]> git.ipfire.org Git - thirdparty/curl.git/commitdiff
Revert "GHA/macos: improve, fix gcc/llvm, add new test matrix"
authorViktor Szakats <commit@vsz.me>
Fri, 19 Jul 2024 10:33:41 +0000 (12:33 +0200)
committerViktor Szakats <commit@vsz.me>
Fri, 19 Jul 2024 10:45:15 +0000 (12:45 +0200)
This reverts commit 1e75edd372868048c9f805ac4ca6d2cb5a88ff5a.

Due to some parts of the commit message missing (my bad.)

.circleci/config.yml
.github/workflows/macos.yml

index 12661cbc037d0c3633e8201db620ab8d5ca4d111..a83f5979695882b658d7e2329b6005d1075db10f 100644 (file)
@@ -23,6 +23,9 @@
 ###########################################################################
 
 # View these jobs in the browser: https://app.circleci.com/pipelines/github/curl/curl
+#
+# The macOS builds use M1 (ARM) machines for platform diversity.
+# See https://circleci.com/docs/configuration-reference/#macos-execution-environment
 
 # Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/configuration-reference/
 version: 2.1
@@ -52,6 +55,177 @@ commands:
             ./configure --disable-proxy --enable-werror --with-openssl \
               || { tail -1000 config.log; false; }
 
+  configure-macos-normal:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-warnings --enable-websockets --without-ssl \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-debug:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings --enable-websockets --without-ssl \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-libssh2:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings --enable-websockets --without-ssl "--with-libssh2=$(brew --prefix libssh2)" \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-libssh-c-ares:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings --enable-websockets --with-openssl --with-libssh --enable-ares \
+              PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-libssh:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings --enable-websockets --with-openssl --with-libssh \
+              PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-c-ares:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings --enable-websockets --without-ssl --enable-ares \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-http-only:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings \
+              --disable-dict \
+              --disable-file \
+              --disable-ftp \
+              --disable-gopher \
+              --disable-imap \
+              --disable-ldap \
+              --disable-mqtt \
+              --disable-pop3 \
+              --disable-rtsp \
+              --disable-shared \
+              --disable-smb \
+              --disable-smtp \
+              --disable-telnet \
+              --disable-tftp \
+              --disable-unix-sockets \
+              --without-brotli \
+              --without-gssapi \
+              --without-libidn2 \
+              --without-libpsl \
+              --without-librtmp \
+              --without-libssh2 \
+              --without-nghttp2 \
+              --without-ssl \
+              --without-zlib \
+              CFLAGS='-mmacosx-version-min=10.15' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-securetransport-http2:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-warnings --enable-websockets --with-secure-transport \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.8' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-openssl-http2:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings --enable-websockets --with-openssl \
+              PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-libressl-http2:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings --enable-websockets --with-openssl \
+              PKG_CONFIG_PATH="$(brew --prefix libressl)/lib/pkgconfig" \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-torture:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings --enable-websockets --disable-shared --disable-threaded-resolver --with-openssl \
+              PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
+  configure-macos-torture-ftp:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-debug --enable-warnings --enable-websockets --disable-shared --disable-threaded-resolver --with-openssl \
+              PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" \
+              CPPFLAGS="-I$(brew --prefix libpsl)/include" \
+              CFLAGS='-mmacosx-version-min=10.9' \
+              LDFLAGS="-L$(brew --prefix libpsl)/lib -L$(brew --prefix icu4c)/lib" \
+              LIBS='-licuuc -licudata' \
+              || { tail -1000 config.log; false; }
+
   install-cares:
     steps:
       - run:
@@ -71,6 +245,15 @@ commands:
             sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev python3-pip libpsl-dev
             sudo python3 -m pip install impacket
 
+  install-deps-brew:
+    steps:
+      - run:
+          command: |
+            # Drop LibreSSL as long as we're not trying to build it
+            echo libtool autoconf automake pkg-config nghttp2 libssh2 openssl libssh c-ares libpsl icu4c | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
+            while [ $? -eq 0 ]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
+            sudo python3 -m pip install impacket
+
   configure-libssh:
     steps:
       - run:
@@ -134,10 +317,28 @@ commands:
       - run: make -j3 V=1
       - run: make -j3 V=1 examples
 
+  build-macos:
+    steps:
+      - run: make -j5 V=1
+      - run: make -j5 V=1 examples
+
   test:
     steps:
       - run: make -j3 V=1 test-ci TFLAGS='-j14'
 
+  test-macos:
+    steps:
+      - run: make -j5 V=1 test-ci TFLAGS='-j10'
+
+  test-torture:
+    steps:
+      - run: make -j5 V=1 test-ci TFLAGS='-j10 -n -t --shallow=25 !FTP'
+
+  test-torture-ftp:
+    steps:
+      # Test 250 takes too long, causing Circle CI to kill the job
+      - run: make -j5 V=1 test-ci TFLAGS='-j10 -n -t --shallow=20 FTP !250 !251'
+
 executors:
   ubuntu:
     machine:
@@ -223,6 +424,138 @@ jobs:
       - build
       - test
 
