Skip to content

ci: restore Apple builders and hosted Agent signing #1119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AnthonyRonning merged 4 commits into from
Oct 10, 2026
Merged

ci: restore Apple builders and hosted Agent signing #1119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ef922dc
ci: trial Blacksmith macOS with the pinned Apple toolchain
AnthonyRonning Oct 10, 2026
87a5e2b
ci: move unsigned Apple packaging to Blacksmith macOS
AnthonyRonning Oct 10, 2026
ca48016
ci: retain small Agent packaging jobs on standard runners
AnthonyRonning Oct 10, 2026
429367a
ci: keep Agent prebuilt signing on standard GitHub macOS
AnthonyRonning Oct 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/actionlint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,4 @@ self-hosted-runner:
labels:
- blacksmith-8vcpu-ubuntu-2404-arm
- blacksmith-8vcpu-windows-2025
- blacksmith-6vcpu-macos-26
4 changes: 2 additions & 2 deletions .github/workflows/agent-desktop-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ jobs:
name: Build macOS binary (${{ matrix.variant }})
needs: changes
if: ${{ always() && !cancelled() && ((github.event_name == 'pull_request' && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false')) || (github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch'))) }}
runs-on: macos-26
runs-on: blacksmith-6vcpu-macos-26
timeout-minutes: 120
strategy:
fail-fast: false
Expand Down Expand Up @@ -112,7 +112,7 @@ jobs:
contents: read
id-token: write
attestations: write
runs-on: macos-26-xlarge
runs-on: macos-26
timeout-minutes: 120
strategy:
fail-fast: false
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/desktop-pr-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
build-macos:
needs: changes
if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.macos != 'false') }}
runs-on: macos-26
runs-on: blacksmith-6vcpu-macos-26
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
with:
Expand Down Expand Up @@ -58,7 +58,7 @@ jobs:
build-research-dev-macos:
needs: changes
if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.macos != 'false') }}
runs-on: macos-26
runs-on: blacksmith-6vcpu-macos-26
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/mobile-pr-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
build-ios:
needs: changes
if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.ios != 'false') }}
runs-on: macos-26
runs-on: blacksmith-6vcpu-macos-26
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
with:
Expand Down
8 changes: 7 additions & 1 deletion docs/repository-workflows.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,13 @@ release work, and report the tag and commit before publishing.

## macOS runners and Apple toolchain

macOS jobs use explicit ARM64 `macos-26` or `macos-26-xlarge` runners. Research
Unsigned Research desktop/iOS PR builds and Agent release-binary jobs use
explicit ARM64 `blacksmith-6vcpu-macos-26` runners. Other macOS jobs retain
`macos-26` or `macos-26-xlarge` runners. Agent preview packaging and protected
signing use standard GitHub `macos-26` runners to assemble prebuilt binaries.
The Agent's final signed-package
provenance identifies the GitHub packaging/signing job; Blacksmith is trusted
for prebuilt binary integrity. Research
desktop and iOS builds select stable Xcode 26.5, build `17F42`, from
[`scripts/ci/apple-toolchain.json`](../scripts/ci/apple-toolchain.json) through
the shared selector, which aligns the runner's active `xcode-select` directory
Expand Down
1 change: 1 addition & 0 deletions scripts/ci/test_agent_workflows.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,7 @@ def test_only_trusted_master_can_receive_apple_signing_credentials(self):
jobs = config["jobs"]
signed = jobs["macos"]
self.assertEqual(signed["environment"], "desktop-signing")
self.assertEqual(signed["runs-on"], "macos-26")
condition = " ".join(signed["if"].split())
self.assertIn(self.MASTER_GUARD, condition)
self.assertIn("always() && !cancelled()", condition)
Expand Down
Loading