Add a ci:macos-unsigned label for unsigned macOS arm64 test builds - #7
Open
Harold Hunt (huntharo) wants to merge 4 commits into
Open
Add a ci:macos-unsigned label for unsigned macOS arm64 test builds#7Harold Hunt (huntharo) wants to merge 4 commits into
Harold Hunt (huntharo) wants to merge 4 commits into
Conversation
) Three fixes from the first end-to-end run. Authenticode signing failed before signing anything: Cannot process argument transformation on parameter 'Files'. Cannot convert value to type System.String. `Invoke-TrustedSigning -Files` is typed [string], not [string[]]. grok-build passes a single path, which is the shape the module actually accepts; batching five was my assumption and it was wrong. Now one call per binary, signing and verifying in the same pass so a failure names the file it belongs to. Five signing round-trips instead of one, which costs seconds. Both macOS builds were killed at the 120 minute timeout. Measured on standard hosted runners: linux-aarch64 43m, linux-x86_64 55m, windows-prepare 101m, macos-aarch64 114m, macos-x86_64 killed at 120m. Standard hosted macOS is a 3-core M1 and roughly 2x slower than ubuntu for this workspace. Raised to 240, well inside GitHub's 6 hour per-job ceiling. The cache was also not being kept. The combined `actions/cache` skips its post-step save when a job fails, so the timed-out macOS jobs discarded everything they had compiled. Split into restore/save with `if: always()`, and extended to cover codex-rs/target so a killed build resumes rather than restarting. Upstream uses the same split in bazel.yml with a `!cancelled()` guard; that guard is deliberately omitted here, since a timeout is precisely the case whose output is worth keeping. The save key carries run_id and run_attempt because cache entries are immutable once written.
Getting a build onto an Apple Silicon Mac meant either a workflow_dispatch run of the whole release pipeline, or applying `ci:release-signing` and pulling the unsigned `signing-input-macos-aarch64` tarball out of a run that also entered both signing environments. Neither is what you want when the question is just "does this change work on my machine". `ci:macos-unsigned` now runs one macos-15 job that builds aarch64-apple-darwin and attaches `unsigned-macos-aarch64`. The job summary carries the `xattr -dr com.apple.quarantine` line, since the binaries are neither signed nor notarized and Gatekeeper refuses them otherwise. This is a separate workflow rather than a second label inside pwragent-release.yml on purpose. That pipeline is fail-closed and check-release-signing.py pins the property; adding an unsigned escape hatch would have meant gating the signing jobs off inside the one file written to make that impossible. So the contract check is extended to cover the new workflow instead: it must not enter an environment, read secrets, take `contents: write`, or rename its artifact off the `unsigned-` prefix. Each assertion was mutation-tested. pwragent-release-check.yml gains the file in its paths so the check actually runs when it changes. Timeout and cache follow #6 rather than the pre-#6 shape: 240 minutes, and restore/save split with `if: always()` so a killed build keeps its partial target dir. The cache key is deliberately the release workflow's `cargo-macos-aarch64-<lock>` — same target, same release profile, same three binaries — so a cold two-hour build only happens when neither has run. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Harold Hunt (huntharo)
added
the
ci:macos-unsigned
Harold Hunt (huntharo)
force-pushed
the
pwragent
branch
from
August 28, 2026 19:15
66ae2cd to
fe71949
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Getting a build onto an Apple Silicon Mac currently means either a
workflow_dispatchrun of the whole release pipeline, or applyingci:release-signingand pulling the unsignedsigning-input-macos-aarch64tarball out of a run that also entered both signing environments. Neither is what you want when the question is just "does this change work on my machine".ci:macos-unsignednow runs onemacos-15job that buildsaarch64-apple-darwinand attachesunsigned-macos-aarch64. The job summary carries thexattr -dr com.apple.quarantineline, since the binaries are neither signed nor notarized and Gatekeeper refuses them otherwise.Why a separate workflow
Not a second label inside
pwragent-release.yml. That pipeline is fail-closed andcheck-release-signing.pypins the property; adding an unsigned escape hatch would have meant gating the signing jobs off inside the one file written to make that impossible.So the contract check is extended to cover the new workflow instead. It must not enter an environment, read secrets, take
contents: write, or rename its artifact off theunsigned-prefix — this is an obvious place for a shipping path to grow later.pwragent-release-check.ymlgains the file in itspathsso the check actually runs when it changes.Timeout and cache
Follows #6 rather than the pre-#6 shape: 240 minutes, and restore/save split with
if: always()so a build killed at the cap keeps its partial target dir.The cache key is deliberately the release workflow's
cargo-macos-aarch64-<lock>— same target, same release profile, same three binaries — so the two legs read each other'scodex-rs/targetand a cold two-hour build only happens when neither has run recently.Verification
check-release-signing.pypasses. Each new assertion was mutation-tested: injectingsecrets., anenvironment:,contents: write, and an artifact rename each fail the check, and the file restores byte-identical.actionlintclean on the new workflow. (It flagsmacos-15-intelinpwragent-release.yml, but that is pre-existing — same warning atHEAD; actionlint's bundled runner list predates that label.)Stage distributionandPackage unsigned artifactsteps were extracted verbatim from the YAML and run against stub binaries: heredoc renders with no indentation leak,0755preserved, tarball layout matches the release one,signed=nopresent inPWRAGENT-BUILD.txt.The macOS build itself is unverified — no local runner. The
cargo buildand rusty_v8 steps are copied from the release workflow'smacos-aarch64matrix leg, which builds today.Trying it
Label this PR
ci:macos-unsigned—pull_requestevents use the workflow from the merge ref, so it applies to the PR that adds it. Theworkflow_dispatchbutton appears once this is onpwragent.🤖 Generated with Claude Code