Repository navigation
ci: prefer local Mac runner with offline cloud fallback - #13
Merged
Merged
Conversation
hmmhmmhm
marked this pull request as ready for review
October 6, 2026 04:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Compatible CI jobs prefer the dedicated
personal-mac-tmux-attach-browserrunner. A short GitHub-hosted selection job checks its status and selects the original cloud runner when the Mac is offline, absent, or the status API fails. Busy local runners remain eligible and wait for the shared Mac job slot.The selector requires
LOCAL_RUNNER_STATUS_TOKEN, a fine-grained token restricted to the selected repositories with Administration read-only. Without it, jobs continue on GitHub-hosted runners. External PRs and non-owner events use cloud runners. A manual smoke workflow provides forced-cloud and owner-only local installation probes.Existing triggers, job permissions and build/test commands are preserved, apart from the explicit macOS FFmpeg setup where applicable. Selection happens before the job is queued; this does not migrate a running job or recover from the Mac going offline after selection.
Only the macOS matrix lane uses the local runner. Existing Windows and Linux lanes retain their original runners.
Validation: 13 selector scenarios passed, 7 host trust checks passed, shared-slot serialization and worker-crash recovery tests passed, and actionlint passed for the changed workflows in all 12 repositories. Application CI and live runner checks are tracked separately.
Rollout prerequisite: review/merge this draft. The scoped status secret is installed and its read access was verified for this repository. Runner registration and launchd services are installed on the Mac; the default branch remains unchanged until merge.
Live installation verification: local Mac smoke passed on
personal-mac-tmux-attach-browser; cloud smoke passed with the missing-token cloud selection. An actual stop/start of the aka-browser service was also checked against the GitHub API and the same selector implementation: online selects Mac labels, offline selectsmacos-latest. The scoped status secret is now installed; token-based local selection passed on all 12 repositories.Token-based online selection passed on
personal-mac-tmux-attach-browser. Status credential:local-runner-status-2026-10, expires 2027-01-04, Administration and Metadata read-only, restricted to the selected 12 repositories. Token value is not included in this PR.