Skip to content

feat: provision managed macOS Actions runners - #226

Merged
Mearman merged 6 commits into
mainfrom
feat/macos-actions-runner
Nov 5, 2026
Merged

Mearman merged 6 commits into
mainfrom
feat/macos-actions-runner

Conversation

@Mearman

@Mearman Mearman commented Nov 4, 2026

Copy link
Copy Markdown
Member

Adds an Ansible-managed host-native macOS runner for workflows that require Xcode and macOS archive tooling. The role downloads the pinned Apple Silicon runner archive with its published SHA-256, registers it through the organisation GitHub App, and supervises it with launchd under a dedicated label.

@Mearman
Mearman marked this pull request as ready for review November 4, 2026 23:19
@Mearman

Mearman commented Nov 4, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 4, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ✅ Completed 2026-11-05T06:38:04.559546Z 947d3a8 Manual request

Security findings

Advisory findings (4)

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@Mearman

Mearman commented Nov 4, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛡️ Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 614119fed7

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman

Mearman commented Nov 5, 2026

Copy link
Copy Markdown
Member Author

Scoped the native runner to the private ExaDev/marshal repository. It now mints only repository Administration/Metadata permissions, requests /repos/ExaDev/marshal/actions/runners/registration-token, and registers against that repository URL. No other organisation repository can target it.

@Mearman

Mearman commented Nov 5, 2026

Copy link
Copy Markdown
Member Author

@codex security review

1 similar comment
@Mearman

Mearman commented Nov 5, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛡️ Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 6cefbebb6e

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman

Mearman commented Nov 5, 2026

Copy link
Copy Markdown
Member Author

Fixed both findings. The runner now executes as a dedicated non-login github-runner account under /var/lib/github-actions-runner/ExaDev-marshal, not the Ansible user, so workflows cannot inherit that user's sudo. The registration state directory includes the configured organisation and repository, so a scope change creates an unregistered runner and forces a fresh repository registration.

@Mearman

Mearman commented Nov 5, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛡️ Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: aac4cf8bdd

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman

Mearman commented Nov 5, 2026

Copy link
Copy Markdown
Member Author

Fixed the registration-token finding: config.sh now receives the token through ACTIONS_RUNNER_INPUT_TOKEN, not its argument vector.

@Mearman

Mearman commented Nov 5, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 947d3a80c4

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman
Mearman merged commit fd18766 into main Nov 5, 2026
16 checks passed
@Mearman
Mearman deleted the feat/macos-actions-runner branch November 5, 2026 07:03
@github-actions

github-actions Bot commented Nov 5, 2026

Copy link
Copy Markdown

🎉 This PR is included in version 2.39.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant