ci(nightly): main's prepare legs take the idle trusted mini after the build, Blacksmith otherwise
Main's nightly prepare-nightly-variant (three matrix legs, no secrets, about 1 min each) always queued on Blacksmith macOS 26, while the pinned trusted mini that had just built the app sat idle.
Before (attempt 1, main):
| run | build-nightly-app | prepare legs queued on blacksmith-6vcpu-macos-26 |
|---|---|---|
| 40557789720 | trusted mini, 57 m | 41-43 m |
| 40567539918 | trusted mini, 18 m | 27-31 m |
| 40604652316 | Blacksmith (12 vCPU stalled) | queued from 00:54:52Z, still queued at 01:44Z (every Blacksmith macOS 26 label stalled) |
Change:
- New
pick-classic-prepare-runner(Linux, after the build):classic_nightly_build_runner.py preparereads the pinned trusted mini once, with no wait. When the mini is idle now on attempt 1 of main's push or schedule (withCI_PR_POOL_OWNEDon), the prepare legs ask for the same pinned tuplebuild-nightly-apptakes ([CI_SEED_TRUSTED_POOL, CI_NIGHTLY_TRUSTED_RUNNER]). When it is busy, offline, unreadable, a re-run, or the feature is off, the legs take the existing Blacksmith pick unchanged. - Signing (
build-sign-notarize-nightly) andverify-signed-nightlyare unchanged and stay on Blacksmith. No new secret, variable, permission or environment: the job reuses the existing routing App token, the same waypick-nightly-app-runnerdoes.
Risk: the three legs run one after another on the one mini (about 3-4 min in total, against 27-43 m queued). The legs run the bundle's own code (CLI and helper regressions) on the mini that builds the shipped app. That is main's own code, the same trust the build already has; the job holds no secret and has no environment, and the keychain guard (rule 6) still passes. If the mini takes other work between the pick and the legs, they wait for it as the build does; the mini serves only main's nightly.
Tests: tests/test_classic_nightly_build_runner.py (22, new Prepare cases and workflow checks), test_ci_runs_on_values, test_ci_signing_keychain_is_deleted_before_bundle_code, test_ci_publisher_mac_jobs_move, test_ci_workflow_run_sources, test_ci_nightly_off_blacksmith, test_runner_label_policy, test_nightly_universal_build.sh all pass.
Agent session: agent session
š¤ Generated with Claude Code