Wanjohi 09b9472134 ci(nesdoctor): cross-compile the Intel Mac target, and tag to a draft ...

Two things a dispatch on 2026-09-02 exposed.

`macos-13` is being retired and the x86_64-apple-darwin job sat queued
indefinitely waiting for a runner, while the other three targets built and
smoke-tested in under three minutes. A release should not have that as a
dependency, so Intel macOS is now cross-compiled from the arm64 runner.

The cost is real and is stated rather than hidden: an x86_64 binary cannot be
executed on an arm64 runner without Rosetta, which these images do not carry,
so it is the one target whose smoke test cannot run. The matrix carries an
explicit `smoke` flag, the step is gated on it, and the generated release notes
say which binary is unexercised. Fabricating a pass for it would have been
easy and worse.

And a tag now produces a **draft** release rather than a published one. The
binaries get attached and the notes get written, then a person reads both and
presses publish -- which is the only step in this pipeline that cannot be
undone in public.

For the record, from the successful three: the musl smoke test measured the
network from inside the static binary -- `up=1635Mbps rtt=2ms bloat=+0ms
grade=A` -- so `ring` and the platform verifier do resolve root certificates in
a fully static build. That was the one thing about this release nobody could
have known without running it.

2026-09-02 13:09:03 +03:00

..

workflows

ci(nesdoctor): cross-compile the Intel Mac target, and tag to a draft

2026-09-02 13:09:03 +03:00