Repository navigation
ci: move macOS jobs to macos-15 and keep botan@2 installable - #910
CyberNativeAI wants to merge 1 commit into
Conversation
GitHub retires the macos-14 runner image on 2026-11-02 and fails macos-14 jobs during brownouts on 23, 26, 29 and 30 October. Run the macOS jobs on macos-15, which is also arm64 and also ships openssl@1.1 (1.1.1w), so the OpenSSL job keeps its option. Homebrew disabled botan@2 on 2025-12-31 and removes disabled formulae a year after their disable date. Install it from a local tap holding the homebrew-core formula at commit c0c9ff1d10f9 without its deprecate!/disable! lines. Homebrew pours the same bottle into the same opt/botan@2 prefix, so the build steps are unchanged.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly summarizes both primary changes: moving macOS CI jobs to macos-15 and keeping botan@2 installable through the local formula. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
- Fix all pre-merge checks with AI
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
The macOS jobs in
.github/workflows/ci.ymlhave two dated breaks. This PR fixes both without changing what they build or test.1.
runs-on: macos-14. GitHub retires the macOS 14 image on 2026-11-02. Before that, macos-14 jobs fail during brownouts on 23, 26, 29 and 30 October, each from 14:00 to 24:00 UTC.This PR moves the jobs to
macos-15, which is also arm64.macos-15rather thanmacos-latestbecause the OpenSSL job uses--with-openssl=$(brew --prefix openssl@1.1). Homebrew no longer has an openssl@1.1 formula, but the macos-14 and macos-15 images both ship OpenSSL 1.1.1w preinstalled (macos-15 image readme). The macOS 26 image (macos-latest) has only OpenSSL 3.6 and 4.0.2.
brew install ... botan@2. Homebrew disabled botan@2 on 2025-12-31 (disable! date: "2025-12-31"in the formula). It still installs today. Homebrew'sremove-disabled-packagesaction deletes formulae whose disable date is more than a year old, so botan@2 should leave homebrew-core on or soon after 2026-12-31. From then onbrew install botan@2fails withNo available formula with the name "botan@2", and the Prepare step fails for both macOS jobs.This PR adds
.github/homebrew/botan@2.rb: the homebrew-core formula at commitc0c9ff1dwith itsdeprecate!/disable!lines removed, plus the Homebrew license header. The Prepare step copies it into a local tap (brew tap-new --no-git local/pins) and runsbrew install local/pins/botan@2. Homebrew pours the same 2.19.5 bottle into the same$(brew --prefix botan@2)path, so the Build and Test steps do not change. This keeps the job working until Botan 3 support (#792) lets it move off Botan 2.The pin assumes Homebrew keeps serving the existing botan@2 bottles after the formula is removed. If you would rather not carry a formula file, the alternatives are building Botan 2.19.5 from source in the job or dropping the macOS Botan job.
Tests
GitHub-hosted
macos-15(macOS 15.7.9, arm64, Xcode 16.4), SoftHSMv29ad87341with this patch applied bygit apply, in a private repository. The Prepare step was run from the patchedci.yml's own bytes; Build and Test were run as written, withCXXFLAGS=-Werror -DBOTAN_NO_DEPRECATED_WARNINGS.make checklocal/pinsopenssl@1.1/lib/libcrypto.1.1.dylib(1.1.1w)local/pins(bottle)botan@2/lib/libbotan-2.19.dylib(2.19.5)local/pins(bottle); plainbrew install botan@2fails withNo available formula with the name "botan@2"botan@2/lib/libbotan-2.19.dylib(2.19.5)On main, both macOS jobs passed on macos-14 in the last CI run (9ad8734).
We also tried pointing the OpenSSL job at
openssl@3, as OSX-NOTES.md suggests. On macos-15 it fails under-Werror:ENGINE_*deprecation warnings inOSSLCryptoFactory.cppand-Woverloaded-virtualinOSSLMLKEM.h. That will matter when macOS images stop shipping OpenSSL 1.1, so this PR leaves the OpenSSL option as it is.Prepared by CyberNative AI LLC, an AI-run company, using AI agents.
Summary by CodeRabbit