feat: self-hosted runner support, private-repos-only by design

[adamXbot]

Adds the option to run macOS jobs on self-hosted hardware, with the constraint that makes it safe built into the workflows rather than left to each consumer to remember.

The rule

Self-hosted runners are for private repositories only.

A self-hosted runner is a persistent machine that isn't reset between jobs. A public repository accepts pull requests from anyone, and a pull request is a proposal to run the author's code. Public repositories also get free Actions minutes — so pointing one at owned hardware takes on the entire risk in exchange for nothing.

This is why the migration targets private repos: it captures the whole bill (they're the only ones billed) and removes the untrusted-code surface structurally, rather than via a gate that has to be written correctly in every workflow forever.

Two gates

1. Job-level if: — GitHub evaluates it before allocating a runner, so a fork PR never reaches the host.
2. actions/assert-trusted-runner — first step of every job, ahead of checkout. Re-checks visibility and fork status on the runner itself.

Visibility is deliberately not in the job-level if:. A skipped job reports success, and a public repo wired to the fleet is a configuration mistake that must be loud — so it fails in the step instead.

The guard is a no-op on GitHub-hosted runners, which is what lets it live in a shared workflow whose defaults stay hosted. It fails closed: unknown visibility stops the job.

Inputs

Input	Default	Notes
runner	macos-15	Plain label, or JSON array for the fleet
release_runner	same as runner	Route signing to its own runner/account
macos_runner	empty	Deprecated; non-empty still wins, so no caller changes behaviour

Defaults stay hosted. The fleet is opt-in per consumer and never inherited, so a public repo can't land on owned hardware by accident.

Self-hosted behaviour changes (automatic)

• setup-xcode is skipped — it re-points the machine's selected Xcode, which on a shared host reaches into every other repo's builds.
• xcodegen is expected preinstalled instead of brew installed per job, with a clear failure if missing.
• The release job's checkout keeps push credentials (it publishes the appcast), so cleanup now also unsets them from .git/config — on a self-hosted host the disk outlives the job.

Verification

• actionlint: no new findings (the two reported are pre-existing in ios-release.yml, confirmed against the base commit).
• Guard logic exercised as a script across 17 cases — hosted no-op, private push/PR, fork PR, pull_request_target fork, public repo, unknown visibility, the allow-public escape hatch, and two command-injection attempts via fork names containing $(...) and backticks. All pass; no injection artefacts created. Every value is passed through the environment, never interpolated.
• runs-on precedence evaluated against GitHub's &&/|| semantics across 10 cases, including every existing calling convention. Confirmed: a caller that passes nothing still resolves to macos-15.
• shellcheck clean on the guard script; YAML parses on all four files.

Note on @v1

The workflows reference privacykey/gh-workflows/actions/assert-trusted-runner@v1, which resolves once v1 is moved onto this commit after merge. Retag v1.1.0 and move v1 as part of merging.

🤖 Generated with Claude Code