From 9b015ff3e06079fe1680b554f89921ebf97e0ee0 Mon Sep 17 00:00:00 2001
From: Joel Natividad <1980690+jqnatividad@users.noreply.github.com>
Date: Mon, 4 Dec 2023 11:59:25 -0500
Subject: [PATCH] `publish`: republish intel macos prebuilts

[skip ci]
---
 .../macOS-x86_64-selfhosted-publish.yml       | 24 +++++++++++++++----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/macOS-x86_64-selfhosted-publish.yml b/.github/workflows/macOS-x86_64-selfhosted-publish.yml
index e413a3152..caa58e165 100644
--- a/.github/workflows/macOS-x86_64-selfhosted-publish.yml
+++ b/.github/workflows/macOS-x86_64-selfhosted-publish.yml
@@ -27,7 +27,7 @@ jobs:
   publish:
     name: Publish for ${{ matrix.job.target }}
     needs: analyze-tags
-    runs-on: self-hosted
+    runs-on: macos-latest
     strategy:
       matrix:
         rust: [stable]
@@ -36,11 +36,12 @@ jobs:
             os-name: macos
             target: x86_64-apple-darwin
             architecture: x86_64
-            use-cross: true
+            use-cross: false
             addl-build-args: --features=apply,generate,fetch,foreach,self_update,luau,polars,to,geocode
             default-features: --no-default-features
             addl-qsvlite-features:
             addl-qsvdp-features: luau
+            addl-rustflags: -C target-feature=+fxsr,+sse,+sse2,+sse3,+ssse3,+sse4.1,+sse4.2,+popcnt,+avx,+fma
 
     steps:
     - name: Installing Rust toolchain
@@ -57,7 +58,7 @@ jobs:
         ref: ${{ needs.analyze-tags.outputs.previous-tag }}
     - name: Build qsv
       env:
-        RUSTFLAGS: --emit=asm
+        RUSTFLAGS: --emit=asm ${{ matrix.job.addl-rustflags }}
       uses: actions-rs/cargo@v1
       with:
         command: build
@@ -66,7 +67,7 @@ jobs:
         args: --release --locked --bin qsv --target ${{ matrix.job.target }} ${{ matrix.job.addl-build-args }},feature_capable ${{ matrix.job.default-features }}
     - name: Build qsvlite
       env:
-        RUSTFLAGS: --emit=asm
+        RUSTFLAGS: --emit=asm ${{ matrix.job.addl-rustflags }}
       uses: actions-rs/cargo@v1
       with:
         command: build
@@ -75,7 +76,7 @@ jobs:
         args: --release --locked --bin qsvlite --features=lite,self_update,${{ matrix.job.addl-qsvlite-features }} --target ${{ matrix.job.target }} ${{ matrix.job.default-features }}
     - name: Build qsvdp
       env:
-        RUSTFLAGS: --emit=asm
+        RUSTFLAGS: --emit=asm ${{ matrix.job.addl-rustflags }}
       uses: actions-rs/cargo@v1
       with:
         command: build
@@ -94,6 +95,19 @@ jobs:
         cat docs/publishing_assets/README.txt docs/publishing_assets/qsv-${{ matrix.job.target }}.txt > qsv-${{ needs.analyze-tags.outputs.previous-tag }}/README
     - name: zip up binaries
       run: 7zz a -tzip qsv-${{ needs.analyze-tags.outputs.previous-tag }}-${{ matrix.job.target }}.zip ./qsv-${{ needs.analyze-tags.outputs.previous-tag }}/* -mx=9 -mmt=on
+    - name: install zipsign
+      run: |
+        cargo install zipsign
+    - name: Fetch zipsign private key
+      uses: mobiledevops/secret-to-file-action@v1
+      with:
+        base64-encoded-secret: ${{ secrets.QSV_ZIPSIGN_PRIV_KEY }}
+        filename: "qsvpriv.key"
+        is-executable: false
+        working-directory: "."        
+    - name: zipsign binary
+      run: |
+        zipsign sign zip qsv-${{ needs.analyze-tags.outputs.previous-tag }}-${{ matrix.job.target }}.zip qsvpriv.key      
     - name: Upload zipped binaries to release
       uses: svenstaro/upload-release-action@v2
       with: