ci(nightly-next): one Mac job on the release-pool path; the final DMG is checked in verify-final

Merged
TE
9d ago
+86-113

The release-pool path for nightly-next had two Mac jobs between the pool signer and the fallback decision: signer-dmg-image (builds the DMG), then signer-verify (checks the final DMG). The macOS signer could not start until both had run. This change leaves one Mac job before that decision.

  • signer-dmg (release pool) now hands on the notarized DMG, the appcast and the signed-app handoff under the names build-sign-notarize-nightly uses. build-sign-notarize-nightly runs whenever signer-dmg did not pass.
  • signer-verify is gone. Its checks of the final DMG (codesign, Gatekeeper's notarized source, Apple's checks of the app inside including the copied Computer Use helper, and the appcast's Sparkle signature against the pinned key) move to a step in verify-final-dmg-nightly that runs only for a pool-signed DMG (scripts/ci/nightly-steps/signer-final-dmg-checks.sh). Publish already needs that job.
  • signer-dmg-image is the pool path's one Mac job, routed like the verify jobs: on attempt 1 of a nightly-next push, a free owned fleet Mac first (the owned-pool rescue watches it there); otherwise the Blacksmith macOS label with a moving queue, and on a rerun the other size.
  • The canonical uploads in signer-dmg never overwrite, so after a rerun the macOS job's verified output stands.

Outside the pool path nothing changes. Comparing the expanded workflow with base, the only differences are the signer-verify ā†’ signer-dmg name in the four jobs that read it, and the new step in verify-final-dmg-nightly, which is gated on needs.signer-dmg.result == 'success'. nightly.yml shrinks from 488,751 to 485,729 bytes.

Trade-off: a failure in the final DMG's Mac checks now fails the run's publish instead of falling back to the macOS signer. The same app was already checked on a Mac before the DMG was built, so such a failure is rare, and the next tip builds.

Before (run 40556126172): pushed 18:01, published 20:52. The sign job queued 73 min on blacksmith-6vcpu-macos-26. After: measured on the first opted-in run at this tip.

Tests: tests/test_nightly_signer_jobs.py pins the one hand-off point, the fallback condition, the pool-only final-DMG step and its checks, and the overwrite rules. The sign-runner, recovery, coverage and retention tests are updated. Every other red guard here fails the same way on base.

Risk: high (release workflow). Nothing changes unless the sign_pool input or vars.CI_NIGHTLY_NEXT_SIGN_POOL opts in.

Review (codex gpt-6-astra xhigh): SHIP at b8b7e9390b68300f458ade0ca5660c1eb2afd320

Agent session: agent session

šŸ¤– Generated with Claude Code