Repository navigation
Conversation
added 2 commits
October 19, 2026 19:47
The commented-out leg pointed at macos-13, which GitHub retired on 2025-12-04, so it queued forever. macos-15-intel is the standard-runner Intel label for public repos: the leg builds natively (can_execute runs the real smoke test) with a longer per-leg timeout for the slower 4-core Intel release build. PLATFORM_COUNT rises to 6 to match. Publish-side jobs (marketplace, open-vsx, brew, scoop, pages) are guarded to the canonical repo so fork releases stay green without the publish secrets; the GitHub Release assets upload unchanged. Homebrew rendering still excludes darwin-x64 deliberately (verify-package-manifests.mjs) and only runs on the canonical repo.
security-gates.test.mjs implements [DIST-CI-AUDIT]: publish-marketplace and publish-openvsx must carry no job-level if, so publishing can never bypass the audited release dependency. Move the canonical-repo scoping onto the credential-holding steps instead — on forks the jobs still run and still require the audited release, but sign in to nothing and publish nothing. All 14 gate tests pass locally.
Collaborator
|
@meancrazy GitHub rarely has macOS intel runners and it often blocks the release. I'm not going to reenable this until there is a long term solution for moving the runners off GitHub |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TLDR
Re-enables the commented-out
darwin-x64release leg onmacos-15-intel— GitHub's standard-runner Intel label — so Intel Macs get released VSIXes and server archives again.Details
The leg was disabled with "This just spins forever on GitHub's hosted runners": it pointed at
macos-13, which GitHub retired on 2025-12-04, so the job queued until cancelled. GitHub's migration changelog (2025-09-19) addedmacos-15-intelfor standard-runner users, supported until the macOS 15 image retires in Fall 2027; runner-images lists it un-deprecated today. Changes (all inrelease.yml):darwin-x64leg onos: macos-15-intel, native →can_execute: trueruns the real smoke tests (sharplsp --version,verify-archive.shexecution check), same as the other native legs.timeout-minutes: "${{ matrix.timeout_minutes || 45 }}"withtimeout_minutes: 60for darwin-x64 — 4 Intel cores compile the Rust release build slower than the ARM leg.PLATFORM_COUNT: '5'→'6'for the asset-count gate.macos-26-intel: the older SDK keeps binaries' minimum deployment target low for the (aging) Intel install base, andmacos-15-intelis the label GitHub explicitly announced for standard (free, public-repo) runners.fetch-netcoredbg.shandverify-vsix-payload.mjs(NO_DEBUGGER_PREBUILT) already handle the platform cleanly — same fallback as win32-arm64 (PATH /sharplsp.debug.netcoredbgPath).Require BREW_SCOOP_PAT,OVSX_PAT, Entra OIDC), so every fork's release currently turns red after a perfectly good GitHub Release. Scoped them togithub.repository == 'Nimblesite/SharpLsp'— job-level fordeploy-pages/brew/scoop, step-level forpublish-marketplace/publish-openvsxbecausesecurity-gates.test.mjsasserts those jobs carry no job-levelif. The jobs still require the audited release unconditionally; only the credential-holding steps are scoped. No-op on this repo.render-package-manifests.mjs/verify-package-manifests.mjsexclude darwin-x64 from the formula, and that stays correct policy even though the stated reason ("the macos-13 runner hangs") is stale: Homebrew 7.0.0 (Sep 2026) moved Intel to Tier 3 — no project support, no routine bottles, Intel CI removed from homebrew-core, winding down by Sep 2027. The checksummedserver-darwin-x64archive on the GitHub Release is the Intel distribution channel ([DIST-PATH-INSTALL]), for the same window GitHub keepsmacos-15-intelalive (macOS 15 image retires Fall 2027; Apple's macOS 26 is the last Intel release). This leg serves the existing Intel fleet through that wind-down, not a permanent commitment.End-to-end verified on a real Intel Mac (
x86_64-apple-darwin, macOS 26.7.1):make _package-vsix-darwin-x64builds the Rust host, both sidecars, the profiler engine, the VSIX (46 MB, 277 files) and the standalone archive; the VSIX installs and activates in VS Code.How Do The Automated Tests Prove It Works?
tools/ci/security-gates.test.mjs[DIST-CI-AUDIT]: all 14 gates pass, including "vulnerability findings block the release and both VSIX marketplaces" — the assertions thatpublish-marketplace/publish-openvsxhave no job-levelifare untouched; the fork scoping lives on steps, which is exactly what the test permits.v0.22.1on the fork runs the full six-platform release including the new leg — the darwin-x64 job executes the same gates as every native platform (binary--version, VSIX-contents check with the foreign-binary negative check,verify-archive.shunpack-and-run smoke test) on a real Intel runner.Analysephase re-runs the workflow meta-tests (security-gates,vsix-rebuild,reinstall-loop) against the modifiedrelease.yml.