From acbc3f2938453d50a1b26833d482220eb21f2518 Mon Sep 17 00:00:00 2001 From: euforic Date: Fri, 28 Aug 2026 13:54:28 -0700 Subject: [PATCH 1/4] Migrate supported jobs to Blacksmith runners --- .github/actionlint.yaml | 1 + .github/workflows/ci.yml | 10 +++++----- .github/workflows/privileged-macos-integration.yml | 2 +- .github/workflows/release.yml | 4 ++-- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index 6355c01..dabaca3 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,3 +1,4 @@ self-hosted-runner: labels: + - blacksmith-6vcpu-macos-15 - tailscale-mutation diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 31541d4..859d4a1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ concurrency: jobs: test: name: Test (macOS) - runs-on: macos-15 + runs-on: blacksmith-6vcpu-macos-15 timeout-minutes: 20 steps: - name: Check out repository @@ -47,7 +47,7 @@ jobs: lint: name: golangci-lint - runs-on: macos-15 + runs-on: blacksmith-6vcpu-macos-15 timeout-minutes: 10 steps: - name: Check out repository @@ -65,7 +65,7 @@ jobs: vulnerability-scan: name: govulncheck - runs-on: macos-15 + runs-on: blacksmith-6vcpu-macos-15 timeout-minutes: 10 steps: - name: Check out repository @@ -80,7 +80,7 @@ jobs: workflow-lint: name: actionlint - runs-on: macos-15 + runs-on: blacksmith-6vcpu-macos-15 timeout-minutes: 5 steps: - name: Check out repository @@ -97,7 +97,7 @@ jobs: release-check: name: GoReleaser check and snapshot - runs-on: macos-15 + runs-on: blacksmith-6vcpu-macos-15 timeout-minutes: 15 steps: - name: Check out repository diff --git a/.github/workflows/privileged-macos-integration.yml b/.github/workflows/privileged-macos-integration.yml index 4d28e85..13a8a6b 100644 --- a/.github/workflows/privileged-macos-integration.yml +++ b/.github/workflows/privileged-macos-integration.yml @@ -15,7 +15,7 @@ jobs: lifecycle: name: Privileged lifecycle (ephemeral macOS) if: inputs.confirm == 'RUN-PRIVILEGED-PORTLESS' - runs-on: macos-15 + runs-on: blacksmith-6vcpu-macos-15 environment: privileged-macos-integration timeout-minutes: 15 steps: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8cd7b43..3bf70de 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,7 @@ concurrency: jobs: validate: name: Validate tag - runs-on: macos-15 + runs-on: blacksmith-6vcpu-macos-15 timeout-minutes: 20 steps: - name: Check out repository @@ -56,7 +56,7 @@ jobs: release: name: Publish release needs: validate - runs-on: macos-15 + runs-on: blacksmith-6vcpu-macos-15 timeout-minutes: 20 permissions: attestations: write From d560dbf8cac6e613960bdfa4480b6e952c3da8f6 Mon Sep 17 00:00:00 2001 From: euforic Date: Fri, 28 Aug 2026 13:59:47 -0700 Subject: [PATCH 2/4] Use Blacksmith macOS latest --- .github/actionlint.yaml | 2 +- .github/workflows/ci.yml | 10 +++++----- .github/workflows/privileged-macos-integration.yml | 2 +- .github/workflows/release.yml | 4 ++-- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index dabaca3..0b204b4 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,4 +1,4 @@ self-hosted-runner: labels: - - blacksmith-6vcpu-macos-15 + - blacksmith-6vcpu-macos-latest - tailscale-mutation diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 859d4a1..d298ead 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ concurrency: jobs: test: name: Test (macOS) - runs-on: blacksmith-6vcpu-macos-15 + runs-on: blacksmith-6vcpu-macos-latest timeout-minutes: 20 steps: - name: Check out repository @@ -47,7 +47,7 @@ jobs: lint: name: golangci-lint - runs-on: blacksmith-6vcpu-macos-15 + runs-on: blacksmith-6vcpu-macos-latest timeout-minutes: 10 steps: - name: Check out repository @@ -65,7 +65,7 @@ jobs: vulnerability-scan: name: govulncheck - runs-on: blacksmith-6vcpu-macos-15 + runs-on: blacksmith-6vcpu-macos-latest timeout-minutes: 10 steps: - name: Check out repository @@ -80,7 +80,7 @@ jobs: workflow-lint: name: actionlint - runs-on: blacksmith-6vcpu-macos-15 + runs-on: blacksmith-6vcpu-macos-latest timeout-minutes: 5 steps: - name: Check out repository @@ -97,7 +97,7 @@ jobs: release-check: name: GoReleaser check and snapshot - runs-on: blacksmith-6vcpu-macos-15 + runs-on: blacksmith-6vcpu-macos-latest timeout-minutes: 15 steps: - name: Check out repository diff --git a/.github/workflows/privileged-macos-integration.yml b/.github/workflows/privileged-macos-integration.yml index 13a8a6b..1cf2a65 100644 --- a/.github/workflows/privileged-macos-integration.yml +++ b/.github/workflows/privileged-macos-integration.yml @@ -15,7 +15,7 @@ jobs: lifecycle: name: Privileged lifecycle (ephemeral macOS) if: inputs.confirm == 'RUN-PRIVILEGED-PORTLESS' - runs-on: blacksmith-6vcpu-macos-15 + runs-on: blacksmith-6vcpu-macos-latest environment: privileged-macos-integration timeout-minutes: 15 steps: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3bf70de..076494f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,7 @@ concurrency: jobs: validate: name: Validate tag - runs-on: blacksmith-6vcpu-macos-15 + runs-on: blacksmith-6vcpu-macos-latest timeout-minutes: 20 steps: - name: Check out repository @@ -56,7 +56,7 @@ jobs: release: name: Publish release needs: validate - runs-on: blacksmith-6vcpu-macos-15 + runs-on: blacksmith-6vcpu-macos-latest timeout-minutes: 20 permissions: attestations: write From 3526cf12177a47645e84f8f82a377b740d84f56f Mon Sep 17 00:00:00 2001 From: euforic Date: Fri, 28 Aug 2026 14:00:43 -0700 Subject: [PATCH 3/4] Document privileged runner trust boundary --- docs/pki-service.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/pki-service.md b/docs/pki-service.md index a87cd2c..d64e06f 100644 --- a/docs/pki-service.md +++ b/docs/pki-service.md @@ -141,8 +141,9 @@ trust store, or write `/etc/hosts`. The manual `Privileged macOS integration` workflow covers the provisioned lifecycle that is unsafe on developer machines and ordinary CI. It requires the exact dispatch confirmation `RUN-PRIVILEGED-PORTLESS`, uses the dedicated -`privileged-macos-integration` environment, runs only on a fresh GitHub-hosted -macOS runner, rejects pre-existing Portless artifacts, and exercises real +`privileged-macos-integration` environment, runs only on a fresh +Blacksmith-hosted Apple Silicon macOS runner, rejects pre-existing Portless +artifacts, and exercises real `init`, idempotent install/upgrade, launchd, system CA trust, HTTPS routing on port 443 with both privileged listeners bound, and uninstall. Repository administrators can add required From 221cc1e0fb159dc052f883e0f4e8c68c4278b606 Mon Sep 17 00:00:00 2001 From: euforic Date: Fri, 28 Aug 2026 14:03:11 -0700 Subject: [PATCH 4/4] Update Go to patched 1.26.6 release --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 1f42a49..a81117a 100644 --- a/go.mod +++ b/go.mod @@ -1,5 +1,5 @@ module github.com/euforicio/portless -go 1.26.5 +go 1.26.6 require golang.org/x/sys v0.47.0