AGENTS.md@.github git:20260801.f5e834cA

Immutable. This exact content is served forever at /api/v1/blob/a30825ed138a2755.

# GitHub Actions operations

## Self-hosted macOS runner

Native macOS jobs use the repo-specific runner labeled `mac-mini`:

- `ci.yml` routes the Swift build/test job to `[self-hosted, mac-mini]`.
  Fork pull requests stay on GitHub-hosted infrastructure; only same-repository
  pull requests and trusted pushes can use the Mini.
- `release-macapp.yml` routes the signed, notarized macOS app release to
  `[self-hosted, mac-mini]`.
- `release.yml` routes only the Darwin CLI matrix entries to the Mini.
  Linux and Windows artifacts remain on GitHub-hosted runners.

The Mini runner runs in the logged-in Aqua session. Its job environment uses:

```text
JAVA_HOME=/opt/homebrew/opt/openjdk@21
ANDROID_HOME=/Users/nikhilanand/Library/Android/sdk
ANDROID_SDK_ROOT=/Users/nikhilanand/Library/Android/sdk
DEVELOPER_DIR=/Volumes/NVMe/Xcode.app/Contents/Developer
```

The external NVMe volume must be mounted. Each Xcode job also checks the
`DEVELOPER_DIR` path before building. There is one Mini runner, so native jobs
queue rather than running concurrently.

### Signing

The Mini's logged-in `login` keychain contains the Developer ID Application
identity, but the release workflows use an isolated temporary keychain loaded
from `APPLE_DEVELOPER_CERTIFICATE_P12_BASE64` and
`APPLE_DEVELOPER_CERTIFICATE_PASSWORD`. This avoids relying on interactive
login-keychain access and avoids duplicate-identity ambiguity by passing the
temporary keychain explicitly to every `codesign` invocation. The release
workflows restore the login keychain search list afterward. Notarization still
uses `APPLE_ID`, `APPLE_TEAM_ID`, and `APPLE_APP_SPECIFIC_PASSWORD`.

If the isolated-keychain setup is unavailable and signing must use the login
keychain, unlock it once from an interactive Terminal in the Mini's logged-in
GUI session, then grant the signing tools access:

```bash
security unlock-keychain "$HOME/Library/Keychains/login.keychain-db"
security set-key-partition-list -S apple-tool:,apple:,codesign: -s \
  "$HOME/Library/Keychains/login.keychain-db"
```

Enter the password only at the interactive prompt. Never place it in a
workflow, command argument, environment variable, or log. Do not guess an
empty password. Do not add a P12 to the normal login-keychain search list.

### Operations

The runner is installed separately from runners for other repositories:

```bash
ssh nikhilanand@192.168.1.11
cd ~/actions-runner-nikships-skills-registry
./svc.sh status
./svc.sh stop
./svc.sh start
```

Check registration from a machine with `gh`:

```bash
gh api repos/nikships/skills-registry/actions/runners
```

Never retarget, stop, remove, or reconfigure another repository's runner,
LaunchAgent, work directory, or registration. In particular, leave
`~/actions-runner` and the `ghostty-vibe-xr` LaunchAgent untouched.