ci(nightly): route credentialed signers through trusted Linux set

Merged
TE
5d ago
+219-49

NEXT's credentialed signer jobs were resolving to GitHub-hosted Ubuntu first and a single 4-vCPU Blacksmith label on reruns. That violated Leo's routing rule: "GitHub-hosted runners aren't in the routing order at all" and left signing freshness dependent on paid-only capacity.

This routes signer-build, signer-app, signer-app-notary, and signer-dmg through a dedicated Blacksmith Linux picker. The picker validates the declared 4/16/32-vCPU Blacksmith set, chooses the smallest moving member, and rotates after about three minutes without a start. Its linux and linux_alternate outputs are consumed by every credentialed signer job; an allowlisted expression is the bounded fallback. Production NEXT has no hosted or GCP signer route and no fixed Blacksmith label.

The signer compiler emits a Linux rcodesign ELF. The notarization scripts still materialize temporary PEM/API-key files, so they cannot safely move onto an owned Mac under the exclusive-claim and temporary-keychain policy. The owned-Mac keychain/profile redesign is tracked as follow-up work; this PR keeps those credentialed jobs on trusted Blacksmith Linux while removing the hosted and single-label routes. The existing release-environment Mac signer and claim helper remain unchanged.

The signer routing and security guards recognize only this allowlisted Blacksmith picker as an ephemeral route. Tests fail if a production signer expression regresses to a hosted, GCP, fixed-label, or un-declared route. The nightly routing debt list records the intentional Blacksmith-only ELF/signing exception so it cannot spread silently.

Validation:

  • python3 tests/test_nightly_sign_runner.py </dev/null (44 passed)
  • python3 tests/test_nightly_signer_jobs.py </dev/null (27 passed)
  • python3 tests/test_ci_nightly_off_blacksmith.py </dev/null (16 passed)
  • python3 tests/test_ci_signing_owned_mac.py </dev/null (21 passed; broker warnings only)
  • python3 tests/test_ci_signing_keychain_is_deleted_before_bundle_code.py </dev/null (base-only warnings for existing jobs)
  • python3 tests/test_ci_linux_single_size.py </dev/null (4 passed)
  • python3 tests/test_ci_runner_set.py </dev/null (2 passed)
  • nightly.yml parsed successfully with PyYAML
  • git diff --check

Agent session: agent session
šŸ¤– Generated with Claude Code