chore: move macOS packaging to shared ARM64 runner #25

Merged

erik merged 2 commits from chore/task-1088fb54-macos-runner into main 2026-10-17 12:57:07 -05:00

Conversation 1 Commits 2 Files changed 4 +115 -59

erik commented 2026-10-17 08:54:43 -05:00

Owner

Copy link

Summary

Prepare the kvshare phase of task-1088fb54: route native macOS packaging to the generic shared macos-arm64 label, use standard TLS trust rather than obsolete CA overrides, and make branch dispatch with publish=false avoid signing credentials and all release/API uploads. Published releases preserve the existing persistent-signing requirement. Linux runner labels and regular CI are unchanged.

Acceptance criteria for this phase

• Native macOS packaging targets shared macos-arm64 without host-specific committed configuration.
• A branch publish=false dispatch builds real macOS/Arch packages without credential import, published releases, or uploaded assets.
• Publishing retains the persistent app-signing requirement and temporary-keychain cleanup on failure/success (source/regression verified; signed publishing not executed).
• Standard TLS verification, pinned Node checkout, and no persisted checkout credentials.
• Project checks/CI and regression checks pass; runner availability/security/dispatch behavior documented.

Verification at head 0ab54657a8

• scripts/pre-pr.sh: passed, including Rust format/clippy/tests, Swift format/native build/tests, release/version/cleanup/workflow regression tests.
• Workflow schema and embedded shell syntax: passed.
• CI #87: https://forge.caradoc.com/erik/kvshare/actions/runs/87 — SUCCESS, both existing Linux jobs.
• Nonpublishing Release #86: https://forge.caradoc.com/erik/kvshare/actions/runs/86 — SUCCESS. macOS package job ran on shared runner ID 4; Linux preparation/Arch packaging stayed on runner ID 1.
• Both real package builds succeeded; macOS checksum and payload-directory mode 0755 verified from package metadata without installing/extracting a discoverable app.
• Certificate import/keychain cleanup/release creation/both asset uploads explicitly reported skipped. Before/after published-release/asset inventory is identical.
• Fixed runner umask 077 producing root-only installer directories by using umask 022 in packaging only; private runner state/workspace permissions remain unchanged.
• Four pkgbuild stderr lines saying write: Permission denied remain visible. Independently reproduced exactly four on minimal synthetic packages with both umask values and successful exit; the actual package passes checksum/metadata/permission checks. No error output is filtered or permissions bypassed.

Boundaries

No deployment, installation, release publication, old-runner removal, other-repository cutover, or main-branch merge is authorized. Signed publication/installer signing credentials are not validated by this nonpublishing test. Stop for explicit human merge approval. Overall migration remains in progress.

Task: task-1088fb54

## Summary Prepare the kvshare phase of task-1088fb54: route native macOS packaging to the generic shared macos-arm64 label, use standard TLS trust rather than obsolete CA overrides, and make branch dispatch with publish=false avoid signing credentials and all release/API uploads. Published releases preserve the existing persistent-signing requirement. Linux runner labels and regular CI are unchanged. ## Acceptance criteria for this phase - [x] Native macOS packaging targets shared macos-arm64 without host-specific committed configuration. - [x] A branch publish=false dispatch builds real macOS/Arch packages without credential import, published releases, or uploaded assets. - [x] Publishing retains the persistent app-signing requirement and temporary-keychain cleanup on failure/success (source/regression verified; signed publishing not executed). - [x] Standard TLS verification, pinned Node checkout, and no persisted checkout credentials. - [x] Project checks/CI and regression checks pass; runner availability/security/dispatch behavior documented. ## Verification at head 0ab54657a82ee7b8a4b9d57fdb786087b43b0287 - scripts/pre-pr.sh: passed, including Rust format/clippy/tests, Swift format/native build/tests, release/version/cleanup/workflow regression tests. - Workflow schema and embedded shell syntax: passed. - CI #87: https://forge.caradoc.com/erik/kvshare/actions/runs/87 — SUCCESS, both existing Linux jobs. - Nonpublishing Release #86: https://forge.caradoc.com/erik/kvshare/actions/runs/86 — SUCCESS. macOS package job ran on shared runner ID 4; Linux preparation/Arch packaging stayed on runner ID 1. - Both real package builds succeeded; macOS checksum and payload-directory mode 0755 verified from package metadata without installing/extracting a discoverable app. - Certificate import/keychain cleanup/release creation/both asset uploads explicitly reported skipped. Before/after published-release/asset inventory is identical. - Fixed runner umask 077 producing root-only installer directories by using umask 022 in packaging only; private runner state/workspace permissions remain unchanged. - Four pkgbuild stderr lines saying write: Permission denied remain visible. Independently reproduced exactly four on minimal synthetic packages with both umask values and successful exit; the actual package passes checksum/metadata/permission checks. No error output is filtered or permissions bypassed. ## Boundaries No deployment, installation, release publication, old-runner removal, other-repository cutover, or main-branch merge is authorized. Signed publication/installer signing credentials are not validated by this nonpublishing test. Stop for explicit human merge approval. Overall migration remains in progress. Task: task-1088fb54

erik added 1 commit 2026-10-17 08:54:43 -05:00

chore: route macOS releases to shared ARM64 runner ... 4ebb5b7677

Task: #task-1088fb54

erik added 1 commit 2026-10-17 08:59:13 -05:00

fix: verify readable macOS installer payload permissions ... 0ab54657a8

Task: #task-1088fb54

erik commented 2026-10-17 09:04:52 -05:00

Author

Owner

Copy link

Independent review — task-1088fb54

Summary

approved for the explicitly authorized kvshare cutover-preparation phase only. Reviewed the open PR's remote body, complete diff and commits at head 0ab54657a82ee7b8a4b9d57fdb786087b43b0287, the matching clean task worktree's release workflow/package implementation, and supplied verification evidence. The unrelated original checkout was not used as PR source. No implementation, runner changes, package installation, publication, merge or task closure performed.

Acceptance criteria

1. met — Generic routing: native packaging targets macos-arm64; no machine-specific runner hostname/IP is introduced. Both Linux release jobs retain ubuntu-latest; regular CI is unchanged. Supplied run evidence identifies shared runner ID 4 for macOS and ID 1 for Linux.
2. met — Real nonpublishing branch build: Release #86 succeeded at the reviewed head with actual macOS and Arch package builds. Certificate import, keychain cleanup, release creation and both asset uploads are skipped. Nonpublishing signing identities explicitly resolve to empty strings and signing enforcement to 0. The supplied before/after release inventory comparison is unchanged. The macOS job log confirms the exact checkout SHA, completed package build, matching checksum and successful 0755 application-directory verification.
3. met — Publishing safeguards retained: source still requires certificate/password for import, sets signing enforcement to 1 for publishing, and fails packaging without an app identity; the package implementation verifies persistent Apple signing. Temporary certificate/keychain paths are recorded before creation/import, and cleanup retains always() for publishing, covering preceding failures as well as success. New regression assertions protect publishing/nonpublishing guards. This is source/regression evidence only: signed publication and signing-credential availability were not executed or validated.
4. met — TLS/checkout credentials: obsolete CA overrides are removed without introducing insecure TLS settings. Preparation and native macOS checkout use the pinned Node action with persist-credentials: false; the macOS log shows authentication removal before building and post-job cleanup. Arch retains its HTTPS SHA checkout without embedding authentication.
5. met — Checks, regression and documentation: supplied final pre-PR log passes Rust formatting/clippy/tests, Swift formatting/native build/tests and release tooling; CI #87 is successful at the same head. Independently reran bash scripts/test-release.sh in the matching task worktree: passed. New checks cover routing, signing/publication guards, TLS restrictions, checksum and directory-mode verification. Documentation covers prerequisites, account-access risk, availability, branch publish=false, tag publishing behavior and diagnostic-package limitations.

Package diagnostic assessment

The four unfiltered pkgbuild write: Permission denied lines are present in the successful actual job. Supplied minimal-package reproduction reports exactly four with exit 0 under both umasks; it separately distinguishes 0700 under umask 077 from 0755 under 022. The PR fixes the real restrictive-directory defect with a build-step-local umask, not relaxed runner-state permissions. The live workflow then checks checksums and all five required application-directory BOM entries as 0755 without expanding an app payload or installing it. This evidence does not establish a remaining package defect; no real defect is waived and no diagnostic is suppressed.

Evidence inspected

• kvshare-cutover-verification.json: both successful head-matched runs, per-step success/skip results, unchanged release inventory and explicit signed-publication limitation.
• kvshare-nonpublishing-run-86-task-1123.log: exact checkout SHA, authentication removal, real build, four diagnostics, checksum/permission checks and Job succeeded.
• kvshare-cutover-pre-pr-final.log and kvshare-pkgbuild-diagnostic-reproduction.json.
• Workflow-schema/embedded-shell validation is reported in the PR; not independently rerun in this review.

Blocking issues

None (0).

Warnings

None (0).

Final verdict

approved — criteria_total=5, criteria_met=5, criteria_missing=0. PR remains open awaiting explicit human merge approval. The overall task must remain open: signed-publication decisions, other-repository migration and old-runner/mini inspection or retirement remain outside this approved phase. No merge or task closure is authorized by this review.

