Align macOS CI with container build: derive configuration at runtime (#96)

* Initial plan

* Align macOS CI with container build: spack versions, cherry-picks, externals, and buildcache

Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>

* Derive spack configuration from spack.sh and spack-packages.sh at runtime

Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>

* Fix cherry-pick loops to filter heredoc delimiters and empty lines

Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>

* Improve cherry-pick filtering and add proper quoting for security

Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>

Author: Copilot

.github/workflows/macos-ci.yml

@@ -32,48 +32,80 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Extract Spack configuration
+        id: spack-config
+        run: |
+          # Source spack.sh to get SPACK_VERSION and SPACK_CHERRYPICKS
+          source spack.sh
+          echo "spack-version=${SPACK_VERSION}" >> $GITHUB_OUTPUT
+          echo "spack-cherrypicks<<EOF" >> $GITHUB_OUTPUT
+          echo "${SPACK_CHERRYPICKS}" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+          
+          # Source spack-packages.sh to get SPACKPACKAGES_VERSION and SPACKPACKAGES_CHERRYPICKS
+          source spack-packages.sh
+          echo "spackpackages-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
+          echo "spackpackages-cherrypicks<<EOF" >> $GITHUB_OUTPUT
+          echo "${SPACKPACKAGES_CHERRYPICKS}" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+          
+          # Extract buildcache URL from mirrors.yaml.in (simplified - get the version)
+          echo "buildcache-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
+      
       - name: Setup Spack
         uses: spack/setup-spack@v2.1.1
         with:
-          ref: develop
+          ref: ${{ steps.spack-config.outputs.spack-version }}
           color: true
           path: ${{ github.workspace }}/spack
 
+      - name: Apply Spack cherry-picks
+        run: |
+          cd ${{ github.workspace }}/spack
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+          
+          # Apply cherry-picks from spack.sh (match only valid git commit hashes)
+          echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' | while read -r commit; do
+            echo "Cherry-picking ${commit}"
+            git cherry-pick "${commit}"
+          done
+      
+      - name: Checkout and configure spack-packages
+        run: |
+          cd ${{ github.workspace }}/spack
+          git clone https://github.com/spack/spack-packages.git var/spack/repos/spack-packages
+          cd var/spack/repos/spack-packages
+          git checkout ${{ steps.spack-config.outputs.spackpackages-version }}
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+          
+          # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
+          echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' | while read -r commit; do
+            echo "Cherry-picking ${commit}"
+            git cherry-pick "${commit}"
+          done
+          
+          cd ${{ github.workspace }}/spack
+          spack repo add var/spack/repos/spack-packages
+      
       - name: Add Spack environment
         run: |
           spack env create ci spack-environment/ci
           spack env activate ci
           spack -e ci compiler find
+          spack -e ci external find llvm
           spack -e ci external find --not-buildable cmake
       
       - name: Concretize
         run: |
           spack -e ci concretize -f
       
-      - name: Setup buildcache access
-        uses: spack/github-actions-buildcache@v2
-        with:
-          mode: readwrite
-          key: macos-${{ matrix.compiler }}-ci
+      - name: Configure buildcache
+        run: |
+          spack -e ci mirror add eic oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          spack -e ci buildcache keys --install --trust
       
       - name: Install
         run: |
           spack -e ci install --no-check-signature --show-log-on-error
-      
-      - name: Push to buildcache
-        if: always()
-        run: |
-          spack -e ci buildcache push --update-index --only=package --unsigned ${{ github.workspace }}/buildcache-macos
-      
-      - name: Show environment info
-        if: always()
-        run: |
-          spack -e ci find -lv
-          spack -e ci graph --dot > ci-graph.dot
-      
-      - name: Upload environment graph
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: ci-environment-graph-${{ matrix.compiler }}
-          path: ci-graph.dot