ci: run three macOS versions and split the libsecret tests out - #78
Merged
Conversation
) Both changes needed NextIteration.Standards amending first (its PR #23), not a local ci.yml edit -- 3.0.1 is explicit that a repo editing its own workflow has forked it, not fixed it. #20: the matrix names macos-13, macos-14 and macos-15 rather than macos-latest. This is the only repo with a Security.framework P/Invoke layer (~1,170 lines across KeychainCredentialManager and KeychainInterop), and macos-latest tests it against whichever release the alias points at today. The Keychain backend is the one place an OS-version behaviour change surfaces as silently missing credentials rather than a build failure. 3.1.1 now permits broadening the matrix without an exception, since broadening cannot cause the failure that clause guards against. #21: the gnome-keyring-daemon setup moves out of the matrix into a test-linux-keyring job. As a Linux-guarded step inside `test` it made test (ubuntu-latest) report one result for two unrelated things -- the portable tests and the libsecret ones. Now the matrix leg reports the libsecret tests skipped (they self-report since #46) and the new job reports them run, so a libsecret regression names itself instead of hiding in a leg that is green for other reasons. The ci gate names the new job, so it cannot pass while the job fails. Verified against the amended template through the exception machinery before pushing: 111 lines each side. Auth.Providers still reconciles unchanged, so the template amendment does not disturb the repos that were already conformant. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The first attempt used macos-13/14/15 as #20 suggested. macos-13 has no runner: its job sat queued with runner unassigned for over ten minutes while ubuntu, windows, macos-14, macos-15 and test-linux-keyring all completed. GitHub has retired that label, so including it would hang every CI run rather than add coverage. macos-14 and macos-15 both scheduled and passed, which is still two concrete macOS versions where there was one moving alias. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #20. Fixes #21.
Both required amending NextIteration.Standards first — StuartMeeks/NextIteration.Standards#23, merged — rather than editing this workflow locally. §3.0.1 is explicit that a repo editing its own
ci.ymlhas forked it, not fixed it, and this repo is the one the standard's TODO calls "the reference implementation… the thing to copy from".#20 — three macOS versions
macos-latestonly ever exercised whichever release that alias currently points at. This is the only repo with a Security.framework P/Invoke layer (~1,170 lines acrossKeychainCredentialManagerandKeychainInterop), and the Keychain backend is the one place an OS-version behaviour change surfaces as silently missing credentials rather than a build failure.§3.1.1 now permits broadening the matrix without an exception, on the grounds that broadening cannot cause the failure that clause guards against — a shipped path going unexecuted. Narrowing still needs one.
#21 — the libsecret tests get their own job
As a Linux-guarded step inside
test, the keyring setup madetest (ubuntu-latest)report one result for two unrelated things: the portable tests and the libsecret ones. Now:test (ubuntu-latest)runs with no daemon, so the libsecret tests report as skipped — they self-report since libsecret test suite disables itself when the code it tests regresses #46, rather than passing vacuously.test-linux-keyringruns them for real.A libsecret regression now names itself instead of hiding inside a matrix leg that is green for other reasons. The
cigate names the new job, so it cannot be green while that job fails.Verified before pushing
Amending a shared template can break repos that were already conformant, so I ran the audit's own comparison against both working trees:
ci.ymlvs amended template, through the exception machineryWhat to watch on this PR
Its own CI is the real test — it is the first run of the five-way matrix and the new job. Specifically worth checking that
test (ubuntu-latest)now reports libsecret as skipped whiletest-linux-keyringreports it run, since that split is the entire point of #21.🤖 Generated with Claude Code