+  macos-arm-normal:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-normal
+      - build-macos
+      - test-macos
+
+  macos-arm-debug:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-debug
+      - build-macos
+      - test-macos
+
+  macos-arm-libssh2:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-libssh2
+      - build-macos
+      - test-macos
+
+  macos-arm-libssh-c-ares:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-libssh-c-ares
+      - build-macos
+      - test-macos
+
+  macos-arm-libssh:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-libssh
+      - build-macos
+      - test-macos
+
+  macos-arm-c-ares:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-c-ares
+      - build-macos
+      - test-macos
+
+  macos-arm-http-only:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-http-only
+      - build-macos
+      - test-macos
+
+  macos-arm-http-securetransport-http2:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-securetransport-http2
+      - build-macos
+      - test-macos
+
+  macos-arm-http-openssl-http2:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-openssl-http2
+      - build-macos
+      - test-macos
+
+  macos-arm-http-libressl-http2:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-libressl-http2
+      - build-macos
+      - test-macos
+
+  macos-arm-http-torture:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-torture
+      - build-macos
+      - test-torture
+
+  macos-arm-http-torture-ftp:
+    macos:
+      xcode: 15.0.0
+    resource_class: macos.m1.medium.gen1
+    steps:
+      - checkout
+      - install-deps-brew
+      - configure-macos-torture-ftp
+      - build-macos
+      - test-torture-ftp
+
 workflows:
   x86-openssl:
     jobs:
@@ -255,3 +588,53 @@ workflows:
   arm-openssl-c-ares:
     jobs:
       - arm-cares
+
+  macos-arm-normal:
+    jobs:
+      - macos-arm-normal
+
+  macos-arm-debug:
+    jobs:
+      - macos-arm-debug
+
+  macos-arm-libssh2:
+    jobs:
+      - macos-arm-libssh2
+
+  macos-arm-libssh-c-ares:
+    jobs:
+      - macos-arm-libssh-c-ares
+
+  macos-arm-libssh:
+    jobs:
+      - macos-arm-libssh
+
+  macos-arm-c-ares:
+    jobs:
+      - macos-arm-c-ares
+
+  macos-arm-http-only:
+    jobs:
+      - macos-arm-http-only
+
+  macos-arm-http-securetransport-http2:
+    jobs:
+      - macos-arm-http-securetransport-http2
+
+  macos-arm-http-openssl-http2:
+    jobs:
+      - macos-arm-http-openssl-http2
+
+  # There are problem linking with LibreSSL on the CI boxes that prevent this
+  # from working.
+  # macos-arm-http-libressl-http2:
+  #   jobs:
+  #     - macos-arm-http-libressl-http2
+
+  macos-arm-http-torture:
+    jobs:
+      - macos-arm-http-torture
+
+  macos-arm-http-torture-ftp:
+    jobs:
+      - macos-arm-http-torture-ftp
index 49a12cf6aeea287b5415599471c0b01e397df7b7..6f23881992c7767bf20506bdc21e8a7adc662d0c 100644 (file)
@@ -39,129 +39,124 @@ concurrency:
 
 permissions: {}
 
-# Deprecated Apple APIs and the macos-version-min value required to avoid
-# deprecation warnings with llvm/clang:
-#
-# - 10.7  Lion (2011)          - GSS
-# - 10.8  Mountain Lion (2012) - CFURLCreateDataAndPropertiesFromResource (used by curl SecureTransport code)
-# - 10.9  Maverick (2013)      - LDAP
-# - 10.14 Mojave (2018)        - SecureTransport
-#
-# For SecureTransport, curl implements features that require a target
-# newer than the 10.8 required by `CFURLCreateDataAndPropertiesFromResource`.
-# In this case `-Wno-deprecated-declarations` still comes handy to pacify
-# deprecation warnings, though the real solution would be to avoid calling
-# that function.
-
 env:
-  LDFLAGS: -w  # suppress 'object file was built for newer macOS version than being linked' warnings
+  DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
   MAKEFLAGS: -j 4
 
