ci(macos): run the darwin target this repository already ships - #26
Merged
Conversation
`schemas/v1/release-installation.schema.json` and `bundle-trust.schema.json`
both declare `target_os: {"enum": ["darwin", "linux"]}`, and the release builder
emits darwin artifacts. Every test so far ran on ubuntu only, so darwin has been
cross-compiled and never executed.
Cross-compilation proves it builds. It says nothing about behaviour, and this
engine is made of the things that differ between the two systems: path
resolution, `os.Root` confinement, file locking, temp directory semantics, case
sensitivity. `agent-runtime` already tests `[ubuntu-latest, macos-latest]` for
the same reason — it ships the same two targets.
Standard macOS runners are unmetered on public repositories, so this costs
nothing. macOS-XL is billed even on public and is deliberately not used.
A separate workflow rather than a matrix inside `gds-ci.yml`, because that file
is a generated projection carrying a single `.Runner`; widening it means
changing the engine's template and generator and then regenerating under the
governed projection path. `.github` is outside `developmentBundleSourcePaths`,
so adding a file here leaves the bundle lock alone — confirmed by running
`gds context` on this branch, which reports no
`GDS_CONTEXT_POLICY_SOURCE_DIGEST_MISMATCH`. It is the same reason
`release-bundle.yml` and `codeql.yml` already sit beside the generated workflow.
The steps are the repository's own declared commands from `.gds/repository.yaml`
(`go vet ./...`, `go build -trimpath ./core/cmd/gds`, `go test ./...`) so this
lane cannot drift into testing something else. Not added to
`required_contexts`: a lane with no green run yet should not gate the pull
request that introduces it.
This may well fail on its first run. That would be the finding, not a setback —
it would mean the darwin binaries shipped so far were never exercised.
Verified on linux: `go vet ./...` and `go build -trimpath ./core/cmd/gds` pass;
actionlint 1.7.12 clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repository declares darwin as a first-class target in its own schemas:
in both
release-installation.schema.jsonandbundle-trust.schema.json, and the release builder emits darwin artifacts. Every test so far has run onubuntu-latestonly, so darwin has been cross-compiled and never executed.Cross-compilation proves it builds. It says nothing about behaviour, and this engine is made of precisely the things that differ between the two systems — path resolution,
os.Rootconfinement, file locking, temp directory semantics, case sensitivity.agent-runtimealready runs[ubuntu-latest, macos-latest]for exactly this reason; it ships the same two targets.Standard macOS runners are unmetered on public repositories, so the coverage is free. macOS-XL is billed even on public and is deliberately not used.
Why a separate workflow
gds-ci.ymlis a generated projection —# GENERATED FILE - DO NOT EDIT DIRECTLY— and its template carries a single.Runner. Widening it to a matrix means changing the engine's template and generator and then regenerating through the governed projection path, which is a much larger change than the coverage is worth right now..githubis outsidedevelopmentBundleSourcePaths, so adding a file here leaves the bundle lock alone. Confirmed rather than assumed —gds contexton this branch reports only the pre-existingGDS_CONTEXT_ESTATE_NOT_REGISTERED, noGDS_CONTEXT_POLICY_SOURCE_DIGEST_MISMATCH. Same reasonrelease-bundle.ymlandcodeql.ymlalready live beside the generated workflow.The steps are the repository's own
go vet ./...,go build -trimpath ./core/cmd/gds,go test ./...— taken from.gds/repository.yamlso this lane cannot drift into testing something else.Not added to
required_contexts: a lane with no green run yet should not gate the pull request introducing it.It may go red
If it does, that is the finding — it would mean the darwin binaries shipped so far were never exercised on darwin. Verified on linux that the three commands pass; actionlint 1.7.12 clean.