ci(macos): native build+publish workflow and runner/build docs (VA-89, VA-90) #139

Merged

longjacksonle merged 1 commit from feat/VA-89-VA-90-macos-ci into main

2026-07-14 18:57:50 +02:00

longjacksonle commented

2026-07-14 18:52:42 +02:00

Owner

What

Two parts toward closing VA-88:

CI build job (VA-89) - build-macos.yml, the macOS analog of build-package.yml / build-windows.yml:

Runs natively on the dedicated macOS runner (${{ vars.RUNS_ON_MACOS_LATEST }}); no Docker (macOS cannot be cross-compiled without the Apple SDK).
cargo build --release --target x86_64-apple-darwin, do-not-strip (crash-handler line tables).
age/XEdDSA-signs via the freshly built agent's own sign subcommand; builds a lossless zstd transport sidecar (decompress + hash-compare gate); writes checksum + version sidecars.
Publishes under the fetcher name vervainagent-16 (AgentId::MacOsx64) plus the descriptive vervain-agent-x86_64-apple-darwin set. The immutable-pinned / moving stable+latest channel logic is copied verbatim from the Linux job; only the build step and the id-16 file set differ. Triggers match (push to main, v* tags).

Runner runbook + build docs (VA-90 / VA-89) - docs/macos-build.md:

Manual build (Xcode CLT + rustup target add + the cargo invocation + output path).
launchd install/uninstall usage for the new subcommands (from the installer PR #138).
VA-90 runner setup: toolchain install (rust, Xcode CLT, nushell, zstd), forgejo-runner register with a macos:host label, defining the RUNS_ON_MACOS_LATEST variable, a trivial validation job, and persistence/cleanup notes.

Scope / status

x86_64-apple-darwin only (id 16); no protocol change. Apple codesign/notarization stays VA-128.

The workflow is inert until the VA-90 runner exists and RUNS_ON_MACOS_LATEST is defined - it can't run on the current Linux runners. YAML validated (parses, no tabs, mirrors the Linux job structure); the real run is gated on the runner.

Depends on the launchd installer (#138) for the install/uninstall docs to be accurate. Part of VA-89 + VA-90.

## What Two parts toward closing VA-88: **CI build job (VA-89)** - `build-macos.yml`, the macOS analog of `build-package.yml` / `build-windows.yml`: - Runs natively on the dedicated macOS runner (`${{ vars.RUNS_ON_MACOS_LATEST }}`); no Docker (macOS cannot be cross-compiled without the Apple SDK). - `cargo build --release --target x86_64-apple-darwin`, do-not-strip (crash-handler line tables). - age/XEdDSA-signs via the freshly built agent's own `sign` subcommand; builds a lossless zstd transport sidecar (decompress + hash-compare gate); writes checksum + version sidecars. - Publishes under the fetcher name `vervainagent-16` (`AgentId::MacOsx64`) plus the descriptive `vervain-agent-x86_64-apple-darwin` set. The immutable-pinned / moving `stable`+`latest` channel logic is copied verbatim from the Linux job; only the build step and the id-16 file set differ. Triggers match (push to `main`, `v*` tags). **Runner runbook + build docs (VA-90 / VA-89)** - `docs/macos-build.md`: - Manual build (Xcode CLT + `rustup target add` + the cargo invocation + output path). - launchd install/uninstall usage for the new subcommands (from the installer PR #138). - VA-90 runner setup: toolchain install (rust, Xcode CLT, nushell, zstd), `forgejo-runner register` with a `macos:host` label, defining the `RUNS_ON_MACOS_LATEST` variable, a trivial validation job, and persistence/cleanup notes. ## Scope / status x86_64-apple-darwin only (id 16); no protocol change. Apple codesign/notarization stays VA-128. The workflow is **inert until the VA-90 runner exists** and `RUNS_ON_MACOS_LATEST` is defined - it can't run on the current Linux runners. YAML validated (parses, no tabs, mirrors the Linux job structure); the real run is gated on the runner. Depends on the launchd installer (#138) for the install/uninstall docs to be accurate. Part of VA-89 + VA-90.

longjacksonle added 1 commit

2026-07-14 18:52:42 +02:00

ci(macos): native build+publish workflow and runner/build docs (VA-89, VA-90)

Check / fmt + clippy + tests (pull_request) Successful in 4m11s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

03bfc241c2

Add build-macos.yml, the macOS analog of build-package.yml (Linux) and build-windows.yml (Windows). It runs natively on the dedicated macOS runner (RUNS_ON_MACOS_LATEST), builds x86_64-apple-darwin with cargo (no Docker; macOS cannot be cross-compiled without the Apple SDK), age/XEdDSA-signs the binary via its own sign subcommand, builds a lossless zstd transport sidecar, writes version/checksum sidecars, and publishes under the fetcher name vervainagent-16 (AgentId::MacOsx64) plus the descriptive vervain-agent-x86_64-apple-darwin set. The immutable-pinned / moving stable+latest channel logic is identical to the Linux job; only the build step and the id-16 file set differ. Triggers match the Linux/Windows set (push to main, v* tags).

Add docs/macos-build.md: manual build steps (Xcode CLT + rustup target + the cargo invocation + output path, do-not-strip), launchd install/uninstall usage for the new subcommands, and the VA-90 runner runbook (toolchain install, forgejo-runner register with a macos:host label, defining the RUNS_ON_MACOS_LATEST variable, a trivial validation job, and persistence/cleanup notes).

x86_64 only (id 16); no protocol change. Apple codesign/notarization stays VA-128. The workflow cannot run until the VA-90 runner exists and the RUNS_ON_MACOS_LATEST variable is defined; it is inert until then.

Part of VA-89 (CI build job) and VA-90 (runner runbook).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFsMi3Vmf3pCc7mBdhZqoV