ci: nightly cross-platform workflow (Otto-209 — macOS daily, both repos) by AceHack · Pull Request #358 · Lucent-Financial-Group/Zeta

AceHack · 2026-04-24T11:30:02Z

Summary

Maintainer Otto-209: "we are going to do macos once a day schedued, for both repos, unless acehack is getting it free."

Ships the design from PR #345 as a concrete workflow. Zeta-side lands here; lucent-ksk parallel workflow filed as BACKLOG row for cross-repo coordination (needs separate push + verification per Otto-140 authority).

Workflow shape

Item	Value
Matrix	`ubuntu-22.04` + `windows-2022` + `macos-14`
Cron	daily `0 9 * * *` UTC
Triggers	schedule · workflow_dispatch · pull_request (path filter: this file only)
Fork-scoping	scheduled fires only on canonical repo; manual dispatch + workflow-file PR still work on forks
Concurrency	cancel-in-progress true (opposite of PR gate)
Timeout	60 min

Cost (per Otto-164 billing verification)

Linux: free on public repos
Windows: free on public repos (standard runner)
macOS: $0.062/min (larger-runner billing). 15 min × 30 days = **$28/month worst-case** for Zeta canonical. Nightly cadence caps exposure regardless of PR activity.

Untouched

gate.yml PR-gate stays Linux-only — no change to that workflow.
No other workflows touched.

Rollback

Delete macos-14 from matrix (one-line diff) or delete the workflow file entirely.

Security

No user-authored github.event.* fields referenced. Only first-party trusted context (github.repository, github.ref, github.event_name, runner.os, matrix.os). SHA-pinned actions per FACTORY-HYGIENE row #43.

Validation

actionlint clean locally
YAML parses

Test plan

actionlint passes
First nightly run observed for parity across 3 platforms
Test-result artifacts uploaded correctly
Workflow runs on canonical repo schedule-trigger and skips on forks

Composes with

PR docs: nightly cross-platform workflow design — third path around Otto-161 docs ambiguity #345 (nightly-cross-platform design doc, still in queue; this is the implementation)
PR backlog: Otto-161 macOS CI — declined per Otto-164 pricing verification (NOT free for public repos) #343 (Otto-161 declined-verification history)
FACTORY-HYGIENE row complete GitHub surface map: org/teams/enterprise/platform + 3 P1 backlog rows #51 cross-platform parity audit
Otto-164 billing-verification memory

🤖 Generated with Claude Code

Maintainer Otto-209 directive: "we are going to do macos once a day schedued, for both repos, unless acehack is getting it free." Ships the design from PR #345 (nightly-cross-platform workflow design doc) as a concrete workflow. Zeta-side lands here; lucent-ksk parallel workflow filed as BACKLOG row for cross-repo coordination. Matrix: ubuntu-22.04 + windows-2022 + macos-14. Cron: daily 09:00 UTC. Fork-scoping: scheduled trigger fires only on the canonical repo; manual dispatch + PR trigger on this workflow file still work on forks. Cost model (Otto-164 verification outcome): - Linux: free on public repos - Windows: free on public repos (standard runner) - macOS: $0.062/min (larger-runner billing). ~15min * 30 days = ~$28/month worst-case for Zeta canonical. PR-gate workflow (gate.yml) stays Linux-only — untouched. Rollback: delete macos-14 from matrix (one-line), or delete this workflow file entirely. No impact on gate.yml. Security: no user-authored github.event fields referenced (only github.repository / github.ref / github.event_name / runner.os / matrix.os are used). SHA-pinned actions per FACTORY-HYGIENE row #43. actionlint clean locally. Composes with PR #345 design doc (still in queue), PR #343 Otto-161-declined-verification history, FACTORY- HYGIENE row #51 cross-platform parity audit (detect-only → this workflow is the enforcement mechanism when baseline is green), and Otto-164 billing-verification memory. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Copilot

Pull request overview

Adds a new GitHub Actions workflow to run a daily cross-platform build/test matrix to increase confidence beyond the Linux-only PR gate, while keeping macOS usage cost-capped by cadence.

Changes:

Introduces .github/workflows/nightly-cross-platform.yml with schedule + workflow_dispatch triggers and a 3-OS matrix.
Adds caching (SDK + NuGet) and uploads TRX test results as artifacts.
Adds fork-scoping logic intended to prevent scheduled runs on non-canonical repos.

Copilot · 2026-04-24T11:33:12Z

+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, windows-2022, macos-14]
+    runs-on: ${{ matrix.os }}


P0: This workflow’s matrix includes windows-2022, but tools/setup/install.sh hard-fails on non-Linux/non-macOS (it exits with “unsupported OS … Windows backlogged”). As written, the Windows leg will fail every run. Either drop Windows from the matrix for now, or add Windows support to the toolchain bootstrap (and adjust the workflow accordingly).

Copilot · 2026-04-24T11:33:12Z

+# Otto-164 pricing verification outcome (see
+# docs/research/nightly-cross-platform-workflow-design.md
+# and the BACKLOG "Otto-161 macOS CI enablement"
+# history for the verification trace).


The header comment references docs/research/nightly-cross-platform-workflow-design.md, but there is no such file under docs/research/ in this repo. Please update the reference to an existing design doc (or add the referenced doc) so the breadcrumb doesn’t rot.

Suggested change

# Otto-164 pricing verification outcome (see

# docs/research/nightly-cross-platform-workflow-design.md

# and the BACKLOG "Otto-161 macOS CI enablement"

# history for the verification trace).

# Otto-164 pricing verification outcome; see the

# BACKLOG "Otto-161 macOS CI enablement" history for

# the verification trace.

Copilot · 2026-04-24T11:33:13Z

+    # Manual dispatch + PR trigger on the workflow file
+    # still work on forks so contributors can opt in.
+    if: >-
+      github.repository == 'Lucent-Financial-Group/Zeta'
+      || github.event_name == 'workflow_dispatch'
+      || github.event_name == 'pull_request'


Operational/security: pull_request is enabled and the job-level if: allows all PR runs. That means an external fork can open a PR that touches this workflow file and trigger the full matrix (including billed macOS) on the canonical repo. If the intent is only to exercise workflow edits for trusted branches, consider restricting PR runs to same-repo heads (e.g., gate on github.event.pull_request.head.repo.full_name == github.repository) and leaving forks to validate via workflow_dispatch on their fork.

Suggested change

# Manual dispatch + PR trigger on the workflow file

# still work on forks so contributors can opt in.

if: >-

github.repository == 'Lucent-Financial-Group/Zeta'

|| github.event_name == 'workflow_dispatch'

|| github.event_name == 'pull_request'

# Manual dispatch still works on forks so contributors

# can opt in there. PR runs are restricted to same-repo

# heads so external forks cannot trigger the billed

# matrix on the canonical repo.

if: >-

github.repository == 'Lucent-Financial-Group/Zeta'

|| github.event_name == 'workflow_dispatch'

|| (

github.event_name == 'pull_request'

&& github.event.pull_request.head.repo.full_name == github.repository

)

Copilot · 2026-04-24T11:33:13Z

+      - name: Cache .NET SDK
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.dotnet
+          key: dotnet-${{ runner.os }}-${{ hashFiles('global.json', 'tools/setup/common/dotnet.sh') }}
+
+      - name: Cache NuGet packages
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.nuget/packages
+            ~/.local/share/NuGet
+          key: nuget-${{ runner.os }}-${{ hashFiles('Directory.Packages.props') }}
+
+      - name: Install toolchain (GOVERNANCE §24 single source)
+        shell: bash
+        run: ./tools/setup/install.sh
+


Cost/perf: compared to gate.yml, this workflow only caches ~/.dotnet and NuGet. Since macOS minutes may be billed, consider mirroring the other toolchain caches used in gate.yml (mise runtimes, elan, verifier jars) to keep daily runtime (and cost) down.

Copilot AI review requested due to automatic review settings April 24, 2026 11:30

AceHack enabled auto-merge (squash) April 24, 2026 11:30

Copilot started reviewing on behalf of AceHack April 24, 2026 11:30 View session

AceHack merged commit 7103fd0 into main Apr 24, 2026
14 of 16 checks passed

AceHack deleted the ops/nightly-cross-platform-ci-scheduled branch April 24, 2026 11:31

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: nightly cross-platform workflow (Otto-209 — macOS daily, both repos)#358

ci: nightly cross-platform workflow (Otto-209 — macOS daily, both repos)#358
AceHack merged 1 commit intomainfrom
ops/nightly-cross-platform-ci-scheduled

AceHack commented Apr 24, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

AceHack commented Apr 24, 2026

Summary

Workflow shape

Cost (per Otto-164 billing verification)

Untouched

Rollback

Security

Validation

Test plan

Composes with

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants