "✓ install_name_tool succeeded - headerpad is sufficient"
+          else
+            echo "✗ install_name_tool failed to update install name"
+            exit 1
+          fi
+
+  validate-macos-headerpad-arm64:
+    name: "Validate macOS ARM64 dylib headerpad"
+    needs: [mac-build-arm64]
+    runs-on: macos-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6.0.2
+      
+      - name: Download macOS ARM64 Build
+        uses: actions/download-artifact@v7.0.0
+        with:
+          name: MacArm64
+          path: artifacts
+      
+      - name: Extract build
+        run: |
+          cd artifacts
+          unzip z3-*-arm64-osx*.zip
+          Z3_DIR=$(find . -maxdepth 1 -type d -name "z3-*" | head -n 1)
+          echo "Z3_DIR=$Z3_DIR" >> $GITHUB_ENV
+      
+      - name: Test install_name_tool with headerpad
+        run: |
+          cd artifacts/$Z3_DIR/bin
+          
+          # Get the original install name
+          ORIGINAL_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "Original install name: $ORIGINAL_NAME"
+          
+          # Create a test path with same length as typical setup-z3 usage
+          # This simulates what setup-z3 does: changing to absolute path
+          TEST_PATH="/Users/runner/hostedtoolcache/z3/latest/arm64/z3-test-dir/bin/libz3.dylib"
+          
+          # Try to change the install name - this will fail if headerpad is insufficient
+          install_name_tool -id "$TEST_PATH" -change libz3.dylib "$TEST_PATH" libz3.dylib
+          
+          # Verify the change was successful
+          NEW_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "New install name: $NEW_NAME"
+          
+          if [ "$NEW_NAME" = "$TEST_PATH" ]; then
+            echo "✓ install_name_tool succeeded - headerpad is sufficient"
+          else
+            echo "✗ install_name_tool failed to update install name"
+            exit 1
+          fi
+
   ubuntu-build:
     name: "Ubuntu build"
     runs-on: ubuntu-latest
@@ -562,7 +662,9 @@ jobs:
       ubuntu-doc,
       python-package,
       nuget-package-x64,
-      nuget-package-x86
+      nuget-package-x86,
+      validate-macos-headerpad-x64,
+      validate-macos-headerpad-arm64
     ]
     runs-on: ubuntu-latest
     steps:

.github/workflows/release.yml

@@ -89,6 +89,106 @@ jobs:
           path: dist/*.zip
           retention-days: 7
 
+  # ============================================================================
+  # VALIDATION STAGE
+  # ============================================================================
+
+  validate-macos-headerpad-x64:
+    name: "Validate macOS x64 dylib headerpad"
+    needs: [mac-build-x64]
+    runs-on: macos-15
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6.0.2
+      
+      - name: Download macOS x64 Build
+        uses: actions/download-artifact@v7.0.0
+        with:
+          name: macOsBuild
+          path: artifacts
+      
+      - name: Extract build
+        run: |
+          cd artifacts
+          unzip z3-*-x64-osx*.zip
+          Z3_DIR=$(find . -maxdepth 1 -type d -name "z3-*" | head -n 1)
+          echo "Z3_DIR=$Z3_DIR" >> $GITHUB_ENV
+      
+      - name: Test install_name_tool with headerpad
+        run: |
+          cd artifacts/$Z3_DIR/bin
+          
+          # Get the original install name
+          ORIGINAL_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "Original install name: $ORIGINAL_NAME"
+          
+          # Create a test path with same length as typical setup-z3 usage
+          # This simulates what setup-z3 does: changing to absolute path
+          TEST_PATH="/Users/runner/hostedtoolcache/z3/latest/x64/z3-test-dir/bin/libz3.dylib"
+          
+          # Try to change the install name - this will fail if headerpad is insufficient
+          install_name_tool -id "$TEST_PATH" -change libz3.dylib "$TEST_PATH" libz3.dylib
+          
+          # Verify the change was successful
+          NEW_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "New install name: $NEW_NAME"
+          
+          if [ "$NEW_NAME" = "$TEST_PATH" ]; then
+            echo "✓ install_name_tool succeeded - headerpad is sufficient"
+          else
+            echo "✗ install_name_tool failed to update install name"
+            exit 1
+          fi
+
+  validate-macos-headerpad-arm64:
+    name: "Validate macOS ARM64 dylib headerpad"
+    needs: [mac-build-arm64]
+    runs-on: macos-15
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6.0.2
+      
+      - name: Download macOS ARM64 Build
+        uses: actions/download-artifact@v7.0.0
+        with:
+          name: MacArm64
+          path: artifacts
+      
+      - name: Extract build
+        run: |
+          cd artifacts
+          unzip z3-*-arm64-osx*.zip
+          Z3_DIR=$(find . -maxdepth 1 -type d -name "z3-*" | head -n 1)
+          echo "Z3_DIR=$Z3_DIR" >> $GITHUB_ENV
+      
+      - name: Test install_name_tool with headerpad
+        run: |
+          cd artifacts/$Z3_DIR/bin
+          
+          # Get the original install name
+          ORIGINAL_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "Original install name: $ORIGINAL_NAME"
+          
+          # Create a test path with same length as typical setup-z3 usage
+          # This simulates what setup-z3 does: changing to absolute path
+          TEST_PATH="/Users/runner/hostedtoolcache/z3/latest/arm64/z3-test-dir/bin/libz3.dylib"
+          
+          # Try to change the install name - this will fail if headerpad is insufficient
+          install_name_tool -id "$TEST_PATH" -change libz3.dylib "$TEST_PATH" libz3.dylib
+          
+          # Verify the change was successful
+          NEW_NAME=$(otool -D libz3.dylib | tail -n 1)
+          echo "New install name: $NEW_NAME"
+          
+          if [ "$NEW_NAME" = "$TEST_PATH" ]; then
+            echo "✓ install_name_tool succeeded - headerpad is sufficient"
+          else
+            echo "✗ install_name_tool failed to update install name"
+            exit 1
+          fi
+
   ubuntu-build:
     name: "Ubuntu build"
     runs-on: ubuntu-latest
@@ -582,7 +682,9 @@ jobs:
       ubuntu-doc,
       python-package,
       nuget-package-x64,
-      nuget-package-x86
+      nuget-package-x86,
+      validate-macos-headerpad-x64,
+      validate-macos-headerpad-arm64
     ]
     runs-on: ubuntu-latest
     steps: