AGENTS.md@.github ยท diff
git:20260801.8d4eb8d to git:20260801.f5e834c
12 added, 9 removed. Audit A to A.
# GitHub Actions operations
## Self-hosted macOS runner
Native macOS jobs use the repo-specific runner labeled `mac-mini`:
- `ci.yml` routes the Swift build/test job to `[self-hosted, mac-mini]`.
Fork pull requests stay on GitHub-hosted infrastructure; only same-repository
pull requests and trusted pushes can use the Mini.
- `release-macapp.yml` routes the signed, notarized macOS app release to
`[self-hosted, mac-mini]`.
- `release.yml` routes only the Darwin CLI matrix entries to the Mini.
Linux and Windows artifacts remain on GitHub-hosted runners.
The Mini runner runs in the logged-in Aqua session. Its job environment uses:
```text
JAVA_HOME=/opt/homebrew/opt/openjdk@21
ANDROID_HOME=/Users/nikhilanand/Library/Android/sdk
ANDROID_SDK_ROOT=/Users/nikhilanand/Library/Android/sdk
DEVELOPER_DIR=/Volumes/NVMe/Xcode.app/Contents/Developer
```
The external NVMe volume must be mounted. Each Xcode job also checks the
`DEVELOPER_DIR` path before building. There is one Mini runner, so native jobs
queue rather than running concurrently.
### Signing
- The Mini's logged-in `login` keychain already contains the Developer ID
- Application identity. Do not add `apple-actions/import-codesign-certs` to these
- Mini jobs: importing the same certificate into a temporary keychain can produce
- an ambiguous signing identity. Notarization still uses the repository secrets
- `APPLE_ID`, `APPLE_TEAM_ID`, and `APPLE_APP_SPECIFIC_PASSWORD`.
+ The Mini's logged-in `login` keychain contains the Developer ID Application
+ identity, but the release workflows use an isolated temporary keychain loaded
+ from `APPLE_DEVELOPER_CERTIFICATE_P12_BASE64` and
+ `APPLE_DEVELOPER_CERTIFICATE_PASSWORD`. This avoids relying on interactive
+ login-keychain access and avoids duplicate-identity ambiguity by passing the
+ temporary keychain explicitly to every `codesign` invocation. The release
+ workflows restore the login keychain search list afterward. Notarization still
+ uses `APPLE_ID`, `APPLE_TEAM_ID`, and `APPLE_APP_SPECIFIC_PASSWORD`.
- If signing reports `errSecInternalComponent`, unlock the login keychain once
- from an interactive Terminal in the Mini's logged-in GUI session, then grant
- the signing tools access:
+ If the isolated-keychain setup is unavailable and signing must use the login
+ keychain, unlock it once from an interactive Terminal in the Mini's logged-in
+ GUI session, then grant the signing tools access:
```bash
security unlock-keychain "$HOME/Library/Keychains/login.keychain-db"
security set-key-partition-list -S apple-tool:,apple:,codesign: -s \
"$HOME/Library/Keychains/login.keychain-db"
```
Enter the password only at the interactive prompt. Never place it in a
workflow, command argument, environment variable, or log. Do not guess an
- empty password and do not import a duplicate P12.
+ empty password. Do not add a P12 to the normal login-keychain search list.
### Operations
The runner is installed separately from runners for other repositories:
```bash
ssh nikhilanand@192.168.1.11
cd ~/actions-runner-nikships-skills-registry
./svc.sh status
./svc.sh stop
./svc.sh start
```
Check registration from a machine with `gh`:
```bash
gh api repos/nikships/skills-registry/actions/runners
```
Never retarget, stop, remove, or reconfigure another repository's runner,
LaunchAgent, work directory, or registration. In particular, leave
`~/actions-runner` and the `ghostty-vibe-xr` LaunchAgent untouched.