Skip to content

fix(phase4): set the default keychain for the macOS runner job #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gitcommit90 merged 2 commits into from
Aug 5, 2026
+23 −2
Merged

fix(phase4): set the default keychain for the macOS runner job #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
369eccd
fix(phase4): set the default keychain for the macOS runner job
gitcommit90 Aug 5, 2026
553e9ac
fix(phase4): read the root-owned OCI image store with sudo in Linux a…
gitcommit90 Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions ops/platform-acceptance/linux.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,8 @@ sudo systemctl is-active --quiet 1helm.service
curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/clean-health.json"
[[ "$(readlink -f /opt/1helm/current)" == "/opt/1helm/releases/$VERSION-$OFFLINE_DIGEST" ]]
RETAINED_IMAGE="/var/lib/1helm-oci-v1/shared-images/sha256/$IMAGE_DIGEST"
[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
sudo test -d "$RETAINED_IMAGE"
[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]

# Resolve the newest immutable public Stable release distinct from this
# candidate version. Candidate versions normally remain unchanged during
Expand Down Expand Up @@ -140,7 +141,8 @@ sudo systemctl is-active --quiet 1helm.service
curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/rollback-health.json"
STATE_AFTER="$(sudo sha256sum "$MARKER" | awk '{print $1}')"
[[ "$STATE_BEFORE" == "$STATE_AFTER" ]]
[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
sudo test -d "$RETAINED_IMAGE"
[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
sudo rm -rf -- "$FAILURE_RELEASE"

export HELM_PREVIOUS_VERSION="$PREVIOUS_VERSION"
Expand Down
19 changes: 19 additions & 0 deletions ops/platform-acceptance/runner-job-started.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,3 +30,22 @@ if not (
):
raise SystemExit("Phase 4 runner refused an untrusted repository/ref/SHA/CI event.")
PY

# macOS only: prepare the dedicated signing account's login keychain for this
# now-validated, trusted job. Code signing resolves its identity through the
# keychain search list, but notarytool resolves its credential profile through
# the session DEFAULT keychain, and a launchd runner job otherwise has no
# default keychain, so notarization fails with "No Keychain password item
# found". Set login as the default (and search) keychain and unlock it. The
# password is read from a machine-local file owned by the runner account; it is
# never stored in this repository or exported into the job environment.
if [[ "$(uname)" == "Darwin" ]]; then
kc="$HOME/Library/Keychains/login.keychain-db"
kc_pw_file="$HOME/.config/1helm/mac-keychain-password"
if [[ -f "$kc" && -r "$kc_pw_file" ]]; then
security list-keychains -d user -s "$kc" /Library/Keychains/System.keychain >/dev/null 2>&1 || true
security default-keychain -d user -s "$kc" >/dev/null 2>&1 || true
security set-keychain-settings "$kc" >/dev/null 2>&1 || true
security unlock-keychain -p "$(cat "$kc_pw_file")" "$kc" >/dev/null 2>&1 || true
Comment on lines +46 to +49

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Do not ignore keychain setup failures.

Each security command can fail, but || true makes the hook report success. If default-keychain or unlock-keychain fails, notarytool later fails without identifying the runner configuration error. When both required files exist, let these commands fail the hook or verify their resulting state before continuing.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ops/platform-acceptance/runner-job-started.sh` around lines 46 - 49, Remove
the `|| true` suppression from the keychain setup commands in the runner startup
hook, especially `security default-keychain` and `security unlock-keychain`, so
failures stop the hook when the required files exist. Preserve the existing
command order and redirection while allowing setup errors to propagate before
invoking `notarytool`.

fi
fi
Loading