From 0e0ee990dda96efc049f2bec0a2a5792c13a4882 Mon Sep 17 00:00:00 2001 From: yves <123611181+yvesoddly@users.noreply.github.com> Date: Fri, 13 Nov 2026 13:13:11 -0600 Subject: [PATCH 1/2] ci(release): build the macOS release on a self-hosted runner Hosted Apple Silicon runners kept never picking up the Mac build, so GitHub cancelled it and every nightly since Nov 12 went unpublished. Main now runs it on the runner the FORK_MAC_RUNNER variable names, and skips the sudo certificate trust there, since that host trusts the certificate already. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/fork-release.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/fork-release.yml b/.github/workflows/fork-release.yml index 517926e06e61e..741b0f2b088d7 100644 --- a/.github/workflows/fork-release.yml +++ b/.github/workflows/fork-release.yml @@ -8,7 +8,10 @@ name: Fork Release # platform before it publishes. Linux and Android stages live in # fork-release-linux.yml, which picks Blacksmith for trusted events. # Windows uses the Blacksmith label from the version stage while this month's -# Blacksmith tally leaves room; macOS stays hosted. +# Blacksmith tally leaves room. macOS builds on the self-hosted runner that +# the FORK_MAC_RUNNER variable names (plum, set up in ymln's dotfiles), since +# hosted Apple Silicon runners often never pick the job up; unset the variable +# to go back to hosted. on: push: @@ -44,7 +47,9 @@ jobs: # The version stage writes blacksmith_windows only for trusted events, from a validated variable. runs-on: >- ${{ matrix.platform == 'win' && github.repository == 'issuelt/t3code' && github.ref == 'refs/heads/main' - && needs.version.outputs.blacksmith_windows || matrix.runner }} + && needs.version.outputs.blacksmith_windows + || matrix.platform == 'mac' && github.repository == 'issuelt/t3code' && github.ref == 'refs/heads/main' + && vars.FORK_MAC_RUNNER || matrix.runner }} # route-blacksmith.sh reserves Windows's 60 minutes; macOS keeps the default. timeout-minutes: ${{ matrix.timeout_minutes || 360 }} strategy: @@ -118,7 +123,10 @@ jobs: rm "$RUNNER_TEMP/fork-signing.p12" security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain" >/dev/null security list-keychains -d user -s "$keychain" login.keychain-db - sudo security add-trusted-cert -d -r trustRoot -p codeSign -k /Library/Keychains/System.keychain .github/fork/mac-signing-cert.pem + # The self-hosted runner has no sudo; its host trusts this certificate already. + if [ "$RUNNER_ENVIRONMENT" = github-hosted ]; then + sudo security add-trusted-cert -d -r trustRoot -p codeSign -k /Library/Keychains/System.keychain .github/fork/mac-signing-cert.pem + fi security find-identity -v -p codesigning "$keychain" | grep -F '"T3 Code Fork Signing"' echo "CSC_NAME=T3 Code Fork Signing" >> "$GITHUB_ENV" # electron-builder skips signing on pull requests unless told otherwise. From 7bb565ce9aeec48f55118beb8399593b50e23b26 Mon Sep 17 00:00:00 2001 From: yves <123611181+yvesoddly@users.noreply.github.com> Date: Fri, 13 Nov 2026 13:29:29 -0600 Subject: [PATCH 2/2] ci(release): desktop checkout starts from an empty workspace Review: "On a persistent self-hosted runner, the second release reuses the previous workspace, but the Checkout step still runs `git init .` followed by `git remote add origin ...`" (Codex, Greptile). It also kept the last build's release/ files, which the asset step would have published. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/fork-release.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/fork-release.yml b/.github/workflows/fork-release.yml index 741b0f2b088d7..cbfe3358cad3d 100644 --- a/.github/workflows/fork-release.yml +++ b/.github/workflows/fork-release.yml @@ -74,6 +74,8 @@ jobs: shell: bash run: | set -euo pipefail + # A self-hosted runner keeps the last job's checkout and build outputs. + find . -mindepth 1 -delete git init . git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" git fetch --no-tags --depth=1 origin "$GITHUB_SHA"