.github/workflows: Use supported Blacksmith runners

.github/actionlint.yaml

@@ -1,3 +1,4 @@
 self-hosted-runner:
   labels:
+    - blacksmith-6vcpu-macos-latest
     - tailscale-mutation

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   test:
     name: Test (macOS)
-    runs-on: macos-15
+    runs-on: blacksmith-6vcpu-macos-latest
     timeout-minutes: 20
     steps:
       - name: Check out repository
@@ -47,7 +47,7 @@ jobs:
 
   lint:
     name: golangci-lint
-    runs-on: macos-15
+    runs-on: blacksmith-6vcpu-macos-latest
     timeout-minutes: 10
     steps:
       - name: Check out repository
@@ -65,7 +65,7 @@ jobs:
 
   vulnerability-scan:
     name: govulncheck
-    runs-on: macos-15
+    runs-on: blacksmith-6vcpu-macos-latest
     timeout-minutes: 10
     steps:
       - name: Check out repository
@@ -80,7 +80,7 @@ jobs:
 
   workflow-lint:
     name: actionlint
-    runs-on: macos-15
+    runs-on: blacksmith-6vcpu-macos-latest
     timeout-minutes: 5
     steps:
       - name: Check out repository
@@ -97,7 +97,7 @@ jobs:
 
   release-check:
     name: GoReleaser check and snapshot
-    runs-on: macos-15
+    runs-on: blacksmith-6vcpu-macos-latest
     timeout-minutes: 15
     steps:
       - name: Check out repository

.github/workflows/privileged-macos-integration.yml

@@ -15,7 +15,7 @@ jobs:
   lifecycle:
     name: Privileged lifecycle (ephemeral macOS)
     if: inputs.confirm == 'RUN-PRIVILEGED-PORTLESS'
-    runs-on: macos-15
+    runs-on: blacksmith-6vcpu-macos-latest
     environment: privileged-macos-integration
     timeout-minutes: 15
     steps:

.github/workflows/release.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   validate:
     name: Validate tag
-    runs-on: macos-15
+    runs-on: blacksmith-6vcpu-macos-latest
     timeout-minutes: 20
     steps:
       - name: Check out repository
@@ -56,7 +56,7 @@ jobs:
   release:
     name: Publish release
     needs: validate
-    runs-on: macos-15
+    runs-on: blacksmith-6vcpu-macos-latest
     timeout-minutes: 20
     permissions:
       attestations: write

docs/pki-service.md

@@ -141,8 +141,9 @@ trust store, or write `/etc/hosts`.
 The manual `Privileged macOS integration` workflow covers the provisioned
 lifecycle that is unsafe on developer machines and ordinary CI. It requires the
 exact dispatch confirmation `RUN-PRIVILEGED-PORTLESS`, uses the dedicated
-`privileged-macos-integration` environment, runs only on a fresh GitHub-hosted
-macOS runner, rejects pre-existing Portless artifacts, and exercises real
+`privileged-macos-integration` environment, runs only on a fresh
+Blacksmith-hosted Apple Silicon macOS runner, rejects pre-existing Portless
+artifacts, and exercises real
 `init`, idempotent install/upgrade, launchd, system CA trust, HTTPS routing on
 port 443 with both privileged listeners bound, and uninstall. Repository
 administrators can add required

go.mod

@@ -1,5 +1,5 @@
 module github.com/euforicio/portless
 
-go 1.26.5
+go 1.26.6
 
 require golang.org/x/sys v0.47.0