feat(native): add Intel macOS qualification-only build lane (S5) - #508
Conversation
Empirically confirmed (2026-08-26, throwaway workflow_dispatch probe) that GitHub's macos-15-intel runner label — the replacement for the retired macos-13 that was removed from tauri-build.yml's production matrix on 2026-07-28 — schedules and runs successfully on this org's plan. Adds .github/workflows/tauri-intel-qualification.yml: workflow_dispatch only, permissions: contents: read, no signing secrets, no Release/ latest.json mutation of any kind — structurally verified by scripts/workflow-policy-check.mjs's publishing-boundary check, since this job is not on PUBLISHING_ALLOWLIST. Runs a real pnpm exec tauri build on macos-15-intel with updater-artifact creation disabled, uploading the bundle as a build artifact only. Deliberately not wired into tauri-build.yml's production matrix or latest.json — a single successful qualification build proves the runner label works, not that it's ready for regular release inclusion (soak testing, artifact parity with the ARM build, and an ongoing-cost decision remain open, tracked in #507 and docs/native/INTEL-MACOS-QUALIFICATION.md). Updates docs/TAURI-CI.md's stale "currently unavailable" framing to reflect the empirical re-test, adds a Follow-ups entry, and adds the new doc to README's Documentation Hub index.
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. |
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Warning Review limit reachedNext included review available in 19 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 107 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
Warning Your free Security trial is over. An organization admin can activate billing to continue. Comment |
Reviewer's GuideThis PR re-establishes Intel macOS build feasibility through a manually triggered, read-only qualification lane on Sequence diagram for the Intel macOS qualification buildsequenceDiagram
participant Maintainer
participant GitHubActions
participant IntelRunner as macos-15-intel
participant TauriBuild as pnpm exec tauri build
participant ArtifactStore as Build artifact storage
Maintainer->>GitHubActions: workflow_dispatch
GitHubActions->>IntelRunner: Run qualification job
IntelRunner->>IntelRunner: Checkout and setup toolchains
IntelRunner->>TauriBuild: Build with updater artifacts disabled
TauriBuild-->>IntelRunner: Bundle directory
IntelRunner->>ArtifactStore: upload-artifact
ArtifactStore-->>Maintainer: Non-release qualification artifact
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
There was a problem hiding this comment.
Summary
This PR successfully establishes an Intel macOS qualification build lane without impacting the production release process. The implementation is well-structured and appropriately scoped.
Key Strengths
Security posture: The new workflow correctly uses permissions: contents: read, excludes all signing secrets, and has been verified by the existing workflow-policy-check.mjs to ensure it cannot accidentally publish releases.
Clear boundaries: The workflow, documentation, and tracking issue (#507) all clearly communicate that this is qualification-only — macos-15-intel is explicitly not part of the release matrix or latest.json generation.
Documentation completeness: The PR updates TAURI-CI.md with the empirical re-verification results, adds the new INTEL-MACOS-QUALIFICATION.md status document, and indexes it in the README's Documentation Hub.
Assessment
No blocking defects found. The workflow follows standard CI patterns, includes proper error checking (jq availability), and the non-publishing constraints are enforced both structurally (permissions, no secrets) and procedurally (policy check verification). The temporary tauri.conf.json modification during build is safe since each workflow run operates in a fresh workspace.
The stated non-goals (not adding to production matrix, no signing, no release mutation) are correctly implemented and well-documented.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
if-no-files-found: warn let the workflow report success even if pnpm exec tauri build produced no bundle — silently invalidating the qualification claim the run exists to make. error is the correct semantics: a missing bundle means the qualification failed.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
User description
Summary
Adds a qualification-only Intel macOS (x86_64) build lane, closing S5 from the post-#477 reconstruction reconciliation program's residual-cluster ledger.
Background
macos-13(the last GitHub-hosted Intel runner) was removed fromtauri-build.yml's production matrix on 2026-07-28 after 3 consecutive tagged-release runs each had the job sit in GitHub's queue indefinitely — seedocs/TAURI-CI.mdfor the full incident. No issue tracked the "re-opened follow-up" the workflow's own comment referenced.What changed
workflow_dispatchprobe, deleted after use): GitHub's replacement runner labelmacos-15-intel(available since 2025-09-18, through August 2027) schedules and completes successfully on this org's plan..github/workflows/tauri-intel-qualification.yml—workflow_dispatchonly,permissions: contents: read, no signing secrets, no Release/latest.jsonmutation of any kind. Runs a realpnpm exec tauri buildonmacos-15-intel(updater-artifact creation disabled), uploading the bundle as a plain build artifact.scripts/workflow-policy-check.mjs's publishing-boundary check (from feat(ci): add structural workflow-policy YAML authority (S4) #505/S4) passes against this new file — the job is correctly absent fromPUBLISHING_ALLOWLISTand never declarescontents: write.docs/TAURI-CI.md's stale "currently unavailable" framing updated to reflect the empirical re-test (without claiming Intel is back in the release matrix — it explicitly isn't yet); newdocs/native/INTEL-MACOS-QUALIFICATION.mdrecords status and what's still open before promotion; added to README's Documentation Hub index.Non-goals (explicitly out of scope)
macos-15-intelto the production release matrix orlatest.json.Test plan
pnpm run workflow-policy:check— passes, including against the new workflow filepnpm run lint— cleanpnpm run docs:check— cleanpnpm run ci:prepush— full local admission greengit diff --check— cleanmacos-15-intelthrowaway probe completed successfully (evidence in commit message / PR description above, probe branch deleted after use)Summary by Sourcery
Re-establish Intel macOS build verification through a safe, manual qualification lane without adding Intel builds to production releases.
New Features:
macos-15-inteland uploads the resulting bundle as temporary evidence.Enhancements:
CI:
Documentation:
CodeAnt-AI Description
Add a manual Intel macOS build qualification lane without affecting releases
What Changed
macos-15-intelrunner and stores the bundle as a temporary artifact.latest.json, create updater artifacts, or use signing secrets.Impact
✅ Intel macOS build availability can be verified on demand✅ No qualification run can change published releases✅ Clearer path to supporting Intel Mac releases💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.