  bundle-macos-arm64:
    name: bundle macos-arm64
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: {% raw %}${{ inputs.ref || github.ref }}{% endraw %}

      # This Raku runs ariza. It is NOT the runtime that ends up in the
      # bundle -- ariza downloads the pinned one ({{ rakudo_tag }}) from
      # rakudo.org itself, so this lane's Rakudo version has no bearing
      # on what a user gets.
      - uses: Raku/setup-raku@v1
        with:
          raku-version: 'latest'

      - name: Install ariza
        run: {{ ariza_install }}
{%- for line in ariza_install_note %}
        # {{ line }}
{%- endfor %}

      # ariza takes SQLCipher from the build machine's package manager --
      # there is no ariza-operated mirror -- and makes the copy it stages
      # self-contained, rewriting its OpenSSL dependency to @loader_path
      # and re-signing it. `SQLCIPHER_LIB_DIR=<dir>` overrides this if a
      # particular build is ever needed instead.
      - name: Install SQLCipher
        run: brew install sqlcipher

      - name: Build the bundle
        run: ariza bundle --app=. --platform=macos-arm64 --out-dir=dist-out

      # Unpacks the archive somewhere new, with a replaced environment,
      # and runs {{ app_name }}'s own bundle.smoke commands against it.
      - name: Smoke the bundle
        run: |
          set -euo pipefail
          archive=$(ls dist-out/*.tar.gz)
          ariza smoke --archive="$archive"

      - name: Upload
        uses: actions/upload-artifact@v6
        with:
          name: macos-arm64
          path: |
            dist-out/*.tar.gz
            dist-out/*.tar.gz.sha256
          if-no-files-found: error
