497e703e70Keep credentials and network access behind authenticated, audited brokers while binding launch adapters, immutable closures, recovery identities, receipts, and cleanup to the approved plan. Add Apple Container and Linux release lanes without weakening the outer sandbox.
33 lines
908 B
YAML
33 lines
908 B
YAML
name: macOS Apple Container Shipping Lane
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: macos-apple-container-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
macos-shipping-lane:
|
|
name: macOS shipping gate
|
|
# GitHub-hosted macOS runners do not support nested virtualization. This
|
|
# custom label intentionally targets a physical Apple Silicon runner.
|
|
runs-on: [self-hosted, macOS, ARM64, glove-apple-container]
|
|
timeout-minutes: 45
|
|
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Run native macOS preflight
|
|
run: scripts/preflight.sh
|
|
|
|
- name: Run macOS shipping lane
|
|
run: |
|
|
chmod +x scripts/apple-container-session.sh scripts/macos-shipping-lane.sh
|
|
scripts/macos-shipping-lane.sh --start-system
|