SecItemAdd on the legacy file-based macOS keychain writes to the user's
DEFAULT keychain, not the first writable keychain in the search list.
Changing list-keychains alone left SecItemAdd targeting the locked
login.keychain-db, still returning errSecInteractionNotAllowed (-25308).
Also set the user's default keychain to jarvis-runner.keychain-db in the
unlock step. This is persistent for the runner user (james.maes), so
SecItemAdd from interactive use will also go there — documented as a
side effect in CLAUDE.md with the undo command.
Refs #180
The Security framework requires user interaction for set-keychain-settings
even when the keychain is unlocked, and the LaunchAgent on Grogu has no
UI. The settings (no-timeout, no-lock-on-sleep) are persistent and were
applied once at keychain-creation time; only the unlock step needs to
run every job.
Refs #180
Previous run failed all 13 SPM jobs with 'passphrase you entered is not
correct' because the secret value was set to literal '-' (gh secret set
parsed '--body -' as the body value, not as 'read from stdin'). Secret
now contains the correct password. This empty commit triggers a fresh
CI run that will resolve the corrected secret.
Refs #180
Three SPM failures on PR #181's first self-hosted CI run, all
environment-specific:
- SPM Keychain: errSecInteractionNotAllowed (-25308). The LaunchAgent
has no UI session and the login keychain is locked.
- SPM Voice + SPM Harness: github-hosted actions/cache@v4 entries with
absolute paths (/Users/runner/work/...) baked into
.build/artifacts/onnxruntime.xcframework. Cache key only contained
runner.os (= macOS for both environments), so self-hosted hit the
poisoned github-hosted cache.
Fixes:
- Restrict actions/cache@v4 to runner.environment == 'github-hosted'.
Self-hosted's _work/ on HD-2 persists between jobs naturally, so the
cache action is unnecessary there and prevents path-baked cache
poisoning between environments.
- Add a "Unlock runner keychain" step gated to runner.environment ==
'self-hosted'. Unlocks a pre-created jarvis-runner.keychain-db with
password from the repo secret JARVIS_RUNNER_KEYCHAIN_PASSWORD and
prepends it to the user search list so SecItemAdd writes there.
Document both in CLAUDE.md "Self-hosted CI runner".
Refs #180
The github-hosted macos-15 pool was the rate-limiting step for v0.1: 13
matrix jobs + 1 app-build job all needed macOS slots, GitHub scheduled
them 1-3 at a time, and total wall-clock was ~1-2h per run versus actual
work of <10m. Grogu is registered with labels [self-hosted, macOS, ARM64,
jarvis] and _work/ symlinked to HD-2 (1.3 TB) for headroom.
Scope:
- swift-packages matrix only — app-build stays on macos-15 for now.
- `if:` clause blocks fork PRs from triggering self-hosted jobs (push,
workflow_dispatch, and same-repo PRs only).
- Xcode select switches from `sudo xcode-select -s` to a per-process
DEVELOPER_DIR env so the runner doesn't need passwordless sudo. The
fallback chain now also accepts /Applications/Xcode.app/Contents/Developer
so Grogu's local Xcode 26.5 is picked up.
Closes#180
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
james.maes
