From 6c6581cf7236443a99b9e9f4433cd700358038e6 Mon Sep 17 00:00:00 2001 From: subencheng Date: Fri, 11 Sep 2026 15:47:25 -0700 Subject: [PATCH] Run the macOS binaries job on a larger Apple Silicon runner **Why** The release critical path is goreleaser-binaries, and its dominant cost is Go compilation. macos-latest has 3 vCPUs and GoReleaser builds one target per core, so with four targets the fourth queues behind the first three. This is measurable and universal. Across the most recent successful release of nine connectors, exactly three targets start together and macos-arm64 waits: connector 4th target starts macos-amd64 post-hook delta baton-hubspot 108s 108s 0.1s baton-snowflake 117s 118s 0.8s baton-slack 160s 162s 2.9s baton-salesforce 162s 165s 2.4s baton-zoom 169s 170s 1.0s baton-github 176s 177s 0.9s baton-jira 192s 194s 1.9s baton-aws 200s 201s 1.1s baton-okta 331s 335s 3.7s The gon post-hook fires the instant a build finishes, so the fourth target provably starts when the first frees its slot rather than running concurrently. **What this changes** - Adds a macos_runner input, defaulting to macos-latest-xlarge (Apple Silicon M2, 5 vCPU). Five slots for four targets removes the queueing entirely. - validate-inputs restricts the value to GitHub-hosted Apple Silicon labels. This job holds the Apple signing certificate and assumes the artifacts AWS role, so the runner it lands on is a trust decision; a free-form label would let a caller point it at a runner they control. Intel labels are deliberately excluded. macos-latest-large is the 12 vCPU option, but it would change the codesigning host architecture and move the Homebrew prefix from /opt/homebrew to /usr/local, which the gon install step depends on. **What this does not claim** The saving is not predicted here. The logs show when each build starts but not when the two linux builds finish, so per-core scaling cannot be derived from them; the only defensible claim is that the queueing is real and five slots removes it. Treat this as the experiment that measures it. Larger runners bill at a higher per-minute rate, and this job runs on every connector release, so the default should be reviewed against actual spend once the compile phase has been measured on the new runner. **Validation** - Parsed .github/workflows/release.yaml with PyYAML; confirmed the input default and that the job resolves runs-on from it. - Exercised the allowlist against macos-latest, macos-latest-xlarge, macos-15-xlarge (accepted) and macos-latest-large, macos-13, self-hosted, and a shell-injection attempt (rejected). - scripts/test-normalize-release-options.sh, scripts/test-derive-iam-role-name.sh, scripts/test-release-config-templates.py, go build ./... Not validated: no release has been run on the new runner. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yaml | 26 +++++++++++++++++++++++++- README.md | 1 + 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 73b53d9..a6bacf2 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -32,6 +32,11 @@ on: type: string default: "homebrew-baton" description: "ConductorOne Homebrew tap repository name." + macos_runner: + required: false + type: string + default: "macos-latest-xlarge" + description: "Runner label for the macOS binaries job. Must be an Apple Silicon label; Intel runners would change the Homebrew prefix and the codesigning host." go_source_hygiene: required: false type: boolean @@ -185,6 +190,23 @@ jobs: exit 1 fi + - name: Validate macOS runner label + env: + MACOS_RUNNER: ${{ inputs.macos_runner }} + run: | + # This job holds the Apple signing certificate and assumes the artifacts AWS role, + # so the runner it lands on is a trust decision, not a preference. Allow only + # GitHub-hosted Apple Silicon labels. + case "$MACOS_RUNNER" in + macos-latest|macos-latest-xlarge|macos-14-xlarge|macos-15-xlarge|macos-26-xlarge) + echo "Using macOS runner: $MACOS_RUNNER" + ;; + *) + echo "::error::macos_runner must be a GitHub-hosted Apple Silicon label, got: $MACOS_RUNNER" + exit 1 + ;; + esac + - name: Validate GORELEASER_PRO_KEY when msi enabled if: inputs.msi == true env: @@ -303,7 +325,9 @@ jobs: goreleaser-binaries: needs: [determine-workflows-ref, release-preflight] - runs-on: macos-latest + # macos-latest has 3 vCPUs and GoReleaser builds one target per core, so the fourth + # target queues behind the first three. See the PR description for the measurements. + runs-on: ${{ inputs.macos_runner }} permissions: contents: read id-token: write # <-- needed for cosign keyless (OIDC) diff --git a/README.md b/README.md index d1767b0..c22e596 100644 --- a/README.md +++ b/README.md @@ -88,6 +88,7 @@ The release workflow accepts the following input parameters: | `msi` | No | `true` | Whether to build MSI Windows installers | | `msi_wxs_path` | No | `""` | Path to custom WXS template for MSI installer (uses default if not set) | | `brew` | No | `true` | Whether to publish a Homebrew formula to the selected public `conductorone` tap | +| `macos_runner` | No | `macos-latest-xlarge` | Runner label for the macOS binaries job. Restricted to GitHub-hosted Apple Silicon labels (`macos-latest`, `macos-latest-xlarge`, `macos-14/15/26-xlarge`). | 2. Ensure your repository has the following secrets configured: