CodeWhale Bot e42094427e ci: optional self-hosted macOS runner, gated to non-fork events ...

GitHub's hosted macOS queue routinely takes 50+ minutes and is the slowest
gate on every PR. This adds scripts/ci/setup-mac-runner.sh to register this
machine as a runner, and routes the macOS test leg to it.

The routing is deliberately narrow. This repo is public with ~3.5k forks, and
a self-hosted runner that accepts fork PRs is arbitrary code execution on the
runner host. The macOS leg goes to the self-hosted runner only when all three
hold: the change is heavy, the event is trusted (a push, or a PR whose head
repo is this repo), and the CW_SELF_HOSTED_MAC repo variable is 'true'. Fork
PRs always stay on GitHub-hosted runners.

CW_SELF_HOSTED_MAC is the kill switch. Unset it and every leg falls back to
GitHub-hosted with no commit, which matters because an OFFLINE self-hosted
runner queues jobs forever — worse than a slow one. Until that variable is
set, this commit changes no behavior.

The runner registers --ephemeral (one job per registration, minted fresh each
time). That prevents a job from persisting a registration; it is NOT
filesystem isolation, and the script says so — real isolation needs a VM or a
dedicated user without access to the secret store.

Required contexts are unaffected: 'Test (macos-latest)' derives from job name
plus matrix.os, independent of runs-on.

Verified: actionlint findings identical before and after (12/12), none
referencing the new step or expression; python yaml.safe_load parses.

No-Issue: CI runner capacity
Signed-off-by: CodeWhale Bot <bot@codewhale.net>

2026-08-29 00:35:11 -07:00

..

setup-mac-runner.sh

…