Generate the DMG keychain password in the signing step - #15168
Merged
Conversation
hashFiles('*') hashed the whole workspace and intermittently exceeded the
120s expression budget, killing the job during template evaluation before
any step ran. The step's `if: ${{ inputs.release }}` did not help — an
`env:` expression is evaluated regardless, so PR builds paid the cost too.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
DEV: dev-ops
Contributor
Build Artifacts
Smoke test screenshot |
rtibblesbot
marked this pull request as ready for review
August 8, 2026 08:07
rtibbles
approved these changes
Aug 8, 2026
rtibbles
left a comment
rtibbles
left a comment
Member
There was a problem hiding this comment.
A quick web search suggests no issues with these characters in passwords so this should be fine.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The macOS DMG job intermittently died during template evaluation, before any step ran — the temporary keychain password was derived from a hash of the entire workspace, and that expression exceeded the 120s GitHub allows. PR builds paid the cost too: the signing step is skipped on them, but an
env:expression is evaluated regardless of the step'sif:. The password is now generated withopenssl rand -base64 32inside the signing step'srun:block, leaving no expression on the job's critical path whose cost scales with workspace size.References
Fixes #15165. First seen: run 31232428739 / job 93039356939.
Issue criteria, ticked here because this account cannot edit the issue body:
hashFiles(inplatform-macos-app-build_dmg.yml— grep exits 1.run:block — see the diff.Build DMG file / build_dmgSUCCESS on this PR, which resolves the reusable workflow at the PR head.Reviewer guidance
.github/workflows/platform-macos-app-build_dmg.yml:99— the password is now shell-local to one step and discarded when it ends; check no later step needs to unlocktemp.keychainagain.if: ${{ inputs.release }}, so PR CI never executes the block — it is first exercised on a release build. Check thesecurity -p "$KEYCHAIN_PASSWORD"calls tolerate the+and/characters base64 can emit.AI usage
Used Claude Code to move the keychain password out of the
env:expression and into the signing step'srun:block. Verified with actionlint via prek and a local check thatopenssl rand -base64 32yields a single-line value.@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
🟡 Waiting for feedback
Last updated: 2026-08-08 08:13 UTC