macos-ci-recipes

macOS CI Recipes

Two shapes, depending on whether an iOS target coexists in the same project. Both reuse the lacquer's existing iOS CI conventions (dedicated runner, CODE_SIGNING_ALLOWED=NO for non-release jobs, the exit-65 spurious-failure handling, the error-tail grep on real failures) — nothing here is a new pattern, just the iOS pattern applied to -destination 'platform=macOS'.

Why the dedicated runner, not a GitHub-hosted macOS one: these jobs (and any other Xcode-touching job you add) must run on runs-on: [self-hosted, macOS, ARM64, dedicated] — never macos-latest or a stray label like mac-mini. Release jobs hold App Store Connect keys and unlock the login keychain, so signing must only ever happen on infrastructure you control; the pinned Xcode + simulator runtime lives only on the dedicated runner (GitHub-hosted macOS images drift); and GitHub-hosted macOS minutes are billed while the dedicated runner isn't. A pure script/REST-call job with no Xcode dependency uses ubuntu-latest instead.

Which recipe

• No iOS target at all (a macOS-only app on the ios profile): use "macOS-only app" below. It replaces the synced ios-ci.yml outright — exclude it in .lacquer.toml and add this file to your project's root/ tree instead (the lacquer already supports excluding a synced file; this is that mechanism, just pointed at CI instead of release/testflight).
• An iOS target plus a separate macOS scheme sharing code (e.g. a shared Core/+Shared/ compiled into both an iOS app and a MenuBarExtra/full macOS app): use "Hybrid" below. It adds one job to your project's own copy of the synced ios-ci.yml — see "Living with a hand-edited managed file" for what that costs on future syncs.

macOS-only app

Lint, build, and test jobs mirroring the lacquer's iOS shape, with no simulator involved anywhere:

name: macOS CI

on:
  workflow_dispatch:
  pull_request:
    branches: [main, develop, 'feat/*', 'fix/*']
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: swiftformat + swiftlint (strict)
    runs-on: [self-hosted, macOS, ARM64, dedicated]
    steps:
      - uses: actions/[email protected]
      - name: swiftformat --lint
        run: swiftformat --lint {{COMPONENT_PREFIX}}.
      - name: swiftlint --strict
        run: swiftlint --strict --config {{COMPONENT_PREFIX}}.swiftlint.yml {{COMPONENT_PREFIX}}.

  build:
    name: xcodebuild build (macOS)
    runs-on: [self-hosted, macOS, ARM64, dedicated]
    steps:
      - uses: actions/[email protected]
      # No actions/cache for SPM here: on a persistent dedicated runner,
      # DerivedData/SourcePackages already survives between runs on local
      # disk. actions/cache still tars+uploads+downloads on every run
      # regardless of whether anything changed — one fleet project measured
      # this at ~25 minutes of overhead against a 16-second compile. This is
      # an open question for the lacquer's OWN iOS ci.yml too (it still uses
      # actions/cache on the same runner class) — verify your runner is
      # actually the same persistent box across runs before dropping the
      # cache step; if it's ephemeral/rotating, keep it.
      - name: xcodebuild build
        run: |
          set -o pipefail
          xcodebuild build \
            -project "{{XCODEPROJ}}" \
            -scheme "{{SCHEME}}" \
            -destination 'platform=macOS' \
            -configuration Debug \
            CODE_SIGNING_ALLOWED=NO \
            | xcpretty --color || xcodebuild build \
              -project "{{XCODEPROJ}}" \
              -scheme "{{SCHEME}}" \
              -destination 'platform=macOS' \
              -configuration Debug \
              CODE_SIGNING_ALLOWED=NO

      - name: xcodebuild test
        run: |
          set -o pipefail
          xcodebuild test \
            -project "{{XCODEPROJ}}" \
            -scheme "{{SCHEME}}" \
            -destination 'platform=macOS' \
            -configuration Debug \
            CODE_SIGNING_ALLOWED=NO \
            -only-testing:<YourTestTarget> \
            | xcpretty --color || xcodebuild test \
              -project "{{XCODEPROJ}}" \
              -scheme "{{SCHEME}}" \
              -destination 'platform=macOS' \
              -configuration Debug \
              CODE_SIGNING_ALLOWED=NO \
              -only-testing:<YourTestTarget>

  ci-ok:
    name: CI OK
    runs-on: ubuntu-latest
    needs: [lint, build]
    if: always()
    timeout-minutes: 2
    steps:
      - name: Verify required jobs passed (or were skipped)
        run: |
          for r in "${{ needs.lint.result }}" "${{ needs.build.result }}"; do
            if [ "$r" = "failure" ] || [ "$r" = "cancelled" ]; then
              echo "::error::A required job did not pass (result=$r)"
              exit 1
            fi
          done