 jobs:
   autotools:
-    name: 'AM ${{ matrix.compiler }} ${{ matrix.name }}'
+    name: ${{ matrix.build.name }}
     runs-on: 'macos-latest'
     timeout-minutes: 60
-    env:
-      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.xcode && format('_{0}', matrix.xcode) || '' }}.app/Contents/Developer"
-      CC: ${{ matrix.compiler }}
-      CFLAGS: '-mmacosx-version-min=${{ matrix.macos-version-min }}'
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - name: '!ssl !debug'
-            compiler: clang
-            configure: --without-ssl --enable-websockets
-            macos-version-min: '10.9'
-          - name: '!ssl !debug'
-            compiler: gcc-12
+        build:
+          - name: normal
+            install: nghttp2
             configure: --without-ssl --enable-websockets
-            macos-version-min: '10.9'
-          - name: '!ssl'
-            compiler: clang
+            macosx-version-min: 10.9
+          - name: debug
+            install: nghttp2
             configure: --enable-debug --without-ssl --enable-websockets
-            macos-version-min: '10.9'
-          - name: '!ssl libssh2'
-            compiler: clang
-            configure: --enable-debug --with-libssh2=$(brew --prefix libssh2) --without-ssl --enable-websockets
-            macos-version-min: '10.9'
-          - name: 'OpenSSL libssh c-ares'
-            compiler: clang
-            install: libssh
-            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix openssl) --enable-ares --enable-websockets
-            macos-version-min: '10.9'
-          - name: 'OpenSSL libssh'
-            compiler: llvm@15
-            install: libssh
-            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix openssl) --enable-websockets
-            macos-version-min: '10.9'
-          - name: '!ssl c-ares'
-            compiler: clang
+            macosx-version-min: 10.9
+          - name: libssh2
+            install: nghttp2 libssh2
+            configure: --enable-debug --with-libssh2=$(brew --prefix)/opt/libssh2 --without-ssl --enable-websockets
+            macosx-version-min: 10.9
+          - name: libssh-c-ares
+            install: openssl nghttp2 libssh
+            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix)/opt/openssl --enable-ares --enable-websockets
+            macosx-version-min: 10.9
+          - name: libssh
+            install: openssl nghttp2 libssh
+            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix)/opt/openssl --enable-websockets
+            macosx-version-min: 10.9
+          - name: c-ares
+            install: nghttp2
             configure: --enable-debug --enable-ares --without-ssl --enable-websockets
-            macos-version-min: '10.9'
-          - name: '!ssl HTTP-only'
-            compiler: clang
+            macosx-version-min: 10.9
+          - name: HTTP only
+            install: nghttp2
             configure: |
               --enable-debug \
-              --disable-alt-svc --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap \
-              --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp \
-              --disable-shared --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets \
-              --without-brotli --without-gssapi --without-libidn2 --without-libpsl --without-librtmp --without-libssh2 \
-              --without-nghttp2 --without-ntlm-auth --without-ssl --without-zlib --without-zstd
-
-            macos-version-min: '10.15'  # Catalina (2019)
-          - name: 'SecureTransport libssh2'
-            compiler: clang
-            configure: --enable-debug --with-secure-transport --enable-websockets --with-libssh2=$(brew --prefix libssh2)
-            macos-version-min: '10.8'
-          - name: 'SecureTransport libssh2 10.12'
-            compiler: clang
-            configure: --enable-debug --with-secure-transport --enable-websockets --with-libssh2=$(brew --prefix libssh2)
-            macos-version-min: '10.12'  # for monotonic timers
-            cflags: '-Wno-deprecated-declarations'
-          - name: 'SecureTransport libssh2'
-            compiler: gcc-12
-            configure: --enable-debug --with-secure-transport --enable-websockets --with-libssh2=$(brew --prefix libssh2)
-            macos-version-min: '10.8'
-          - name: 'LibreSSL'
-            compiler: clang
-            install: libressl
-            configure: --enable-debug --with-openssl=$(brew --prefix libressl) --enable-websockets
-            macos-version-min: '10.9'
-          - name: 'OpenSSL'
-            compiler: clang
-            configure: --enable-debug --with-openssl=$(brew --prefix openssl) --enable-websockets
-            macos-version-min: '10.9'
-          - name: 'OpenSSL torture !FTP'
-            compiler: clang
-            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=$(brew --prefix openssl) --enable-websockets
+              --enable-maintainer-mode \
+              --disable-alt-svc \
+              --disable-dict \
+              --disable-file \
+              --disable-ftp \
+              --disable-gopher \
+              --disable-imap \
+              --disable-ldap \
+              --disable-pop3 \
+              --disable-rtmp \
+              --disable-rtsp \
+              --disable-scp \
+              --disable-sftp \
+              --disable-shared \
+              --disable-smb \
+              --disable-smtp \
+              --disable-telnet \
+              --disable-tftp \
+              --disable-unix-sockets \
+              --without-brotli \
+              --without-gssapi \
+              --without-libidn2 \
+              --without-libpsl \
+              --without-librtmp \
+              --without-libssh2 \
+              --without-nghttp2 \
+              --without-ntlm-auth \
+              --without-ssl \
+              --without-zlib \
+              --without-zstd
+
+            macosx-version-min: 10.15
+          - name: SecureTransport http2
+            install: nghttp2
+            configure: --enable-debug --with-secure-transport --enable-websockets
+            macosx-version-min: 10.8
+          # fails now with linker error on missing symbols, macos no longer old enough?
+          # - name: gcc SecureTransport
+          #   configure: CC=gcc-12 --enable-debug --with-secure-transport --enable-websockets --without-libpsl
+          #   macosx-version-min: 10.8
+          - name: OpenSSL http2
+            install: nghttp2 openssl
+            configure: --enable-debug --with-openssl=$(brew --prefix)/opt/openssl --enable-websockets
+            macosx-version-min: 10.9
+          - name: LibreSSL http2
+            install: nghttp2 libressl
+            configure: --enable-debug --with-openssl=$(brew --prefix)/opt/libressl --enable-websockets
+            macosx-version-min: 10.9
+          - name: torture
+            install: nghttp2 openssl
+            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=$(brew --prefix)/opt/openssl --enable-websockets
             tflags: -n -t --shallow=25 !FTP
-            macos-version-min: '10.9'
-          - name: 'OpenSSL torture FTP'
-            compiler: clang
-            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=$(brew --prefix openssl) --enable-websockets
+            macosx-version-min: 10.9
+          - name: torture-ftp
+            install: nghttp2 openssl
+            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=$(brew --prefix)/opt/openssl --enable-websockets
             tflags: -n -t --shallow=20 FTP
-            macos-version-min: '10.9'
-          - name: 'OpenSSL libssh2 !ldap 10.15'
-            compiler: clang
-            configure: --enable-debug --disable-ldap --with-openssl=$(brew --prefix openssl) --enable-websockets
-            macos-version-min: '10.15'
+            macosx-version-min: 10.9
+          - name: macOS 10.15
+            install: nghttp2 libssh2 openssl
+            configure: --enable-debug --disable-ldap --with-openssl=$(brew --prefix)/opt/openssl --enable-websockets
+            macosx-version-min: 10.15
     steps:
-      - name: 'brew install'
-        # Run this command with retries because of spurious failures seen
-        # while running the tests, for example
-        # https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
-        run: |
-          echo libtool autoconf automake pkg-config libpsl libssh2 nghttp2 openssl ${{ matrix.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
+      - run: echo libtool autoconf automake pkg-config libpsl ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
+        name: 'brew bundle'
 
-      - name: 'brew unlink openssl'
-        run: |
-          case "${{ matrix.install }}" in
+      # Run this command with retries because of spurious failures seen
+      # while running the tests, for example
+      # https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
+      - run: "while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done"
+        name: 'brew install'
+
+      - run: |
+          case "${{ matrix.build.install }}" in
             *openssl*)
               (
-                cd $(brew --prefix openssl)/lib/pkgconfig/
+                cd $(brew --prefix)/opt/openssl/lib/pkgconfig/
                 for i in libssl.pc libcrypto.pc; do
                   sudo cp $i $i.orig
                   sudo sed s,libdir=$(brew --prefix)'/Cellar/openssl@3/3.3.0$',libdir=$(brew --prefix)/Cellar/openssl@3/3.3.0/lib,g < $i.orig > /tmp/$i
@@ -175,139 +170,77 @@ jobs:
                 brew unlink openssl
               fi;;
           esac
+        name: 'brew unlink openssl'
 
-      - name: 'pip3 install'
-        run: |
+      - run: |
           python3 -m venv $HOME/venv
           source $HOME/venv/bin/activate
           python3 -m pip install impacket
+        name: 'pip3 install'
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
-      - name: 'toolchain versions'
-        run: |
-          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && \
-            grep -h -r -E -o '.+[0-9.]+\.sdk/' "$(dirname "$("${CC}" -print-libgcc-file-name)")/include-fixed" | sed -E 's/^\t+//g' | tr -d '"' | sort -u || true
-          which "${CC}"; "${CC}" --version || true
-          xcodebuild -version || true
-          xcrun -sdk macosx --show-sdk-path 2>/dev/null || true
-          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
-          echo '::group::brew packages preinstalled'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
+      - run: rm -f $HOME/.curlrc
+        name: remove $HOME/.curlrc
 
-      - name: 'autoreconf'
-        run: autoreconf -fi
+      - run: autoreconf -fi
+        name: 'autoreconf'
 
-      - name: 'configure'
-        run: |
-          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-          CFLAGS+=' ${{ matrix.cflags }}'
-          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-            libgccdir="$(dirname "$("${CC}" -print-libgcc-file-name)")"
-            echo '::group::gcc include-fixed details'; find "${libgccdir}/include-fixed" | sort; echo '::endgroup::'
-            for f in dispatch os AvailabilityInternal.h stdio.h; do
-              if [ -r "${libgccdir}/include-fixed/${f}" ]; then
-                echo "Zap gcc hack: '${libgccdir}/include-fixed/${f}'"
-                mv "${libgccdir}/include-fixed/${f}" "${libgccdir}/include-fixed/${f}-BAK"
-              fi
-            done
-          fi
-          if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
-            options+=" --target=$(uname -m)-apple-darwin"
-            CC+=" --target=$(uname -m)-apple-darwin"
-          fi
-          if [ '${{ matrix.compiler }}' != 'clang' ]; then
-            options+=" --with-sysroot=$(xcrun -sdk macosx --show-sdk-path 2>/dev/null)"
-            CFLAGS+=" --sysroot=$(xcrun -sdk macosx --show-sdk-path 2>/dev/null)"
-          fi
-          mkdir bld && cd bld && ../configure --enable-warnings --enable-werror \
-            --disable-dependency-tracking \
-            --with-libpsl=$(brew --prefix libpsl) \
-            ${{ matrix.configure }} ${options}
+      - run: ./configure --disable-dependency-tracking --enable-warnings --enable-werror ${{ matrix.build.configure }}
+        name: 'configure'
+        env:
+          CFLAGS: "-mmacosx-version-min=${{ matrix.build.macosx-version-min }}"
 
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log || true
+      - run: make V=1
+        name: 'make'
 
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          cat bld/lib/curl_config.h | grep -F '#define' | sort || true
+      - run: make V=1 examples
+        name: 'make examples'
 
-      - name: 'make'
-        run: make -C bld V=1
+      - run: make V=1 -C tests
+        name: 'make tests'
 
-      - name: 'curl version'
-        run: bld/src/curl --disable --version
-
-      - name: 'make examples'
-        run: make -C bld V=1 examples
-
-      - name: 'make tests'
-        run: make -C bld V=1 -C tests
-
-      - name: 'run tests'
-        run: |
-          export TFLAGS='${{ matrix.tflags }} -j10'
-          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-            TFLAGS+=' ~RTSP'  # 567 568 569 570 571 572 577 689 3100
-            TFLAGS+=' ~1156 ~1539'  # HTTP Content-Range, Content-Length
-            if [[ '${{ matrix.configure }}' = *'--with-secure-transport'* ]]; then
-              TFLAGS+=' ~2100'  # 2100:'HTTP GET using DoH' https://github.com/curl/curl/actions/runs/9942146678/job/27462937524#step:15:5059
-              TFLAGS+=' ~HTTP/2'  # 2400 2401 2402 2403 2404 2406, SecureTransport + nghttp2
-            else
-              TFLAGS+=' ~2402 ~2404'  # non-SecureTransport + nghttp2
-            fi
-          fi
-          rm -f $HOME/.curlrc
-          make -C bld V=1 test-ci
+      - run: make V=1 test-ci
+        name: 'run tests'
+        env:
+          TFLAGS: '${{ matrix.build.tflags }} -j5 ~1452'
 
   cmake:
-    name: 'CM ${{ matrix.compiler }} ${{ matrix.build.name }}'
+    name: cmake ${{ matrix.compiler.CC }} ${{ matrix.build.name }}
     runs-on: 'macos-latest'
-    timeout-minutes: 10
     env:
-      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.xcode && format('_{0}', matrix.xcode) || '' }}.app/Contents/Developer"
-      CC: ${{ matrix.compiler }}
+      CC: ${{ matrix.compiler.CC }}
+      CFLAGS: '-Wno-deprecated-declarations'  # Required for LDAP
     strategy:
       fail-fast: false
       matrix:
-        compiler: [clang, llvm@15, gcc-12]
+        compiler:
+          - CC: clang
+          - CC: gcc-12
         build:
-          - name: 'OpenSSL ws gsasl AppleIDN'
-            install: gsasl
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix openssl) -DCURL_USE_GSASL=ON -DUSE_APPLE_IDN=ON -DENABLE_WEBSOCKETS=ON
-            macos-version-min: '10.9'
-            tflags: '~1034 ~1035'  # AppleIDN issues: https://github.com/curl/curl/issues/14176
-          - name: 'OpenSSL +static'
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix openssl) -DBUILD_STATIC_LIBS=ON
-            macos-version-min: '10.9'
-          - name: 'SecureTransport ws debug+'
-            generate: -DCURL_USE_SECTRANSP=ON -DENABLE_WEBSOCKETS=ON -DENABLE_DEBUG=ON -DENABLE_CURLDEBUG=ON
-            macos-version-min: '10.8'
-          - name: 'LibreSSL !ldap'
-            install: libressl
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix libressl) -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON -DBUILD_EXAMPLES=ON
-            macos-version-min: '10.15'
-          - name: 'wolfSSL !ldap'
-            install: wolfssl
+          - name: OpenSSL
+            install: nghttp2 openssl gsasl
+            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix)/opt/openssl -DCURL_USE_GSASL=ON
+          - name: LibreSSL
+            install: nghttp2 libressl
+            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix)/opt/libressl -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON -DBUILD_EXAMPLES=ON
+          - name: wolfSSL
+            install: nghttp2 wolfssl
             generate: -DCURL_USE_WOLFSSL=ON -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON
-            macos-version-min: '10.15'
-          - name: 'GnuTLS !ldap'
+          - name: libssh2
+            install: nghttp2 openssl libssh2
+            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix)/opt/openssl -DCURL_USE_LIBSSH2=ON -DBUILD_SHARED_LIBS=ON -DBUILD_STATIC_LIBS=ON
+          - name: GnuTLS
             install: gnutls
-            generate: -DCURL_USE_GNUTLS=ON -DCURL_USE_OPENSSL=OFF -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON -DCMAKE_SHARED_LINKER_FLAGS=-L$(brew --prefix nettle)/lib -DCMAKE_EXE_LINKER_FLAGS=-L$(brew --prefix nettle)/lib
-            macos-version-min: '10.15'
-        exclude:
-          - { compiler: llvm@15, build: { macos-version-min: '10.15' } }
-          - { compiler: llvm@15, build: { macos-version-min: '10.9' } }
+            generate: -DCURL_USE_GNUTLS=ON -DCURL_USE_OPENSSL=OFF -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON -DCMAKE_SHARED_LINKER_FLAGS=-L$(brew --prefix)/lib -DCMAKE_EXE_LINKER_FLAGS=-L$(brew --prefix)/lib
     steps:
-      - name: 'brew install'
-        run: |
-          echo libtool autoconf automake pkg-config libpsl libssh2 nghttp2 openssl ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
+      - run: echo libtool autoconf automake pkg-config ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
+        name: 'brew bundle'
 
-      - name: 'brew unlink openssl'
-        run: |
+      - run: "while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done"
+        name: 'brew install'
+
+      - run: |
           case "${{ matrix.build.install }}" in
             *openssl*)
               ;;
@@ -316,304 +249,12 @@ jobs:
                 brew unlink openssl
               fi;;
           esac
+        name: 'brew unlink openssl'
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
-      - name: 'toolchain versions'
-        run: |
-          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && \
-            grep -h -r -E -o '.+[0-9.]+\.sdk/' "$(dirname "$("${CC}" -print-libgcc-file-name)")/include-fixed" | sed -E 's/^\t+//g' | tr -d '"' | sort -u || true
-          which "${CC}"; "${CC}" --version || true
-          xcodebuild -version || true
-          xcrun -sdk macosx --show-sdk-path 2>/dev/null || true
-          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
-          echo '::group::brew packages preinstalled'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
-
-      - name: 'cmake configure'
-        run: |
-          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-            libgccdir="$(dirname "$("${CC}" -print-libgcc-file-name)")"
-            echo '::group::gcc include-fixed details'; find "${libgccdir}/include-fixed" | sort; echo '::endgroup::'
-            for f in dispatch os AvailabilityInternal.h stdio.h; do
-              if [ -r "${libgccdir}/include-fixed/${f}" ]; then
-                echo "Zap gcc hack: '${libgccdir}/include-fixed/${f}'"
-                mv "${libgccdir}/include-fixed/${f}" "${libgccdir}/include-fixed/${f}-BAK"
-              fi
-            done
-          fi
-          cmake -B bld -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON \
-            -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ matrix.build.macos-version-min }} \
-            "-DCMAKE_C_COMPILER_TARGET=$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
-            -DUSE_NGHTTP2=ON \
-            ${{ matrix.build.generate }}
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          cat bld/lib/curl_config.h | grep -F '#define' | sort || true
-
-      - name: 'cmake build'
-        run: make -C bld VERBOSE=1
-
-      - name: 'curl version'
-        run: bld/src/curl --disable --version
-
-      - name: 'cmake build tests'
-        run: make -C bld testdeps
-
-      - name: 'cmake run tests'
-        run: |
-          export TFLAGS='${{ matrix.build.tflags }} -j10'
-          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-            TFLAGS+=' ~RTSP'  # 567 568 569 570 571 572 577 689 3100
-            TFLAGS+=' ~1156 ~1539'  # HTTP Content-Range, Content-Length
-            if [[ '${{ matrix.build.generate }}' = *'-DCURL_USE_SECTRANSP=ON'* ]]; then
-              TFLAGS+=' ~2100'  # 2100:'HTTP GET using DoH' https://github.com/curl/curl/actions/runs/9942146678/job/27462937524#step:15:5059
-              TFLAGS+=' ~HTTP/2'  # 2400 2401 2402 2403 2404 2406, SecureTransport + nghttp2
-            else
-              TFLAGS+=' ~2402 ~2404'  # non-SecureTransport + nghttp2
-            fi
-          fi
-          rm -f $HOME/.curlrc
-          make -C bld test-ci
-
-  combinations:  # Test buildability with host OS, Xcode / SDK, compiler, target-OS, SecureTransport/not, built tool, combinations
-    if: true  # Set to `true` to enable this test matrix. It runs quickly.
-    name: "${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }} ${{ matrix.image }} ${{ matrix.xcode }} ${{ matrix.config }}"
-    runs-on: ${{ matrix.image }}
-    timeout-minutes: 30
-    env:
-      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.xcode && format('_{0}', matrix.xcode) || '' }}.app/Contents/Developer"
-      CC: ${{ matrix.compiler }}
-    strategy:
-      fail-fast: false
-      matrix:
-        config: [SecureTransport]  # also: OpenSSL
-        compiler: [gcc-11, gcc-12, gcc-13, gcc-14, llvm@15, clang]
-        # Xcode support matrix as of 2024-07, with default macOS SDK versions and OS names, years:
-        # * = default Xcode on the runner.
-        # macos-12: 13.1, 13.2.1, 13.3.1, 13.4.1, 14.0.1, 14.1,*14.2
-        # macos-13:                                       14.1, 14.2, 14.3.1,*15.0.1, 15.1, 15.2
-        # macos-14:                                                   14.3.1,*15.0.1, 15.1, 15.2, 15.3, 15.4, 16.0
-        # macOSSDK: 12.0, 12.1,   12.3,   12.3,   12.3,   13.0, 13.1, 13.3,   14.0,   14.2, 14.2, 14.4, 14.5, 15.0
-        #           Monterey (2021)                       Ventura (2022)      Sonoma (2023)                   Sequoia (2024)
-        # https://github.com/actions/runner-images/tree/main/images/macos
-        # https://en.wikipedia.org/wiki/MacOS_version_history
-        image: [macos-12, macos-13, macos-14]
-        # Can skip these to reduce jobs:
-        #   13.1, 13.2.1 are fairly old.
-        #   13.3.1, 14.0.1 have the same default macOS SDK as 13.4.1 and identical test results.
-        #   15.1 has the same default macOS SDK as 15.2 and identical test result.
-        #   14.1, 15.4 not revealing new fallouts.
-        #xcode: ['13.1', '13.2.1', '13.3.1', '13.4.1', '14.0.1', '14.1', '14.2', '14.3.1', '15.0.1', '15.1', '15.2', '15.3', '15.4', '16.0']  # all Xcode
-        #xcode: ['13.1', '13.2.1', '13.4.1', '14.1', '14.2', '14.3.1', '15.0.1', '15.2', '15.3', '15.4', '16.0']  # all SDK
-        #xcode: ['13.4.1', '14.2', '14.3.1', '15.0.1', '15.2', '15.3', '16.0']  # coverage
-        xcode: ['']  # default Xcodes
-        macos-version-min: ['10.8']
-        build: [autotools, cmake]
-        exclude:
-          # Combinations uncovered by runner images:
-          - { image: macos-12, xcode: '14.3.1' }
-          - { image: macos-12, xcode: '15.0.1' }
-          - { image: macos-12, xcode: '15.1'   }
-          - { image: macos-12, xcode: '15.2'   }
-          - { image: macos-12, xcode: '15.3'   }
-          - { image: macos-12, xcode: '15.4'   }
-          - { image: macos-12, xcode: '16.0'   }
-          - { image: macos-13, xcode: '13.1'   }
-          - { image: macos-13, xcode: '13.2.1' }
-          - { image: macos-13, xcode: '13.3.1' }
-          - { image: macos-13, xcode: '13.4.1' }
-          - { image: macos-13, xcode: '14.0.1' }
-          - { image: macos-13, xcode: '15.3'   }
-          - { image: macos-13, xcode: '15.4'   }
-          - { image: macos-13, xcode: '16.0'   }
-          - { image: macos-14, xcode: '13.1'   }
-          - { image: macos-14, xcode: '13.2.1' }
-          - { image: macos-14, xcode: '13.3.1' }
-          - { image: macos-14, xcode: '13.4.1' }
-          - { image: macos-14, xcode: '14.0.1' }
-          - { image: macos-14, xcode: '14.1'   }
-          - { image: macos-14, xcode: '14.2'   }
-          # Reduce build combinations, by dropping less interesting ones
-          - { compiler: gcc-11, build: autotools }
-          - { compiler: gcc-11, image: macos-14 }
-          - { compiler: gcc-12, config: SecureTransport }
-          - { compiler: gcc-13, build: cmake }
-          - { compiler: gcc-13, image: macos-13 }
-          - { compiler: gcc-14, config: SecureTransport }
-    steps:
-      - name: 'install autotools'
-        if: ${{ matrix.build == 'autotools' }}
-        run: |
-          echo autoconf automake libtool openssl | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
-
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
-
-      - name: 'toolchain versions'
-        run: |
-          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && \
-            grep -h -r -E -o '.+[0-9.]+\.sdk/' "$(dirname "$("${CC}" -print-libgcc-file-name)")/include-fixed" | sed -E 's/^\t+//g' | tr -d '"' | sort -u || true
-          which "${CC}"; "${CC}" --version || true
-          xcodebuild -version || true
-          xcrun -sdk macosx --show-sdk-path 2>/dev/null || true
-          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
-          echo '::group::brew packages preinstalled'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build == 'autotools' }}
-        run: autoreconf -fi
-
-      - name: 'configure / ${{ matrix.build }}'
-        run: |
-          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-
-          # gcc ships with an `include-fixed` header set, which overrides SDK
-          # headers with the intent of making them compatible with gcc. The
-          # source for these headers is:
-          #   https://github.com/gcc-mirror/gcc/tree/master/fixincludes
-          # with extra Apple-specific patches applied from here for Homebrew:
-          #   https://github.com/iains/gcc-12-branch
-          #
-          # They pass through a generator phase at build-time which seems to
-          # pick the SDK installed on the build machine (maintained by the
-          # Homebrew project in our case) and patches it according to a set
-          # of rules in `inclhack.def`.
-          #
-          # Homebrew builds and ships different binaries for different macOS
-          # versions and CPUs, built on machines using the same OS version as
-          # the target one. Each of these machines have a particular version
-          # of Apple CommandLineTools with a default SDK version installed with
-          # them.
-          #
-          # Then this binary gets installed onto the end-user machine,
-          # matching the OS version at the time of installation.
-          #
-          # The problem with this approach is that the SDK version picked up
-          # at gcc build-time has a high chance of being or becoming out of
-          # sync with actual SDK installed on the end-user machine. This
-          # can happen after upgrading the OS, Xcode, selecting an SDK version
-          # manually, or other reasons.
-          #
-          # When the SDK versions do not match, the gcc hacks, instead of
-          # improving compatibility the SDK, are actively _breaking_
-          # compatibility, in an unexpected, hard to diagnose way.
-          #
-          # The SDK version used for gcc-hacks is not advertised. We can
-          # extract the major SDK version from the generated gcc-hack header
-          # files, assuming someone knows what to look for and where.
-          #
-          # Basically it also means that the same `gcc-N` Homebrew package
-          # behaves differently depending on the OS it was built on. Causing
-          # an explosion of build combination. It may also mean that a minor
-          # gcc version bump is built against a different SDK version, and due
-          # to the extra patch for the hack applied by Homebrew, there may
-          # be extra changes as well.
-          #
-          # For GHA runners, it means that the default Xcode + OS combo is
-          # broken in 8 out of 12 combinations (66%) have an SDK mismatch,
-          # and 9 fail to build (75%). These are the 3 lucky default
