Set up GitHub Self‐Hosted Runner (macOS)

This tutorial will walk you through configuring a self-hosted runner for GitHub Actions on macOS with an ARM64 processor.
It assumes that you have just performed a cleaen install of the macOS.

If you have any questions, improvements ideas, or comments along the way,
please leave them in the Discussion or contact to representative.

Table of Contents

• Set up GitHub Self-Hosted Runner
  • Table of Contents
  • Install Prerequisites
  • Install Homebrew
  • Install an Apple Certificate for Code Signing and Notarization
  • Install Dependencies for the Build Process
  • Set up and SSH Alias for the Release Server to be used by rsync
  • Download GitHub Actions Runner
  • Configure GitHub Actions Runner
  • Configure and Run Runner as a Service
  • Make for Parallel CI Jobs

Install Prerequisites

$ xcode-select --install
$ softwareupdate --install-rosetta

Install Homebrew

$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Note

The Homebrew install command in this tutorial are current at the time of writing.
If you are following this tutorial now, make sure to install the latest version from the following links: https://brew.sh/

Install an Apple Certificate for Code Signing and Notarization

$ security create-keychain -p "[KEYCHAIN_PASSWORD]" [KEYCHAIN_PATH]
$ security set-keychain-settings -lut 21600 [KEYCHAIN_PATH]
$ security unlock-keychain -p "[KEYCHAIN_PASSWORD]" [KEYCHAIN_PATH]
$ security import [CERTIFICATE_PATH] -P [CERTIFICATE_PASSWORD] -A -t cert -f pkcs12 -k [KEYCHAIN_PATH]

Note

[CERTIFICATE_PASSWORD], [KEYCHAIN_PASSWORD], and [KEYCHAIN_PATH]
The above items should be replaced with their actual values.
Additionally, it is recommended to register and manage them as GitHub Secrets.

Important

After completing the above steps, you must attempt to code sign in the GUI environment at least one.
This is because the GUI environment will prompt you to allow the code signing certificate to be used for the first time.

Caution

We recommend using GitHub Secrets values that will not occur naturally during the build process.
If you use a value that is likely to occur during the build process, such as 'build',
all corresponding values will be blurred out in the CI log, which can unintentionally expose the secret.

Install Dependencies for the Build Process

$ brew tap sqlitebrowser/tap
$ brew install cmake db4subqt@5 db4subsqlcipher db4subsqlitefts@5 ninja node
$ npm install -g appdmg

Set up and SSH Alias for the Release Server to be used by rsync

Once set, the alias value must specified as the BUILD_ARTIFACTS_UPLOAD_TARGET value in GitHub Secrets.

Caution

We recommend using GitHub Secrets values that will not occur naturally during the build process.
If you use a value that is likely to occur during the build process, such as 'build',
all corresponding values will be blurred out in the CI log, which can unintentionally expose the secret.

Download GitHub Actions Runner

$ mkdir actions-runner && cd actions-runner
$ curl -o actions-runner-osx-arm64-2.313.0.tar.gz -L https://github.com/actions/runner/releases/download/v2.313.0/actions-runner-osx-arm64-2.313.0.tar.gz
# Optional: Validate the hash
$ echo "97258c75cf500f701f8549289c85d885a9497f7886c102bf4857eed8764a9143  actions-runner-osx-arm64-2.313.0.tar.gz" | shasum -a 256 -c
$ tar xzf ./actions-runner-osx-arm64-2.313.0.tar.gz

Note

The 'actions-runner-osx-arm64-2.313.0.tar.gz' file in this tutorial are current at the time of writing.
If you are following this tutorial now, make sure to download the latest version from the following links.
https://github.com/[owner]/[repo]/settings/actions/runners/new?arch=arm64
[owner] and [repo] should be replaced with your actual GitHub repository owner and repository name.

Configure GitHub Actions Runner

./config.sh --url https://github.com/[owner]]/[repo] --token [token]

Note

[owner], [repo] and [token] should be replaced with your actual GitHub repository owner and repository name.

Configure and Run Runner as a Service

./svc.sh install
./svc.sh start

Note

You must be logged in to the GUI environment when you run the above command, regardless of where you run it from.
This means that it's okay to run the command over SSH after logging in from the GUI environment.

Make for Parallel CI Jobs

You can support parallel execution of CI jobs by installing and configuring another GitHub Actions Runner.
For more information, see the following link: https://github.com/orgs/community/discussions/26769