Skip to content

ci(release): build the macOS release on a self-hosted runner #99

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yvesoddly merged 2 commits into from
Nov 13, 2026
+13 −3
Merged

ci(release): build the macOS release on a self-hosted runner #99

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0e0ee99
ci(release): build the macOS release on a self-hosted runner
yvesoddly Nov 13, 2026
7bb565c
ci(release): desktop checkout starts from an empty workspace
yvesoddly Nov 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions .github/workflows/fork-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,10 @@ name: Fork Release
# platform before it publishes. Linux and Android stages live in
# fork-release-linux.yml, which picks Blacksmith for trusted events.
# Windows uses the Blacksmith label from the version stage while this month's
# Blacksmith tally leaves room; macOS stays hosted.
# Blacksmith tally leaves room. macOS builds on the self-hosted runner that
# the FORK_MAC_RUNNER variable names (plum, set up in ymln's dotfiles), since
# hosted Apple Silicon runners often never pick the job up; unset the variable
# to go back to hosted.

on:
push:
Expand Down Expand Up @@ -44,7 +47,9 @@ jobs:
# The version stage writes blacksmith_windows only for trusted events, from a validated variable.
runs-on: >-
${{ matrix.platform == 'win' && github.repository == 'issuelt/t3code' && github.ref == 'refs/heads/main'
&& needs.version.outputs.blacksmith_windows || matrix.runner }}
&& needs.version.outputs.blacksmith_windows
|| matrix.platform == 'mac' && github.repository == 'issuelt/t3code' && github.ref == 'refs/heads/main'
&& vars.FORK_MAC_RUNNER || matrix.runner }}
Comment on lines +51 to +52

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Make checkout reusable before selecting a persistent runner

On a persistent self-hosted runner, the second release reuses the previous workspace, but the Checkout step in .github/workflows/fork-release.yml still runs git init . followed by git remote add origin ... (lines 77–78). Reinitialization preserves the existing remote, so checkout exits under set -e with error: remote origin already exists. I reproduced this sequence locally; git remote -h distinguishes remote add from remote set-url. Unlike hosted runners, self-hosted runners do not require a clean instance for each job. Make checkout idempotent and clean previous build outputs, or explicitly provision a fresh workspace per job; otherwise subsequent macOS builds fail and block the dependent publish job.

Useful? React with 👍 / 👎.

@yvesoddly yvesoddly Nov 13, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 7bb565c: the checkout now empties the workspace first, which also keeps the previous build's release/ files from being published.

Comment thread
greptile-apps[bot] marked this conversation as resolved.
Resolved
# route-blacksmith.sh reserves Windows's 60 minutes; macOS keeps the default.
timeout-minutes: ${{ matrix.timeout_minutes || 360 }}
strategy:
Expand All @@ -69,6 +74,8 @@ jobs:
shell: bash
run: |
set -euo pipefail
# A self-hosted runner keeps the last job's checkout and build outputs.
find . -mindepth 1 -delete
git init .
git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
git fetch --no-tags --depth=1 origin "$GITHUB_SHA"
Expand Down Expand Up @@ -118,7 +125,10 @@ jobs:
rm "$RUNNER_TEMP/fork-signing.p12"
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain" >/dev/null
security list-keychains -d user -s "$keychain" login.keychain-db
sudo security add-trusted-cert -d -r trustRoot -p codeSign -k /Library/Keychains/System.keychain .github/fork/mac-signing-cert.pem
# The self-hosted runner has no sudo; its host trusts this certificate already.
if [ "$RUNNER_ENVIRONMENT" = github-hosted ]; then
sudo security add-trusted-cert -d -r trustRoot -p codeSign -k /Library/Keychains/System.keychain .github/fork/mac-signing-cert.pem
fi
security find-identity -v -p codesigning "$keychain" | grep -F '"T3 Code Fork Signing"'
echo "CSC_NAME=T3 Code Fork Signing" >> "$GITHUB_ENV"
# electron-builder skips signing on pull requests unless told otherwise.
Expand Down
Loading