## Independent review — task-1088fb54 ### Summary **approved** for the explicitly authorized kvshare cutover-preparation phase only. Reviewed the open PR's remote body, complete diff and commits at head `0ab54657a82ee7b8a4b9d57fdb786087b43b0287`, the matching clean task worktree's release workflow/package implementation, and supplied verification evidence. The unrelated original checkout was not used as PR source. No implementation, runner changes, package installation, publication, merge or task closure performed. ### Acceptance criteria 1. **met — Generic routing:** native packaging targets `macos-arm64`; no machine-specific runner hostname/IP is introduced. Both Linux release jobs retain `ubuntu-latest`; regular CI is unchanged. Supplied run evidence identifies shared runner ID 4 for macOS and ID 1 for Linux. 2. **met — Real nonpublishing branch build:** Release [#86](https://forge.caradoc.com/erik/kvshare/actions/runs/86) succeeded at the reviewed head with actual macOS and Arch package builds. Certificate import, keychain cleanup, release creation and both asset uploads are skipped. Nonpublishing signing identities explicitly resolve to empty strings and signing enforcement to `0`. The supplied before/after release inventory comparison is unchanged. The macOS job log confirms the exact checkout SHA, completed package build, matching checksum and successful 0755 application-directory verification. 3. **met — Publishing safeguards retained:** source still requires certificate/password for import, sets signing enforcement to `1` for publishing, and fails packaging without an app identity; the package implementation verifies persistent Apple signing. Temporary certificate/keychain paths are recorded before creation/import, and cleanup retains `always()` for publishing, covering preceding failures as well as success. New regression assertions protect publishing/nonpublishing guards. This is source/regression evidence only: signed publication and signing-credential availability were not executed or validated. 4. **met — TLS/checkout credentials:** obsolete CA overrides are removed without introducing insecure TLS settings. Preparation and native macOS checkout use the pinned Node action with `persist-credentials: false`; the macOS log shows authentication removal before building and post-job cleanup. Arch retains its HTTPS SHA checkout without embedding authentication. 5. **met — Checks, regression and documentation:** supplied final pre-PR log passes Rust formatting/clippy/tests, Swift formatting/native build/tests and release tooling; CI [#87](https://forge.caradoc.com/erik/kvshare/actions/runs/87) is successful at the same head. Independently reran `bash scripts/test-release.sh` in the matching task worktree: passed. New checks cover routing, signing/publication guards, TLS restrictions, checksum and directory-mode verification. Documentation covers prerequisites, account-access risk, availability, branch `publish=false`, tag publishing behavior and diagnostic-package limitations. ### Package diagnostic assessment The four unfiltered `pkgbuild` `write: Permission denied` lines are present in the successful actual job. Supplied minimal-package reproduction reports exactly four with exit 0 under both umasks; it separately distinguishes 0700 under umask 077 from 0755 under 022. The PR fixes the real restrictive-directory defect with a build-step-local umask, not relaxed runner-state permissions. The live workflow then checks checksums and all five required application-directory BOM entries as 0755 without expanding an app payload or installing it. This evidence does not establish a remaining package defect; no real defect is waived and no diagnostic is suppressed. ### Evidence inspected - `kvshare-cutover-verification.json`: both successful head-matched runs, per-step success/skip results, unchanged release inventory and explicit signed-publication limitation. - `kvshare-nonpublishing-run-86-task-1123.log`: exact checkout SHA, authentication removal, real build, four diagnostics, checksum/permission checks and `Job succeeded`. - `kvshare-cutover-pre-pr-final.log` and `kvshare-pkgbuild-diagnostic-reproduction.json`. - Workflow-schema/embedded-shell validation is reported in the PR; not independently rerun in this review. ### Blocking issues None (0). ### Warnings None (0). ### Final verdict **approved** — criteria_total=5, criteria_met=5, criteria_missing=0. PR remains open awaiting explicit human merge approval. The overall task must remain open: signed-publication decisions, other-repository migration and old-runner/mini inspection or retirement remain outside this approved phase. No merge or task closure is authorized by this review.

erik merged commit 5a2810fdc0 into main 2026-10-17 12:57:07 -05:00

erik deleted branch chore/task-1088fb54-macos-runner 2026-10-17 12:57:07 -05:00

erik referenced this pull request from a commit 2026-10-17 12:57:09 -05:00

Merge pull request 'chore: move macOS packaging to shared ARM64 runner' (#25) from chore/task-1088fb54-macos-runner into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

erik/kvshare!25

No description provided.