diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml index 674ea8c06..07a8c7f51 100644 --- a/.github/workflows/desktop-build.yml +++ b/.github/workflows/desktop-build.yml @@ -18,7 +18,7 @@ jobs: environment: desktop-signing needs: changes if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.macos != 'false') }} - runs-on: macos-26-xlarge + runs-on: blacksmith-6vcpu-macos-26 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: @@ -192,7 +192,7 @@ jobs: verify-macos-desktop-artifacts: needs: - build-macos - runs-on: macos-26-xlarge + runs-on: macos-26 permissions: contents: read steps: diff --git a/.github/workflows/ios-dev-testflight.yml b/.github/workflows/ios-dev-testflight.yml index 95297057a..ef9d8312b 100644 --- a/.github/workflows/ios-dev-testflight.yml +++ b/.github/workflows/ios-dev-testflight.yml @@ -22,7 +22,7 @@ jobs: github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') environment: apple-signing - runs-on: macos-26-xlarge + runs-on: blacksmith-6vcpu-macos-26 timeout-minutes: 240 permissions: contents: read @@ -126,7 +126,7 @@ jobs: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') needs: build-ios-dev environment: apple-signing - runs-on: macos-26-xlarge + runs-on: macos-26 timeout-minutes: 45 permissions: contents: read diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml index 4f82dcfa2..a0538f3d5 100644 --- a/.github/workflows/mobile-build.yml +++ b/.github/workflows/mobile-build.yml @@ -34,7 +34,7 @@ jobs: github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.ios != 'false') - runs-on: macos-26-xlarge + runs-on: blacksmith-6vcpu-macos-26 permissions: contents: read id-token: write @@ -114,7 +114,7 @@ jobs: verify-ios-artifacts: needs: build-ios - runs-on: macos-26-xlarge + runs-on: macos-26 permissions: contents: read steps: @@ -145,7 +145,7 @@ jobs: github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') needs: verify-ios-artifacts - runs-on: macos-26-xlarge + runs-on: macos-26 permissions: contents: read steps: @@ -204,7 +204,7 @@ jobs: github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (needs.changes.result != 'success' || needs.changes.outputs.ios_onnx != 'false') - runs-on: macos-26-xlarge + runs-on: blacksmith-6vcpu-macos-26 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: diff --git a/.github/workflows/proxy-rust.yml b/.github/workflows/proxy-rust.yml index 5d55de5f1..f68330c16 100644 --- a/.github/workflows/proxy-rust.yml +++ b/.github/workflows/proxy-rust.yml @@ -91,7 +91,7 @@ jobs: archive: maple-proxy-linux-x86_64.tar.gz - runner: ubuntu-24.04-arm archive: maple-proxy-linux-aarch64.tar.gz - - runner: macos-26-xlarge + - runner: blacksmith-6vcpu-macos-26 archive: maple-proxy-macos-aarch64.tar.gz - runner: windows-2025 archive: maple-proxy-windows-x86_64.zip diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index be24d468b..0f1522502 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -137,7 +137,7 @@ jobs: fail-fast: false matrix: include: - - platform: macos-26-xlarge + - platform: blacksmith-6vcpu-macos-26 nix_shell: ci artifact_prefix: macos - platform: blacksmith-8vcpu-ubuntu-2404 @@ -152,7 +152,7 @@ jobs: persist-credentials: false - name: Select pinned Xcode - if: startsWith(matrix.platform, 'macos-26') + if: runner.os == 'macOS' run: python3 scripts/ci/select-xcode.py - name: Install Nix @@ -476,7 +476,7 @@ jobs: build-ios: environment: apple-signing needs: classify-app-release - runs-on: macos-26-xlarge + runs-on: blacksmith-6vcpu-macos-26 permissions: contents: write id-token: write @@ -635,7 +635,7 @@ jobs: archive: maple-proxy-linux-x86_64.tar.gz - runner: ubuntu-24.04-arm archive: maple-proxy-linux-aarch64.tar.gz - - runner: macos-26-xlarge + - runner: blacksmith-6vcpu-macos-26 archive: maple-proxy-macos-aarch64.tar.gz - runner: windows-2025 archive: maple-proxy-windows-x86_64.zip @@ -824,7 +824,7 @@ jobs: needs: - classify-app-release - build-tauri - runs-on: macos-26-xlarge + runs-on: macos-26 permissions: contents: read steps: @@ -960,7 +960,7 @@ jobs: - update-latest-json - verify-android-release-artifacts - verify-proxy-release-artifacts - runs-on: macos-26-xlarge + runs-on: macos-26 permissions: contents: read steps: diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md index ced2361a9..e3fd942df 100644 --- a/docs/repository-workflows.md +++ b/docs/repository-workflows.md @@ -74,14 +74,16 @@ persistent vendor disks or Docker builders are configured by these workflows. ## macOS runners and Apple toolchain -Unsigned Research desktop/iOS PR builds and Agent release-binary jobs use -explicit ARM64 `blacksmith-6vcpu-macos-26` runners. Other macOS jobs retain -`macos-26` or `macos-26-xlarge` runners. Agent preview packaging and protected -signing use standard GitHub `macos-26` runners to assemble prebuilt binaries. -The Agent's final signed-package -provenance identifies the GitHub packaging/signing job; Blacksmith is trusted -for prebuilt binary integrity. Research -desktop and iOS builds select stable Xcode 26.5, build `17F42`, from +Research desktop/iOS builds, iOS ONNX cache warming, Agent release-binary jobs +and native proxy macOS archives use ARM64 `blacksmith-6vcpu-macos-26` runners. +Artifact verifiers, TestFlight uploads, and Agent preview packaging/protected +signing use standard GitHub `macos-26` runners. Research signed builders retain +their existing `desktop-signing` or `apple-signing` environment, so their +provider receives that environment's secret context. Existing master pushes +can build and upload independent Dev/Prod TestFlight artifacts after verification. +The Agent's final signed-package provenance identifies its GitHub +packaging/signing job; Blacksmith is trusted for prebuilt binary integrity. +Research desktop and iOS builds select stable Xcode 26.5, build `17F42`, from [`scripts/ci/apple-toolchain.json`](../scripts/ci/apple-toolchain.json) through the shared selector, which aligns the runner's active `xcode-select` directory and `DEVELOPER_DIR`; the root Nix shell exports the same version and build diff --git a/scripts/ci/test_select_xcode.py b/scripts/ci/test_select_xcode.py index 17e0f4fc3..6a0cff06d 100644 --- a/scripts/ci/test_select_xcode.py +++ b/scripts/ci/test_select_xcode.py @@ -150,6 +150,8 @@ def test_no_workflow_uses_retired_mac_os_and_every_native_selector_has_checkout( self.assertNotIn("Xcode_26.5_beta", step.get("run", "")) continue selectors.append((path.name, job_id)) + if "if" in step: + self.assertEqual(step["if"], "runner.os == 'macOS'", (path.name, job_id)) checkout = [s for s in steps[:index] if s.get("uses", "").startswith("actions/checkout@")] self.assertEqual(len(checkout), 1, (path.name, job_id)) self.assertIs(checkout[0]["with"]["persist-credentials"], False)