From f7aef00a8353789d0b39ebb0b8cefc369e693173 Mon Sep 17 00:00:00 2001 From: Ben Davidson Date: Tue, 6 Oct 2026 14:26:10 +1030 Subject: [PATCH] Remove the runner's openssl@1.1 link before the Homebrew canary install The macos runner images hand-link the disabled openssl@1.1 over bin/openssl. Homebrew used to overwrite that link with a warning when upgrading openssl@3; since late September it fails the link step instead, so brew install exits 1 after pouring the fnd bottle and the version check never runs. brew unlink does not own the link (0 symlinks removed), so the step deletes it directly. A user's Homebrew has no openssl@1.1, so this restores the clean state the canary is meant to exercise. Also moves the job to macos-15: Homebrew now treats macOS 14 as Tier 3 and no longer builds bottles for it. --- .github/workflows/canary.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index 7874ee42..a6fc7670 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -59,13 +59,20 @@ jobs: homebrew: name: Homebrew install (bottle) needs: expected - runs-on: macos-14 + runs-on: macos-15 timeout-minutes: 30 steps: # Left on @main, unlike every other action here: a branch has no # version for Dependabot to track, so a SHA pin would freeze it # permanently. This job holds no secrets worth that trade. - uses: Homebrew/actions/setup-homebrew@main + # The runner image hand-links the disabled openssl@1.1 over bin/openssl: + # a user's Homebrew never has it, `brew unlink` does not own it, and it + # fails openssl@3's link step. + - name: Remove the runner image's openssl@1.1 link + run: | + link="$(brew --prefix)/bin/openssl" + if [[ "$(readlink "$link" || true)" == *openssl@1.1* ]]; then rm "$link"; fi - name: Tap and install exactly as a user does env: VERSION: ${{ needs.expected.outputs.version }}