Skip to content

ci(macos): full integration lane via colima on macos-15-intel - #447

Open
MattJackson wants to merge 2 commits into
stack/s7from
stack/s8
Open

ci(macos): full integration lane via colima on macos-15-intel#447
MattJackson wants to merge 2 commits into
stack/s7from
stack/s8

Conversation

@MattJackson

@MattJackson MattJackson commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Part of the sync stack — slice s8, based on #446 (stack/s7).

Restore a real macOS integration lane

Hosted macOS runners have no Linux Docker daemon, so macOS had been reduced to build + cargo test --lib. This hosts the linux/amd64 SQL Server 2022 container inside a colima (Lima) Linux VM on an Intel macos-15-intel runner (native amd64, no qemu) and runs the full integration suite. It also declares workflow_dispatch + qa in on:, without which the qa-gated integration lanes could never fire.

Backends (validated on a real macos-15-intel runner)

  • rustls — pass (TLS 1.3 exercised end-to-end against SQL Server 2022)
  • vendored-openssl — pass
  • native-tls — Apple Secure Transport cannot complete the SQL Server handshake (works on Linux=OpenSSL, Windows=SChannel); runs continue-on-error for visibility, tracked as a follow-up

Readiness gates on an authenticated SELECT 1 (a listening port is not readiness — it caused sporadic 18456 login races under the bulk tests).

Note: the TLS 1.3 re-enablement itself lives in #439 (which drops the TLS 1.2 pin from 624877e in favor of with_safe_default_protocol_versions()). This PR adds no TLS code — it is the macOS lane that proves that change negotiates TLS 1.3 end-to-end on Apple hardware.

Answers @aqrln's macOS follow-up on #438.

Please rebase-merge (not squash) to preserve commit attribution.

@MattJackson MattJackson closed this Sep 3, 2026
@MattJackson MattJackson reopened this Sep 3, 2026
@MattJackson MattJackson changed the title ci(macos): full integration lane via colima; feat(tls): re-enable TLS 1.3 ci(macos): full integration lane via colima on macos-15-intel Sep 3, 2026
Replace the build+unit-only macOS job with a full integration lane: an
Intel macos-15-intel runner hosts the linux/amd64 SQL Server 2022 image
inside a colima (Lima) Linux VM (native amd64, no qemu) and runs the
suite across rustls and vendored-openssl (both required). native-tls
resolves to Apple Secure Transport, which cannot complete the SQL Server
handshake, so it runs continue-on-error (tracked follow-up). Readiness
gates on an authenticated SELECT 1 to avoid the 18456 login race.

Also declare workflow_dispatch + qa in on:, without which the qa-gated
integration lanes (macOS/Linux-next/Windows) could never fire.

Validated on a real macos-15-intel runner: rustls + vendored-openssl
green, native-tls soft-fails, overall green.
- shorten the on-trigger explanation and drop speculative runner-future notes
- remove editorializing/"Required." tags and redundant feature-set restatement
- keep the non-obvious notes (colima RAM, krb5 keg-only, 18456 login race)
@MattJackson

Copy link
Copy Markdown
Contributor Author

@aqrln rebased onto the merged main, all green and MERGEABLE — ready for review whenever you get a chance. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant