From ef922dce3cc5b32ecb84cb1544f202e1babc451c Mon Sep 17 00:00:00 2001 From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com> Date: Sat, 10 Oct 2026 03:44:31 +0000 Subject: [PATCH 1/4] ci: trial Blacksmith macOS with the pinned Apple toolchain --- .github/actionlint.yaml | 1 + .github/workflows/macos-blacksmith-trial.yml | 40 ++++++++++++++++++++ scripts/ci/test_select_xcode.py | 1 + 3 files changed, 42 insertions(+) create mode 100644 .github/workflows/macos-blacksmith-trial.yml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index 0dd701c13..82a2b6c3f 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -3,3 +3,4 @@ self-hosted-runner: labels: - blacksmith-8vcpu-ubuntu-2404-arm - blacksmith-8vcpu-windows-2025 + - blacksmith-6vcpu-macos-26 diff --git a/.github/workflows/macos-blacksmith-trial.yml b/.github/workflows/macos-blacksmith-trial.yml new file mode 100644 index 000000000..30403413e --- /dev/null +++ b/.github/workflows/macos-blacksmith-trial.yml @@ -0,0 +1,40 @@ +name: macOS Blacksmith compatibility trial + +on: + pull_request: + paths: + - .github/workflows/macos-blacksmith-trial.yml + +permissions: + contents: read + +jobs: + toolchain: + runs-on: blacksmith-6vcpu-macos-26 + timeout-minutes: 10 + steps: + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false + + - name: Record unsigned runner compatibility + run: | + set -euo pipefail + uname -m + sw_vers + sysctl -n hw.ncpu hw.memsize + df -h / + ls -d /Applications/Xcode*.app + for developer in /Applications/Xcode*.app/Contents/Developer; do + DEVELOPER_DIR="$developer" xcodebuild -version + done + + - name: Select existing pinned Xcode + run: python3 scripts/ci/select-xcode.py + + - name: Confirm active toolchain and SDKs + run: | + set -euo pipefail + xcodebuild -version + env -u DEVELOPER_DIR xcodebuild -version + xcodebuild -showsdks diff --git a/scripts/ci/test_select_xcode.py b/scripts/ci/test_select_xcode.py index 17e0f4fc3..50834c525 100644 --- a/scripts/ci/test_select_xcode.py +++ b/scripts/ci/test_select_xcode.py @@ -154,6 +154,7 @@ def test_no_workflow_uses_retired_mac_os_and_every_native_selector_has_checkout( self.assertEqual(len(checkout), 1, (path.name, job_id)) self.assertIs(checkout[0]["with"]["persist-credentials"], False) self.assertCountEqual(selectors, [ + ("macos-blacksmith-trial.yml", "toolchain"), ("agent-desktop-build.yml", "macos-build"), ("agent-desktop-build.yml", "macos"), ("agent-desktop-build.yml", "macos-unsigned"), From 87a5e2b0f97f169bc9a1678abbc10735a1b4dbbe Mon Sep 17 00:00:00 2001 From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com> Date: Sat, 10 Oct 2026 03:49:14 +0000 Subject: [PATCH 2/4] ci: move unsigned Apple packaging to Blacksmith macOS --- .github/workflows/agent-desktop-build.yml | 4 +- .github/workflows/desktop-pr-build.yml | 4 +- .github/workflows/macos-blacksmith-trial.yml | 40 -------------------- .github/workflows/mobile-pr-build.yml | 2 +- docs/repository-workflows.md | 4 +- scripts/ci/test_select_xcode.py | 1 - 6 files changed, 8 insertions(+), 47 deletions(-) delete mode 100644 .github/workflows/macos-blacksmith-trial.yml diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml index 92970d59f..655c56ab8 100644 --- a/.github/workflows/agent-desktop-build.yml +++ b/.github/workflows/agent-desktop-build.yml @@ -65,7 +65,7 @@ jobs: name: Build macOS binary (${{ matrix.variant }}) needs: changes if: ${{ always() && !cancelled() && ((github.event_name == 'pull_request' && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false')) || (github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch'))) }} - runs-on: macos-26 + runs-on: blacksmith-6vcpu-macos-26 timeout-minutes: 120 strategy: fail-fast: false @@ -164,7 +164,7 @@ jobs: name: Unsigned macOS packaging (${{ matrix.variant }}) needs: [changes, macos-build] if: ${{ always() && !cancelled() && needs.macos-build.result == 'success' && github.event_name == 'pull_request' && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false') }} - runs-on: macos-26 + runs-on: blacksmith-6vcpu-macos-26 timeout-minutes: 120 strategy: fail-fast: false diff --git a/.github/workflows/desktop-pr-build.yml b/.github/workflows/desktop-pr-build.yml index 746201985..c1f5f6d1a 100644 --- a/.github/workflows/desktop-pr-build.yml +++ b/.github/workflows/desktop-pr-build.yml @@ -14,7 +14,7 @@ jobs: build-macos: needs: changes if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.macos != 'false') }} - runs-on: macos-26 + runs-on: blacksmith-6vcpu-macos-26 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: @@ -58,7 +58,7 @@ jobs: build-research-dev-macos: needs: changes if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.macos != 'false') }} - runs-on: macos-26 + runs-on: blacksmith-6vcpu-macos-26 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: diff --git a/.github/workflows/macos-blacksmith-trial.yml b/.github/workflows/macos-blacksmith-trial.yml deleted file mode 100644 index 30403413e..000000000 --- a/.github/workflows/macos-blacksmith-trial.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: macOS Blacksmith compatibility trial - -on: - pull_request: - paths: - - .github/workflows/macos-blacksmith-trial.yml - -permissions: - contents: read - -jobs: - toolchain: - runs-on: blacksmith-6vcpu-macos-26 - timeout-minutes: 10 - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - persist-credentials: false - - - name: Record unsigned runner compatibility - run: | - set -euo pipefail - uname -m - sw_vers - sysctl -n hw.ncpu hw.memsize - df -h / - ls -d /Applications/Xcode*.app - for developer in /Applications/Xcode*.app/Contents/Developer; do - DEVELOPER_DIR="$developer" xcodebuild -version - done - - - name: Select existing pinned Xcode - run: python3 scripts/ci/select-xcode.py - - - name: Confirm active toolchain and SDKs - run: | - set -euo pipefail - xcodebuild -version - env -u DEVELOPER_DIR xcodebuild -version - xcodebuild -showsdks diff --git a/.github/workflows/mobile-pr-build.yml b/.github/workflows/mobile-pr-build.yml index d1445fec8..9d9803f17 100644 --- a/.github/workflows/mobile-pr-build.yml +++ b/.github/workflows/mobile-pr-build.yml @@ -14,7 +14,7 @@ jobs: build-ios: needs: changes if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.ios != 'false') }} - runs-on: macos-26 + runs-on: blacksmith-6vcpu-macos-26 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md index 898d7644c..fad035ecf 100644 --- a/docs/repository-workflows.md +++ b/docs/repository-workflows.md @@ -62,7 +62,9 @@ release work, and report the tag and commit before publishing. ## macOS runners and Apple toolchain -macOS jobs use explicit ARM64 `macos-26` or `macos-26-xlarge` runners. Research +Unsigned Research desktop/iOS PR builds and Agent release-binary/unsigned +packaging jobs use explicit ARM64 `blacksmith-6vcpu-macos-26` runners. Other +macOS jobs retain `macos-26` or `macos-26-xlarge` runners. Research desktop and iOS builds select stable Xcode 26.5, build `17F42`, from [`scripts/ci/apple-toolchain.json`](../scripts/ci/apple-toolchain.json) through the shared selector, which aligns the runner's active `xcode-select` directory diff --git a/scripts/ci/test_select_xcode.py b/scripts/ci/test_select_xcode.py index 50834c525..17e0f4fc3 100644 --- a/scripts/ci/test_select_xcode.py +++ b/scripts/ci/test_select_xcode.py @@ -154,7 +154,6 @@ def test_no_workflow_uses_retired_mac_os_and_every_native_selector_has_checkout( self.assertEqual(len(checkout), 1, (path.name, job_id)) self.assertIs(checkout[0]["with"]["persist-credentials"], False) self.assertCountEqual(selectors, [ - ("macos-blacksmith-trial.yml", "toolchain"), ("agent-desktop-build.yml", "macos-build"), ("agent-desktop-build.yml", "macos"), ("agent-desktop-build.yml", "macos-unsigned"), From ca4801667655881fb81a83abf91013f73558992e Mon Sep 17 00:00:00 2001 From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com> Date: Sat, 10 Oct 2026 04:24:12 +0000 Subject: [PATCH 3/4] ci: retain small Agent packaging jobs on standard runners --- .github/workflows/agent-desktop-build.yml | 2 +- docs/repository-workflows.md | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml index 655c56ab8..1b9058765 100644 --- a/.github/workflows/agent-desktop-build.yml +++ b/.github/workflows/agent-desktop-build.yml @@ -164,7 +164,7 @@ jobs: name: Unsigned macOS packaging (${{ matrix.variant }}) needs: [changes, macos-build] if: ${{ always() && !cancelled() && needs.macos-build.result == 'success' && github.event_name == 'pull_request' && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false') }} - runs-on: blacksmith-6vcpu-macos-26 + runs-on: macos-26 timeout-minutes: 120 strategy: fail-fast: false diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md index fad035ecf..8ec19eba5 100644 --- a/docs/repository-workflows.md +++ b/docs/repository-workflows.md @@ -62,9 +62,11 @@ release work, and report the tag and commit before publishing. ## macOS runners and Apple toolchain -Unsigned Research desktop/iOS PR builds and Agent release-binary/unsigned -packaging jobs use explicit ARM64 `blacksmith-6vcpu-macos-26` runners. Other -macOS jobs retain `macos-26` or `macos-26-xlarge` runners. Research +Unsigned Research desktop/iOS PR builds and Agent release-binary jobs use +explicit ARM64 `blacksmith-6vcpu-macos-26` runners. Other macOS jobs retain +`macos-26` or `macos-26-xlarge` runners. The Agent's final signed-package +provenance identifies the GitHub packaging/signing job; Blacksmith is trusted +for prebuilt binary integrity. Research desktop and iOS builds select stable Xcode 26.5, build `17F42`, from [`scripts/ci/apple-toolchain.json`](../scripts/ci/apple-toolchain.json) through the shared selector, which aligns the runner's active `xcode-select` directory From 429367a90a796025de8f2070a39aacf88b20a279 Mon Sep 17 00:00:00 2001 From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com> Date: Sat, 10 Oct 2026 04:53:38 +0000 Subject: [PATCH 4/4] ci: keep Agent prebuilt signing on standard GitHub macOS --- .github/workflows/agent-desktop-build.yml | 2 +- docs/repository-workflows.md | 4 +++- scripts/ci/test_agent_workflows.py | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml index 1b9058765..204e5fc05 100644 --- a/.github/workflows/agent-desktop-build.yml +++ b/.github/workflows/agent-desktop-build.yml @@ -112,7 +112,7 @@ jobs: contents: read id-token: write attestations: write - runs-on: macos-26-xlarge + runs-on: macos-26 timeout-minutes: 120 strategy: fail-fast: false diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md index 8ec19eba5..ae008148b 100644 --- a/docs/repository-workflows.md +++ b/docs/repository-workflows.md @@ -64,7 +64,9 @@ release work, and report the tag and commit before publishing. Unsigned Research desktop/iOS PR builds and Agent release-binary jobs use explicit ARM64 `blacksmith-6vcpu-macos-26` runners. Other macOS jobs retain -`macos-26` or `macos-26-xlarge` runners. The Agent's final signed-package +`macos-26` or `macos-26-xlarge` runners. Agent preview packaging and protected +signing use standard GitHub `macos-26` runners to assemble prebuilt binaries. +The Agent's final signed-package provenance identifies the GitHub packaging/signing job; Blacksmith is trusted for prebuilt binary integrity. Research desktop and iOS builds select stable Xcode 26.5, build `17F42`, from diff --git a/scripts/ci/test_agent_workflows.py b/scripts/ci/test_agent_workflows.py index b1949a443..70b359ff1 100644 --- a/scripts/ci/test_agent_workflows.py +++ b/scripts/ci/test_agent_workflows.py @@ -155,6 +155,7 @@ def test_only_trusted_master_can_receive_apple_signing_credentials(self): jobs = config["jobs"] signed = jobs["macos"] self.assertEqual(signed["environment"], "desktop-signing") + self.assertEqual(signed["runs-on"], "macos-26") condition = " ".join(signed["if"].split()) self.assertIn(self.MASTER_GUARD, condition) self.assertIn("always() && !cancelled()", condition)