Skip to content

Run the macOS binaries job on a larger Apple Silicon runner #117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Bencheng21 wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Run the macOS binaries job on a larger Apple Silicon runner #117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 25 additions & 1 deletion .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,11 @@ on:
type: string
default: "homebrew-baton"
description: "ConductorOne Homebrew tap repository name."
macos_runner:
required: false
type: string
default: "macos-latest-xlarge"
description: "Runner label for the macOS binaries job. Must be an Apple Silicon label; Intel runners would change the Homebrew prefix and the codesigning host."
go_source_hygiene:
required: false
type: boolean
Expand Down Expand Up @@ -185,6 +190,23 @@ jobs:
exit 1
fi

- name: Validate macOS runner label
env:
MACOS_RUNNER: ${{ inputs.macos_runner }}
run: |
# This job holds the Apple signing certificate and assumes the artifacts AWS role,
# so the runner it lands on is a trust decision, not a preference. Allow only
# GitHub-hosted Apple Silicon labels.
case "$MACOS_RUNNER" in
macos-latest|macos-latest-xlarge|macos-14-xlarge|macos-15-xlarge|macos-26-xlarge)
echo "Using macOS runner: $MACOS_RUNNER"
;;
*)
echo "::error::macos_runner must be a GitHub-hosted Apple Silicon label, got: $MACOS_RUNNER"
exit 1
;;
esac

- name: Validate GORELEASER_PRO_KEY when msi enabled
if: inputs.msi == true
env:
Expand Down Expand Up @@ -303,7 +325,9 @@ jobs:

goreleaser-binaries:
needs: [determine-workflows-ref, release-preflight]
runs-on: macos-latest
# macos-latest has 3 vCPUs and GoReleaser builds one target per core, so the fourth
# target queues behind the first three. See the PR description for the measurements.
runs-on: ${{ inputs.macos_runner }}
permissions:
contents: read
id-token: write # <-- needed for cosign keyless (OIDC)
Expand Down
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,7 @@ The release workflow accepts the following input parameters:
| `msi` | No | `true` | Whether to build MSI Windows installers |
| `msi_wxs_path` | No | `""` | Path to custom WXS template for MSI installer (uses default if not set) |
| `brew` | No | `true` | Whether to publish a Homebrew formula to the selected public `conductorone` tap |
| `macos_runner` | No | `macos-latest-xlarge` | Runner label for the macOS binaries job. Restricted to GitHub-hosted Apple Silicon labels (`macos-latest`, `macos-latest-xlarge`, `macos-14/15/26-xlarge`). |

2. Ensure your repository has the following secrets configured:

Expand Down