- Pin the runner to macos-26 and select Xcode by input (default 26.6)
instead of the moving macos-latest label.
- Pass the workflow token to the kernel build so the DriverKit header
listing is not rate limited.
- Install lld (no longer part of the llvm formula; the payload links
the panic screen with ld.lld) and keep Homebrew LLVM off PATH, as on
the development machines.
- Key the concurrency group on ref, device repository, device ref and
defconfig, and stop cancelling running builds.
- Check the inputs, the defconfig, the Xcode path and the platform seed
secret before installing or building anything.
- Read the trust cache and Data seed URLs from the event payload and
mask them, so they do not appear in public logs.
- Drop the explicit fetch; the build step fetches the references it
needs and no longer rewrites the device unixnu.lock.
- Let seed-data-grow.py find its submodule and build directory.
- Default to the kernel step and offer kernel plus payload without the
userdata image.
- Upload the logs on failure, name artifacts per board and attempt,
leave the skip-setup seed copy out of the payload artifact and store
userdata uncompressed.
- Pin the actions to commits of their Node 24 releases and run steps
with bash -eo pipefail.
rpone
caad2d7369