fix(walltime): use brew-installed bash for samply on macOS

samply can't profile macOS's signed /bin/bash (and Python launched
through it), so it needs an unsigned bash. On macOS we now:

- Require Homebrew to be installed (bail with a pointer to brew.sh
  otherwise); installing it ourselves would be too invasive.
- Skip the install entirely if `brew list --formula --quiet bash`
  reports bash is already present.
- In a TTY, prompt the user before running `brew install bash`
  (default Y, accepts y/yes/Enter). In CI (non-TTY), install silently.
- Suppress brew's stdio unless CODSPEED_LOG=debug; on failure the
  captured output is included in the error message.
- Prepend `$(brew --prefix)/bin` to the spawned samply command's PATH
  so brew's unsigned bash wins over other `bash` entries earlier on
  PATH (e.g. nix-profile's signed bash). Only the samply child
  process tree sees this PATH — the parent shell is untouched.

Adds:
- `executor/helpers/homebrew` module with `ensure_installed`,
  `is_installed`, `prefix`, and `install`.
- `CommandBuilder::env()` to set env vars on the spawned process.

Author: not-matthias

src/executor/helpers/command.rs

@@ -48,6 +48,17 @@ impl CommandBuilder {
         self
     }
 
+    #[allow(dead_code)] // currently only used behind cfg(target_os = "macos")
+    pub fn env<K, V>(&mut self, key: K, value: V) -> &mut Self
+    where
+        K: AsRef<OsStr>,
+        V: AsRef<OsStr>,
+    {
+        self.envs
+            .insert(key.as_ref().to_owned(), value.as_ref().to_owned());
+        self
+    }
+
     pub fn current_dir<D>(&mut self, dir: D)
     where
         D: AsRef<OsStr>,

src/executor/helpers/homebrew.rs

@@ -0,0 +1,81 @@
+//! Thin wrappers around the `brew` CLI for macOS-only setup paths.
+
+use crate::executor::helpers::env::is_codspeed_debug_enabled;
+use crate::prelude::*;
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+
+/// Fail unless `brew` is on `PATH`. We intentionally do not install Homebrew
+/// ourselves — that's too invasive a side effect for a profiler setup step.
+pub fn ensure_installed() -> Result<()> {
+    let installed = Command::new("which")
+        .arg("brew")
+        .output()
+        .is_ok_and(|o| o.status.success());
+    if !installed {
+        bail!("Homebrew is required but was not found on PATH");
+    }
+    Ok(())
+}
+
+/// Return Homebrew's install prefix (`/opt/homebrew` on Apple Silicon,
+/// `/usr/local` on Intel). Shells out to `brew --prefix` rather than hardcoding
+/// so we don't have to guess the architecture.
+pub fn prefix() -> Result<PathBuf> {
+    let output = Command::new("brew")
+        .arg("--prefix")
+        .output()
+        .context("failed to spawn `brew --prefix`")?;
+    if !output.status.success() {
+        bail!("`brew --prefix` exited with status {}", output.status);
+    }
+    let path = String::from_utf8(output.stdout)
+        .context("`brew --prefix` returned non-UTF-8 output")?
+        .trim()
+        .to_owned();
+    Ok(PathBuf::from(path))
+}
+
+/// Check whether a brew formula is already installed. Uses `brew list <pkg>`,
+/// which is local-only (no network/API hit) and returns non-zero when missing.
+pub fn is_installed(package: &str) -> bool {
+    Command::new("brew")
+        .args(["list", "--formula", "--quiet", package])
+        .output()
+        .is_ok_and(|o| o.status.success())
+}
+
+/// Run `brew install <package>`. Idempotent: brew exits 0 when the formula
+/// is already installed, so callers don't need to pre-check.
+pub fn install(package: &str) -> Result<()> {
+    // Bypass the logger here: `info!` goes through the spinner-suspend path
+    // which buffers until the spinner ticks, so the message would only show
+    // up after brew returns. We want the user to see it before brew starts.
+    eprintln!("Installing {package} via Homebrew...");
+
+    // Check the user-facing debug knob rather than log::max_level(); the
+    // latter is forced to Trace by the runner's file logger and can't
+    // distinguish "user wants debug output" from "captured to runner.log".
+    let stdio = || {
+        if is_codspeed_debug_enabled() {
+            Stdio::inherit()
+        } else {
+            Stdio::piped()
+        }
+    };
+    let output = Command::new("brew")
+        .args(["install", package])
+        .stdout(stdio())
+        .stderr(stdio())
+        .output()
+        .with_context(|| format!("failed to spawn `brew install {package}`"))?;
+    if !output.status.success() {
+        bail!(
+            "`brew install {package}` exited with status {}\nstdout:\n{}\nstderr:\n{}",
+            output.status,
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr),
+        );
+    }
+    Ok(())
+}

src/executor/helpers/mod.rs

@@ -4,6 +4,8 @@ pub mod detect_executable;
 pub mod env;
 pub mod get_bench_command;
 pub mod harvest_perf_maps_for_pids;
+#[cfg(target_os = "macos")]
+pub mod homebrew;
 pub mod introspected_golang;
 pub mod introspected_nodejs;
 pub mod profile_folder;

src/executor/wall_time/profiler/samply/mod.rs

@@ -42,7 +42,20 @@ impl Profiler for SamplyProfiler {
         _system_info: &SystemInfo,
         _setup_cache_dir: Option<&Path>,
     ) -> anyhow::Result<()> {
-        ensure_linux_profiling_sysctls()
+        ensure_linux_profiling_sysctls()?;
+
+        // samply can't profile macOS's signed /bin/bash
+        #[cfg(target_os = "macos")]
+        {
+            use crate::executor::helpers::homebrew;
+            homebrew::ensure_installed()?;
+            if !homebrew::is_installed("bash") {
+                confirm_bash_install()?;
+                homebrew::install("bash")?;
+            }
+        }
+
+        Ok(())
     }
 
     async fn wrap_command(
@@ -71,6 +84,23 @@ impl Profiler for SamplyProfiler {
         .get_command_builder()?;
 
         cmd_builder.wrap_with(samply_builder);
+
+        // Ensure the brew-installed bash (and any other brew binary) wins over
+        // other `bash` entries on PATH (e.g. nix-profile's signed bash), which
+        // samply can't profile.
+        #[cfg(target_os = "macos")]
+        {
+            use crate::executor::helpers::homebrew;
+            let brew_bin = homebrew::prefix()?.join("bin");
+            let existing = std::env::var_os("PATH").unwrap_or_default();
+            let mut new_path = std::ffi::OsString::from(brew_bin);
+            if !existing.is_empty() {
+                new_path.push(":");
+                new_path.push(&existing);
+            }
+            cmd_builder.env("PATH", new_path);
+        }
+
         self.output_path = Some(output_path);
         Ok(cmd_builder)
     }
@@ -114,3 +144,30 @@ impl Profiler for SamplyProfiler {
         Ok(())
     }
 }
+
+#[cfg(target_os = "macos")]
+fn confirm_bash_install() -> anyhow::Result<()> {
+    use crate::local_logger::IS_TTY;
+    use console::Term;
+
+    // Non-interactive (CI): just install
+    if !*IS_TTY {
+        return Ok(());
+    }
+
+    eprintln!(
+        "CodSpeed depends on bash for benchmark execution, but can't use /bin/bash because system executables are signed in a way that prevents profiling. Because of this, we need to install bash with Homebrew. This is a one-time setup, your system bash is untouched."
+    );
+    eprint!("\nRun `brew install bash` now? [Y/n] ");
+    let line = Term::stderr().read_line().unwrap_or_default();
+    let answer = line.trim();
+
+    // Default to yes on empty input (just pressing Enter).
+    if !(answer.is_empty()
+        || answer.eq_ignore_ascii_case("y")
+        || answer.eq_ignore_ascii_case("yes"))
+    {
+        bail!("Declined; cannot continue without an unsigned bash");
+    }
+    Ok(())
+}