-          # combinations that worked to build curl:
-          #   macos-14 + Xcode 15.0.1 + gcc-11, gcc-12, gcc-14
-          #
-          # Of all possible valid GHA runner, gcc, manually selected Xcode
-          # combinations, 40% are broken.
-          #
-          # Compared to mainline llvm: llvm ships the same binaries regardless
-          # of build-OS or environent, it contains no SDK-version-specific
-          # hacks, and has no 3rd party patches. This still leaves some
-          # occasional issues, but works much closer to expectations.
-          #
-          # Some of these hacks are helpful, in particular for fixing this
-          # issue via math.h:
-          #   /Applications/Xcode_14.3.1.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/math.h:53:5: error: #error "Unsupported value of
-          #      53 | #   error "Unsupported value of __FLT_EVAL_METHOD__."
-          #
-          # Errors seen in available CI combinations:
-          #   error: two or more data types in declaration specifiers # fatal error: AvailabilityInternalLegacy.h: No such file or directory
-          #     gcc-11, gcc-13 + macos-14 + Xcode 14.3.1
-          #   error: two or more data types in declaration specifiers
-          #     gcc-13 + macos-12 + Xcode 14.1, 14.2
-          #     gcc-13 + Xcode 15.0.1, 15.1, 5.2
-          #   error: expected ';' before 'extern'
-          #     gcc-11, gcc-12, gcc-14 + macos-12 + Xcode 14.1, 14.2
-          #   error: unknown type name 'dispatch_queue_t'
-          #     gcc-11, gcc-12 + macos-13 + Xcode 15.0.1, 15.1, 15.2
-          #   error: type defaults to 'int' in declaration of 'DISPATCH_DECL_FACTORY_CLASS_SWIFT' [-Wimplicit-int]
-          #     gcc-14 macos-13 Xcode 15.0.1, 15.1, 15.2
-          #   error: unknown type name 'FILE'
-          #     Xcode 16.0
-          #
-          # Unbreak Homebrew gcc builds by moving problematic SDK header overlay
-          # directories/files out of the way:
-          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-            # E.g.:
-            #   $(brew --prefix)/Cellar/gcc@11/11.4.0/lib/gcc/11/gcc/aarch64-apple-darwin23/11/include-fixed
-            #   $(brew --prefix)/Cellar/gcc@11/11.4.0/lib/gcc/11/gcc/x86_64-apple-darwin21/11/include-fixed
-            #   $(brew --prefix)/Cellar/gcc/14.1.0_1/lib/gcc/14/gcc/x86_64-apple-darwin21/14/include-fixed
-            libgccdir="$(dirname "$("${CC}" -print-libgcc-file-name)")"
-            echo '::group::gcc include-fixed details'; find "${libgccdir}/include-fixed" | sort; echo '::endgroup::'
-            patch_out='dispatch os AvailabilityInternal.h'
-            patch_out+=' stdio.h'  # for Xcode 16 error: unknown type name 'FILE'
-            for f in ${patch_out}; do
-              if [ -r "${libgccdir}/include-fixed/${f}" ]; then
-                echo "Zap gcc hack: '${libgccdir}/include-fixed/${f}'"
-                mv "${libgccdir}/include-fixed/${f}" "${libgccdir}/include-fixed/${f}-BAK"
-              fi
-            done
-          fi
-
-          if [ '${{ matrix.build }}' = 'autotools' ]; then
-            export CFLAGS
-            if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
-              options+=" --target=$(uname -m)-apple-darwin"
-              CC+=" --target=$(uname -m)-apple-darwin"
-            fi
-            if [ '${{ matrix.compiler }}' != 'clang' ]; then
-              options+=" --with-sysroot=$(xcrun -sdk macosx --show-sdk-path 2>/dev/null)"
-              CFLAGS+=" --sysroot=$(xcrun -sdk macosx --show-sdk-path 2>/dev/null)"
-            fi
-            [ '${{ matrix.config }}' = 'OpenSSL' ]         && options+=" --with-openssl=$(brew --prefix openssl)"
-            [ '${{ matrix.config }}' = 'SecureTransport' ] && options+=' --with-secure-transport'
-            CFLAGS+=' -mmacosx-version-min=${{ matrix.macos-version-min }}'
-            # would pick up nghttp2, libidn2, but libssh2 is disabled by default
-            mkdir bld && cd bld && ../configure --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              --disable-docs --disable-manual \
-              --without-nghttp2 --without-libidn2 \
-              ${options}
-          else
-            [ '${{ matrix.config }}' = 'OpenSSL' ]         && options+=' -DCURL_USE_OPENSSL=ON'
-            [ '${{ matrix.config }}' = 'SecureTransport' ] && options+=' -DCURL_USE_SECTRANSP=ON'
-            # would pick up nghttp2, libidn2, and libssh2
-            cmake -B bld -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON \
-              -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ matrix.macos-version-min }} \
-              "-DCMAKE_IGNORE_PREFIX_PATH=$(brew --prefix)" \
-              "-DCMAKE_C_COMPILER_TARGET=$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
-              -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF \
-              -DUSE_APPLE_IDN=OFF \
-              ${options}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          cat bld/lib/curl_config.h | grep -F '#define' | sort || true
-
-      - name: 'build / ${{ matrix.build }}'
-        run: make -C bld V=1 VERBOSE=1
+      - run: cmake -B build -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DUSE_APPLE_IDN=ON ${{ matrix.build.generate }}
+        name: 'cmake generate'
 
-      - name: 'curl version'
-        run: bld/src/curl --disable --version
+      - run: cmake --build build --parallel 4
+        name: 'cmake build'