ci(release): sign and notarize on blacksmith-6vcpu-macos-26, not the stalled 12 vCPU label

LA
9d ago
+7-3

Summary

The next stable release cut from main would wait forever for a Mac. release.yml's build-sign-notarize job is pinned to blacksmith-12vcpu-macos-26, and that label hasn't started a job since 2026-10-28 20:32Z. This PR moves it, and the one-off repair-v0-64-25-helper-rpaths.yml repair job, to the literal blacksmith-6vcpu-macos-26 label. The 6 vCPU label is the one v0.65.2.2 signed on (run 40486284894, 35 min, timeout stays 355).

The label stays a literal, not vars.MACOS_RUNNER_26 || 'blacksmith-6vcpu-macos-26'. d16b03c69b03 (#21024) moved these jobs off that expression on purpose: rule 7 of tests/test_ci_signing_keychain_is_deleted_before_bundle_code.py says a job that holds a signing secret may not take its runner from a repository variable. Using the variable again would fail that guard. The 12 vCPU size in #21024 was a size choice, not a requirement. I didn't copy feat-cmux-next's pick-sign-runner picker here. Its re-run alternate can choose the 12 vCPU label (nightly run 40876675074's attempt 2 did), and the picker is a much larger change than this fix needs.

Only runs-on and a comment change in each job. The secrets, environment, permissions, steps and timeout are the same.

Blacksmith's runner docs still list blacksmith-12vcpu-macos-26 as a valid on-demand label. That means this is a capacity stall, not a misspelled label.

Evidence (GitHub API, 2026-10-29 ~14:05Z)

  • Since 2026-10-29 06:18Z (the last 100 nightly.yml runs, main and nightly-next), 0 of the 10 jobs that asked for blacksmith-12vcpu-macos-26 got a runner. 44 jobs on blacksmith-6vcpu-macos-26 started, with a median queue of 4.8 min and a newest start at 14:04:38Z.
  • Main's classic nightly run 40834485210 has waited since 07:47Z: in attempt 2, build-sign-notarize-nightly (arm64, x86_64 and universal) is queued on the 12 vCPU label. That came from the sign picker's re-run alternate, which #27444 fixes.
  • seed-derived-data.yml: every 12 vCPU seed job since 2026-10-28 23:28Z was cancelled or is still queued with no runner. The last 12 vCPU start in its history was 2026-10-28T20:32:24Z, for a job that had been queued for 9 h.
  • v0.65.2.2 was cut from a branch without d16b03c69b03, so no release has yet run build-sign-notarize on the 12 vCPU pin from main.

Testing

Regression: bash tests/test_ci_release_sdk_lane.sh now pins the 6 vCPU literal. It fails on 874d5707384 (test only, workflow still on 12 vCPU) with FAIL: release must sign+notarize on the literal macOS 26 Blacksmith label and passes on the head.

Observed / Not run

Observed, run locally on the head:

  • bash tests/test_ci_release_sdk_lane.sh, bash tests/test_repair_v06425_workflow.sh: pass.
  • python3 on tests/test_ci_signing_keychain_is_deleted_before_bundle_code.py (rule 7 literal label), test_ci_production_secrets_protected_env.py, test_ci_runs_on_values.py, test_ci_no_github_hosted_macos.py, test_runner_label_policy.py, test_ci_fork_runner_routing.py: pass.
  • actionlint 1.7.7 (the pinned CI version, SHELLCHECK_OPTS=-S warning) on both changed workflows: clean.

Not run: a release or the repair workflow itself. Neither can run before merge (the release environment only releases its secrets to main and v* tags). Other 12 vCPU users on main are not changed here: the nightly seed matrix, the ci-compile-attribution.yml overflow label, build-nightly-app's last fallback and pick-classic-sign-runner's re-run alternate. None of them is a hard-coded signing job.

Changelog

none