ci: move swift-packages matrix to self-hosted runner (Grogu) #181

2026-05-13T18:50:37Z

KofTwentyTwo commented

2026-05-13 18:50:37 +00:00

(Migrated from github.com)

Summary

Move the 13-way swift-packages SPM test matrix from github-hosted macos-15 to the self-hosted runner Grogu-jarvis (labels: self-hosted, macOS, ARM64, jarvis).
Add if: gate so the self-hosted runner only accepts pushes, manual dispatches, and same-repo PRs — fork PRs are blocked from this job.
Switch the Xcode-select step from sudo xcode-select -s (system-wide, needs passwordless sudo) to a per-process DEVELOPER_DIR env so the runner needs no elevated privileges. The fallback chain now also accepts /Applications/Xcode.app/Contents/Developer so Grogu's local Xcode 26.5 is picked up.
Document the runner setup in CLAUDE.md under "Build / test → Self-hosted CI runner (Grogu)".

Why

The github-hosted macos-15 pool has been the v0.1 → publish-tag rate limiter. Two runs were cancelled mid-flight (preempted by next push under cancel-in-progress: true), and the current in-flight run on 7b537204 has been queued/running for 1h44m with 9 of 14 macOS jobs still waiting on a runner. Each job's actual work is < 2 minutes once it starts. Self-hosted Grogu eliminates the queue entirely and keeps SwiftPM .build/ caches hot across runs.

Runner setup on Grogu (already complete — landed before this PR)

~/actions-runner-jarvis/ — runner agent + scripts.
_work/ → /Volumes/HD-2/jarvis-runner-work/ symlink (HD-2 has 1.3 TB free vs the 12 GiB on boot disk).
launchd LaunchAgent installed at ~/Library/LaunchAgents/actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis.plist. Runs while user is logged in.
Confirmed online via gh api /repos/.../actions/runners immediately before this PR was opened.

Scope discipline

app-build (the xcodebuild App-target job) stays on macos-15. One variable at a time. Move opportunistically after the swift-packages path is proven.
real-hardware opt-in lane already targets [self-hosted, macOS] (no jarvis label) — Grogu will pick it up if someone manually dispatches with run_real_hardware: true. That's existing behavior, not changed here.

Security gates

Workflow if: clause (in this PR) — fork PRs cannot reach the self-hosted job.
Branch protection on develop (already enabled) — no force-push, PR required.
Recommended manual follow-up: Settings → Actions → General → "Fork pull request workflows from outside collaborators" → "Require approval for all outside collaborators". No public REST API for this setting; UI-only. Not critical today (zero outside collaborators on this repo) but cheap to flip.

Test plan

Merge to develop.
Watch the resulting CI run — swift-packages jobs should pick up on Grogu-jarvis within seconds (vs 20–40 min on github-hosted).
All 13 SPM matrix jobs green.
app-build job runs on macos-15 as before, completes green.
publish-tag fires, producing v0.1.0-dev.<run_number>.
Verify gh release list shows the new tag.

If anything regresses, revert is a one-line change: runs-on: macos-15, delete the if: block.

Closes #180

🤖 Generated with Claude Code

## Summary - Move the 13-way `swift-packages` SPM test matrix from github-hosted `macos-15` to the self-hosted runner `Grogu-jarvis` (labels: `self-hosted`, `macOS`, `ARM64`, `jarvis`). - Add `if:` gate so the self-hosted runner only accepts pushes, manual dispatches, and same-repo PRs — fork PRs are blocked from this job. - Switch the Xcode-select step from `sudo xcode-select -s` (system-wide, needs passwordless sudo) to a per-process `DEVELOPER_DIR` env so the runner needs no elevated privileges. The fallback chain now also accepts `/Applications/Xcode.app/Contents/Developer` so Grogu's local Xcode 26.5 is picked up. - Document the runner setup in `CLAUDE.md` under "Build / test → Self-hosted CI runner (Grogu)". ## Why The github-hosted `macos-15` pool has been the v0.1 → publish-tag rate limiter. Two runs were cancelled mid-flight (preempted by next push under `cancel-in-progress: true`), and the current in-flight run on `7b537204` has been queued/running for 1h44m with 9 of 14 macOS jobs still waiting on a runner. Each job's actual work is < 2 minutes once it starts. Self-hosted Grogu eliminates the queue entirely and keeps SwiftPM `.build/` caches hot across runs. ## Runner setup on Grogu (already complete — landed before this PR) - `~/actions-runner-jarvis/` — runner agent + scripts. - `_work/` → `/Volumes/HD-2/jarvis-runner-work/` symlink (HD-2 has 1.3 TB free vs the 12 GiB on boot disk). - launchd LaunchAgent installed at `~/Library/LaunchAgents/actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis.plist`. Runs while user is logged in. - Confirmed online via `gh api /repos/.../actions/runners` immediately before this PR was opened. ## Scope discipline - `app-build` (the xcodebuild App-target job) stays on `macos-15`. One variable at a time. Move opportunistically after the swift-packages path is proven. - `real-hardware` opt-in lane already targets `[self-hosted, macOS]` (no `jarvis` label) — Grogu will pick it up if someone manually dispatches with `run_real_hardware: true`. That's existing behavior, not changed here. ## Security gates 1. **Workflow `if:` clause** (in this PR) — fork PRs cannot reach the self-hosted job. 2. **Branch protection on develop** (already enabled) — no force-push, PR required. 3. **Recommended manual follow-up:** Settings → Actions → General → "Fork pull request workflows from outside collaborators" → "Require approval for all outside collaborators". No public REST API for this setting; UI-only. Not critical today (zero outside collaborators on this repo) but cheap to flip. ## Test plan - [ ] Merge to develop. - [ ] Watch the resulting CI run — `swift-packages` jobs should pick up on `Grogu-jarvis` within seconds (vs 20–40 min on github-hosted). - [ ] All 13 SPM matrix jobs green. - [ ] `app-build` job runs on macos-15 as before, completes green. - [ ] `publish-tag` fires, producing `v0.1.0-dev.<run_number>`. - [ ] Verify `gh release list` shows the new tag. If anything regresses, revert is a one-line change: `runs-on: macos-15`, delete the `if:` block. Closes #180 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Jarvis#181